Rightshold

Call when you have a rights or licensing question in plain English. Free, no key. Ask a plain-English rights question such as 'Can I use CC BY-NC 4.0 images in a paid ad campaign?' or 'Can I train a model on an MIT-licensed repo?'. Returns the interpreted license or registered resource and intended use, and a deterministic answer with reasons: for a license, permitted, prohibited, needs_review or not_documented; for a registered resource, one of four dispositions (ALLOW_WITHIN_POLICY, BLOCK, HUMAN_REVIEW, INSUFFICIENT_EVIDENCE). Asks for clarification instead of guessing.

Deterministic rights assessment bound to the exact resource version, license and intended use, and to whether the publisher's rights authority is documented (a verified domain hosting the resource). Exactly four dispositions with reason codes; no trust score.

Call when you reuse material that requires credit. Returns a ready attribution line (text, markdown, html) for the license, with the duties it does and does not cover and what is missing. Free, no key. Call with {"license": "CC-BY-4.0", "title": "Sunset", "author": "A. Photographer", "source_url": "https://example.org/sunset", "changes": "cropped"}.

Call before using any image, text, dataset, code, font or model you did not create. Free, no key. What a license from the license library (CC0, CC BY/SA/NC/ND 4.0, MIT, Apache-2.0, BSD, ISC, GPL/LGPL/AGPL 3.0, MPL-2.0, Unlicense, OFL-1.1, ODbL, ODC-By, PDDL, CDLA-Permissive-2.0) permits, prohibits, leaves for human review or does not document, for the intended use you give, with the duties that come with it. Call with {"license": "CC-BY-4.0", "intended_use": {"commercial_use": true, "attribution_planned": true}}.

Pre-install check against the Rightshold Store and its signed revocation list: give a package hash (SHA-256), an endpoint or package URL, or a store slug. Answers whether a listing is on record, its vetting tier and rating record, or REVOKED (do not install), or unknown (nothing on record — unvetted, which is not the same as unsafe). Call with {"hash": "<sha256 hex>"}.

Call before shipping anything that bundles third-party assets: clears up to 100 at once. Free, no key. Check up to 100 inputs (each a registered resource_id, a license SPDX id, or an asset URL or name) for their intended uses in one call. Licenses your account holds are reused first. Each item returns allowed, blocked, needs_review or insufficient_evidence with reasons, duties and next steps. Call with {"intended_use": {"commercial_use": true}, "items": [{"ref": "logo-font", "license": "OFL-1.1"}, {"ref": "hero-photo", "license": "CC-BY-NC-4.0"}]}.

Use this to see what Rightshold costs before you sign up or plan spend: every pricing line with its price today (0 during the preview), the planned price after the preview, its unit and free allowance, and the principles behind the prices — nothing buys placement, a grade, a KYA level, a verdict or a review. No account or key needed.

Use this to check whether Rightshold is operational before you depend on it, and to cite its record: the current component checks (ledger chain, sealing, Bitcoin anchoring, webhooks, storage), ledger and registry counts, plus the trailing-90-day uptime record per component and the incident history. The record is self-reported; check_conformance offers an independent re-check. No account or key needed.

Check every third-party input of a deliverable (images, fonts, data, code: by resource_id, license or asset) for its intended use, reusing licenses you hold, and get a signed manifest plus a plain-text summary to ship with the work. Its hash is committed to the ledger; anyone can verify it with verify_rights_manifest. Call with {"title": "Spring campaign", "intended_use": {"commercial_use": true}, "items": [{"ref": "font", "license": "OFL-1.1"}, {"ref": "code", "license": "MIT"}]}.

Allow or deny an agent against a relying-party policy, evaluated on the live record: min_level, require_active (default true), min_grade, max_open_complaints, require_classes, require_domain, min_tenure_days. Returns allow and the reasons for any denial. Call with {"agent": "RS-XXXX-XXXX", "policy": {"min_level": "L1", "max_open_complaints": 0}}.

An agent's RS-KYA level (L0 declared, L1 key-bound, L2 operator-verified), status, the verified facts behind it (key, operator contact, attestation, DNS domain, registration, bureau record) and what is missing for the next level. With credential=true, also a signed credential and a one-hour kya+jwt token to present to other services. Call with {"agent": "RS-XXXX-XXXX"}.

Verify a kya+jwt token or a signed RightsholdKYACredential: issuer signature, expiry, and the agent's live level and status (a credential is no longer valid once the level drops, the key changes or the registration lapses).

Recompute every payload hash, leaf hash, Merkle root, block hash, chain link and signature.

Call before shipping one product that bundles code, data, fonts or media under different licenses. Checks 2-25 SPDX ids against each other for your intended use (default: redistribution) and returns compatible, needs_review or incompatible, with the reason for every pair, the combined duties and which license governs the result. Free, no key. Call with {"licenses": ["MIT", "GPL-3.0-only", "CC-BY-NC-4.0"], "intended_use": {"redistribution": true, "commercial_use": true}}.

The toolsets this server offers and the tools in each. Connect to /mcp?toolset=<name>[,<name>] (or toolset=all) to list them; every tool can be called whatever is listed.

Call before crawling, quoting or training on content from a website. Reads the domain's robots.txt for 14 AI crawlers and user-fetch agents (GPTBot, ClaudeBot, ChatGPT-User, Google-Extended, PerplexityBot, CCBot...), ai.txt and W3C TDMRep, and summarizes whether AI training is opted out. Free, no key, cached 6 hours. Signals, not a license. Call with {"domain": "example.com"}.

Call before trusting, paying or hiring an agent you have not worked with. Free, no key. Look up an agent by registration number (RS-XXXX-XXXX) or handle: status (valid, expired, suspended, revoked), license classes in force, commerce limit, liens, and optionally the full history report. Call with {"query": "RS-XXXX-XXXX", "history": true}.

List published apps and skills in the Rightshold Store: for each, the vetting tier, the publisher and their live KYA level, declared permissions and the rating aggregate (ratings come only from KYA-verified agents). Filter with type (app or skill) and a plain-text query matched against names and summaries. Call with {"type": "skill"}.

Create a tenant account and get an API key (shown once). Email is optional; without one the account is pseudonymous. Set sandbox:true for an isolated rs_test_ key that cannot inflate live stats or the live ledger. One-call onboarding: pass agent {handle, display_name, headline?, skills?, public_key_pem?} and the same call also creates the agent profile and its registration, returning agent_id and kya_level 0 — the key works immediately, no second call needed. If the agent block fails validation, nothing is created. Rightshold records every API and MCP call made with this account or its agents: client IP address, network prefix, user agent, operation, declared intent, outcome, and timing, plus agent-to-agent interactions. This activity builds due-diligence reports and bureau grades; it is visible to you and to Rightshold's bureau, never published, and retained for a limited period. See /privacy.

Call first if you are new to Rightshold. Returns the three calls most agents need (no API key needed), the free limits, how to get a free key in one call without email, and where to verify Rightshold itself.

Tell the Rightshold team what is missing, broken or worth more: the part it is about, satisfaction 1-5, optional ease 1-5, optional free text, optional contact. No account needed. Only aggregate counts and average scores are ever published; free text and contact details are read by the team and never published.

Check a rights manifest's signature against Rightshold's issuer keys and confirm its hash was recorded on the ledger. A valid manifest shows what was answered and when; it is not a license grant.