arc-relay, from Comma Compliance, is a Model Context Protocol control plane that secures AI agent tool calls for regulated deployments. It intercepts MCP traffic between clients and servers to enforce policy, redact sensitive inputs and outputs, and create persistent logs of tool interactions for audit and governance. The tool provides a unified proxy, bidirectional middleware pipeline, risk-based access control, health monitoring, and encrypted archiving for centralized management. Designed for enterprise security teams, compliance officers, and developers building autonomous agents who need governed tool access.

What deployment environments does it support?

Deployment model: It installs as a Docker container or as a Go binary requiring Go 1.24+, designed to sit in front of MCP hosts such as Claude Desktop and Cursor. The tool accepts server endpoints running under Docker stdio, HTTP, or remote SSE transports, which lets organizations route multiple MCP servers behind a single authenticated control plane without changing client code.

How auditable and compliant are stored interactions?

Retention and encryption: The app streams tool calls to external retention endpoints using NaCl Box encryption, producing an end-to-end encrypted copy outside the control plane. That streaming archive format is explicitly aimed at meeting SEC and FINRA retention requirements and supports later forensic review or compliance audits, provided organizations configure external webhooks and storage targets to receive the encrypted records.

What resilience and lifecycle controls does it provide?

Operational resilience: The product includes periodic health pings, automatic recovery for failed MCP servers, and a Docker lifecycle manager that can start, stop, health-check, and recover containerized server processes. These controls let administrators detect unresponsive tool backends and trigger predefined recovery steps, which helps keep agent workflows available during transient failures or container crashes.

How does it integrate with enterprise authentication and management workflows?

Identity and management: Management interfaces include a Web UI and a REST API for creating users, issuing API keys, and adjusting server configurations programmatically. Authentication layers cover session cookies for the UI, Bearer API keys for proxy access, and OAuth 2.1 for remote server connections, which permits integration with existing identity providers and scripted deployments without exposing raw credentials in agent prompts.

A pragmatic, open-source control plane for regulated teams

arc-relay is a pragmatic, open-source control plane suited to enterprise security teams and compliance officers who need enforceable governance for MCP-based agents. Its design targets regulated retention and audit requirements, but adopting it requires dedicated operations and integration effort to run containers or compile the Go binary. Organizations prepared for that overhead gain a central governance layer for agent tool access and long-term compliance records.