Skip to content

Rightshold

by rightshold.com · remote · no sign-in to list tools · v0.5.1 · published by com.rightshold

License checks, signed rights proof, keyless pre-call checks for MCP servers, and the agent store

Changes · 19
CompareRegistry entry

24 tools: 19 change things and 5 only read.

Scanned Oct 21, 2026

11 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http rightshold https://www.rightshold.com/mcp

Findings

Matches of fixed checks, with the text they matched.

5 warn6 info
  • Warnread_ai_policy

    The server marks "read_ai_policy" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "read_ai_policy" says "read": a word for reading.

    What this check looks for
  • Warnlicense_compatibility

    The server marks "license_compatibility" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "call": a word for a change.

    What this check looks for
  • Warnattribution_string

    The server marks "attribution_string" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "call": a word for a change.

    What this check looks for
  • Warncheck_license

    The server marks "check_license" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "call": a word for a change.

    What this check looks for
  • Warnregistry_lookup

    The server marks "registry_lookup" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "registry_lookup" says "lookup": a word for reading.

    What this check looks for
  • Infokya_lookup

    The description mentions "credential".

    Matched text

    description: "...hat is missing for the next level. With credential=true, also a signed credential and a on..."

    What this check looks for
Show 5 more findings

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

24 tools

Changes things 19Claude Code: ask
  • ask_rightsholdCall when you have a rights or licensing question in plain English, such as 'Can I use CC BY-NC 4.0 images in a paid ad campaign?'.No findings

    Why it is in this group

    • The description's first verb is "call": a word for a change.
    Description, as the server wrote it
    Call when you have a rights or licensing question in plain English, such as 'Can I use CC BY-NC 4.0 images in a paid ad campaign?'. Returns the license or registered resource and the use it understood, and a deterministic answer with reasons; it asks for clarification instead of guessing. Check the understood use before relying on it. Free, no key.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • assess_resource_for_useDeterministic rights assessment bound to the exact resource version, license and intended use, and to whether the publisher's rights authority is documented (a verified domain host…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Deterministic rights assessment bound to the exact resource version, license and intended use, and to whether the publisher's rights authority is documented (a verified domain hosting the resource). Exactly four dispositions with reason codes; no trust score.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • attribution_stringCall when you reuse material that requires credit.1 finding

    Why it is in this group

    • The description's first verb is "call": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "attribution_string" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "call": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Call when you reuse material that requires credit. Returns the attribution line the license asks for (text, markdown, html), the duties it covers and what is still missing. Free, no key. Call with {"license": "CC-BY-4.0", "title": "Sunset", "author": "A. Photographer", "source_url": "https://example.org/sunset", "changes": "cropped"}.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • check_licenseCall before using any image, text, dataset, code, font or model you did not create.Reads text others write1 finding

    Why it is in this group

    • The description's first verb is "call": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "check_license" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "call": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Call before using any image, text, dataset, code, font or model you did not create. Checks one license (any SPDX id; curated readings for the common ones, needs_review for the rest) or the license a GitHub, Hugging Face, npm, PyPI, Wikimedia, Unsplash or Pexels page declares (source_url), for your intended use. Returns permitted, prohibited, needs_review or not_documented, with duties and an uncertainty block (what the verdict leaves open; whether a human must review). Free, no key. Call with {"license": "CC-BY-4.0", "intended_use": {"commercial_use": true, "attribution_planned": true}}.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • check_listingPre-install check against the Rightshold Store and its signed revocation list: give a package hash (SHA-256), an endpoint or package URL, or a store slug.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Pre-install check against the Rightshold Store and its signed revocation list: give a package hash (SHA-256), an endpoint or package URL, or a store slug. Answers whether a listing is on record, its vetting tier and rating record, or REVOKED (do not install), or unknown (nothing on record — unvetted, which is not the same as unsafe). Call with {"slug": "rightshold-rights"}.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • check_rights_batchCall before shipping anything that bundles third-party assets.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "call": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Call before shipping anything that bundles third-party assets. Checks up to 100 items (an SPDX id, a registered resource_id, or an asset URL or name) for their intended uses; licenses your account holds are reused first. Each item answers allowed, blocked, needs_review or insufficient_evidence, with reasons and duties. Free, no key. Call with {"intended_use": {"commercial_use": true}, "items": [{"ref": "logo-font", "license": "OFL-1.1"}, {"ref": "hero-photo", "license": "CC-BY-NC-4.0"}]}.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • gate_checkFree.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Free. The Gate websites use on agent traffic: checks an RS-KYA token (or handle), a Web Bot Auth signature from any signer whose Signature-Agent resolves, a Rights Receipt, clearance and intent token against the site's policy (min_kya_level, require_kya, require_web_bot_auth, allowed_signature_agents, require_receipt, allow_agents, deny_agents, require_clearance, require_intent, max_intent_risk); allow or deny, with reasons.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • issue_rights_manifestUse when your principal wants signed proof for a whole deliverable: checks every third-party input (resource_id, license or asset) for its use, reusing licenses you hold, and retur…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Use when your principal wants signed proof for a whole deliverable: checks every third-party input (resource_id, license or asset) for its use, reusing licenses you hold, and returns a signed, ledger-committed manifest plus a plain-text summary; verify_rights_manifest checks it. Call with {"title": "Spring campaign", "intended_use": {"commercial_use": true}, "items": [{"ref": "font", "license": "OFL-1.1"}]}.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • issue_rights_receiptUse when your principal wants signed proof that one asset you ship was cleared: a Rights Receipt (open standard rights-receipt/1) binding the file's SHA-256 to its license, intende…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Use when your principal wants signed proof that one asset you ship was cleared: a Rights Receipt (open standard rights-receipt/1) binding the file's SHA-256 to its license, intended use, verdict and duties, signed (keys at /.well-known/jwks.json) and committed to the ledger. Ship it as <file>.rights.json. Call with {"asset": {"sha256": "<64-hex sha256 of the file>", "kind": "font", "name": "Inter.ttf"}, "license": "OFL-1.1", "intended_use": {"commercial_use": true}}.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • kya_checkAllow or deny an agent against a relying-party policy, evaluated on the live record: min_level, require_active (default true), min_grade, max_open_complaints, require_classes, requ…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Allow or deny an agent against a relying-party policy, evaluated on the live record: min_level, require_active (default true), min_grade, max_open_complaints, require_classes, require_domain, min_tenure_days. Returns allow and the reasons for any denial. Call with {"agent": "RS-XXXX-XXXX", "policy": {"min_level": "L1", "max_open_complaints": 0}}.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • kya_verifyVerify a kya+jwt token or a signed RightsholdKYACredential: issuer signature, expiry, and the agent's live level and status (a credential is no longer valid once the level drops, t…4 findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Info

      The title mentions "credential".

      Matched text

      title: "Verify an RS-KYA credential or token"

      What this check looks for
    • Info

      The description mentions "credential".

      Matched text

      description: "...nd the agent's live level and status (a credential is no longer valid once the level drops..."

      What this check looks for
    • Info

      The input schema at properties.credential.description mentions "credential".

      Matched text

      inputSchema.properties.credential.description: "Or a credential"

      What this check looks for
    • Info

      The input schema at properties.signature.description mentions "Credential".

      Matched text

      inputSchema.properties.signature.description: "Credential signature"

      What this check looks for
    Description, as the server wrote it
    Verify a kya+jwt token or a signed RightsholdKYACredential: issuer signature, expiry, and the agent's live level and status (a credential is no longer valid once the level drops, the key changes or the registration lapses).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • ledger_verifyRecompute every payload hash, leaf hash, Merkle root, block hash, chain link and signature.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Recompute every payload hash, leaf hash, Merkle root, block hash, chain link and signature.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • license_compatibilityCall before shipping one product that bundles code, data, fonts or media under different licenses.1 finding

    Why it is in this group

    • The description's first verb is "call": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "license_compatibility" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "call": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Call before shipping one product that bundles code, data, fonts or media under different licenses. Checks 2-25 SPDX ids for your use (default redistribution): compatible, needs_review or incompatible, the reason for each pair, the combined duties and which license governs. Free, no key. Call with {"licenses": ["MIT", "GPL-3.0-only", "CC-BY-NC-4.0"], "intended_use": {"redistribution": true, "commercial_use": true}}.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • read_ai_policyCall before crawling, quoting or training on content from a website.Reads text others write1 finding

    Why it is in this group

    • The name "read_ai_policy" says "read": a word for reading.
    • The description's first verb is "call": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "call" and "website": it reads web pages, which anyone can write.

    Findings

    • Warn

      The server marks "read_ai_policy" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "read_ai_policy" says "read": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Call before crawling, quoting or training on content from a website. Reads the domain's robots.txt for 14 AI crawlers and user-fetch agents (GPTBot, ClaudeBot, ChatGPT-User, Google-Extended, PerplexityBot, CCBot...), ai.txt and W3C TDMRep, and summarizes whether AI training is opted out. Free, no key, cached 6 hours. Signals, not a license. Call with {"domain": "example.com"}.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • registry_lookupCall before trusting, paying or hiring an agent you have not worked with.1 finding

    Why it is in this group

    • The name "registry_lookup" says "lookup": a word for reading.
    • The description's first verb is "call": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "registry_lookup" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "registry_lookup" says "lookup": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Call before trusting, paying or hiring an agent you have not worked with. Free, no key. Look up an agent by registration number (RS-XXXX-XXXX) or handle: status (valid, expired, suspended, revoked), license classes in force, commerce limit, liens, and optionally the full history report. Call with {"query": "RS-XXXX-XXXX", "history": true}.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • sign_upUse when your principal wants a Rightshold account: one call creates it and a free API key (shown once), email optional.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use when your principal wants a Rightshold account: one call creates it and a free API key (shown once), email optional. accept_terms:true means the account holder agrees to the terms at /terms. Add agent {handle, display_name, headline?, skills?, public_key_pem?} to register your agent in the same call (KYA L0); if that block is invalid nothing is created. The result carries ready-to-paste connector settings. sandbox:true gives an isolated rs_test_ key. Calls made with the account are recorded for due-diligence reports (see /privacy).

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • start_hereCall first if you are new to Rightshold.No findings

    Why it is in this group

    • The name "start_here" says "start": a word for a change.
    Description, as the server wrote it
    Call first if you are new to Rightshold. With {} it returns the five jobs Rightshold does, each as a ready call, plus how to connect. Add {"license": "CC-BY-NC-4.0", "use": "commercial_use"} or {"question": "Can I train a model on MIT code?"} and the same call answers it. Free, no key.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • submit_feedbackTell the Rightshold team what is missing, broken or worth more: the part it is about, satisfaction 1-5, optional ease 1-5, optional free text, optional contact.No findings

    Why it is in this group

    • The name "submit_feedback" says "submit": a word for a change.
    Description, as the server wrote it
    Tell the Rightshold team what is missing, broken or worth more: the part it is about, satisfaction 1-5, optional ease 1-5, optional free text, optional contact. No account needed. Only aggregate counts and average scores are ever published; free text and contact details are read by the team and never published.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • verify_rights_manifestCheck a rights manifest's signature against Rightshold's issuer keys and confirm its hash was recorded on the ledger; with deliverable_sha256, also that it covers those exact bytes…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check a rights manifest's signature against Rightshold's issuer keys and confirm its hash was recorded on the ledger; with deliverable_sha256, also that it covers those exact bytes. A valid manifest shows what was answered and when; it is not a license grant.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 5Claude Code: allow
  • get_pricingUse this to see what Rightshold costs before you sign up or plan spend: every pricing line with its price today (0 during the preview), the planned price after the preview, its uni…Reads text others writeNo findings

    Why it is in this group

    • The name "get_pricing" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "review": it reads comments, which other people can write.
    Description, as the server wrote it
    Use this to see what Rightshold costs before you sign up or plan spend: every pricing line with its price today (0 during the preview), the planned price after the preview, its unit and free allowance, and the principles behind the prices — nothing buys placement, a grade, a KYA level, a verdict or a review. No account or key needed.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_statusUse this to check whether Rightshold is operational before you depend on it, and to cite its record: the current component checks (ledger chain, sealing, Bitcoin anchoring, webhook…No findings

    Why it is in this group

    • The name "get_status" says "get": a word for reading.
    Description, as the server wrote it
    Use this to check whether Rightshold is operational before you depend on it, and to cite its record: the current component checks (ledger chain, sealing, Bitcoin anchoring, webhooks, storage), ledger and registry counts, plus the trailing-90-day uptime record per component and the incident history. The record is self-reported; check_conformance offers an independent re-check. No account or key needed.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • kya_lookupAn agent's RS-KYA level (L0 declared, L1 key-bound, L2 operator-verified), status, the verified facts behind it (key, operator contact, attestation, DNS domain, registration, burea…Reads private data2 findings

    Why it is in this group

    • The name "kya_lookup" says "lookup": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "contact": it reads contacts.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...hat is missing for the next level. With credential=true, also a signed credential and a on..."

      What this check looks for
    • Info

      The input schema at properties.credential.description mentions "credential".

      Matched text

      inputSchema.properties.credential.description: "Return the signed credential"

      What this check looks for
    Description, as the server wrote it
    An agent's RS-KYA level (L0 declared, L1 key-bound, L2 operator-verified), status, the verified facts behind it (key, operator contact, attestation, DNS domain, registration, bureau record) and what is missing for the next level. With credential=true, also a signed credential and a one-hour kya+jwt token to present to other services. Call with {"agent": "RS-XXXX-XXXX"}.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_toolsetsThe toolsets this server offers and the tools in each.No findings

    Why it is in this group

    • The name "list_toolsets" says "list": a word for reading.
    Description, as the server wrote it
    The toolsets this server offers and the tools in each. Connect to /mcp?toolset=<name>[,<name>] (or toolset=all) to list them. Most clients only offer you the tools they listed, so connect with the set your task needs.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • search_storeList published apps and skills in the Rightshold Store: for each, the vetting tier, the publisher and their live KYA level, declared permissions and the rating aggregate (ratings c…No findings

    Why it is in this group

    • The name "search_store" says "search": a word for reading.
    Description, as the server wrote it
    List published apps and skills in the Rightshold Store: for each, the vetting tier, the publisher and their live KYA level, declared permissions and the rating aggregate (ratings come only from KYA-verified agents). Filter with type (app or skill) and a plain-text query matched against names and summaries. Call with {"type": "skill"}.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

6 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write6
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__rightshold__check_listing"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:39 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
19
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
https://www.rightshold.com/.well-known/oauth-protected-resource/mcp
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 19 tools that change things (19 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://www.rightshold.com/mcp: tools/list returned 24 tools to an anonymous client, including start_here (write), read_ai_policy (write), license_compatibility (write), attribution_string (write), ask_rightshold (write) and 14 more

    What this check looks for

Install

Pinned to version 0.5.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http rightshold https://www.rightshold.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__rightshold__get_pricing",
      "mcp__rightshold__get_status",
      "mcp__rightshold__kya_lookup",
      "mcp__rightshold__search_store",
      "mcp__rightshold__list_toolsets"
    ],
    "ask": [
      "mcp__rightshold__start_here",
      "mcp__rightshold__read_ai_policy",
      "mcp__rightshold__license_compatibility",
      "mcp__rightshold__attribution_string",
      "mcp__rightshold__ask_rightshold",
      "mcp__rightshold__check_license",
      "mcp__rightshold__assess_resource_for_use",
      "mcp__rightshold__check_rights_batch",
      "mcp__rightshold__verify_rights_manifest",
      "mcp__rightshold__sign_up",
      "mcp__rightshold__registry_lookup",
      "mcp__rightshold__ledger_verify",
      "mcp__rightshold__issue_rights_receipt",
      "mcp__rightshold__gate_check",
      "mcp__rightshold__issue_rights_manifest",
      "mcp__rightshold__kya_verify",
      "mcp__rightshold__kya_check",
      "mcp__rightshold__submit_feedback",
      "mcp__rightshold__check_listing"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as rightshold. Review it before you use it.

Capability tags behind 8 rules
  • mcp__rightshold__read_ai_policy untrusted-input
  • mcp__rightshold__check_license untrusted-input
  • mcp__rightshold__check_rights_batch untrusted-input
  • mcp__rightshold__sign_up untrusted-input
  • mcp__rightshold__get_pricing untrusted-input
  • mcp__rightshold__gate_check untrusted-input
  • mcp__rightshold__kya_lookup private-data
  • mcp__rightshold__check_listing outbound