Rightos Mcp

io.github.suomimasuda由 GitHub 账号 suomimasuda 发布v0.5.1更新于 Oct 29, 2026

RightOS MCP: privacy-first QR queue/EV/pickup. 20 tools, no end-user PII.

已验证STDIO仅桌面位置与生活效率与工作流商业与电商

概览

AI 生成的概览

RightOS MCP 让助手签发、核验、转让和取消注重隐私的数字二维码凭证，适用于排队、诊所、电动车充电、活动和取件。

可以做什么
  • 查询与核验凭证：按 ID 获取凭证、用验证码核验、转让给新持有人，或由持有人自行取消
  • 查看策略与队列：读取场所生效策略、列出行业预设与国家覆盖规则、查看公开的排队人数
  • 以运营者身份管理场所与凭证：列出和创建场所、覆盖或重置策略、签发、核销和取消凭证
  • 审计与导出：读取仅追加的策略变更日志，将组织数据导出为 JSON
  • 管理 Webhook：列出、注册和删除用于凭证与队列事件的外发 Webhook
适用场景
适用于在 RightOS 上运营排队、诊所候诊、电动车充电、活动或包裹取件场景，并希望助手无需编写 HTTP 调用即可完成凭证签发、核验和策略查询。公开工具无需账号即可查询凭证或场所策略。
运行要求
通过 npx 从 npm 包 @i-s3/rightos-mcp 在本地运行（需要 Node.js）。环境变量 RIGHTOS_API_KEY 可选：不设置时仅公开工具可用；运营者工具需要已注册组织提供的密钥（有免费套餐）。可用 RIGHTOS_BASE_URL 覆盖 API 基础地址。文档中提供了共享演示密钥供试用。
安装前请注意
运营者工具会写入、修改和删除数据：签发、核销和取消凭证，创建场所，覆盖策略，注册或删除 Webhook。签发的验证码和 Webhook 签名密钥只返回一次，需妥善保存。取消不可撤销，转让会使旧验证码立即失效。套餐对场所数量和每月用量有限制，超限会返回需付费的响应。策略预设只是默认值，不构成法律建议。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Rightos Mcp，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

@i-s3/rightos-mcp — RightOS MCP Server

MCP (Model Context Protocol) server for RightOS — lets AI agents issue, verify, and transfer digital QR tickets for queues, clinic waiting, EV charging, events, and package pickup without writing HTTP code.

For coding agents: start with npx -y @i-s3/rightos-mcp and demo key rk_demo_00000000000000000000. Full docs: llms-full.txt · OpenAPI · ai.txt

RightOS verifies that a valid right is present — never who the person is. No names, phone numbers, or birthdates are required from end users.

RightOS is not a taxi or ride-hailing service. It does not arrange vehicles, set fares, assign drivers, or broker dispatch.

Setup

Add to your MCP client configuration (Cursor, Claude Desktop, etc.):

json
{  "mcpServers": {    "rightos": {      "command": "npx",      "args": ["-y", "@i-s3/rightos-mcp"],      "env": {        "RIGHTOS_API_KEY": "rk_live_..."      }    }  }}

RIGHTOS_API_KEY is optional. Without it, only the public tools work (plans, token lookup, verify, transfer, holder cancel, location policy, policy presets). Get a key by registering an organization — free tier, no credit card.

To try it with the shared demo organization, set RIGHTOS_API_KEY to rk_demo_00000000000000000000.

Tools

Public (no API key):

ToolDescription
list_plansList pricing plans (globally uniform)
get_tokenGet a Right Token by ID (never returns the secret code)
verify_tokenVerify a token with its verification code
transfer_tokenTransfer a token via re-keying (old code invalidated)
holder_cancel_tokenSelf-cancel a token as its current holder (policy permitting)
get_location_policyGet a location's effective policy (public for transparency)
list_policiesList all industry presets and country overlays (JP/US/GB/KR/TW/FR/DE/IT/ES/AU)

Operator (requires RIGHTOS_API_KEY):

ToolDescription
list_locationsList your organization's locations
create_locationCreate a location (type determines the industry policy preset)
set_location_policyOverride or reset a location's policy
get_policy_historyPolicy change audit log (append-only, newest first)
issue_tokenIssue a digital QR ticket (code + wallet URL returned exactly once)
use_tokenMark a ticket as used after service
cancel_tokenCancel a ticket
export_dataExport all organization data as JSON (no lock-in)
list_webhooksList outbound webhooks (never includes signing secrets)
create_webhookRegister a webhook — HMAC-SHA256 signed deliveries; secret returned exactly once
delete_webhookDelete a webhook

Example prompts

  • "Issue a queue ticket for my main counter and give me the wallet URL."
  • "Verify this ticket: tok_... with code K7MP-..."
  • "Make my EV charging location non-transferable." (it already is, by industry preset — the agent can check with get_location_policy)

Resources

License

MIT © I-S3 Inc.

来源：mcp/README.md，提交 4b08c8c

工具

20

list_plans

List RightOS pricing plans (globally uniform pricing, free tier available).

无需输入参数。

get_token

Get a Right Token (digital QR ticket) by its tokenId. Never returns the secret verification code.

输入参数tokenId必填

verify_token

Verify a Right Token with its verification code. Result is success / failed / expired / cancelled / already_used / not_yet_valid (when enforceTimeWindow blocks verify before startTime). Rate limited (10/min per token).

输入参数tokenId必填verificationCode必填

transfer_token

Transfer a Right Token to a new holder (re-keying: a new verification code is issued and the old one is invalidated immediately). Only the current holder can transfer. May be rejected by the location's policy (policy_transfer_disabled / transfer_limit_reached).

输入参数tokenId必填verificationCode必填

holder_cancel_token

Self-cancel a Right Token as its current holder (proven by the verification code). May be rejected by the location's policy (policy_cancel_disabled). Irreversible. Rate limited like verify.

输入参数tokenId必填verificationCode必填

get_location_policy

Get a location's effective policy (transferability, max transfers, default validity, holder self-cancellation). Resolution: industry preset -> country overlay -> location override. Public for transparency.

输入参数locationId必填

list_policies

List the full policy knowledge base: industry presets per location type and country overlays (JP, US, GB, KR, TW, FR, DE, IT, ES, AU — informed by local ticket-resale laws). Useful when choosing a location type or proposing policy overrides. Defaults, not legal advice. Public.

无需输入参数。

get_location_queue

Public queue snapshot for a location (counts only, no PII). Optional tokenId adds aheadCount and queuePosition. Does not auto-call or assign staff (ADR-0024).

输入参数tokenIdlocationId必填

list_locations

List your organization's locations. Requires the RIGHTOS_API_KEY environment variable (operator API key).

无需输入参数。

list_tokens

List your organization's Right Tokens. Filter by locationId, status, and since (ISO 8601). Requires the RIGHTOS_API_KEY environment variable (operator API key).

输入参数sincestatuslocationId

create_location

Create a location (shop, clinic, ev_charging, event, logistics, pickup, other). Returns 402 if the plan's location limit is exceeded. Requires the RIGHTOS_API_KEY environment variable (operator API key).

输入参数name必填typeaddresstimezone

set_location_policy

Override a location's policy (partial update: transferable, maxTransfers, defaultValidityMinutes, verificationRequirement, holderCancellable, maxActiveTokens, enforceTimeWindow, requireVerifyBeforeUse, approachingThreshold). Set reset=true to restore the industry preset. Requires the RIGHTOS_API_KEY environment variable (operator API key).

输入参数resetlocationId必填maxTransferstransferablemaxActiveTokensenforceTimeWindowholderCancellableapproachingThresholddefaultValidityMinutesrequireVerifyBeforeUseverificationRequirement

issue_token

Issue a Right Token (digital QR ticket). The verification code and wallet URL are returned EXACTLY ONCE — hand the walletUrl to the end user. Returns 402 if the plan's monthly limit is exceeded. Returns 409 queue_full when maxActiveTokens is reached. Requires the RIGHTOS_API_KEY environment variable (operator API key).

输入参数title必填endTimestartTimelocationId必填description

use_token

Mark a Right Token as used after service (own organization only). Returns 409 verify_required when requireVerifyBeforeUse policy is enabled and the token is not yet verified. Requires the RIGHTOS_API_KEY environment variable (operator API key).

输入参数tokenId必填

cancel_token

Cancel a Right Token (own organization only). Requires the RIGHTOS_API_KEY environment variable (operator API key).

输入参数tokenId必填

get_policy_history

Policy change audit log for a location (before/after overrides, newest first). Append-only. Requires the RIGHTOS_API_KEY environment variable (operator API key).

输入参数locationId必填

export_data

Export all organization data (locations, tokens, verification logs, policy change history) as JSON. Contains no secret values. Requires the RIGHTOS_API_KEY environment variable (operator API key).

无需输入参数。

list_webhooks

List the organization's outbound webhooks (never includes signing secrets). Requires the RIGHTOS_API_KEY environment variable (operator API key).

无需输入参数。

create_webhook

Register an outbound webhook (up to 3 per organization, https only). Events: token.verified / token.used / token.cancelled / token.transferred / queue.approaching (defaults to all; queue.approaching fires only when the location policy sets approachingThreshold). The response includes the signing secret (whsec_...) EXACTLY ONCE — deliveries are signed via the x-rightos-signature header (t=<unix seconds>,v1=<hex HMAC-SHA256>). Requires the RIGHTOS_API_KEY environment variable (operator API key).

输入参数url必填events

delete_webhook

Delete an outbound webhook (own organization only). Requires the RIGHTOS_API_KEY environment variable (operator API key).

输入参数webhookId必填

版本历史

2
  1. v0.5.1最新Oct 22, 2026
  2. v0.5.0Sep 16, 2026

评分

已满足适用检查项的 90%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分
  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分