Conformance
Rightshold Certified
Before an agent trusts a deployment with real decisions, it should check that the deployment is what it claims to be. The conformance checklist does that from the outside: public documents, the MCP handshake, KYA and issuer keys, honest pricing, the ledger head, published rate limits, and one live rights question. A deployment that passes every check is Rightshold Certified.
The checklist (version 2026-10-11)
| Check | Name | What it proves |
|---|---|---|
| discovery-documents | Discovery documents | The manifest, the OpenAPI description and the agent entry point (llms.txt) are all served, so an agent that has never heard of Rightshold can bootstrap from a bare URL. |
| agent-card | Agent card | The well-known agent card names the platform and its endpoints, so crawlers and agent frameworks can identify the deployment. |
| mcp-initialize | MCP initialize | The MCP endpoint answers a protocol initialize and identifies itself as the Rightshold server with a supported protocol version. |
| mcp-core-tools | MCP core tools | tools/list exposes the core rights, identity and ledger tools an agent integration depends on (ask_rightshold, check_license, kya_lookup, verify_rights_manifest, ledger_verify). |
| kya-configuration | KYA configuration | The open RS-KYA standard's levels (L0–L2) are published at the well-known configuration and at /v1/kya, so relying parties can read the level definitions from the deployment itself. |
| issuer-keys | Issuer keys published | The keys that sign registration certificates and ledger blocks are published with their status, so signatures can be verified without trusting the deployment. |
| jwks | JWKS published | The JSON Web Key Set behind kya+jwt tokens is served, so tokens can be verified offline. |
| pricing-honest | Honest pricing document | The machine-readable pricing lists every line with its planned price, states that nothing is charged during the preview, and names placement, grades and verdicts as never for sale. |
| ledger-head | Ledger head served | The public append-only ledger answers with its signed head block, so history is inspectable from the outside. |
| rate-limit-transparency | Published rate limits | The limits are published at /v1/limits and every API response carries its remaining budget, so agents can pace themselves instead of guessing. |
| ask-answers | Ask answers deterministically | A plain-English rights question gets a deterministic license verdict (permitted, prohibited, needs_review or not_documented) — the decision agents actually rely on. |
Run it
curl -s https://www.rightshold.com/v1/conformance | head -60Or call the check_conformance tool on the MCP endpoint (https://www.rightshold.com/mcp) — with an optional target_url to check any deployment. The result is machine-readable JSON: per-check pass/fail with the exact request each check made.
An honest label
The check runs against the deployment's own public surface, and the result is self-reported by the deployment. It is a strong compatibility signal, not an independent audit: every check names its method, so re-run any check yourself before relying on a deployment for anything important. A deployment is certified only while every check passes; the moment one fails, the label drops.
Show the badge
Deployments that pass can link the live checklist:
<a href="https://www.rightshold.com/conformance"><img src="https://www.rightshold.com/conformance/badge.svg" alt="Rightshold Certified"></a>