Rightos Mcp

io.github.suomimasudaPublished by GitHub account suomimasudav0.5.1Updated Oct 29, 2026

RightOS MCP: privacy-first QR queue/EV/pickup. 20 tools, no end-user PII.

VerifiedSTDIODesktop onlyLocation & LifestyleProductivity & WorkflowBusiness & Commerce

Overview

AI-generated overview

RightOS MCP lets an assistant issue, verify, transfer and cancel privacy-first digital QR tickets for queues, clinics, EV charging, events and pickup.

What you can do
  • Look up and verify tickets: fetch a token by ID, verify it with its code, transfer it to a new holder, or self-cancel as holder
  • Inspect policies and queues: read a location's effective policy, list industry presets and country overlays, view public queue counts
  • Manage locations and tickets as an operator: list and create locations, override or reset policies, issue, use and cancel tokens
  • Review and export: read the append-only policy change log, export organization data as JSON
  • Manage webhooks: list, register and delete outbound webhooks for token and queue events
When to use it
Useful when you run a queue, clinic waiting room, EV charging site, event or package pickup point on RightOS and want an assistant to handle ticket issuance, verification and policy checks without writing HTTP calls. Public tools also work for checking a ticket or a location's policy without an account.
Requirements
Runs locally via npx from the npm package @i-s3/rightos-mcp (Node.js). The RIGHTOS_API_KEY environment variable is optional: without it only public tools work; operator tools need a key from a registered organization (free tier). RIGHTOS_BASE_URL can override the API base URL. A shared demo key is documented for trying it out.
Before you install
Operator tools create, change and delete data: issuing, using and cancelling tickets, creating locations, overriding policies, and registering or deleting webhooks. Issued verification codes and webhook signing secrets are returned only once, so store them safely. Cancellation is irreversible and transfers invalidate the old code. Plans have location and monthly limits, and exceeding them returns a payment-required response. Policy presets are defaults, not legal advice.

Installation

In SourceWeft

  1. Open Rightos Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@i-s3/rightos-mcp — RightOS MCP Server

MCP (Model Context Protocol) server for RightOS — lets AI agents issue, verify, and transfer digital QR tickets for queues, clinic waiting, EV charging, events, and package pickup without writing HTTP code.

For coding agents: start with npx -y @i-s3/rightos-mcp and demo key rk_demo_00000000000000000000. Full docs: llms-full.txt · OpenAPI · ai.txt

RightOS verifies that a valid right is present — never who the person is. No names, phone numbers, or birthdates are required from end users.

RightOS is not a taxi or ride-hailing service. It does not arrange vehicles, set fares, assign drivers, or broker dispatch.

Setup

Add to your MCP client configuration (Cursor, Claude Desktop, etc.):

json
{  "mcpServers": {    "rightos": {      "command": "npx",      "args": ["-y", "@i-s3/rightos-mcp"],      "env": {        "RIGHTOS_API_KEY": "rk_live_..."      }    }  }}

RIGHTOS_API_KEY is optional. Without it, only the public tools work (plans, token lookup, verify, transfer, holder cancel, location policy, policy presets). Get a key by registering an organization — free tier, no credit card.

To try it with the shared demo organization, set RIGHTOS_API_KEY to rk_demo_00000000000000000000.

Tools

Public (no API key):

ToolDescription
list_plansList pricing plans (globally uniform)
get_tokenGet a Right Token by ID (never returns the secret code)
verify_tokenVerify a token with its verification code
transfer_tokenTransfer a token via re-keying (old code invalidated)
holder_cancel_tokenSelf-cancel a token as its current holder (policy permitting)
get_location_policyGet a location's effective policy (public for transparency)
list_policiesList all industry presets and country overlays (JP/US/GB/KR/TW/FR/DE/IT/ES/AU)

Operator (requires RIGHTOS_API_KEY):

ToolDescription
list_locationsList your organization's locations
create_locationCreate a location (type determines the industry policy preset)
set_location_policyOverride or reset a location's policy
get_policy_historyPolicy change audit log (append-only, newest first)
issue_tokenIssue a digital QR ticket (code + wallet URL returned exactly once)
use_tokenMark a ticket as used after service
cancel_tokenCancel a ticket
export_dataExport all organization data as JSON (no lock-in)
list_webhooksList outbound webhooks (never includes signing secrets)
create_webhookRegister a webhook — HMAC-SHA256 signed deliveries; secret returned exactly once
delete_webhookDelete a webhook

Example prompts

  • "Issue a queue ticket for my main counter and give me the wallet URL."
  • "Verify this ticket: tok_... with code K7MP-..."
  • "Make my EV charging location non-transferable." (it already is, by industry preset — the agent can check with get_location_policy)

Resources

License

MIT © I-S3 Inc.

Source: mcp/README.md at commit 4b08c8c

Tools

20

list_plans

List RightOS pricing plans (globally uniform pricing, free tier available).

Takes no parameters.

get_token

Get a Right Token (digital QR ticket) by its tokenId. Never returns the secret verification code.

ParameterstokenIdrequired

verify_token

Verify a Right Token with its verification code. Result is success / failed / expired / cancelled / already_used / not_yet_valid (when enforceTimeWindow blocks verify before startTime). Rate limited (10/min per token).

ParameterstokenIdrequiredverificationCoderequired

transfer_token

Transfer a Right Token to a new holder (re-keying: a new verification code is issued and the old one is invalidated immediately). Only the current holder can transfer. May be rejected by the location's policy (policy_transfer_disabled / transfer_limit_reached).

ParameterstokenIdrequiredverificationCoderequired

holder_cancel_token

Self-cancel a Right Token as its current holder (proven by the verification code). May be rejected by the location's policy (policy_cancel_disabled). Irreversible. Rate limited like verify.

ParameterstokenIdrequiredverificationCoderequired

get_location_policy

Get a location's effective policy (transferability, max transfers, default validity, holder self-cancellation). Resolution: industry preset -> country overlay -> location override. Public for transparency.

ParameterslocationIdrequired

list_policies

List the full policy knowledge base: industry presets per location type and country overlays (JP, US, GB, KR, TW, FR, DE, IT, ES, AU — informed by local ticket-resale laws). Useful when choosing a location type or proposing policy overrides. Defaults, not legal advice. Public.

Takes no parameters.

get_location_queue

Public queue snapshot for a location (counts only, no PII). Optional tokenId adds aheadCount and queuePosition. Does not auto-call or assign staff (ADR-0024).

ParameterstokenIdlocationIdrequired

list_locations

List your organization's locations. Requires the RIGHTOS_API_KEY environment variable (operator API key).

Takes no parameters.

list_tokens

List your organization's Right Tokens. Filter by locationId, status, and since (ISO 8601). Requires the RIGHTOS_API_KEY environment variable (operator API key).

ParameterssincestatuslocationId

create_location

Create a location (shop, clinic, ev_charging, event, logistics, pickup, other). Returns 402 if the plan's location limit is exceeded. Requires the RIGHTOS_API_KEY environment variable (operator API key).

Parametersnamerequiredtypeaddresstimezone

set_location_policy

Override a location's policy (partial update: transferable, maxTransfers, defaultValidityMinutes, verificationRequirement, holderCancellable, maxActiveTokens, enforceTimeWindow, requireVerifyBeforeUse, approachingThreshold). Set reset=true to restore the industry preset. Requires the RIGHTOS_API_KEY environment variable (operator API key).

ParametersresetlocationIdrequiredmaxTransferstransferablemaxActiveTokensenforceTimeWindowholderCancellableapproachingThresholddefaultValidityMinutesrequireVerifyBeforeUseverificationRequirement

issue_token

Issue a Right Token (digital QR ticket). The verification code and wallet URL are returned EXACTLY ONCE — hand the walletUrl to the end user. Returns 402 if the plan's monthly limit is exceeded. Returns 409 queue_full when maxActiveTokens is reached. Requires the RIGHTOS_API_KEY environment variable (operator API key).

ParameterstitlerequiredendTimestartTimelocationIdrequireddescription

use_token

Mark a Right Token as used after service (own organization only). Returns 409 verify_required when requireVerifyBeforeUse policy is enabled and the token is not yet verified. Requires the RIGHTOS_API_KEY environment variable (operator API key).

ParameterstokenIdrequired

cancel_token

Cancel a Right Token (own organization only). Requires the RIGHTOS_API_KEY environment variable (operator API key).

ParameterstokenIdrequired

get_policy_history

Policy change audit log for a location (before/after overrides, newest first). Append-only. Requires the RIGHTOS_API_KEY environment variable (operator API key).

ParameterslocationIdrequired

export_data

Export all organization data (locations, tokens, verification logs, policy change history) as JSON. Contains no secret values. Requires the RIGHTOS_API_KEY environment variable (operator API key).

Takes no parameters.

list_webhooks

List the organization's outbound webhooks (never includes signing secrets). Requires the RIGHTOS_API_KEY environment variable (operator API key).

Takes no parameters.

create_webhook

Register an outbound webhook (up to 3 per organization, https only). Events: token.verified / token.used / token.cancelled / token.transferred / queue.approaching (defaults to all; queue.approaching fires only when the location policy sets approachingThreshold). The response includes the signing secret (whsec_...) EXACTLY ONCE — deliveries are signed via the x-rightos-signature header (t=<unix seconds>,v1=<hex HMAC-SHA256>). Requires the RIGHTOS_API_KEY environment variable (operator API key).

Parametersurlrequiredevents

delete_webhook

Delete an outbound webhook (own organization only). Requires the RIGHTOS_API_KEY environment variable (operator API key).

ParameterswebhookIdrequired

Version history

2
  1. v0.5.1LatestOct 22, 2026
  2. v0.5.0Sep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts