Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/tamzrod/mcprelay/agents-mdgit clone --depth 1 https://github.com/tamzrod/mcprelayWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/tamzrod/mcprelay/agents-md)<a href="https://agentmods.dev/instructions/tamzrod/mcprelay/agents-md"><img src="https://agentmods.dev/badge/instructions/tamzrod/mcprelay/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.06019 | $0.06019 |
| Opus 5 | $0.03010 | $0.03010 |
| Sonnet 5 | $0.01204 | $0.01204 |
| Haiku 4.5 | $0.00602 | $0.00602 |
Grade B, and why
mcprelay AGENTS.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
- Cloud conversations read MCP config from **stored user settings** How it starts
The opening of the file, as written. The whole thing — 362 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md — MCP Connector repository memory
Repository-specific knowledge for the MCP Connector project. Loaded automatically each session.
Project state
- Phase: Phase 0 (architecture baseline) COMPLETE. Phase 1 COMPLETE.
Phase 2 COMPLETE (G4 = PASS). Phase 3 COMPLETE (G5 = PASS,
2026-08-10). Phase 4 IN PROGRESS — BLOCKED: OAuth callback failed (stale authorize
URL); retry required (G6 BLOCKED, 2026-08-10). The auth boundary holds: downstream bearer
API-key gate; connector-hosted operator OAuth consent (
/oauth/authorize+/oauth/callback); Notion OAuth lifecycle (discovery → DCR → PKCE → exchange → refresh → rotation →invalid_grant→ restart survival) via the SDK's first-party helpers; encrypted SQLite credential store (AES-256-GCM, atomic rotation, per-grant mutex); authenticated upstream MCP connection via explicit bearer header + 401-refresh-retry; no upstream credentials ever reach the downstream client. Validated against a mock auth server (no real Notion credentials in tests). Evidence: docs/evidence/G5.md. Phase 4 (G6) status: the production Docker image was built (D-14) and the connector deployed behind the TLS work-host ingress with a persistent encrypted SQLite volume. Validated live: downstream bearer-api_keyboundary (401 on missing/invalid), MCPinitializeover TLS, OpenHands Cloudapi_keyconfiguration + connection, and the real Notion OAuth automated chain (RFC 9728 → RFC 8414 → RFC 7591 DCR → PKCE S256 → 302 authorize redirect). A human Notion consent was attempted but the callback failed withstate not found or already consumed— the operator used a stale authorize URL whose single-use state was not in the current store; no grant was persisted (notion_grantempty). The connector's state mechanism was independently verified correct (correct-state callback passes the state check and proceeds to token exchange) → operational failure, not a code defect; no workaround applied. 10 of 16 G6 criteria PASS; 5 are BLOCKED on a successful consent (retry with a fresh/oauth/authorizeURL); 1 is PARTIAL (restart mechanism verified, grant-survival pending consent). Work STOPPED per Phase 4 instructions; Phase 5 not begun. The deployed connector remains live and ready to complete consent. Evidence: docs/evidence/G6.md. All three Phase 1 gates passed: G1 = PASS (OpenHands Cloud consumes a bearerapi_keySHTTP MCP endpoint, no OAuth, no custom headers; docs/evidence/G1.md); G2 = PASS (Notion hosted MCP is OAuth 2.0 Auth Code- PKCE + DCR, browser-consent, OAuth-only; access token ~8h/use
expires_in; refresh token rotates each refresh, 180-day absolute non-sliding cap or 30-day inactivity;invalid_grantterminal; docs/evidence/G2.md); G3 = SUFFICIENT (Notion hosted MCP exposesnotion-search+notion-fetchfor read,notion-create-pages/notion-update-pagefor create/update, andnotion-get-commentsfor reading comments; docs/evidence/G3.md). D-09 = DECIDED (2026-08-10): TypeScript/Node.js +@modelcontextprotocol/sdk(server + client Streamable HTTP), first-party MCP OAuth client helpers in@modelcontextprotocol/sdk/client/auth.js(NOopenid-client— SDK helpers are sufficient per D-12), SQLite credential store (field-level AES-256-GCM at rest, master key fromMCPRELAY_MASTER_KEYenv), deployed as a Docker container behind a TLS-terminating reverse proxy with a persistent volume. Phase 3 entry decisions (2026-08-10): D-10 (SQLite + field-level AES-256-GCM + env master key), D-11 (connector-hosted/oauth/authorize+/oauth/callbackbrowser flow), D-12 (remain on SDK v1.30.0; native auth helpers; noopenid-client; no transportauthProviderauto-path — explicit bearer + managed refresh), stateful/stateless check (stateless sufficient for Notion; D-08 unchanged), D-13 (downstream bearerapi_key, scrypt-hashed,MCPRELAY_CONNECTOR_API_KEY). Phase 2 exit gate satisfied; Phase 3 entry prerequisites satisfied; Phase 3 implementation in progress (G5 not yet passed).
- PKCE + DCR, browser-consent, OAuth-only; access token ~8h/use
- Roadmap is a strict gated contract: a later phase MUST NOT begin until the previous phase's exit gate is satisfied and documented. "Code exists" is not completion.
- Repo name:
mcprelay(GitHub: tamzrod/mcprelay). The project is called "MCP Connector" (the original README said "MCP Relay"; README has been reconciled to "MCP Connector"). Do not rename the repo without instruction. - Existing files at design start:
LICENSE, an incompleteREADME.md(now completed/reconciled). Everything indocs/is newly authored.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 362 lines · 6,019 tokens per session scan B 15a81aa1308d
mcprelay AGENTS.md is an instructions file published in the GitHub repository tamzrod/mcprelay (0 stars, last pushed 26d ago), licensed Apache-2.0. It adds 6,019 tokens to every session, about $0.0301 per session on Opus 5. A static security scan graded it B with 1 finding (reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.