Rightos Mcp

io.github.suomimasuda由 GitHub 帳號 suomimasuda 發布v0.5.1更新於 Oct 29, 2026

RightOS MCP: privacy-first QR queue/EV/pickup. 20 tools, no end-user PII.

已驗證STDIO僅桌面位置與生活效率與工作流商業與電商

概覽

AI 產生的概覽

RightOS MCP 讓助理簽發、驗證、轉讓與取消重視隱私的數位 QR 憑證，適用於排隊、診所、電動車充電、活動與取件。

可以做什麼
  • 查詢與驗證憑證：依 ID 取得憑證、用驗證碼驗證、轉讓給新持有人，或由持有人自行取消
  • 查看政策與佇列：讀取場所的生效政策、列出產業預設與國家覆寫規則、查看公開的排隊人數
  • 以營運者身分管理場所與憑證：列出與建立場所、覆寫或重設政策、簽發、核銷與取消憑證
  • 稽核與匯出：讀取僅可追加的政策變更紀錄，將組織資料匯出為 JSON
  • 管理 Webhook：列出、註冊與刪除用於憑證與佇列事件的外送 Webhook
適用情境
適合在 RightOS 上經營排隊、診所候診、電動車充電、活動或包裹取件據點，並希望助理不必自行撰寫 HTTP 呼叫就能完成憑證簽發、驗證與政策查詢。公開工具不需帳號即可查詢憑證或場所政策。
執行需求
透過 npx 從 npm 套件 @i-s3/rightos-mcp 在本機執行（需要 Node.js）。環境變數 RIGHTOS_API_KEY 為選用：未設定時僅公開工具可用；營運者工具需要已註冊組織提供的金鑰（有免費方案）。可用 RIGHTOS_BASE_URL 覆寫 API 基礎位址。文件中提供共用示範金鑰供試用。
安裝前請注意
營運者工具會寫入、變更與刪除資料：簽發、核銷與取消憑證，建立場所，覆寫政策，註冊或刪除 Webhook。簽發的驗證碼與 Webhook 簽章金鑰只回傳一次，需妥善保存。取消不可復原，轉讓會讓舊驗證碼立即失效。方案對場所數量與每月用量有限制，超額會回傳需付費的回應。政策預設值僅供參考，不構成法律建議。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Rightos Mcp，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

@i-s3/rightos-mcp — RightOS MCP Server

MCP (Model Context Protocol) server for RightOS — lets AI agents issue, verify, and transfer digital QR tickets for queues, clinic waiting, EV charging, events, and package pickup without writing HTTP code.

For coding agents: start with npx -y @i-s3/rightos-mcp and demo key rk_demo_00000000000000000000. Full docs: llms-full.txt · OpenAPI · ai.txt

RightOS verifies that a valid right is present — never who the person is. No names, phone numbers, or birthdates are required from end users.

RightOS is not a taxi or ride-hailing service. It does not arrange vehicles, set fares, assign drivers, or broker dispatch.

Setup

Add to your MCP client configuration (Cursor, Claude Desktop, etc.):

json
{  "mcpServers": {    "rightos": {      "command": "npx",      "args": ["-y", "@i-s3/rightos-mcp"],      "env": {        "RIGHTOS_API_KEY": "rk_live_..."      }    }  }}

RIGHTOS_API_KEY is optional. Without it, only the public tools work (plans, token lookup, verify, transfer, holder cancel, location policy, policy presets). Get a key by registering an organization — free tier, no credit card.

To try it with the shared demo organization, set RIGHTOS_API_KEY to rk_demo_00000000000000000000.

Tools

Public (no API key):

ToolDescription
list_plansList pricing plans (globally uniform)
get_tokenGet a Right Token by ID (never returns the secret code)
verify_tokenVerify a token with its verification code
transfer_tokenTransfer a token via re-keying (old code invalidated)
holder_cancel_tokenSelf-cancel a token as its current holder (policy permitting)
get_location_policyGet a location's effective policy (public for transparency)
list_policiesList all industry presets and country overlays (JP/US/GB/KR/TW/FR/DE/IT/ES/AU)

Operator (requires RIGHTOS_API_KEY):

ToolDescription
list_locationsList your organization's locations
create_locationCreate a location (type determines the industry policy preset)
set_location_policyOverride or reset a location's policy
get_policy_historyPolicy change audit log (append-only, newest first)
issue_tokenIssue a digital QR ticket (code + wallet URL returned exactly once)
use_tokenMark a ticket as used after service
cancel_tokenCancel a ticket
export_dataExport all organization data as JSON (no lock-in)
list_webhooksList outbound webhooks (never includes signing secrets)
create_webhookRegister a webhook — HMAC-SHA256 signed deliveries; secret returned exactly once
delete_webhookDelete a webhook

Example prompts

  • "Issue a queue ticket for my main counter and give me the wallet URL."
  • "Verify this ticket: tok_... with code K7MP-..."
  • "Make my EV charging location non-transferable." (it already is, by industry preset — the agent can check with get_location_policy)

Resources

License

MIT © I-S3 Inc.

來源：mcp/README.md，提交 4b08c8c

工具

20

list_plans

List RightOS pricing plans (globally uniform pricing, free tier available).

無需輸入參數。

get_token

Get a Right Token (digital QR ticket) by its tokenId. Never returns the secret verification code.

輸入參數tokenId必填

verify_token

Verify a Right Token with its verification code. Result is success / failed / expired / cancelled / already_used / not_yet_valid (when enforceTimeWindow blocks verify before startTime). Rate limited (10/min per token).

輸入參數tokenId必填verificationCode必填

transfer_token

Transfer a Right Token to a new holder (re-keying: a new verification code is issued and the old one is invalidated immediately). Only the current holder can transfer. May be rejected by the location's policy (policy_transfer_disabled / transfer_limit_reached).

輸入參數tokenId必填verificationCode必填

holder_cancel_token

Self-cancel a Right Token as its current holder (proven by the verification code). May be rejected by the location's policy (policy_cancel_disabled). Irreversible. Rate limited like verify.

輸入參數tokenId必填verificationCode必填

get_location_policy

Get a location's effective policy (transferability, max transfers, default validity, holder self-cancellation). Resolution: industry preset -> country overlay -> location override. Public for transparency.

輸入參數locationId必填

list_policies

List the full policy knowledge base: industry presets per location type and country overlays (JP, US, GB, KR, TW, FR, DE, IT, ES, AU — informed by local ticket-resale laws). Useful when choosing a location type or proposing policy overrides. Defaults, not legal advice. Public.

無需輸入參數。

get_location_queue

Public queue snapshot for a location (counts only, no PII). Optional tokenId adds aheadCount and queuePosition. Does not auto-call or assign staff (ADR-0024).

輸入參數tokenIdlocationId必填

list_locations

List your organization's locations. Requires the RIGHTOS_API_KEY environment variable (operator API key).

無需輸入參數。

list_tokens

List your organization's Right Tokens. Filter by locationId, status, and since (ISO 8601). Requires the RIGHTOS_API_KEY environment variable (operator API key).

輸入參數sincestatuslocationId

create_location

Create a location (shop, clinic, ev_charging, event, logistics, pickup, other). Returns 402 if the plan's location limit is exceeded. Requires the RIGHTOS_API_KEY environment variable (operator API key).

輸入參數name必填typeaddresstimezone

set_location_policy

Override a location's policy (partial update: transferable, maxTransfers, defaultValidityMinutes, verificationRequirement, holderCancellable, maxActiveTokens, enforceTimeWindow, requireVerifyBeforeUse, approachingThreshold). Set reset=true to restore the industry preset. Requires the RIGHTOS_API_KEY environment variable (operator API key).

輸入參數resetlocationId必填maxTransferstransferablemaxActiveTokensenforceTimeWindowholderCancellableapproachingThresholddefaultValidityMinutesrequireVerifyBeforeUseverificationRequirement

issue_token

Issue a Right Token (digital QR ticket). The verification code and wallet URL are returned EXACTLY ONCE — hand the walletUrl to the end user. Returns 402 if the plan's monthly limit is exceeded. Returns 409 queue_full when maxActiveTokens is reached. Requires the RIGHTOS_API_KEY environment variable (operator API key).

輸入參數title必填endTimestartTimelocationId必填description

use_token

Mark a Right Token as used after service (own organization only). Returns 409 verify_required when requireVerifyBeforeUse policy is enabled and the token is not yet verified. Requires the RIGHTOS_API_KEY environment variable (operator API key).

輸入參數tokenId必填

cancel_token

Cancel a Right Token (own organization only). Requires the RIGHTOS_API_KEY environment variable (operator API key).

輸入參數tokenId必填

get_policy_history

Policy change audit log for a location (before/after overrides, newest first). Append-only. Requires the RIGHTOS_API_KEY environment variable (operator API key).

輸入參數locationId必填

export_data

Export all organization data (locations, tokens, verification logs, policy change history) as JSON. Contains no secret values. Requires the RIGHTOS_API_KEY environment variable (operator API key).

無需輸入參數。

list_webhooks

List the organization's outbound webhooks (never includes signing secrets). Requires the RIGHTOS_API_KEY environment variable (operator API key).

無需輸入參數。

create_webhook

Register an outbound webhook (up to 3 per organization, https only). Events: token.verified / token.used / token.cancelled / token.transferred / queue.approaching (defaults to all; queue.approaching fires only when the location policy sets approachingThreshold). The response includes the signing secret (whsec_...) EXACTLY ONCE — deliveries are signed via the x-rightos-signature header (t=<unix seconds>,v1=<hex HMAC-SHA256>). Requires the RIGHTOS_API_KEY environment variable (operator API key).

輸入參數url必填events

delete_webhook

Delete an outbound webhook (own organization only). Requires the RIGHTOS_API_KEY environment variable (operator API key).

輸入參數webhookId必填

版本歷史

2
  1. v0.5.1最新Oct 22, 2026
  2. v0.5.0Sep 16, 2026

評分

已滿足適用檢查項的 90%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分
  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分