RelayShield-MCP is a security intelligence server that brings breach detection, threat scanning, and identity risk tools into Claude and other MCP-compatible AI agents. It offers the following capabilities:

• Email Breach Lookup (check_breach): Check if an email appears in 13 billion+ compromised accounts via Have I Been Pwned, returning breach count and details.

• SIM Swap Detection (check_sim_swap): Detect SIM swap or eSIM provisioning events on a phone number in the last 24 hours using live carrier data.

• Domain Lookalike Monitoring (check_domain_lookalikes): Identify typosquat and lookalike domains impersonating a brand via DNS resolution and Certificate Transparency data.

• OAuth Supply Chain Watchlist (check_oauth_watchlist): Check if high-risk OAuth-connected SaaS apps (Slack, GitHub, Notion, etc.) tied to an email have appeared in recent breaches.

• Infostealer Log Lookup (check_infostealer): Check if an email appears in infostealer malware logs (RedLine, Raccoon, Vidar, etc.).

• EVM Wallet Risk Scan (scan_wallet): Assess an Ethereum/EVM wallet for on-chain risk signals like blacklisting and phishing associations via GoPlus Security.

• URL Malware/Phishing Scan (scan_url): Submit a URL for async analysis across 70+ security engines.

• File Malware Scan (scan_file): Submit a publicly accessible file URL for async binary malware analysis across 70+ AV engines.

• Scan Result Polling (check_scan_result): Retrieve the verdict (malicious, suspicious, clean, or timeout) for a previously submitted URL or file scan (free tool).

• MCP Registry Risk Check (check_mcp_registry_risk): Check an MCP server URL or package name for known-malicious indicators, typosquats, and domain registration age before connecting.

• Prompt Injection Breach Check (check_prompt_injection_breach): Detect email exposure in breach dumps linked to AI agent prompt-injection attacks.

• Supply Chain Exposure (check_supply_chain): Analyze up to 10 vendor domains for breach or infostealer exposure.

• Session Risk Check (check_session_risk): Detect active or reusable stolen session cookies/tokens tied to an identity.

• Non-Human Identity (NHI) Exposure (check_nhi_exposure): Find exposed API keys, service tokens, and PATs associated with an identity.

• Secret Scanning (check_secret_scan): Discover secrets exposed in public GitHub/GitLab repositories.

All tools are accessible via RELAYSHIELD_API_KEY (subscription) or RELAYSHIELD_X_PAYMENT (pay-as-you-go).

Check if GitHub OAuth apps connected to a user's email have been involved in known security breaches.

Check if Notion OAuth apps connected to a user's email have been involved in known security breaches.

Check if Slack OAuth apps connected to a user's email have been involved in known security breaches.

Check if Zapier OAuth apps connected to a user's email have been involved in known security breaches.