Sold by: RelayShield
Deployed on AWS
RelayShield's Consumption Security API Bundles deliver metered access to focused threat intelligence and identity risk detection capabilities, billed entirely through AWS Marketplace. Bundle D, Agentic Attack Surface, covers MCP registry risk, prompt-injection breach correlation, agent-framework CVE targeting, bulk per-agent identity risk scoring and LLM credential exposure detection, scored from RelayShield's own corpus. Callable by AI agents over MCP and by REST.
Overview
Bundle D: Agentic Attack Surface is built for the emerging risk of AI-agent-driven attacks. It includes MCP registry risk scoring (detecting typosquatted AI agent tool servers and domains already known to be malicious), prompt-injection breach correlation (surfacing exposed sessions tied to prompt-injection attacks via infostealer log analysis), agent-framework CVE targeting risk (CVE exposure scoped to your declared agent stack, LangChain, AutoGPT, CrewAI, and similar), bulk per-agent identity risk scoring across up to 10 domains and 5 agents each, purpose-built for AI governance programs and MSP client sweeps, and LLM credential exposure detection to detect exposed LLM/AI provider API keys (OpenAI, Anthropic, Google, Groq, xAI, Replicate) in criminal stealer logs.
The checks are delivered as an MCP server, so an AI agent can call them directly as part of its own reasoning, and as REST endpoints for existing security pipelines.
Every score is computed from RelayShield's own continuously collected corpus: monitored criminal Telegram marketplaces, infostealer log dumps, and public indicator feeds. The queries you send are not forwarded to outside data providers, and every response names any signal it did not run, so a missing signal is never mistaken for a clean result. We deliberately do not quote a corpus headline here. A total indicator count is dominated by public feeds that most buyers already ingest, and it is out of date the week it is published; what matters is the exclusive fraction, which we report per capability on request.
Billing note: the monthly minimum commitment applies whether or not you call a given security function that month, and per-Unit charges apply only to the functions you actually call above the included baseline. Your API key is issued automatically by email when your AWS Marketplace subscription activates, with full usage instructions included. All access is provisioned and billed through AWS Marketplace.
Highlights
- Each bundle is licensed independently through AWS Marketplace, with no dependency on any other bundle or platform-wide subscription.
- Contract-with-consumption pricing: a minimum monthly commitment covers included usage, with transparent per-call pricing for anything above that baseline.
- Scored from RelayShield's own continuously collected corpus, with no customer query sent to outside data providers, and callable directly by an AI agent over MCP.
Details
Sold by
Categories
Delivery method
Integration protocol
Type
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor, and additional usage. You pay upfront or in installments according to your contract terms with the vendor. This entitles you to a specified quantity of use for the contract duration. Usage-based pricing is in effect for overages or additional usage not covered in the contract. These charges are applied on top of the contract price. If you choose not to renew or replace your contract before the contract end date, access to your entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/month |
|---|---|---|
Agentic Attack Surface - Monthly Access | Monthly minimum commitment for Agentic Attack Surface API access: agent identity risk scoring, agent framework exploit monitoring, MCP registry risk, prompt injection breach detection, and LLM credential exposure detection. | $270.00 |
The following dimensions are not included in the contract terms, which will be charged based on your usage.
Dimension | Description | Cost/unit |
|---|---|---|
Agent Identity Risk Score | Risk scoring for AI agent identities across breach, infostealer, and session exposure. | $1.80 |
Agent Framework Exploit Monitoring | Cross-references your tech stack against known and emerging CVEs affecting AI agents. | $0.18 |
MCP Registry Risk | Flags malicious, typosquatted or newly registered MCP servers and tool registries. | $0.32 |
Prompt Injection Breach Detection | Detects credential and session exposure from prompt injection attacks on AI agents. | $0.32 |
LLM Credential Exposure Detection | Detects exposed LLM/AI provider API keys (OpenAI, Anthropic, Google, etc) in stealer logs. | $0.36 |
Dimensions summary
This bundle covers the Agentic Attack Surface API through six units. Five are usage-based detection functions you pay per call: agent identity risk scoring, agent framework exploit monitoring, MCP registry risk, prompt injection breach detection, and LLM credential exposure detection. The sixth, Monthly Access, is a monthly minimum commitment that unlocks access to all five functions. You pay the monthly commitment plus per-call usage as you make requests. Each detection unit is billed independently, so your total scales with how many of each check you run. Billing runs through your AWS account.
Top-of-mind questions for buyers
One unit equals one API call to that detection endpoint. For example, one MCP registry check, one prompt injection breach scan, or one LLM credential exposure lookup each counts as a single billable unit. Bulk per-agent identity scoring submits multiple domains and agents in one call, counting as one unit.
You pay the Monthly Access commitment regardless of volume. On top of that, each detection function bills per call as you use it. If you make more calls, usage charges rise. If you make fewer, you still pay the monthly commitment. There is no automatic tier change.
Each of the five functions bills independently, so your mix of checks decides the total. High-volume checks like MCP registry risk or prompt injection detection add up faster if you run them often. The Monthly Access commitment stays fixed. All charges appear together on your AWS invoice.
api.relayshield.net
Helpful?
Vendor refund policy
The monthly minimum commitment and metered usage charges are billed in arrears and are generally non-refundable once incurred. RelayShield will issue a full or partial refund for verified billing errors, duplicate charges, or a service outage attributable to RelayShield. To request a refund, contact us at support.relayshield.net within 30 days of the disputed charge.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
API-Based Agents & Tools
API-Based Agents and Tools integrate through standard web protocols. Your applications can make API calls to access agent capabilities and receive responses.
Additional details
Usage instructions
Connecting Point your MCP client at: https://api.relayshield.net/mcp
This is a remote MCP server over HTTPS using the Streamable HTTP transport. Use an MCP client that supports that transport.
No account-level secret is required to connect. Each tool call takes your RelayShield API key as a parameter, so you are only billed for the calls you make.
Tools check_mcp_server_risk: checks an MCP server URL for typosquat risk and for presence in RelayShield's criminal IOC corpus. Returns CRITICAL, HIGH, MEDIUM or LOW with findings. Params: server_url, api_key
check_prompt_injection_breach: checks an email for credential exposure sourced specifically from prompt-injection attacks against AI agents, distinct from ordinary phishing or malware breaches. Params: email, api_key
check_tech_stack_cve: checks a declared AI agent framework or tech stack for CISA KEV or high-EPSS CVEs currently being exploited. Params: tech_stack (comma-separated, for example "langchain, nacos, minio"), api_key
check_bulk_identity_risk: hierarchical org and AI-agent-identity risk scoring for a domain and up to 5 agent or service-account identities. A critically exposed agent elevates the org's overall rating. Params: domain, agent_emails (comma-separated, up to 5), api_key
check_llm_credential_exposure: checks a domain for exposed LLM and AI provider API keys (OpenAI, Anthropic, Google, Groq, xAI, Replicate) in criminal stealer logs, where a leaked key becomes a live, uncapped billing liability. Params: domain, api_key
check_server_status: lists the tools on this server and confirms connectivity. No API key required.
How scores are produced Every score is computed from RelayShield's own continuously collected corpus. Queries are not forwarded to outside data providers, and each response names any signal it did not run, so a missing signal is never mistaken for a clean result.
Getting an API key Your API key is generated automatically and emailed to you when your AWS Marketplace subscription activates. No separate signup step is required.
Support
Vendor support
Email support: support@relayshield.net . Full API documentation, authentication steps, endpoint URLs, and sample requests are included in this product's Usage Instructions. Response within 1 business day for standard issues.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
RelayShield delivers threat intelligence and identity security via REST API - 4.5M+ IOC corpus, breach detection, SIM swap monitoring, infostealer exposure, ransomware victim tracking, and session hijack detection. Built for MSPs, MSSPs, and security-forward development teams.
RelayShield Attack Surface & Supply Chain delivers metered access to five exposure detection APIs, billed entirely through AWS Marketplace. It covers third-party and vendor exposure, asset intelligence sweeps, public artifact secret detection, threat actor lookup, and session hijack risk. The bundle is licensed independently, with no dependency on any other RelayShield product.
RelayShield Core Identity Exposure delivers metered access to six identity threat detection APIs, billed entirely through AWS Marketplace. It covers breach exposure, SIM swap detection, infostealer log checks, domain lookalike detection, OAuth token exposure, and crypto threat intelligence. The bundle is licensed independently, with no dependency on any other RelayShield product or bundle.
RedProtect is a managed security service, which provides fully configured, tuned and managed industry-leading WAF and vulnerability scanning systems, with teams of service and support engineers to manage all the technical aspects of delivering a highly effective security program ongoing.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.