How do I install Replyslip?

Replyslip supports both local and remote installation. For local use, install it via the provided package manager and add the configuration to your AI app. For remote access, add the server URL to your MCP configuration.

Is Replyslip safe to use?

Replyslip was flagged by MCP Marketplace's security scan, scoring 4.6/10 (high risk). It has 4 high or critical findings to review. Review the security report on this page carefully before installing it.

What credentials does Replyslip need?

Replyslip requires the following credentials or environment variables: DATABASE_URL, ENCRYPTION_KEY, CRON_SECRET, UNSUBSCRIBE_SECRET, RESEND_API_KEY, EMAIL_FROM, REPLYSLIP_ALLOW_PRIVATE_WEBHOOKS, REPLYSLIP_URL, REPLYSLIP_WATCHER_KEY, REPLYSLIP_POLL_INTERVAL_MS, REPLYSLIP_ORCA_BIN, STATS_API_KEY, STATS_EXCLUDE_WORKSPACE_IDS, ALERT_EMAIL. You can find setup instructions on the server detail page.

What AI apps work with Replyslip?

Replyslip uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Replyslip MCP Server

by Klahrich

Developer ToolsUse Caution4.6MCP RegistryLocalRemote

Free

Server data from the Official MCP Registry

Relay for messages and schema-checked tasks between AI agents.

About

Relay for messages and schema-checked tasks between AI agents.

Remote endpoints: streamable-http: https://replyslip.com/api/mcp

Security Report

4.6

Use Caution4.6High Risk

ReplySlip is a multi-tenant agent relay with bearer API-key authentication enforced on the MCP endpoint (required: true), per-agent tool scoping, and no evidence of exfiltration or shell injection in the reviewed code. The main concerns are supply-chain trust in the watcher script, whose SHA-256 checksum is served from the same origin as the script, and agent API keys stored as plaintext files readable by the same OS user. The audited files are only part of the repository, so the score reflects the visible code only. Supply chain analysis found 6 known vulnerabilities in dependencies (1 critical, 3 high severity).

7 files analyzed · 10 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

database

Check that this permission is expected for this type of plugin.

env_vars

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

process_spawn

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

Postgres connection string. Required to boot the app and to migrate.Optional

Environment variable: DATABASE_URL

32 bytes, base64. AES-256-GCM for webhook secrets, and the HMAC pepper for sign-in codes.Optional

Environment variable: ENCRYPTION_KEY

Bearer token for /api/cron/wakes.Optional

Environment variable: CRON_SECRET

HMAC key for one-click marketing unsubscribe links. Required for unsubscribeUrl and /api/v1/unsubscribe. Not a default; set it on the host.Optional

Environment variable: UNSUBSCRIBE_SECRET

When set, sign-in codes are sent with Resend. When empty, codes are logged.Optional

Environment variable: RESEND_API_KEY

From address. Required only when RESEND_API_KEY is set.Optional

Environment variable: EMAIL_FROM

1 allows webhook URLs on loopback and private networks. Leave unset in production.Optional

Environment variable: REPLYSLIP_ALLOW_PRIVATE_WEBHOOKS

Public origin for unsubscribeUrl when set. Also the default origin for the watcher CLI and for replyslip register when --url is omitted.Optional

Environment variable: REPLYSLIP_URL

Default watcher key for the CLI when --key and --key-file are both omitted. The local setup in /skill.md stores the key in ~/.replyslip/watcher-<machine>.key instead.Optional

Environment variable: REPLYSLIP_WATCHER_KEY

Default poll interval for the CLI.Optional

Environment variable: REPLYSLIP_POLL_INTERVAL_MS

Orca CLI binary for the orca driver when orca is not on PATH. Default orca. Not a server variable.Optional

Environment variable: REPLYSLIP_ORCA_BIN

Bearer token for GET /api/admin/stats. When unset, that route is 404.Optional

Environment variable: STATS_API_KEY

Comma-separated workspace UUIDs left out of /api/admin/stats and out of the first-agent alert.Optional

Environment variable: STATS_EXCLUDE_WORKSPACE_IDS

Inbox for the first-agent alert. When unset, the alert is skipped.Optional

Environment variable: ALERT_EMAIL

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Reviews

No reviews yet

Be the first to review this server!

4.8

Local

MCP Marketplace

Free

by mcp-marketplace · Developer Tools

Search and install MCP servers from inside your AI client.

Replyslip MCP Server

About

Security Report

Findings (10)Action required

Permissions Required

What You'll Need

How to Install & Connect

Reviews

No reviews yet

More Developer Tools MCP Servers

Rea

Paperclip

Fetch

Git

Toleno

MCP Marketplace