Rightos MCP server

Read from the package source without running it. The installed server may list more.

• cancel_tokenwrite action

  Cancel a Right Token (own organization only).

• create_locationwrite action

  Create a location (shop, clinic, ev_charging, event, logistics, pickup, other). Returns 402 if the plan's location limit is exceeded.

• create_webhookwrite action

  Register an outbound webhook (up to 3 per organization, https only). Events: token.verified / token.used / token.cancelled / token.transferred / queue.approaching (defaults to all; queue.approaching fires only when the location policy sets approachingThreshold). The response includes the signing secret (whsec_...) EXACTLY ONCE — deliveries are signed via the x-rightos-signature header (t=<unix sec

• delete_webhookwrite action

  Delete an outbound webhook (own organization only).

• export_data

  Export all organization data (locations, tokens, verification logs, policy change history) as JSON. Contains no secret values.

• get_location_policy

  Get a location's effective policy (transferability, max transfers, default validity, holder self-cancellation). Resolution: industry preset -> country overlay -> location override. Public for transparency.

• get_location_queue

  Public queue snapshot for a location (counts only, no PII). Optional tokenId adds aheadCount and queuePosition. Does not auto-call or assign staff (ADR-0024).

• get_policy_history

  Policy change audit log for a location (before/after overrides, newest first). Append-only.

• get_token

  Get a Right Token (digital QR ticket) by its tokenId. Never returns the secret verification code.

• holder_cancel_tokenwrite action

  Self-cancel a Right Token as its current holder (proven by the verification code). May be rejected by the location's policy (policy_cancel_disabled). Irreversible. Rate limited like verify.

• issue_token

  Issue a Right Token (digital QR ticket). The verification code and wallet URL are returned EXACTLY ONCE — hand the walletUrl to the end user. Returns 402 if the plan's monthly limit is exceeded. Returns 409 queue_full when maxActiveTokens is reached.

• list_locations

  List your organization's locations.

• list_plans

  List RightOS pricing plans (globally uniform pricing, free tier available).

• list_policies

  List the full policy knowledge base: industry presets per location type and country overlays (JP, US, GB, KR, TW, FR, DE, IT, ES, AU — informed by local ticket-resale laws). Useful when choosing a location type or proposing policy overrides. Defaults, not legal advice. Public.

• list_tokens

  List your organization's Right Tokens. Filter by locationId, status, and since (ISO 8601).

• list_webhooks

  List the organization's outbound webhooks (never includes signing secrets).

• set_location_policy

  Override a location's policy (partial update: transferable, maxTransfers, defaultValidityMinutes, verificationRequirement, holderCancellable, maxActiveTokens, enforceTimeWindow, requireVerifyBeforeUse, approachingThreshold). Set reset=true to restore the industry preset.

• transfer_tokenwrite action

  Transfer a Right Token to a new holder (re-keying: a new verification code is issued and the old one is invalidated immediately). Only the current holder can transfer. May be rejected by the location's policy (policy_transfer_disabled / transfer_limit_reached).

• use_token

  Mark a Right Token as used after service (own organization only). Returns 409 verify_required when requireVerifyBeforeUse policy is enabled and the token is not yet verified.

• verify_token

  Verify a Right Token with its verification code. Result is success / failed / expired / cancelled / already_used / not_yet_valid (when enforceTimeWindow blocks verify before startTime). Rate limited (10/min per token).

• Code scan2 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitystatic API keys via environment variables6/15
• Maintenancelast push 14 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Rightos: common questions

Is Rightos MCP server safe?

Mostly: it is graded B (83/100). Read the Rightos safety report

How do I install Rightos?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does Rightos need an API key?

Yes. The registry entry asks for RIGHTOS_API_KEY.

Is Rightos maintained?

The last commit was 15 days ago (2026-09-06). The latest release is v0.5.0.