AI agents
Relic serves the Model Context Protocol (MCP). Its read-only tools call the Relic API as you, so an agent sees only what you may read.
| Tool | Answers |
|---|---|
search_artifacts | files whose name contains a text |
artifact_details | a file's size, checksums, properties, builds and scan |
artifact_findings | a file's vulnerabilities, malicious packages, secrets and misconfigurations |
explain_download | whether a download is blocked, and by what |
list_repositories | the repositories, with their class and format |
repository_setup | the URLs a client uses for a repository |
package_allowed | whether a package version may be added as a dependency |
Over standard input and output
relic mcp runs as a subprocess of the agent, with the current context's
credentials. Sign in first:
relic auth login https://relic.example.com
Then register the command, for example in a project's .mcp.json:
{
"mcpServers": {
"relic": {"command": "relic", "args": ["mcp"]}
}
}
Over HTTP
The server serves streamable HTTP at /mcp. It needs an access token as
Authorization: Bearer <token>. Create one:
relic auth token create --description "coding agent" --expires-days 30
Then point the agent at the endpoint:
{
"mcpServers": {
"relic": {
"type": "http",
"url": "https://relic.example.com/mcp",
"headers": {"Authorization": "Bearer ${RELIC_TOKEN}"}
}
}
}
Routing an agent's dependencies
In a project directory, point the package manager at Relic and tell agents to check dependencies first:
relic package setup npm npm-virtual --agent
This writes the client's configuration to your user files (the token stays out
of the project), adds a section to AGENTS.md telling agents to use only the
repository and ask package_allowed first, and registers relic mcp in
.mcp.json. Other content of both files is kept.
package_allowed refuses a version when:
- the malicious package catalog lists it;
- the repository's npm or PyPI metadata leaves it out (cooling down, quarantined, blocked or absent);
- a stored finding, end of life, deprecation or lack of maintenance violates a blocking rule of a watch covering the repository (ignore rules apply).
A package URL type the repository's format cannot hold is an error; a generic repository takes any type. The answer also lists the version's operational risks.
Run the same check from the command line; it exits 1 when refused:
relic package check pkg:npm/lodash@4.17.21 --repository npm-virtual
MCP server and skill registries
| Format | Holds |
|---|---|
mcp | MCP registry server.json files, served at /api/mcp/<repository>/v0/servers |
skills | zip files with a SKILL.md whose front matter gives name and description |
An entry is listed and served only after an administrator approves its content, in Agent registry in the UI or with the CLI. Until then, every route (the files API, the Artifactory®-compatible API) refuses to download, copy or move it, except for administrators and viewers. New content needs a new approval. Relic Scan scans skill bundles like any zip file.
A file the registry cannot read (invalid JSON, no name, a zip without
SKILL.md, or too large) is never served. Replace it with a valid one.
Upload a server definition:
relic artifact upload server.json mcp-servers/weather/1.1.0/server.json
List the entries of a repository you may read (administrators and viewers also see unapproved ones):
relic registry list mcp-servers
Approve one:
relic registry approve mcp-servers/weather/1.1.0/server.json
Point an MCP client's registry at Relic:
https://relic.example.com/api/mcp/mcp-servers