RCO Records - Record of Cleared Orders

io.github.alloolooPublished by GitHub account allooloov2.3.1Updated Nov 7, 2026

The record of what the agent relied on: a signed, chained receipt per cleared read. Verify by id.

VerifiedStreamable HTTPWeb executableDatabasesFinanceSecurity & Monitoring

Overview

AI-generated overview

Remote MCP door that writes, lists and verifies signed, chained receipts for cleared reads of a regulated record, plus signed statements and auditor keys.

What you can do
  • Write a signed v1 receipt for a read a gate has cleared, idempotent on writer, subject, market, rule version, cleared time and answer hash
  • Verify a receipt by id and get its hash, signature and the public key that checks it
  • List your own receipts by sequence or date range, up to 500 per call
  • Fetch a signed monthly or date-range statement with count, sequence bounds, slice digest and chain tip
  • Issue a read-only auditor sub-key limited to listing receipts and fetching statements
When to use it
For regulated agents or firms that need attributable evidence of what an assistant relied on: a verifiable record of each cleared read, auditable by third parties and by an external auditor without sharing the underlying content.
Requirements
A remote streamable HTTP endpoint; no local package. A writer bearer token for write_receipt, a customer key for list_receipts, get_statement and issue_auditor_key, and network access. verify_receipt is public and needs no credential.
Before you install
Bearer credentials are required for writing, listing and statements; the issued auditor key value is returned only once, so store it safely. Receipts are written into a chained record operated by Allooloo and cannot be edited afterwards. The service records the read event and answer hash but not the content itself.

Installation

In SourceWeft

  1. Open RCO Records - Record of Cleared Orders in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.allooloo%2Frco-records/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "rco-records-record-of-cleared-orders": {
      "type": "http",
      "url": "https://mcp.rco-records.ai/mcp"
    }
  }
}

README

RCO Records — Record of Cleared Orders

RCO — the record of what the agent relied on. Every read, receipted.

Every answer the Allooloo record gives a regulated agent is receipted: one signed receipt per cleared read, chained to the one before, verifiable by anyone against a published key. The receipt is the agent's alibi.

Standard held by Allooloo Technologies Corp. · Open standard, MIT licence. — https://allooloo.ai

What is in this repository

PathWhat
SPEC.mdReceipt v1 — the frozen spec — and the v0 history format
sdk/typescript/verify.tsreference verify(), verifyChain(), carry() — WebCrypto only
sdk/python/rco_verify.pyreference verify(), verify_chain() — needs cryptography
sdk/go/verify.goreference Verify() — standard library only
worker/, public/, wrangler.toml, schema.sql, rails/the door as it runs (Cloudflare Worker + D1)

The spec and the reference verify() ship under MIT (LICENSE). Nothing else is licensed: the chain, the keys, the door and the Register are operated by Allooloo, not licensed.

Verify a receipt

bash
node sdk/typescript/cli.ts rco:4xvpzgxxmno5bfxxmv5h
bash
python sdk/python/rco_verify.py rco:4xvpzgxxmno5bfxxmv5h

verify(receipt, jwks) is a pure function: recompute hash (and id for v1), check sig against kid. A receipt verifies forever without asking Allooloo anything.

Source: README.md at commit 22ad261

Tools

5

write_receipt

Write one v1 receipt for a read a gate has cleared. Authenticated: Authorization: Bearer <writer token>. Idempotent on (writer, subject, subject_type, market, rule_version, cleared_at, answer_hash). Returns the receipt.

Parameterscallermarketsubjectrequiredcaller_keycleared_atanswer_hashrule_versionrequiredsubject_typerequired

verify_receipt

Return one receipt by id (rco:… for v1, dec_… for v0) with the verification result (hash, id, signature) and the public key (JWK) that checks it. Public.

Parametersidrequired

list_receipts

Your own receipts only — the rows whose caller is your customer key — by seq range (from_seq, to_seq, after_seq) or date range (from, to: YYYY-MM-DD, to inclusive), limit ≤ 500. Authorization: Bearer <customer key>. Refuses without a key.

Parameterstofromlimitto_seqfrom_seqafter_seq

get_statement

A signed statement of your slice for a month (month: YYYY-MM) or a date range (from, to: YYYY-MM-DD, to exclusive): count, first and last seq, slice digest, the chain tip at issue, Ed25519 signature by Allooloo. Authorization: Bearer <customer key>.

Parameterstofrommonth

issue_auditor_key

Issue a read-only sub-key on your own slice for your auditor (list_receipts and get_statement only). Authorization: Bearer <customer key>. The key value is returned once.

Parametersname

Version history

2
  1. v2.3.1LatestOct 31, 2026
  2. v2.3.0Oct 30, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts