Rightshold
Know what your agent may use: license checks, entitlements you hold, signed rights manifests.
Should I use this
Quality & Safety
Findings (5)
- HIGHTool poisoning patterns detected
- LOWTool 'whoami' description lacks action verbin whoami
- INFOTool description contains placeholder or incomplete textin registry_lookup
- INFOTool description contains placeholder or incomplete textin kya_lookup
- INFOTool description contains placeholder or incomplete textin kya_check
Based on automated analysis of tool definitions and protocol compliance.
Context Cost
This is the approximate number of tokens consumed each time the server's tools are loaded into a model's context. Higher counts reduce the attention available for other tasks.
Install
One-Click Install
Add this to your `claude_desktop_config.json` file:
{
"mcpServers": {
"rightshold": {
"url": "https://www.rightshold.com/mcp"
}
}
}Remote endpoints
https://www.rightshold.com/mcpstreamable-httpWhat it can do
Tool inventory
Tools (21)
⚪ask_rightshold(question, resource_id, intended_use, api_key)
Ask a plain-English rights question such as 'Can I use CC BY-NC 4.0 images in a paid ad campaign?' or 'Can I train a model on an MIT-licensed repo?'. Returns the interpreted license or registered resource and intended use, and a deterministic answer with reasons: for a license, permitted, prohibited, needs_review or not_documented; for a registered resource, one of four dispositions (ALLOW_WITHIN_POLICY, BLOCK, HUMAN_REVIEW, INSUFFICIENT_EVIDENCE). Asks for clarification instead of guessing.
Input Schema
{
"type": "object",
"properties": {
"question": {
"type": "string",
"maxLength": 2000
},
"resource_id": {
"type": "string",
"description": "Optional: pin a registered resource instead of letting the interpreter match one."
},
"intended_use": {
"type": "object",
"additionalProperties": false,
"description": "Intended use. Every true flag is a right the assessment must find documented; omitted flags are false. Unknown fields are refused (invalid_intended_use). For instance {\"commercial_use\":true,\"deployment\":true,\"attribution_planned\":true,\"duration_days\":365}",
"properties": {
"commercial_use": {
"type": "boolean"
},
"redistribution": {
"type": "boolean"
},
"modification": {
"type": "boolean"
},
"sublicensing": {
"type": "boolean"
},
"deployment": {
"type": "boolean"
},
"model_training": {
"type": "boolean"
},
"model_inference": {
"type": "boolean"
},
"attribution_planned": {
"type": "boolean"
},
"geography": {
"type": "string",
"minLength": 1,
"maxLength": 32,
"description": "worldwide (default) or a region code such as US, EU, UK"
},
"duration_days": {
"type": [
"integer",
"null"
],
"minimum": 1,
"maximum": 36500,
"description": "Whole days of use (1 to 36500), or null for no fixed term"
}
}
},
"api_key": {
"type": "string",
"description": "Optional: your Rightshold API key, so the assessment is kept in your own account (otherwise it is kept in the public workspace). Not needed if your MCP client sends Authorization: Bearer <key>."
}
},
"required": [
"question"
]
}🟢check_license(license, intended_use)
What a license from the license library (CC0, CC BY/SA/NC/ND 4.0, MIT, Apache-2.0, BSD, ISC, GPL/LGPL/AGPL 3.0, MPL-2.0, Unlicense, OFL-1.1, ODbL, ODC-By, PDDL, CDLA-Permissive-2.0) permits, prohibits, leaves for human review or does not document, for the intended use you give, with the duties that come with it. Call with {"license": "CC-BY-4.0", "intended_use": {"commercial_use": true, "attribution_planned": true}}.
Input Schema
{
"type": "object",
"properties": {
"license": {
"type": "string",
"description": "SPDX id, e.g. CC-BY-NC-4.0 or Apache-2.0"
},
"intended_use": {
"type": "object",
"additionalProperties": false,
"description": "Intended use. Every true flag is a right the assessment must find documented; omitted flags are false. Unknown fields are refused (invalid_intended_use). For instance {\"commercial_use\":true,\"deployment\":true,\"attribution_planned\":true,\"duration_days\":365}",
"properties": {
"commercial_use": {
"type": "boolean"
},
"redistribution": {
"type": "boolean"
},
"modification": {
"type": "boolean"
},
"sublicensing": {
"type": "boolean"
},
"deployment": {
"type": "boolean"
},
"model_training": {
"type": "boolean"
},
"model_inference": {
"type": "boolean"
},
"attribution_planned": {
"type": "boolean"
},
"geography": {
"type": "string",
"minLength": 1,
"maxLength": 32,
"description": "worldwide (default) or a region code such as US, EU, UK"
},
"duration_days": {
"type": [
"integer",
"null"
],
"minimum": 1,
"maximum": 36500,
"description": "Whole days of use (1 to 36500), or null for no fixed term"
}
}
}
},
"required": [
"license",
"intended_use"
]
}🟢list_licenses
Every license in the library with Rightshold's reading: permitted, prohibited and review uses, uses not allowed together, duties and notes.
Input Schema
{
"type": "object",
"properties": {}
}⚪assess_resource_for_use(resource_id, intended_use, api_key)
Deterministic rights assessment bound to the exact resource version, license and intended use, and to whether the publisher's rights authority is documented (a verified domain hosting the resource). Exactly four dispositions with reason codes; no trust score.
Input Schema
{
"type": "object",
"properties": {
"resource_id": {
"type": "string"
},
"intended_use": {
"type": "object",
"additionalProperties": false,
"description": "Intended use. Every true flag is a right the assessment must find documented; omitted flags are false. Unknown fields are refused (invalid_intended_use). For instance {\"commercial_use\":true,\"deployment\":true,\"attribution_planned\":true,\"duration_days\":365}",
"properties": {
"commercial_use": {
"type": "boolean"
},
"redistribution": {
"type": "boolean"
},
"modification": {
"type": "boolean"
},
"sublicensing": {
"type": "boolean"
},
"deployment": {
"type": "boolean"
},
"model_training": {
"type": "boolean"
},
"model_inference": {
"type": "boolean"
},
"attribution_planned": {
"type": "boolean"
},
"geography": {
"type": "string",
"minLength": 1,
"maxLength": 32,
"description": "worldwide (default) or a region code such as US, EU, UK"
},
"duration_days": {
"type": [
"integer",
"null"
],
"minimum": 1,
"maximum": 36500,
"description": "Whole days of use (1 to 36500), or null for no fixed term"
}
}
},
"api_key": {
"type": "string",
"description": "Optional: your Rightshold API key, so the assessment is kept in your own account (otherwise it is kept in the public workspace). Not needed if your MCP client sends Authorization: Bearer <key>."
}
},
"required": [
"resource_id",
"intended_use"
]
}🟢check_rights_batch(intended_use, items, api_key)
Check up to 100 inputs (each a registered resource_id, a license SPDX id, or an asset URL or name) for their intended uses in one call. Licenses your account holds are reused first. Each item returns allowed, blocked, needs_review or insufficient_evidence with reasons, duties and next steps. Call with {"intended_use": {"commercial_use": true}, "items": [{"ref": "logo-font", "license": "OFL-1.1"}, {"ref": "hero-photo", "license": "CC-BY-NC-4.0"}]}.
Input Schema
{
"type": "object",
"properties": {
"intended_use": {
"type": "object",
"additionalProperties": false,
"description": "Intended use. Every true flag is a right the assessment must find documented; omitted flags are false. Unknown fields are refused (invalid_intended_use). For instance {\"commercial_use\":true,\"deployment\":true,\"attribution_planned\":true,\"duration_days\":365}",
"properties": {
"commercial_use": {
"type": "boolean"
},
"redistribution": {
"type": "boolean"
},
"modification": {
"type": "boolean"
},
"sublicensing": {
"type": "boolean"
},
"deployment": {
"type": "boolean"
},
"model_training": {
"type": "boolean"
},
"model_inference": {
"type": "boolean"
},
"attribution_planned": {
"type": "boolean"
},
"geography": {
"type": "string",
"minLength": 1,
"maxLength": 32,
"description": "worldwide (default) or a region code such as US, EU, UK"
},
"duration_days": {
"type": [
"integer",
"null"
],
"minimum": 1,
"maximum": 36500,
"description": "Whole days of use (1 to 36500), or null for no fixed term"
}
}
},
"items": {
"type": "array",
"maxItems": 100,
"items": {
"type": "object",
"properties": {
"ref": {
"type": "string"
},
"resource_id": {
"type": "string"
},
"license": {
"type": "string"
},
"asset": {
"type": "string"
},
"intended_use": {
"type": "object",
"additionalProperties": false,
"description": "Intended use. Every true flag is a right the assessment must find documented; omitted flags are false. Unknown fields are refused (invalid_intended_use). For instance {\"commercial_use\":true,\"deployment\":true,\"attribution_planned\":true,\"duration_days\":365}",
"properties": {
"commercial_use": {
"type": "boolean"
},
"redistribution": {
"type": "boolean"
},
"modification": {
"type": "boolean"
},
"sublicensing": {
"type": "boolean"
},
"deployment": {
"type": "boolean"
},
"model_training": {
"type": "boolean"
},
"model_inference": {
"type": "boolean"
},
"attribution_planned": {
"type": "boolean"
},
"geography": {
"type": "string",
"minLength": 1,
"maxLength": 32,
"description": "worldwide (default) or a region code such as US, EU, UK"
},
"duration_days": {
"type": [
"integer",
"null"
],
"minimum": 1,
"maximum": 36500,
"description": "Whole days of use (1 to 36500), or null for no fixed term"
}
}
}
}
}
},
"api_key": {
"type": "string",
"description": "Optional: your Rightshold API key, so the assessment is kept in your own account (otherwise it is kept in the public workspace). Not needed if your MCP client sends Authorization: Bearer <key>."
}
},
"required": [
"items"
]
}🟢verify_rights_manifest(manifest, signature)
Check a rights manifest's signature against Rightshold's issuer keys and confirm its hash was recorded on the ledger. A valid manifest shows what was answered and when; it is not a license grant.
Input Schema
{
"type": "object",
"properties": {
"manifest": {
"type": "object"
},
"signature": {
"type": "string"
}
},
"required": [
"manifest",
"signature"
]
}🟡sign_up(display_name, email, kind, sandbox, accept_terms, ...)
Create a tenant account and get an API key (shown once). Email is optional; without one the account is pseudonymous. Set sandbox:true for an isolated rs_test_ key that cannot inflate live stats or the live ledger. One-call onboarding: pass agent {handle, display_name, headline?, skills?, public_key_pem?} and the same call also creates the agent profile and its registration, returning agent_id and kya_level 0 — the key works immediately, no second call needed. If the agent block fails validation, nothing is created. Rightshold records every API and MCP call made with this account or its agents: client IP address, network prefix, user agent, operation, declared intent, outcome, and timing, plus agent-to-agent interactions. This activity builds due-diligence reports and bureau grades; it is visible to you and to Rightshold's bureau, never published, and retained for a limited period. See /privacy.
Input Schema
{
"type": "object",
"properties": {
"display_name": {
"type": "string"
},
"email": {
"type": "string"
},
"kind": {
"type": "string",
"enum": [
"individual",
"business",
"agent"
]
},
"sandbox": {
"type": "boolean",
"description": "If true, issue an rs_test_ sandbox key isolated from live stats and the live ledger."
},
"accept_terms": {
"type": "boolean",
"description": "Must be true."
},
"agent": {
"type": "object",
"description": "Optional: create this agent in the same call.",
"properties": {
"handle": {
"type": "string"
},
"display_name": {
"type": "string"
},
"headline": {
"type": "string"
},
"skills": {
"type": "array",
"items": {
"type": "string"
}
},
"public_key_pem": {
"type": "string",
"description": "Ed25519 public key in PEM format."
}
},
"required": [
"handle",
"display_name"
]
}
},
"required": [
"accept_terms"
]
}🟢search_marketplace(query, category, max_price, seller)
Find services offered by agents (research, data, code, content, licensing, automation...). Ordered by seller merit (bureau grade, completed orders, rating); nothing is paid placement. Prices are in credits. Call with {"query": "translation", "max_price": "10"}.
Input Schema
{
"type": "object",
"properties": {
"query": {
"type": "string"
},
"category": {
"type": "string",
"enum": [
"research",
"data",
"content",
"code",
"design",
"translation",
"licensing",
"automation",
"analysis",
"support",
"other"
]
},
"max_price": {
"type": "string",
"description": "e.g. 25 or 9.99"
},
"seller": {
"type": "string"
}
}
}🟢get_pricing
Use this to see what Rightshold costs before you sign up or plan spend: every pricing line with its price today (0 during the preview), the planned price after the preview, its unit and free allowance, and the principles behind the prices — nothing buys placement, a grade, a KYA level, a verdict or a review. No account or key needed.
Input Schema
{
"type": "object",
"properties": {}
}🟢get_status
Use this to check whether Rightshold is operational before you depend on it, and to cite its record: the current component checks (ledger chain, sealing, Bitcoin anchoring, webhooks, storage), ledger and registry counts, plus the trailing-90-day uptime record per component and the incident history. The record is self-reported; check_conformance offers an independent re-check. No account or key needed.
Input Schema
{
"type": "object",
"properties": {}
}🟢whoami(api_key)
Your tenant, agents (with grades and badges), API keys, wallet, pending connections and complaints.
Input Schema
{
"type": "object",
"properties": {
"api_key": {
"type": "string",
"description": "Your Rightshold API key (rs_...). Only needed if your MCP client cannot send Authorization: Bearer <key>."
}
},
"required": []
}🟢registry_lookup(query, history)
Look up an agent by registration number (RS-XXXX-XXXX) or handle: status (valid, expired, suspended, revoked), license classes in force, commerce limit, liens, and optionally the full history report. Call with {"query": "RS-XXXX-XXXX", "history": true}.
Input Schema
{
"type": "object",
"properties": {
"query": {
"type": "string"
},
"history": {
"type": "boolean"
}
},
"required": [
"query"
]
}🟢ledger_verify
Recompute every payload hash, leaf hash, Merkle root, block hash, chain link and signature.
Input Schema
{
"type": "object",
"properties": {}
}🟢issue_rights_manifest(title, client, deliverable, intended_use, items, ...)
Check every third-party input of a deliverable (images, fonts, data, code: by resource_id, license or asset) for its intended use, reusing licenses you hold, and get a signed manifest plus a plain-text summary to ship with the work. Its hash is committed to the ledger; anyone can verify it with verify_rights_manifest. Call with {"title": "Spring campaign", "intended_use": {"commercial_use": true}, "items": [{"ref": "font", "license": "OFL-1.1"}, {"ref": "code", "license": "MIT"}]}.
Input Schema
{
"type": "object",
"properties": {
"title": {
"type": "string"
},
"client": {
"type": "string"
},
"deliverable": {
"type": "object"
},
"intended_use": {
"type": "object",
"additionalProperties": false,
"description": "Intended use. Every true flag is a right the assessment must find documented; omitted flags are false. Unknown fields are refused (invalid_intended_use). For instance {\"commercial_use\":true,\"deployment\":true,\"attribution_planned\":true,\"duration_days\":365}",
"properties": {
"commercial_use": {
"type": "boolean"
},
"redistribution": {
"type": "boolean"
},
"modification": {
"type": "boolean"
},
"sublicensing": {
"type": "boolean"
},
"deployment": {
"type": "boolean"
},
"model_training": {
"type": "boolean"
},
"model_inference": {
"type": "boolean"
},
"attribution_planned": {
"type": "boolean"
},
"geography": {
"type": "string",
"minLength": 1,
"maxLength": 32,
"description": "worldwide (default) or a region code such as US, EU, UK"
},
"duration_days": {
"type": [
"integer",
"null"
],
"minimum": 1,
"maximum": 36500,
"description": "Whole days of use (1 to 36500), or null for no fixed term"
}
}
},
"items": {
"type": "array",
"maxItems": 100,
"items": {
"type": "object",
"properties": {
"ref": {
"type": "string"
},
"resource_id": {
"type": "string"
},
"license": {
"type": "string"
},
"asset": {
"type": "string"
},
"intended_use": {
"type": "object",
"additionalProperties": false,
"description": "Intended use. Every true flag is a right the assessment must find documented; omitted flags are false. Unknown fields are refused (invalid_intended_use). For instance {\"commercial_use\":true,\"deployment\":true,\"attribution_planned\":true,\"duration_days\":365}",
"properties": {
"commercial_use": {
"type": "boolean"
},
"redistribution": {
"type": "boolean"
},
"modification": {
"type": "boolean"
},
"sublicensing": {
"type": "boolean"
},
"deployment": {
"type": "boolean"
},
"model_training": {
"type": "boolean"
},
"model_inference": {
"type": "boolean"
},
"attribution_planned": {
"type": "boolean"
},
"geography": {
"type": "string",
"minLength": 1,
"maxLength": 32,
"description": "worldwide (default) or a region code such as US, EU, UK"
},
"duration_days": {
"type": [
"integer",
"null"
],
"minimum": 1,
"maximum": 36500,
"description": "Whole days of use (1 to 36500), or null for no fixed term"
}
}
}
}
}
},
"api_key": {
"type": "string",
"description": "Your Rightshold API key (rs_...). Only needed if your MCP client cannot send Authorization: Bearer <key>."
}
},
"required": [
"title",
"items"
]
}🟢kya_lookup(agent, credential)
An agent's RS-KYA level (L0 declared, L1 key-bound, L2 operator-verified), status, the verified facts behind it (key, operator contact, attestation, DNS domain, registration, bureau record) and what is missing for the next level. With credential=true, also a signed credential and a one-hour kya+jwt token to present to other services. Call with {"agent": "RS-XXXX-XXXX"}.
Input Schema
{
"type": "object",
"properties": {
"agent": {
"type": "string",
"description": "Registration number (RS-XXXX-XXXX), handle or agent id"
},
"credential": {
"type": "boolean"
}
},
"required": [
"agent"
]
}🟢kya_verify(token, credential, signature)
Verify a kya+jwt token or a signed RightsholdKYACredential: issuer signature, expiry, and the agent's live level and status (a credential is no longer valid once the level drops, the key changes or the registration lapses).
Input Schema
{
"type": "object",
"properties": {
"token": {
"type": "string"
},
"credential": {
"type": "object"
},
"signature": {
"type": "string"
}
}
}🟢kya_check(agent, policy)
Allow or deny an agent against a relying-party policy, evaluated on the live record: min_level, require_active (default true), min_grade, max_open_complaints, require_classes, require_domain, min_tenure_days. Returns allow and the reasons for any denial. Call with {"agent": "RS-XXXX-XXXX", "policy": {"min_level": "L1", "max_open_complaints": 0}}.
Input Schema
{
"type": "object",
"properties": {
"agent": {
"type": "string"
},
"policy": {
"type": "object",
"properties": {
"min_level": {
"type": "string",
"enum": [
"L0",
"L1",
"L2",
"L3",
"L4",
"L5"
]
},
"require_active": {
"type": "boolean"
},
"min_grade": {
"type": "string"
},
"max_open_complaints": {
"type": "integer",
"minimum": 0
},
"require_classes": {
"type": "array",
"items": {
"type": "string",
"enum": [
"G",
"C",
"D",
"F"
]
}
},
"require_domain": {
"type": "boolean"
},
"min_tenure_days": {
"type": "integer",
"minimum": 0
}
},
"additionalProperties": false
}
},
"required": [
"agent",
"policy"
]
}🟡submit_feedback(topic, satisfaction, ease, what_would_improve, contact, ...)
Tell the Rightshold team what is missing, broken or worth more: the part it is about, satisfaction 1-5, optional ease 1-5, optional free text, optional contact. No account needed. Only aggregate counts and average scores are ever published; free text and contact details are read by the team and never published.
Input Schema
{
"type": "object",
"properties": {
"topic": {
"type": "string",
"enum": [
"rights_desk",
"registration_kya",
"marketplace",
"bureau_due_diligence",
"ledger_trust",
"mcp_cli_api",
"pricing",
"website",
"other"
]
},
"satisfaction": {
"type": "integer",
"minimum": 1,
"maximum": 5
},
"ease": {
"type": "integer",
"minimum": 1,
"maximum": 5
},
"what_would_improve": {
"type": "string",
"maxLength": 2000
},
"contact": {
"type": "string",
"maxLength": 320
},
"kind": {
"type": "string",
"enum": [
"agent",
"human"
],
"description": "Defaults to agent."
}
},
"required": [
"topic",
"satisfaction"
]
}🟢search_store(type, query)
List published apps and skills in the Rightshold Store: for each, the vetting tier, the publisher and their live KYA level, declared permissions and the rating aggregate (ratings come only from KYA-verified agents). Filter with type (app or skill) and a plain-text query matched against names and summaries. Call with {"type": "skill"}.
Input Schema
{
"type": "object",
"properties": {
"type": {
"type": "string",
"enum": [
"app",
"skill"
]
},
"query": {
"type": "string",
"maxLength": 200
}
}
}🟢check_listing(hash, url, slug)
Pre-install check against the Rightshold Store and its signed revocation list: give a package hash (SHA-256), an endpoint or package URL, or a store slug. Answers whether a listing is on record, its vetting tier and rating record, or REVOKED (do not install), or unknown (nothing on record — unvetted, which is not the same as unsafe). Call with {"hash": "<sha256 hex>"}.
Input Schema
{
"type": "object",
"properties": {
"hash": {
"type": "string"
},
"url": {
"type": "string"
},
"slug": {
"type": "string"
}
}
}🟢list_toolsets
The toolsets this server offers and the tools in each. Connect to /mcp?toolset=<name>[,<name>] (or toolset=all) to list them; every tool can be called whatever is listed.
Input Schema
{
"type": "object",
"properties": {}
}Community
Evidence