What is covalent-bond-self-relay?

A setup guide for deploying your own Covalent Bond relay as a Cloudflare Worker with a Durable Object. The relay routes encrypted messages and can be checked through a health endpoint.

Use it to install Wrangler, sign in through the browser, deploy the relay, check its health, and configure its URL.

It lets you host the relay in your own Cloudflare account instead of relying on a public relay, with a free Cloudflare account supported.

How gopalrajsuresh/covalent-bond configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to gopalrajsuresh/covalent-bond. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/gopalrajsuresh/covalent-bond/main/.claude/skills/covalent-bond-self-relay/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/gopalrajsuresh/covalent-bond

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/gopalrajsuresh/covalent-bond/covalent-bond-self-relay/github.svg)](https://agentmods.dev/skills/gopalrajsuresh/covalent-bond/covalent-bond-self-relay)

Your own site

<a href="https://agentmods.dev/skills/gopalrajsuresh/covalent-bond/covalent-bond-self-relay"><img src="https://agentmods.dev/badge/skills/gopalrajsuresh/covalent-bond/covalent-bond-self-relay/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/gopalrajsuresh/covalent-bond/covalent-bond-self-relay"><img src="https://agentmods.dev/badge/skills/gopalrajsuresh/covalent-bond/covalent-bond-self-relay.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 0 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 659 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00000	$0.00659
Opus 5	$0.00000	$0.00329
Sonnet 5	$0.00000	$0.00132
Haiku 4.5	$0.00000	$0.00066

Measured 12d ago against content hash b78072d55d30, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

covalent-bond-self-relay scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

4. **Verify.** `curl <relay-url>/health` must return `{"status":"ok",...}`.

.claude/skills/covalent-bond-self-relay/SKILL.md · 57 lines

How it starts

The opening of the file, as written. The whole thing — 57 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Deploy your own Covalent Bond relay

The relay is a Cloudflare Worker + one Durable Object. It is untrusted by design (sees only routing IDs and ciphertext), so self-hosting is a convenience/availability choice, not a security requirement. A free Cloudflare account is enough; there are no KV namespaces and no secrets.

Steps (agent-driven)

Check prerequisites. node --version must be ≥ 18. Install the Cloudflare CLI if missing: npm install -g wrangler (or use npx wrangler throughout).
Authenticate (the human does this part). Run wrangler login, which opens a browser. STOP and tell the user to sign in (or create a free Cloudflare account first at https://dash.cloudflare.com/sign-up). Never ask for, handle, or store their Cloudflare credentials or API tokens yourself; wait until wrangler whoami succeeds.
Deploy. From the repository root:
```
cd cloudflare-worker
wrangler deploy
```
The v1-session-do Durable Object migration in wrangler.toml runs automatically on first deploy. The output ends with the relay URL: https://covalent-bond-relay.<their-subdomain>.workers.dev.
Verify. curl <relay-url>/health must return {"status":"ok",...}. (First request after deploy can take ~a minute to propagate; retry once.)
Configure. Set COVALENT_RELAY_URL=<relay-url> on both machines, in either place (a real environment variable wins over .env):
- copy .env.example to .env in the covalent-bond folder and edit the value (the MCP server reads it at startup), or
- put it in the MCP client's server config (claude mcp add --scope user --env COVALENT_RELAY_URL=... covalent -- node .../bin/cli.js, or the env block for other clients).
Then restart the agent session so the MCP server relaunches.

Notes

Optional per-IP throttle: uncomment the IP_LIMITER binding in cloudflare-worker/wrangler.toml (per-session limits are always enforced inside the Durable Object regardless).
Local testing without Cloudflare: npm run relay:dev (mock relay on http://localhost:8787) or wrangler dev for the real worker locally.
Full relay documentation: cloudflare-worker/README.md.

Read the full file on GitHub · 57 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

12d ago First seen · 57 lines · 0 tokens per session scan A b78072d55d30

Subscribe to this mod's changes

covalent-bond-self-relay is a skill published in the GitHub repository gopalrajsuresh/covalent-bond (0 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 659 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Cloud DevOps and cloud ai-agents claude cloudflare-workers e2ee encryption mcp

cloudflare-bundler-apps

Author Cloudflare Worker Bundler-compatible apps that build and preview correctly inside a space. Use this skill whenever you scaffold, modify, or deploy a project that will be built with @cloudflare/worker-bundler (i.e. anything served from /space/:name/preview/:branch/). Covers wrangler config, project layout…

cloudflare/vibesdk · 105 tokens

prepare-cloudflare-production-deployment

Source-of-truth runbook for preparing this Vinext Cloudflare Workers SaaS template for production deployment. Use when setting up or auditing Cloudflare MCP resources, wrangler.jsonc bindings, Worker secrets, Turnstile, Email Sending, GitHub Actions secrets/variables, or GitHub CLI deployment wiring for this…

LubomirGeorgiev/cloudflare-workers-nextjs-saas-template · 72 tokens

performing-kubernetes-etcd-security-assessment

Assess the security posture of Kubernetes etcd clusters by evaluating encryption at rest, TLS configuration, access controls, backup encryption, and network isolation.

xalgorix/xalgorix · 38 tokens

implementing-envelope-encryption-with-aws-kms

Envelope encryption is a strategy where data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a master key (KEK) managed by AWS KMS. This approach allows encrypting.

xalgorix/xalgorix · 55 tokens

detecting-azure-storage-account-misconfigurations

Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions using the azure-mgmt-storage Python SDK.

xalgorix/xalgorix · 54 tokens

portal-relay

Set up and run a public Portal relay on any Linux host with a public IP — Docker Compose deployment, embedded authoritative DNS with one-time NS delegation, optional TCP/UDP lease ports for game hosting, and registration in the public relay pool. Use when the user asks to run their own relay, contribute a relay to the…

gosuda/portal-tunnel · 111 tokens

covalent-bond: Skill for Claude Code