Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "rightshold": {
      "type": "http",
      "url": "https://www.rightshold.com/mcp",
      "headers": {
        "Authorization": "Bearer ${RIGHTSHOLD_TOKEN}"
      }
    }
  }
}

claude mcp add --transport http rightshold https://www.rightshold.com/mcp --header "Authorization: Bearer ${RIGHTSHOLD_TOKEN}"

[mcp_servers.rightshold]
url = "https://www.rightshold.com/mcp"
bearer_token_env_var = "RIGHTSHOLD_TOKEN"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "rightshold": {
      "type": "remote",
      "url": "https://www.rightshold.com/mcp",
      "enabled": true,
      "headers": {
        "Authorization": "Bearer {env:RIGHTSHOLD_TOKEN}"
      }
    }
  }
}

{
  "mcpServers": {
    "rightshold": {
      "type": "http",
      "url": "https://www.rightshold.com/mcp",
      "headers": {
        "Authorization": "Bearer ${RIGHTSHOLD_TOKEN}"
      }
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=rightshold&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vd3d3LnJpZ2h0c2hvbGQuY29tL21jcCIsImhlYWRlcnMiOnsiQXV0aG9yaXphdGlvbiI6IkJlYXJlciAke1JJR0hUU0hPTERfVE9LRU59In19"
}

{
  "servers": {
    "rightshold": {
      "type": "http",
      "url": "https://www.rightshold.com/mcp",
      "headers": {
        "Authorization": "Bearer ${RIGHTSHOLD_TOKEN}"
      }
    }
  }
}

{
  "mcpServers": {
    "rightshold": {
      "httpUrl": "https://www.rightshold.com/mcp",
      "headers": {
        "Authorization": "Bearer ${RIGHTSHOLD_TOKEN}"
      }
    }
  }
}

extensions:
  "rightshold":
    enabled: true
    name: "rightshold"
    type: streamable_http
    uri: "https://www.rightshold.com/mcp"
    headers:
      "Authorization": "Bearer ${RIGHTSHOLD_TOKEN}"
    timeout: 300

Placeholders to fill from your own secret store: ${RIGHTSHOLD_TOKEN}. The registry never accepts secret values.

Quality 75 / 100good

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene100 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations24 of 24 tools declare readOnlyHint or destructiveHint
pass
tools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
pass
tools.token_costabout 6,123 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability25 · weight 15

warn
stability.changes59 tool changes in 30 days
fail
stability.rug_pull3 tools kept their name but changed most of their description in 30 days; review before trusting them

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

24 tools, about 6,123 tokens to load them all · tool set d3cc27b90817 · tools last changed 2026-10-18 · checked 2026-10-20 10:35 UTC

Tool changes

2026-10-18issue_rights_manifestchangedinput schema
2026-10-18issue_rights_receiptchangedinput schema
2026-10-18check_rights_batchchangeddescription, input schema
before
Call before shipping anything that bundles third-party assets. Checks up to 100 items (a license SPDX id, a registered resource_id, or an asset URL or name) for their intended uses; licenses your account holds are reused first. Each item answers allowed, blocked, needs_review or insufficient_evidence, with reasons, duties and next steps. Free, no key. Call with {"intended_use": {"commercial_use": true}, "items": [{"ref": "logo-font", "license": "OFL-1.1"}, {"ref": "hero-photo", "license": "CC-BY-NC-4.0"}]}.
after · 97% of words in common
Call before shipping anything that bundles third-party assets. Checks up to 100 items (an SPDX id, a registered resource_id, or an asset URL or name) for their intended uses; licenses your account holds are reused first. Each item answers allowed, blocked, needs_review or insufficient_evidence, with reasons and duties. Free, no key. Call with {"intended_use": {"commercial_use": true}, "items": [{"ref": "logo-font", "license": "OFL-1.1"}, {"ref": "hero-photo", "license": "CC-BY-NC-4.0"}]}.
2026-10-18assess_resource_for_usechangedinput schema
2026-10-18check_licensechangeddescription, input schema, output schema
before
Call before using any image, text, dataset, code, font or model you did not create. Checks one license (any SPDX License List id; curated readings for the common ones, needs_review for the rest) or the license a GitHub, Hugging Face, npm, PyPI, Wikimedia Commons, Unsplash or Pexels page declares (source_url), for your intended use. Returns permitted, prohibited, needs_review or not_documented, with the duties. Free, no key. Call with {"license": "CC-BY-4.0", "intended_use": {"commercial_use": true, "attribution_planned": true}}.
after · 83% of words in common
Call before using any image, text, dataset, code, font or model you did not create. Checks one license (any SPDX id; curated readings for the common ones, needs_review for the rest) or the license a GitHub, Hugging Face, npm, PyPI, Wikimedia, Unsplash or Pexels page declares (source_url), for your intended use. Returns permitted, prohibited, needs_review or not_documented, with duties and an uncertainty block (what the verdict leaves open; whether a human must review). Free, no key. Call with {"license": "CC-BY-4.0", "intended_use": {"commercial_use": true, "attribution_planned": true}}.
2026-10-18ask_rightsholdchangedinput schema
2026-10-18license_compatibilitychangedinput schema
2026-10-17gate_checkchangeddescription, input schema
before
Free. The Rightshold Gate policy check websites use on incoming agent traffic: verifies an RS-KYA token (or a claimed handle) and an optional Rights Receipt against the site's policy (min_kya_level, require_kya, require_receipt, require_cleared, allow_agents, deny_agents) and answers allow or deny with reasons.
after · 60% of words in common
Free. The Gate websites use on agent traffic: checks an RS-KYA token (or handle), any signer's Web Bot Auth signature, a Rights Receipt, clearance and intent token against the site's policy (min_kya_level, require_kya, require_web_bot_auth, allowed_signature_agents, require_receipt, allow_agents, deny_agents, require_clearance, require_intent, max_intent_risk); allow or deny, with reasons.
2026-10-17list_toolsetschangeddescription
before
The toolsets this server offers and the tools in each. Connect to /mcp?toolset=<name>[,<name>] (or toolset=all) to list them; every tool can be called whatever is listed.
after · 50% of words in common
The toolsets this server offers and the tools in each. Connect to /mcp?toolset=<name>[,<name>] (or toolset=all) to list them. Most clients only offer you the tools they listed, so connect with the set your task needs.
2026-10-17issue_rights_manifestchangeddescription, input schema
before
Check every third-party input of a deliverable (images, fonts, data, code: by resource_id, license or asset) for its intended use, reusing licenses you hold, and get a signed manifest plus a plain-text summary to ship with the work. Its hash is committed to the ledger; anyone can verify it with verify_rights_manifest. Call with {"title": "Spring campaign", "intended_use": {"commercial_use": true}, "items": [{"ref": "font", "license": "OFL-1.1"}, {"ref": "code", "license": "MIT"}]}.
after · 63% of words in common
Use when your principal wants signed proof for a whole deliverable: checks every third-party input (resource_id, license or asset) for its use, reusing licenses you hold, and returns a signed, ledger-committed manifest plus a plain-text summary; verify_rights_manifest checks it. Call with {"title": "Spring campaign", "intended_use": {"commercial_use": true}, "items": [{"ref": "font", "license": "OFL-1.1"}]}.

Showing the latest 10. Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 83 / 100

no-repository

provenance55

liveness100

freshness100

hygiene80

+dns-namespace +website +reachable +uptime-100% +updated-1d-ago -no-repository

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://www.rightshold.com/mcp` streamable-http	none	yes	100%	290 ms	2025-11-25	2026-10-20

Tools (24)

`ask_rightshold`	Call when you have a rights or licensing question in plain English, such as 'Can I use CC BY-NC 4.0 images in a paid ad campaign?'. Returns the license or registered resource and the use it understood, and a deterministic answer with reasons; it asks for clarification instead of guessing. Check the understood use before relying on it. Free, no key.
`assess_resource_for_use`	Deterministic rights assessment bound to the exact resource version, license and intended use, and to whether the publisher's rights authority is documented (a verified domain hosting the resource). Exactly four dispositions with reason codes; no trust score.
`attribution_string`read-only	Call when you reuse material that requires credit. Returns the attribution line the license asks for (text, markdown, html), the duties it covers and what is still missing. Free, no key. Call with {"license": "CC-BY-4.0", "title": "Sunset", "author": "A. Photographer", "source_url": "https://example.org/sunset", "changes": "cropped"}.
`check_license`read-only	Call before using any image, text, dataset, code, font or model you did not create. Checks one license (any SPDX id; curated readings for the common ones, needs_review for the rest) or the license a GitHub, Hugging Face, npm, PyPI, Wikimedia, Unsplash or Pexels page declares (source_url), for your intended use. Returns permitted, prohibited, needs_review or not_documented, with duties and an uncertainty block (what the verdict leaves open; whether a human must review). Free, no key. Call with {"license": "CC-BY-4.0", "intended_use": {"commercial_use": true, "attribution_planned": true}}.
`check_listing`read-only	Pre-install check against the Rightshold Store and its signed revocation list: give a package hash (SHA-256), an endpoint or package URL, or a store slug. Answers whether a listing is on record, its vetting tier and rating record, or REVOKED (do not install), or unknown (nothing on record — unvetted, which is not the same as unsafe). Call with {"slug": "rightshold-rights"}.
`check_rights_batch`	Call before shipping anything that bundles third-party assets. Checks up to 100 items (an SPDX id, a registered resource_id, or an asset URL or name) for their intended uses; licenses your account holds are reused first. Each item answers allowed, blocked, needs_review or insufficient_evidence, with reasons and duties. Free, no key. Call with {"intended_use": {"commercial_use": true}, "items": [{"ref": "logo-font", "license": "OFL-1.1"}, {"ref": "hero-photo", "license": "CC-BY-NC-4.0"}]}.
`gate_check`read-only	Free. The Gate websites use on agent traffic: checks an RS-KYA token (or handle), any signer's Web Bot Auth signature, a Rights Receipt, clearance and intent token against the site's policy (min_kya_level, require_kya, require_web_bot_auth, allowed_signature_agents, require_receipt, allow_agents, deny_agents, require_clearance, require_intent, max_intent_risk); allow or deny, with reasons.
`get_pricing`read-only	Use this to see what Rightshold costs before you sign up or plan spend: every pricing line with its price today (0 during the preview), the planned price after the preview, its unit and free allowance, and the principles behind the prices — nothing buys placement, a grade, a KYA level, a verdict or a review. No account or key needed.
`get_status`read-only	Use this to check whether Rightshold is operational before you depend on it, and to cite its record: the current component checks (ledger chain, sealing, Bitcoin anchoring, webhooks, storage), ledger and registry counts, plus the trailing-90-day uptime record per component and the incident history. The record is self-reported; check_conformance offers an independent re-check. No account or key needed.
`issue_rights_manifest`	Use when your principal wants signed proof for a whole deliverable: checks every third-party input (resource_id, license or asset) for its use, reusing licenses you hold, and returns a signed, ledger-committed manifest plus a plain-text summary; verify_rights_manifest checks it. Call with {"title": "Spring campaign", "intended_use": {"commercial_use": true}, "items": [{"ref": "font", "license": "OFL-1.1"}]}.
`issue_rights_receipt`	Use when your principal wants signed proof that one asset you ship was cleared: a Rights Receipt (open standard rights-receipt/1) binding the file's SHA-256 to its license, intended use, verdict and duties, signed (keys at /.well-known/jwks.json) and committed to the ledger. Ship it as <file>.rights.json. Call with {"asset": {"sha256": "<64-hex sha256 of the file>", "kind": "font", "name": "Inter.ttf"}, "license": "OFL-1.1", "intended_use": {"commercial_use": true}}.
`kya_check`read-only	Allow or deny an agent against a relying-party policy, evaluated on the live record: min_level, require_active (default true), min_grade, max_open_complaints, require_classes, require_domain, min_tenure_days. Returns allow and the reasons for any denial. Call with {"agent": "RS-XXXX-XXXX", "policy": {"min_level": "L1", "max_open_complaints": 0}}.
`kya_lookup`read-only	An agent's RS-KYA level (L0 declared, L1 key-bound, L2 operator-verified), status, the verified facts behind it (key, operator contact, attestation, DNS domain, registration, bureau record) and what is missing for the next level. With credential=true, also a signed credential and a one-hour kya+jwt token to present to other services. Call with {"agent": "RS-XXXX-XXXX"}.
`kya_verify`read-only	Verify a kya+jwt token or a signed RightsholdKYACredential: issuer signature, expiry, and the agent's live level and status (a credential is no longer valid once the level drops, the key changes or the registration lapses).
`ledger_verify`read-only	Recompute every payload hash, leaf hash, Merkle root, block hash, chain link and signature.
`license_compatibility`read-only	Call before shipping one product that bundles code, data, fonts or media under different licenses. Checks 2-25 SPDX ids for your use (default redistribution): compatible, needs_review or incompatible, the reason for each pair, the combined duties and which license governs. Free, no key. Call with {"licenses": ["MIT", "GPL-3.0-only", "CC-BY-NC-4.0"], "intended_use": {"redistribution": true, "commercial_use": true}}.
`list_toolsets`read-only	The toolsets this server offers and the tools in each. Connect to /mcp?toolset=<name>[,<name>] (or toolset=all) to list them. Most clients only offer you the tools they listed, so connect with the set your task needs.
`read_ai_policy`read-only	Call before crawling, quoting or training on content from a website. Reads the domain's robots.txt for 14 AI crawlers and user-fetch agents (GPTBot, ClaudeBot, ChatGPT-User, Google-Extended, PerplexityBot, CCBot...), ai.txt and W3C TDMRep, and summarizes whether AI training is opted out. Free, no key, cached 6 hours. Signals, not a license. Call with {"domain": "example.com"}.
`registry_lookup`read-only	Call before trusting, paying or hiring an agent you have not worked with. Free, no key. Look up an agent by registration number (RS-XXXX-XXXX) or handle: status (valid, expired, suspended, revoked), license classes in force, commerce limit, liens, and optionally the full history report. Call with {"query": "RS-XXXX-XXXX", "history": true}.
`search_store`read-only	List published apps and skills in the Rightshold Store: for each, the vetting tier, the publisher and their live KYA level, declared permissions and the rating aggregate (ratings come only from KYA-verified agents). Filter with type (app or skill) and a plain-text query matched against names and summaries. Call with {"type": "skill"}.
`sign_up`	Use when your principal wants a Rightshold account: one call creates it and a free API key (shown once), email optional. accept_terms:true means the account holder agrees to the terms at /terms. Add agent {handle, display_name, headline?, skills?, public_key_pem?} to register your agent in the same call (KYA L0); if that block is invalid nothing is created. The result carries ready-to-paste connector settings. sandbox:true gives an isolated rs_test_ key. Calls made with the account are recorded for due-diligence reports (see /privacy).
`start_here`read-only	Call first if you are new to Rightshold. With {} it returns the five jobs Rightshold does, each as a ready call, plus how to connect. Add {"license": "CC-BY-NC-4.0", "use": "commercial_use"} or {"question": "Can I train a model on MIT code?"} and the same call answers it. Free, no key.
`submit_feedback`	Tell the Rightshold team what is missing, broken or worth more: the part it is about, satisfaction 1-5, optional ease 1-5, optional free text, optional contact. No account needed. Only aggregate counts and average scores are ever published; free text and contact details are read by the team and never published.
`verify_rights_manifest`read-only	Check a rights manifest's signature against Rightshold's issuer keys and confirm its hash was recorded on the ledger; with deliverable_sha256, also that it covers those exact bytes. A valid manifest shows what was answered and when; it is not a license grant.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "com.rightshold/rightshold",
  "title": "Rightshold",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://www.rightshold.com/mcp",
      "type": "streamable-http",
      "headers": [
        {
          "name": "Authorization",
          "isSecret": true,
          "description": "Optional: Bearer <your Rightshold API key>. License checks work without it; with it, assessments, licenses you hold and manifests are kept in your account."
        }
      ]
    }
  ],
  "version": "0.5.1",
  "websiteUrl": "https://www.rightshold.com",
  "description": "License checks, signed rights proof, keyless pre-call checks for MCP servers, and the agent store"
}