com.rightshold/rightshold

Est-ce que com.rightshold/rightshold est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.rightshold/rightshold » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 24 outils

• ask_rightshold≈ 434 tokens

  Call when you have a rights or licensing question in plain English, such as 'Can I use CC BY-NC 4.0 images in a paid ad campaign?'. Returns the license or registered resource and the use it understood, and a deterministic answer with reasons; it asks for clarification instead of guessing. Check the understood use before relying on it. Free, no key.

  Paramètres, retour & exemple (3)

  Paramètres

  • question · string · requis
    Plain-language rights question
  • resource_id · string · optionnel
    Optional: pin a registered resource instead of letting the interpreter match one.
  • intended_use · object · optionnel
    Uses to check: each true flag must be documented; omitted = false; unknown fields refused. For instance {"commercial_use":true}

  Exemple d'appel

  {"name": "ask_rightshold", "arguments": {"question": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• assess_resource_for_use≈ 381 tokens

  Deterministic rights assessment bound to the exact resource version, license and intended use, and to whether the publisher's rights authority is documented (a verified domain hosting the resource). Exactly four dispositions with reason codes; no trust score.

  Paramètres, retour & exemple (2)

  Paramètres

  • resource_id · string · requis
    Registered resource id
  • intended_use · object · requis
    Uses to check: each true flag must be documented; omitted = false; unknown fields refused. For instance {"commercial_use":true}

  Exemple d'appel

  {"name": "assess_resource_for_use", "arguments": {"resource_id": "texte", "intended_use": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• attribution_string≈ 296 tokens

  Call when you reuse material that requires credit. Returns the attribution line the license asks for (text, markdown, html), the duties it covers and what is still missing. Free, no key. Call with {"license": "CC-BY-4.0", "title": "Sunset", "author": "A. Photographer", "source_url": "https://example.org/sunset", "changes": "cropped"}.

  Paramètres, retour & exemple (5)

  Paramètres

  • title · string · optionnel
    Work title
  • author · string · optionnel
    Creator
  • changes · string|boolean · optionnel
    What you changed
  • license · string · requis
    SPDX id
  • source_url · string · optionnel
    Where it came from

  Exemple d'appel

  {"name": "attribution_string", "arguments": {"license": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"text": "texte", "missing": [], "required": true}}

• check_license≈ 626 tokens

  Call before using any image, text, dataset, code, font or model you did not create. Checks one license (any SPDX id; curated readings for the common ones, needs_review for the rest) or the license a GitHub, Hugging Face, npm, PyPI, Wikimedia, Unsplash or Pexels page declares (source_url), for your intended use. Returns permitted, prohibited, needs_review or not_documented, with duties and an uncertainty block (what the verdict leaves open; whether a human must review). Free, no key. Call with {"license": "CC-BY-4.0", "intended_use": {"commercial_use": true, "attribution_planned": true}}.

  Paramètres, retour & exemple (3)

  Paramètres

  • license · string · optionnel
    SPDX id, e.g. CC-BY-NC-4.0 (uncurated ids answer needs_review)
  • source_url · string · optionnel
    Instead of license: a page on GitHub, Hugging Face, npm, PyPI, Wikimedia Commons, Unsplash or Pexels; the license it declares is checked
  • intended_use · object · requis
    Uses to check: each true flag must be documented; omitted = false; unknown fields refused. For instance {"commercial_use":true}

  Exemple d'appel

  {"name": "check_license", "arguments": {"intended_use": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"duties": [], "license": {}, "verdict": "permitted", "findings": [], "uncertainty": {}, "uses_evaluated": []}}

• check_listing≈ 218 tokens

  Pre-install check against the Rightshold Store and its signed revocation list: give a package hash (SHA-256), an endpoint or package URL, or a store slug. Answers whether a listing is on record, its vetting tier and rating record, or REVOKED (do not install), or unknown (nothing on record — unvetted, which is not the same as unsafe). Call with {"slug": "rightshold-rights"}.

  Paramètres, retour & exemple (3)

  Paramètres

  • url · string · optionnel
    Listing or repo URL
  • hash · string · optionnel
    SHA-256 of the package
  • slug · string · optionnel
    Store slug

  Exemple d'appel

  {"name": "check_listing", "arguments": {"url": "texte", "hash": "texte", "slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check_rights_batch≈ 803 tokens

  Call before shipping anything that bundles third-party assets. Checks up to 100 items (an SPDX id, a registered resource_id, or an asset URL or name) for their intended uses; licenses your account holds are reused first. Each item answers allowed, blocked, needs_review or insufficient_evidence, with reasons and duties. Free, no key. Call with {"intended_use": {"commercial_use": true}, "items": [{"ref": "logo-font", "license": "OFL-1.1"}, {"ref": "hero-photo", "license": "CC-BY-NC-4.0"}]}.

  Paramètres, retour & exemple (2)

  Paramètres

  • items · array · requis
  • intended_use · object · optionnel
    Uses to check: each true flag must be documented; omitted = false; unknown fields refused. For instance {"commercial_use":true}

  Exemple d'appel

  {"name": "check_rights_batch", "arguments": {"items": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"items": [], "summary": {}}}

• gate_check≈ 324 tokens

  Free. The Gate websites use on agent traffic: checks an RS-KYA token (or handle), a Web Bot Auth signature from any signer whose Signature-Agent resolves, a Rights Receipt, clearance and intent token against the site's policy (min_kya_level, require_kya, require_web_bot_auth, allowed_signature_agents, require_receipt, allow_agents, deny_agents, require_clearance, require_intent, max_intent_risk); allow or deny, with reasons.

  Paramètres, retour & exemple (8)

  Paramètres

  • agent · string · optionnel
    Or RS number/handle
  • policy · object · optionnel
    Gate policy
  • receipt · object · optionnel
    Rights Receipt
  • request · object · optionnel
    The signed request {method, url, headers} as received: its Web Bot Auth signature, and the intent token's key binding.
  • clearance · string · optionnel
  • kya_token · string · optionnel
    Agent RS-KYA token
  • asset_sha256 · string · optionnel
    Uploaded file hash
  • intent_token · string · optionnel

  Exemple d'appel

  {"name": "gate_check", "arguments": {"agent": "texte", "policy": {}, "receipt": {}, "request": {}, "clearance": "texte", "kya_token": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_pricing≈ 156 tokens

  Use this to see what Rightshold costs before you sign up or plan spend: every pricing line with its price today (0 during the preview), the planned price after the preview, its unit and free allowance, and the principles behind the prices — nothing buys placement, a grade, a KYA level, a verdict or a review. No account or key needed.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_pricing", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_status≈ 173 tokens

  Use this to check whether Rightshold is operational before you depend on it, and to cite its record: the current component checks (ledger chain, sealing, Bitcoin anchoring, webhooks, storage), ledger and registry counts, plus the trailing-90-day uptime record per component and the incident history. The record is self-reported; check_conformance offers an independent re-check. No account or key needed.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_status", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• issue_rights_manifest≈ 598 tokens

  Use when your principal wants signed proof for a whole deliverable: checks every third-party input (resource_id, license or asset) for its use, reusing licenses you hold, and returns a signed, ledger-committed manifest plus a plain-text summary; verify_rights_manifest checks it. Call with {"title": "Spring campaign", "intended_use": {"commercial_use": true}, "items": [{"ref": "font", "license": "OFL-1.1"}]}.

  Paramètres, retour & exemple (7)

  Paramètres

  • items · array · requis
  • title · string · requis
  • client · string · optionnel
  • api_key · string · optionnel
    Deprecated: use Authorization: Bearer <key> (arguments can reach transcripts).
  • deliverable · object · optionnel
  • intended_use · object · optionnel
    Uses to check: each true flag must be documented; omitted = false; unknown fields refused. For instance {"commercial_use":true}
  • idempotency_key · string · optionnel
    Optional: a retry with the same key returns the first proof.

  Exemple d'appel

  {"name": "issue_rights_manifest", "arguments": {"items": [], "title": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• issue_rights_receipt≈ 451 tokens

  Use when your principal wants signed proof that one asset you ship was cleared: a Rights Receipt (open standard rights-receipt/1) binding the file's SHA-256 to its license, intended use, verdict and duties, signed (keys at /.well-known/jwks.json) and committed to the ledger. Ship it as <file>.rights.json. Call with {"asset": {"sha256": "<64-hex sha256 of the file>", "kind": "font", "name": "Inter.ttf"}, "license": "OFL-1.1", "intended_use": {"commercial_use": true}}.

  Paramètres, retour & exemple (9)

  Paramètres

  • agent · string · optionnel
  • asset · object · requis
    The file
  • api_key · string · optionnel
    Deprecated: use Authorization: Bearer <key> (arguments can reach transcripts).
  • license · string · optionnel
    SPDX id
  • ttl_days · integer · optionnel
  • attribution · object · optionnel
  • resource_id · string · optionnel
  • intended_use · object · optionnel
    Same shape as check_license
  • idempotency_key · string · optionnel
    Optional: a retry with the same key returns the first proof.

  Exemple d'appel

  {"name": "issue_rights_receipt", "arguments": {"asset": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• kya_check≈ 297 tokens

  Allow or deny an agent against a relying-party policy, evaluated on the live record: min_level, require_active (default true), min_grade, max_open_complaints, require_classes, require_domain, min_tenure_days. Returns allow and the reasons for any denial. Call with {"agent": "RS-XXXX-XXXX", "policy": {"min_level": "L1", "max_open_complaints": 0}}.

  Paramètres, retour & exemple (2)

  Paramètres

  • agent · string · requis
  • policy · object · requis

  Exemple d'appel

  {"name": "kya_check", "arguments": {"agent": "texte", "policy": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• kya_lookup≈ 221 tokens

  An agent's RS-KYA level (L0 declared, L1 key-bound, L2 operator-verified), status, the verified facts behind it (key, operator contact, attestation, DNS domain, registration, bureau record) and what is missing for the next level. With credential=true, also a signed credential and a one-hour kya+jwt token to present to other services. Call with {"agent": "RS-XXXX-XXXX"}.

  Paramètres, retour & exemple (2)

  Paramètres

  • agent · string · requis
    Registration number (RS-XXXX-XXXX), handle or agent id
  • credential · boolean · optionnel
    Return the signed credential

  Exemple d'appel

  {"name": "kya_lookup", "arguments": {"agent": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• kya_verify≈ 178 tokens

  Verify a kya+jwt token or a signed RightsholdKYACredential: issuer signature, expiry, and the agent's live level and status (a credential is no longer valid once the level drops, the key changes or the registration lapses).

  Paramètres, retour & exemple (3)

  Paramètres

  • token · string · optionnel
    RS-KYA token
  • signature · string · optionnel
    Credential signature
  • credential · object · optionnel
    Or a credential

  Exemple d'appel

  {"name": "kya_verify", "arguments": {"token": "texte", "signature": "texte", "credential": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• ledger_verify≈ 93 tokens

  Recompute every payload hash, leaf hash, Merkle root, block hash, chain link and signature.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "ledger_verify", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• license_compatibility≈ 508 tokens

  Call before shipping one product that bundles code, data, fonts or media under different licenses. Checks 2-25 SPDX ids for your use (default redistribution): compatible, needs_review or incompatible, the reason for each pair, the combined duties and which license governs. Free, no key. Call with {"licenses": ["MIT", "GPL-3.0-only", "CC-BY-NC-4.0"], "intended_use": {"redistribution": true, "commercial_use": true}}.

  Paramètres, retour & exemple (2)

  Paramètres

  • licenses · array · requis
    SPDX ids
  • intended_use · object · optionnel
    Uses to check: each true flag must be documented; omitted = false; unknown fields refused. For instance {"commercial_use":true}

  Exemple d'appel

  {"name": "license_compatibility", "arguments": {"licenses": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"pairs": [], "verdict": "compatible", "combined_duties": []}}

• list_toolsets≈ 122 tokens

  The toolsets this server offers and the tools in each. Connect to /mcp?toolset=<name>[,<name>] (or toolset=all) to list them. Most clients only offer you the tools they listed, so connect with the set your task needs.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_toolsets", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• read_ai_policy≈ 218 tokens

  Call before crawling, quoting or training on content from a website. Reads the domain's robots.txt for 14 AI crawlers and user-fetch agents (GPTBot, ClaudeBot, ChatGPT-User, Google-Extended, PerplexityBot, CCBot...), ai.txt and W3C TDMRep, and summarizes whether AI training is opted out. Free, no key, cached 6 hours. Signals, not a license. Call with {"domain": "example.com"}.

  Paramètres, retour & exemple (2)

  Paramètres

  • path · string · optionnel
    Optional path to check, default /
  • domain · string · requis
    Host name such as example.com (a URL is accepted)

  Exemple d'appel

  {"name": "read_ai_policy", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• registry_lookup≈ 201 tokens

  Call before trusting, paying or hiring an agent you have not worked with. Free, no key. Look up an agent by registration number (RS-XXXX-XXXX) or handle: status (valid, expired, suspended, revoked), license classes in force, commerce limit, liens, and optionally the full history report. Call with {"query": "RS-XXXX-XXXX", "history": true}.

  Paramètres, retour & exemple (2)

  Paramètres

  • query · string · requis
    RS number, handle or name
  • history · boolean · optionnel
    Include ledger history

  Exemple d'appel

  {"name": "registry_lookup", "arguments": {"query": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_store≈ 194 tokens

  List published apps and skills in the Rightshold Store: for each, the vetting tier, the publisher and their live KYA level, declared permissions and the rating aggregate (ratings come only from KYA-verified agents). Filter with type (app or skill) and a plain-text query matched against names and summaries. Call with {"type": "skill"}.

  Paramètres, retour & exemple (2)

  Paramètres

  • type · string · optionnel · app | skill
  • query · string · optionnel
    Search text

  Exemple d'appel

  {"name": "search_store", "arguments": {"type": "app", "query": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• sign_up≈ 416 tokens

  Use when your principal wants a Rightshold account: one call creates it and a free API key (shown once), email optional. accept_terms:true means the account holder agrees to the terms at /terms. Add agent {handle, display_name, headline?, skills?, public_key_pem?} to register your agent in the same call (KYA L0); if that block is invalid nothing is created. The result carries ready-to-paste connector settings. sandbox:true gives an isolated rs_test_ key. Calls made with the account are recorded for due-diligence reports (see /privacy).

  Paramètres, retour & exemple (6)

  Paramètres

  • kind · string · optionnel · individual | business | agent
  • agent · object · optionnel
    Optional: create this agent in the same call.
  • email · string · optionnel
    Optional
  • sandbox · boolean · optionnel
    If true, issue an rs_test_ sandbox key isolated from live stats and the live ledger.
  • accept_terms · boolean · requis
    Must be true.
  • display_name · string · optionnel
    Account name

  Exemple d'appel

  {"name": "sign_up", "arguments": {"accept_terms": true}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• start_here≈ 272 tokens

  Call first if you are new to Rightshold. With {} it returns the five jobs Rightshold does, each as a ready call, plus how to connect. Add {"license": "CC-BY-NC-4.0", "use": "commercial_use"} or {"question": "Can I train a model on MIT code?"} and the same call answers it. Free, no key.

  Paramètres, retour & exemple (3)

  Paramètres

  • use · string · optionnel · commercial_use | redistribution | modification | sublicensing | deployment | model_training | model_inference
    Optional: the use to check the license for (default commercial_use)
  • license · string · optionnel
    Optional: an SPDX id to check right away, e.g. CC-BY-NC-4.0
  • question · string · optionnel
    Optional: a rights question in plain English, answered in the same call

  Exemple d'appel

  {"name": "start_here", "arguments": {"use": "commercial_use", "license": "texte", "question": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• submit_feedback≈ 308 tokens

  Tell the Rightshold team what is missing, broken or worth more: the part it is about, satisfaction 1-5, optional ease 1-5, optional free text, optional contact. No account needed. Only aggregate counts and average scores are ever published; free text and contact details are read by the team and never published.

  Paramètres, retour & exemple (6)

  Paramètres

  • ease · integer · optionnel
  • kind · string · optionnel · agent | human
    Defaults to agent.
  • topic · string · requis · rights_desk | registration_kya | marketplace | bureau_due_diligence | ledger_trust | mcp_cli_api | pricing | website
  • contact · string · optionnel
    Optional reply address
  • satisfaction · integer · requis
    1-5
  • what_would_improve · string · optionnel
    Free text

  Exemple d'appel

  {"name": "submit_feedback", "arguments": {"topic": "rights_desk", "satisfaction": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• verify_rights_manifest≈ 270 tokens

  Check a rights manifest's signature against Rightshold's issuer keys and confirm its hash was recorded on the ledger; with deliverable_sha256, also that it covers those exact bytes. A valid manifest shows what was answered and when; it is not a license grant.

  Paramètres, retour & exemple (3)

  Paramètres

  • manifest · object · requis
    Manifest as issued
  • signature · string · requis
    Its signature
  • deliverable_sha256 · string · optionnel
    Optional: the SHA-256 of the deliverable you received

  Exemple d'appel

  {"name": "verify_rights_manifest", "arguments": {"manifest": {}, "signature": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"valid": true, "cleared": true, "reasons": [], "environment": "live"}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://www.rightshold.com/mcp