One endpoint for every MCP tool.
Your coding agent builds the servers. Rayrun runs them behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.
Free for one developer · No card required
ray.run/dashboard
Works with the clients you already use
- Claude
- Codex
- Cursor
- VS Code
- Windsurf
- OpenCode
One entry replaces every client config.
mcp.json
{
"mcpServers": {
"linear": { "url": "…",
"headers": { "Authorization": "Bearer …" } },
"stripe": { "command": "npx",
"env": { "STRIPE_API_KEY": "sk_live_…" } },
"notion": { "command": "npx",
"env": { "NOTION_TOKEN": "ntn_…" } },
"internal-api": { "command": "node",
"env": { "API_KEY": "…" } }
}
}mcp.json
{
"mcpServers": {
"ray.run": {
"url": "https://ray.run/mcp"
}
}
}Your coding agent builds the server. Rayrun runs it.
Hand a scaffolded project to Codex or Claude Code, then deploy with one command.
codex · hacker-news-digest
$ npx rayrun setup https://ray.run/mcp \
--client codex --yes --login
$ npx rayrun login
you → Codex
Build a Hacker News digest MCP.
Add get_top_stories({ limit }), test it,
and deploy it to Rayrun.
Codex $ npx rayrun init hacker-news-digest
Codex server implemented · tests passed
Codex $ npx rayrun deploy hacker-news-digest --wait
Rayrun build succeeded · release active · get_top_stories
you → Codex
Tell me today's top HN stories via Rayrun.
you → Codex
Update my HN MCP to only surface stories
whose titles mention AI, then redeploy it.
Codex code updated · tests passed · release active- 1Scaffold
rayrun initgives your agent a complete TypeScript or Python project, with a working tool and a test. - 2Deploy
rayrun deploy --waituploads the source. It streams validation, build, and release status to the terminal. - 3Verify and releaseA candidate starts beside the live release and is verified first. A failed build leaves the current release live.
- How deploying works
Then publish it to your customers.
Your customers add one URL to their own client and sign in with your identity provider, without joining your workspace.
- Your sign-inCustomers sign in with your OpenID Connect provider. Your server receives a signed token naming who called.
- Your policy, per customerChoose what they can call and how often. A change that needs approval waits for the customer who asked.
- Your domainServe it from a subdomain you own, proved with a DNS record and certified by Cloudflare.
Add a service in one step. No adapter to write.
Paste what you have. Rayrun discovers the tools and puts them behind your endpoint, with the same credentials, access policy, and activity trail as everything else.
ray.run/dashboard · add service
- Remote MCP
https://mcp.linear.app/mcpRayrun completes OAuth and stores the credential. - OpenAPI
https://api.example.com/openapi.jsonEvery supported operation becomes a typed tool. - npm package
@acme/mcp-server@1.4.0Pinned to the version you name, and served over HTTP. - Container image
ghcr.io/acme/mcp:1.4Inspected, then run beside everything else.
Code mode loads a tool’s definition only when the model needs it. How code mode works.
Keep control after deployment.
Access is decided per service, tool, and argument. Changed definitions wait for a person. Every call leaves one searchable record.
Allow, ask, or block
Set a policy per service, then override any tool. A call that needs a person waits for one.
How access worksDefinition review and scanning
A changed tool definition waits until you approve it. Reusable detector profiles add service- and access-profile-scoped protection: arguments block, results redact, and matching policies cannot weaken existing scanning.
How definitions are heldCredentials held once
Credentials stay with Rayrun, or in your own AWS account. Clients get a token. Services get the credential.
How credentials are heldray.run/dashboard/activity
Built for teams that answer to a security review.
The controls are published. So is what is not yet certified. A security review can start from the facts.
- Encrypted per workspaceEvery workspace has its own data-encryption key, and Rayrun holds the wrapping key separately.
- Secrets never reach a browserA stored credential is never sent to a browser, not even to the admin who entered it.
- Single sign-on and SCIMOIDC or SAML 2.0 single sign-on, SCIM 2.0 provisioning, and access profiles by directory group. Your provider can authorize every client, so nobody connects one by hand.
- Signed audit exportEvery call records who made it and which policy applied. The record can stream to your SIEM in signed batches.
- Isolated, verified buildsSource builds run in isolation and package a non-root image. A release is verified before traffic moves.
- Published, not badgedRayrun publishes its controls, the third parties that see workspace data, and where it stands on SOC 2 and HIPAA.
Start with one server.
Connect one service and one client, then add the rest when you need them.