relic-bridge

Status: alpha (pre-1.0). Phases 1-7 (local stdio, self-hosted HTTP, Cloudflare Worker, sign-in and admin panel, OAuth, more tools, power features) shipped in 0.7.0; later releases fix what live verification runs against real New Relic accounts found and add the Phase 8 hardening. The current version is on the npm badge below and in the CHANGELOG. Each release is on npm (with provenance), as a GitHub Release and as the signed ghcr.io/mhidalgo-lab/relic-bridge image. Phase 8 (hardening and launch) is in progress toward v1.0. OAuth is implemented and documented for claude.ai and Claude mobile, but has not been verified with the real apps (compatibility).

An open-source Model Context Protocol server that lets AI agents (Claude Code, Claude Desktop, claude.ai, Claude mobile, Cursor, VS Code, …) query New Relic through the NerdGraph API using only a User API key — no account-level MCP enablement required.

Features:

Local stdio:

• Local stdio (npx): your MCP client starts the server; one connection from env vars, or one project per process from a YAML file.
• Secure by default: read-only tools, query limits, redacted logs, documented threat model. The key is read from the environment (${VAR} references in YAML) and is never a tool argument.

Self-hosted HTTP (multi-device guide):

• relic-bridge serve: a Node / Docker HTTP server (SQLite) that your devices reach over TLS, with several projects at their own URLs (/p/{slug}/mcp).
• One token per device (rb_live_…), revocable individually; per-grant tool and account allowlists, query limits, rate limits and expiry (access model).
• New Relic keys stored encrypted (master key you hold, with rotation); bring-your-own-key for teams; an audit log (90 days by default).
• A management CLI and an admin API, plus an optional pass-through mode where callers bring their own key.

Cloudflare:

• A Cloudflare Worker deployment on D1, one setup command or a Deploy button (guide, limits and costs). The guide has not yet been validated on a clean Cloudflare account.

Sign-in and admin panel (admin guide):

• Sign in with Google, GitHub, Cloudflare Access or any OpenID Connect provider, with deny-by-default allow-lists, optional auto-provisioning, and a one-time setup link for the first owner (identity providers).
• Sessions, roles and CSRF (owner, admin, member) for the admin API and the panel (admin access).
• An admin panel (/admin, works on a phone, no JavaScript needed): New Relic keys, projects, grants, device tokens, users, an audit viewer with CSV export, usage statistics, a connect page with client snippets, and “My access” for members, who bring their own keys (panel guide).
• Contributor checks: a Playwright browser run (pnpm test:e2e) and an OWASP ZAP baseline scan (pnpm scan:zap).

OAuth for claude.ai and your phone (phone guide):

• OAuth 2.1 (RB_OAUTH=on): claude.ai on the web and the Claude mobile apps connect to /p/{slug}/mcp without a token. Discovery, client metadata documents and dynamic registration, a consent screen where you choose the grant, one-hour access tokens with rotating refresh tokens, and per-device Disconnect plus an owner’s OAuth apps list (OAuth guide, how it works).
• The split for several devices: laptops use a device token each, the phone uses OAuth.
• Tested with SDK clients shaped like the real ones; the real claude.ai and mobile apps are still to be checked (client compatibility).

Tools and power features:

• 41 tools (reference): NRQL, entities, golden metrics, alerts and issues, errors, deployments, transactions, logs, synthetics, dashboards, and one-call reports such as entity_health and dependency_health; plus MCP prompts and resources.
• Opt-in write tools (change events, acknowledging and closing issues, dashboards), off unless a grant enables them and approved per call by default.
• Query limits, a query cache, charts (MCP Apps), long-running reports as MCP Tasks, doctor, config import/export, an OS keychain, per-grant quotas, the Claude Code plugin and optional self-monitoring with OpenTelemetry.

Planned for 1.0 (Phase 8) (see the roadmap): final threat model and an external security review, performance and cost checks, a documentation site, a support policy and the launch.

Install

Node.js 24.11 or later and a New Relic User API key. The simplest setup is a local stdio server that your MCP client starts (the same CLI also offers serve for self-hosting, management commands, an OS keychain and doctor):

claude mcp add relic \
  --env NEW_RELIC_API_KEY= \
  --env NEW_RELIC_ACCOUNT_ID=1234567 \
  --env NEW_RELIC_REGION=US \
  -- npx -y relic-bridge

Other clients and the multi-project YAML mode: local quickstart. Releases are published from GitHub Actions with npm provenance; each GitHub Release carries the tarball, an SBOM and checksums with build attestations (how to verify). Changes: CHANGELOG.

Documentation

The same pages are published as a searchable site at (built from docs/ by site/; pnpm docs:check builds it locally and checks every link). The links below go to the Markdown.

• Get started: local quickstart · client setup · Claude Code plugin · configuration · migrating a config · troubleshooting
• Deploy: self-hosting · deploy to Cloudflare · Cloudflare limits and costs · multi-device setup · verify a release · registry listing · upgrading · versioning and support policy
• Access and admin: admin guide · admin panel · admin access · sign-in providers · access model · secrets · audit log · security basics
• OAuth: use it from your phone and claude.ai · OAuth settings · how OAuth works · client compatibility
• Using the tools: query limits · query cache · output formats · charts (MCP Apps) · self-monitoring (OpenTelemetry)
• Reference: tools · prompts · resources · CLI · admin API
• Roadmap & task index
• Architecture · Decisions (ADRs) · Research & platform limits
• Threat model
• How we track work · Agent instructions
• Contributing · Security policy · Code of Conduct

Development

corepack enable && pnpm install
pnpm lint && pnpm typecheck && pnpm test && pnpm build

See CONTRIBUTING.md for details.

Disclaimer

relic-bridge is an unofficial, community project. It is not affiliated with, endorsed by, or supported by New Relic, Inc. New Relic and NerdGraph are trademarks of New Relic, Inc.

License

Apache-2.0. See NOTICE.