pan -relay

pan-mcp-relay is a security-enhanced MCP Relay Server that sits between MCP Clients and MCP Servers to inspect and constrain tool usage in real-time. It leverages Prisma AIRS AI Runtime API Intercept to scan tool descriptions, tool call parameters, and tool call responses for threats such as prompt injections, malicious URLs, and data leakage, helping protect IDEs, LLM chat clients, and AI agents from harmful MCP Server Tools. To use it, configure your Prisma AIRS API Key and AI security profile, then run the relay with the provided CLI. The relay supports multiple transport methods, including the default stdio transport as well as streamable HTTP and SSE transports, enabling flexible deployment in local and remote environments.

Prerequisites:

• A valid Prisma AIRS API Key and an AI security profile configured in Strata Cloud Manager.
• Python 3.9+ installed on your system.
• uv (Astral UV) recommended for installation and management of MCP tools.

Installation steps:

1. Install uv (recommended method):

# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows (PowerShell)
# Follow the standalone installer instructions in the README (not shown here)

2. Install pan-mcp-relay via uv:

# Quickstart (latest release)
uvx pan-mcp-relay@latest --help

3. Standard install (adds the tool to your PATH):

# Install the tool (returns executable on PATH)
uv tool install pan-mcp-relay@latest

# Run help to verify
pan-mcp-relay --help

4. Upgrade to the bleeding-edge version (optional):

uv tool install --upgrade pan-mcp-relay

5. Create an mcp-relay.yaml configuration file with your Prisma AIRS credentials and desired settings as described in the Configuration section.

Note: The README recommends uv over pip/pipx for performance and startup times.

Tips and notes:

• Use uv to install and manage pan-mcp-relay for faster startup times.
• Ensure your Prisma AIRS API Key and AI Security Profile are correctly configured in your mcp-relay.yaml or environment variables.
• The relay can operate with multiple transport options; choose stdio for local testing or streamable HTTP/SSE transports for remote deployment.
• If upgrading, verify compatibility with your configuration file since API endpoints or required fields may evolve between releases.
• Common issues often relate to API key scope or profile mismatches; verify keys and profiles in Strata Cloud Manager under Insights > Prisma AIRS.
• You can run pan-mcp-relay with --help to see all CLI options, including transport configuration, logging levels, and MCP client/server endpoints.