Relay: Everything you do online. Any agent. Any teammate.

The problem

The web was built for you.
Not for your agents.

01

Sessions die mid-task

Logouts, checkbox walls, bot detection and crashed browsers turn a ten-minute job into a babysitting session. The agent gives up, and the job lands back on you.

02

Most of your accounts have no API

Archives, portals, back-office tools and paywalled sites only speak browser. Whatever you can do there, your agents can't, unless someone builds the bridge.

03

Sharing means handing over the keys

To give an agent or a teammate access today you paste a password, forward an API key or share a login. Then you can't scope it, can't see what happened, and can't take it back cleanly.

The product

Five layers. One thing to hand over.

01 · Core
A browser that gets through
Stays signed in, clears challenges with Loki, climbs the routing ladder when a site pushes back, and sleeps instead of dying.
The browser →
02 · Multiplier
Any site becomes an API
Every signed-in account becomes a connection, and every action becomes a typed tool any agent can call over MCP or REST.
Any site → API →
03 · Reach
Communications, built in
Email, texts, phone calls and real letters come built in, under the same grants and spend limits, and nothing goes out without your approval.
Communications →
04 · Trust
Secrets used, never seen
Share logins and API keys with agents and teammates. Relay types them, calls with them and scrubs them from everything that comes back.
Security model →
05 · Compounding
Everything you build is shared
Skills, workflows, tools and learned challenge methods accumulate, so each new agent or teammate starts with all of it.
The Library →

01 · The agentic browser

A browser that gets through. And stays through.

Starting a cloud browser is easy. Finishing a long job on a real account is where most setups fall over. Relay is built for the second part: pinned Google Chrome with signed-in identities that survive the things that usually end a session.

Stays logged in. Named identities keep cookies, local storage and IndexedDB on a persistent volume. Many sessions can share one identity at once, and a sign-in in one reaches the others within seconds.
Gets through two-factor on its own. Relay computes authenticator codes inside the vault and types them at sign-in, so agents pass 2FA without waiting on a human and never see the seed.
Signs itself back in. Vault-backed login flows for configured sites type credentials server-side and check the page for signed-out controls before trusting a session.
Escalates when sites push back. Plain HTTP first, then a full browser, then quiet mode on a sticky residential exit. Relay remembers which rung each host needed.
Quiet mode for hostile sites. Chrome on a real display with native keyboard and pointer input and no automation instrumentation.
Sleeps instead of dying. Idle sessions free their browser after five minutes and wake on the same pages when the agent returns, including after a deploy or restart.

POST /v1/fetchrouting ladder

1

Plain HTTPChrome TLS fingerprint, no browser

fastest

2

Agent browserfull Chrome, instrumented

when JS is needed

3

Quiet + residentialnative input, sticky residential exit

when sites push back

One deadline covers the whole ladder. Every attempt reports its outcome, timing and bytes, and payloads are validated, not just fetched.

Two-factor, handled

Six digits shouldn't stop a job.

Authenticator codes, automatically

Store a site's authenticator seed once. Whenever that site asks, Relay generates the current code server-side and types it as a masked secret. The agent never sees the seed or the code.

Enrolls itself

On a two-factor setup page, an agent can save the authenticator from the manual key, the otpauth:// link or the QR code straight into the vault, and get back a reference instead of the secret.

Email and SMS codes too

Codes sent by email or text can be read from your own Mail and Messages, or from phones and inboxes your agents have, then typed in for them. Password-reset and account-recovery messages are always refused.

You approve code use once, in your agent's chat, and can revoke it anytime.

Challenges · Loki

A challenge is a step, not a dead end.

Loki is Relay's challenge coordinator. It clears what it knows natively, hands visual puzzles to your agent with everything it needs, checks the result itself, and remembers what worked. The job never gets punted back to you.

resolve
Clear it natively

Built-in playbooks wait out interstitials and use native input on checkbox challenges such as Cloudflare Turnstile and DDoS-Guard, plus known drag controls. Attempts are bounded, so no loop runs forever.
continue
Hand puzzles to the agent

For a visual puzzle, Loki returns image evidence, the remaining objective, any learned methods that apply and a continuation. Your agent solves it through browser_act.
verify
Trust the page, not the claim

An agent saying "done" never counts. Loki re-observes the page, confirms the challenge is gone and checks that the target element and URL you asked for are really there.
learn
Remember what worked

A verified recipe becomes a signed, private Library method. Three verified solves mark it validated. A failed replay retires it. Recipes store the method, never answers, codes or credentials.

agent → loki_resolve

{ "session": "SESSION_UUID",
  "requestId": "REQUEST_UUID",
  "budgetMs": 15000,
  "ready": { "selector": "main.account-content",
             "url": "https://example.com/account" } }

← cleared, or a continuation

{ "status": "cleared", "reason": "target_ready" }

// or: challenge_required + image evidence,
// attemptId, revision, learned methods.
// Agent acts, then calls loki_report.

02 · The multiplier

Turn any account into an API. Hand it to any agent.

Once Relay can get into a site, it can turn that site into something you can grant: a named connection, typed tools and repeatable methods. They work the same way in the dashboard, over REST and over MCP.

Every account is a connection
Signed-in profiles, vault logins and API keys appear as stable IDs like browser:archive or api:exa. Grant a connection to an agent and it can open that account directly, without ever needing the password.
Every action is a typed tool
Toolkits declare tools with schemas. The dashboard builds its run forms from them, POST /v1/tools/NAME/execute runs them over REST, and tools_execute runs them over MCP, all with the same result and the same permissions.
Wrap a site or an API once
Register a toolkit server-side with a Zod schema and a handler, or a native API toolkit that keeps its key in the vault with daily call and spend limits. Every connected agent can discover it with tools_search.
Read any page as data
fetch and browser_read return pageable markdown. browser_act batches up to 50 commands with retry keys and diff observations, so agents read and act in few round trips.
Methods, not just endpoints
Workflows package a procedure with its own version, inputs, instructions, exact tool-version dependencies and completion checks, so a multi-step job runs the same way every time.

03 · Communications, built in

Browser, email, text, phone and letter. Built into every agent.

Some jobs end in an inbox, on a phone line or at a mailbox. Relay's channels ship as built-in toolkits, under the same grants, daily limits and replay ledger as everything else, and nothing goes out without your say-so.

Browser

Any site, signed in

The agentic browser above: your accounts, past challenges and through 2FA, for anything that only happens on a web page.

Email

Your inboxes, in hand

Agents work in the mail accounts you grant them through Relay's signed-in browser, pick up sign-in codes on their own, and find addresses in the contact directory.

Text

Texts from your numbers

twilio_sms_send sends a text or MMS. Delivery status, error codes and whole threads come back, and the dashboard's Connectivity area shows each thread with names from your contacts.

Phone

Calls that speak for you

twilio_call_place rings a number and speaks a message or runs a call script, capped by maxMinutes, with length, price and recordings in the call history. Your agent can ring you when a job needs a decision.

Letter

Real letters, real post

Write in Markdown and Relay adds a letterhead, renders a free proof and checks the address with USPS, then it's printed and mailed first class or certified, with tracking. Addresses come from the contact directory.

You approve every send. Before a text, call or letter goes out, your agent shows you the recipient, the content and the estimated cost, and sends only after you say yes in its chat. Daily call and spend limits cap each channel, and a retried letter never mails twice.

Texts and calls run through the built-in Twilio toolkit on your own Twilio account, and letters through the built-in PostGrid toolkit on your own PostGrid account. Add each key to the vault once.

Sharing

Share logins, API keys, skills and tooling. With any agent or teammate.

Everything in Relay has an owner and a grant list. You decide which agents and which people get each thing, and you change your mind in one place.

ResourceCoding agentNightly jobAliceBob

browser:archive✓✓✓—

api:exa✓—✓✓

skill: monthly-report✓✓assignedorg

toolkit: archive✓✓✓—

Illustrative grants. Revoke any cell: disable a connection, revoke a key or OAuth app, or suspend a teammate, and live connections close.

04 · The trust layer

Agents use your secrets. They never see them.

That's what makes sharing safe. Agents and teammates hold references, never values. Relay types the password, calls the API with the key, and scrubs both out of everything that comes back.

agent →

{ "command": "fill",
  "target": { "label": "Password" },
  "secret": "archive.password" }

Relay checks the grant, resolves the entry and types it into the page

← agent

{ "ok": true,
  "value": "••••••••",
  "snapshot": "textbox Password [masked]" }

Encrypted at rest
AES-256-GCM vault on each person's own volume. Library files are encrypted separately before they reach object storage.
Scrubbed on the way out
Stored values are masked in results, errors, snapshots, HTML and screenshots. API keys never appear in tool results or history.
Least privilege per agent
Each login, key and connection lists who may use it. Grants are checked at use and fail closed.
Protected identities
Sensitive profiles refuse screenshots, exports and live views outright, and keep one fixed network exit.
2FA without exposure
Authenticator codes are generated inside Relay at sign-in. Seeds are never returned, and codes never travel through prompts, URLs or logs.
Observation, not handoff
A live view needs your explicit approval: a single-use token for one session, one reason, five minutes. The agent still does the work.

05 · Compounding

Every new agent starts with everything you've built.

Each login you add, tool you wrap, skill you write and challenge Loki learns stays in Relay. The next agent you connect, or the next teammate you invite, gets all of it through one URL.

Skills from a folder

Sync a folder with a SKILL.md and its scripts. Connected agents get the new version on their next read.

Versioned, never lost

Every save, upload and sharing change is an immutable version. Restore any of them, and concurrent edits conflict instead of overwriting.

Methods that improve

Verified Loki recipes join your Library as private methods, so the next encounter with that challenge starts with a known approach.

Day-one teammates

Invite someone and grant the accounts, keys and skills they need. Their agent is useful from its first request.

How it works

Set it up once. Hand it to anyone.

1
Bring your access
Sign browser identities into your sites, add logins and API keys to the vault, and import your skills and tools.
2
Grant it
Choose which agents and which teammates get each login, key, skill and toolkit. Everything else stays private.
3
Connect
Paste the /mcp address into any remote-MCP client and approve it in your browser. No local runtime, revocable from /account.
4
Watch the record
Live event streams per session, plus private history of every tool call, the credential reference and scope it used, and its usage.

Teams

Shared access. Private history.

In team mode, every person gets their own Relay: a dedicated worker, browser profiles and vault behind one HTTPS gateway. The owner shares accounts, keys and skills person by person.

Isolated by default. Each teammate's sessions, cookies, downloads and activity stay on their own worker and volume. Session IDs can't reach across.
Shared logins, per-person grants. Publish an organization credential once and grant it to named people. Personal entries take precedence when someone has their own.
Standard sign-in. Single-use invitations, OAuth discovery, dynamic client registration and PKCE, with short-lived access tokens.
No backdoor. Admins manage membership and shared resources. There's no impersonation, no private-vault access and no viewing someone else's browser.

For developers

Speaks MCP natively. REST and CDP when you want the controls.

One registry backs every surface. Agents discover tools on demand instead of loading every schema, and scripts can attach Playwright-compatible tooling straight to a session's CDP address.

browser_openbrowser_actbrowser_readbrowser_loginbrowser_codebrowser_downloadfetchloki_resolveloki_reportconnections_listlibrary_getdirectory_findmail_sendtwilio_sms_sendtwilio_call_placeworkflows_gettools_searchtools_execute

// Any remote-MCP client. Sign-in happens in your browser (OAuth + PKCE).
{
  "mcpServers": {
    "relay": {
      "url": "https://relay.ghostly.works/mcp"
    }
  }
}

// Then just ask:
// "Sign in to the archive and download this month's statements."

// 1. Find the right tool without loading every schema
tools_search { "query": "download PDF", "toolkit": "browser" }

// 2. Open a granted, signed-in account by its connection ID
browser_open { "connection": "browser:archive", "url": "https://archive.example.org" }

// 3. Batch actions; credentials go in by reference
browser_act {
  "session": "SESSION_UUID",
  "commands": [
    { "command": "fill", "target": { "label": "Search" }, "value": "1931 census" },
    { "command": "press", "target": { "label": "Search" }, "key": "Enter" }
  ],
  "observe": { "mode": "diff", "compact": true }
}

import { z } from "zod";
import relayPlugin, { type Toolkit } from "@relay/api/plugin";

const archive: Toolkit = {
  id: "archive", name: "Archive", version: "1.0.0",
  description: "Search the archive account",
  authentication: "Uses the browser:archive connection",
  tools: [{
    name: "archive_search",
    description: "Search records and return results",
    input: z.object({ query: z.string() }).strict(),
    annotations: { readOnlyHint: true },
    execute: async (args) => { /* drive the session */ },
  }],
};

await app.register(relayPlugin, { toolkits: [archive] });
// Now in the dashboard, REST and MCP, for whoever you grant.

# Quiet session on a saved identity, US residential exit
curl -X POST https://relay.ghostly.works/v1/sessions \
  -H "relay-api-key: $RELAY_KEY" \
  -d '{"mode":"quiet","identity":"archive","residential":{"country":"US"}}'

# Run any registered tool over REST
curl -X POST https://relay.ghostly.works/v1/tools/fetch/execute \
  -H "relay-api-key: $RELAY_KEY" \
  -d '{"arguments":{"url":"https://example.org/report"}}'

Use cases

What people hand to Relay.

Research behind logins

Search subscription archives and records sites on a known-device identity, read results as markdown and pull the PDFs.

Portals that fight back

Back-office tools and government sites with challenge pages, driven in quiet mode with Loki handling the walls.

A site as a team tool

Wrap a portal's search in a toolkit once, and everyone you grant it to can call it from their own agent.

Coding agents with real access

Let a coding agent use staging logins and API keys through tools, with nothing pasted into the repo or the chat.

Onboarding a teammate

Invite them, grant the shared logins, keys and skills they need, and their agent is productive on day one.

One kit for every agent

Switch assistants, models or machines. Your accounts, tools and skills come with you through one URL.

Accounts locked behind 2FA

Banking-style portals and admin consoles that demand an authenticator code on every sign-in, handled without a phone in your hand.

Letters that still need paper

Formal requests, notices and replies that have to arrive by post, drafted and sent by your agent.

The calls nobody wants to make

Confirming bookings, chasing a supplier or following up by text, with your agent calling you back when it needs a decision.

FAQ

Questions, answered.

Does Relay solve CAPTCHAs?

It clears interstitials and checkbox challenges such as Cloudflare Turnstile and DDoS-Guard itself, with native input. Visual puzzles go to your connected agent through Loki, with image evidence and any learned method that applies; Loki then verifies the page independently. Relay doesn't send challenges to a third-party solving service, and it never makes them your job.

Can agents get through two-factor sign-in without me?

For authenticator-app codes, yes. Store the seed once, or let an agent enroll it from the setup page, and Relay generates and types the current code whenever the site asks. Email and SMS codes can come from your own Mail and Messages or from your agents' own phones and inboxes. You approve code use once in your agent's chat.

What do I need for email, texts, calls and letters?

They're built in. Email works through the mail accounts you sign Relay's browser into. Texts and calls run through the built-in Twilio toolkit on your own Twilio account, and letters through the built-in PostGrid toolkit on your own PostGrid account: add each key to the vault once. Every text, call and letter waits for your approval in chat, and daily limits cap what each channel can spend.

How is this different from a cloud browser service?

Cloud browsers give an agent a browser. Relay also owns the accounts that browser signs into, the credentials and 2FA it uses, the tools built on top, the ways it reaches the world beyond the screen, and who's allowed to use each one. Then it hands all of that to any agent or teammate as scoped access.

Can an agent or teammate ever see a shared password or key?

Not through Relay. They reference a vault field; Relay types it or calls the API with it, and masks it in every result, error, snapshot and screenshot. Page scripts an agent runs can read the page they run in, so keep your most sensitive accounts on protected identities.

How do I take access back?

Disable or disconnect a connection, revoke an agent key or connected OAuth app from /account, unassign a skill, or suspend a teammate. Revocation and suspension close that person's live connections.

Which agents can connect?

Any client that supports remote MCP over Streamable HTTP. OAuth-capable clients sign in through your browser with no installer. Scripts can use REST, or attach to a session's CDP address.

In team mode, who can see my activity?

Only you. Each person's sessions, downloads and history stay on their own worker. Sharing a login or a skill doesn't change who can see what you did with it. The hosting operator still administers the underlying machines.

Where does it run?

Relay is your own deployment. Run it locally with Docker Compose or in the cloud; the reference deployment runs on Railway with persistent volumes for profiles and the vault.

Everything you do online.Any agent. Any teammate.

The web was built for you.Not for your agents.

Sessions die mid-task

Most of your accounts have no API

Sharing means handing over the keys

Five layers. One thing to hand over.

A browser that gets through

Any site becomes an API

Communications, built in

Secrets used, never seen

Everything you build is shared

A browser that gets through. And stays through.

Six digits shouldn't stop a job.

Authenticator codes, automatically

Enrolls itself

Email and SMS codes too

A challenge is a step, not a dead end.

Clear it natively

Hand puzzles to the agent

Trust the page, not the claim

Remember what worked

Turn any account into an API. Hand it to any agent.

Every account is a connection

Every action is a typed tool

Wrap a site or an API once

Read any page as data

Methods, not just endpoints

Browser, email, text, phone and letter. Built into every agent.

Any site, signed in

Your inboxes, in hand

Texts from your numbers

Calls that speak for you

Real letters, real post

Share logins, API keys, skills and tooling. With any agent or teammate.

Signed-in accounts

Provider keys

Instructions & files

Toolkits & workflows

Agents use your secrets. They never see them.

Encrypted at rest

Scrubbed on the way out

Least privilege per agent

Protected identities

2FA without exposure

Observation, not handoff