MCP relays

MCP relays let coding agents reach remote MCP (Model Context Protocol) HTTP servers through llama-dash, so the provider bearer token stays encrypted in the credential vault and every exchange is logged.

Relays live at /mcp-relays/:slug. A relay request must include x-llama-dash-api-key, and that key must explicitly allow the relay. The stored upstream credential is then injected into outbound headers, the response streams through, and the exchange is logged without exposing the provider secret. Successful relay requests are metadata-only by default; failures keep bounded debug capture.

Configure a client

Create the relay in Policies, then point your client at the relay URL with a separate llama-dash key header. The Policies page shows this snippet for each configured relay:

{
  "mcpServers": {
    "hyperline_sandbox": {
      "type": "http",
      "url": "http://<llama-dash-host>:3000/mcp-relays/hyperline-sandbox",
      "headers": {
        "x-llama-dash-api-key": "sk-..."
      }
    }
  }
}

The provider bearer is injected only when an API key that is explicitly allowed to use the relay forwards the request upstream.