Connections
Add accounts and tools once. Every agent that uses runelay sees them.
A connection is a source of tools. Its name becomes the tool prefix, so a connection named linear exposes tools like linear.list_issues. Names are lowercased and anything other than letters and numbers becomes _.
There are four ways to add one in the panel: install from the catalog, add a custom connection, import an agent config, or run runelay import / runelay migrate from the CLI.
Catalog
About 25 curated MCP servers with one-click OAuth. Pick one, sign in, and its tools are ready.
Connection types
Remote MCP
The URL of an MCP server, plus optional headers (one per line, Name: value, stored encrypted). If the server asks for sign-in, OAuth opens next.
Local command
A command that starts an MCP server on the runelay machine itself, with arguments and environment variables (one per line, KEY=value).
Local commands are off by default. They need RUNELAY_ENABLE_STDIO=true, and even then only an owner or admin can create them from the panel. The process gets a minimal environment, without server secrets. The Docker image ships without Node, so commands like npx need the desktop app or a custom image.
OpenAPI
An OpenAPI spec in JSON or YAML. Each operation becomes a tool. You can set a base URL (optional; without it, the spec's own URL is used), headers and query parameters.
OAuth
When a remote MCP server requires sign-in, runelay runs the OAuth flow and stores the tokens encrypted. The callback is PUBLIC_URL/v1/oauth/callback, so PUBLIC_URL must be the public address of your server.
A connection whose sign-in expired shows Needs sign-in. Reconnect it from the panel. After runelay migrate, the /connectors/reconnect queue walks you through every pending login one tab at a time.
Servers that take a key instead of OAuth can be connected by pasting the token. It is encrypted on the server and agents never see it.
Import
Paste your ~/.claude.json, ~/.codex/config.toml, ~/.grok/config.toml or ~/.cursor/mcp.json in the panel, or run runelay import on your computer. Importing through the API never expands ${VARS} from the server environment.
Status
Each connection shows its tool count and a status: OK, Error, Needs sign-in or Not tested. You can test, pause or remove a connection. Removing one deletes its sign-in and its tools disappear from every agent in the organization.
Outgoing requests to private network addresses are blocked unless RUNELAY_ALLOW_PRIVATE_URLS=true. See Security.