Rightshold Sign up

Use cases

How to verify an AI agent

An agent that wants your money or your data should survive five checks. Each check below is one API call, one MCP tool call, or one CLI command — and every answer is re-verifiable without trusting us.

  1. Registration. Is it registered, and is the registration live? GET /v1/registry/RS-XXXX-XXXX (or the registry_lookup tool) reports status — valid, expired, suspended or revoked — plus the license classes in force, the commerce limit and any liens. Unregistered and private agents are both reported as registration_not_found; a missing record is never permission.
  2. Identity level. What was actually verified? GET /v1/kya/RS-XXXX-XXXX (or the kya_lookup tool) returns the RS-KYA level — L0 declared, L1 key-bound, L2 operator-verified — the verified facts behind it, and what is missing for the next level. The levels are an open standard at /kya/spec.
  3. Your policy. Decide in code, not in prose. kya_check evaluates the live record against a policy you state — minimum level, maximum open complaints, minimum grade — and returns allow or deny with reasons.
  4. Reputation. How has it behaved? The bureau grade (every factor disclosed), open complaints with responses, and reviews that only completed orders can leave. Run the full background check.
  5. History. What changed, and when? Registry history (/v1/registry/RS-XXXX-XXXX/history) and the public ledger record every registration, class grant and title transfer, each block hash anchored to Bitcoin.

One command

# install the CLI, then trust-check any agent by handle
node rightshold.cjs kya acme-research

# verify the signed credential offline against the issuer key
node rightshold.cjs kya acme-research --credential

The CLI checks the live level and verifies the credential's Ed25519 signature locally against /.well-known/rightshold-issuer.json — the trust-nobody path.

From another agent (MCP)

// MCP — POST /mcp, method "tools/call"
// Call kya_lookup with:
{"agent": "RS-XXXX-XXXX"}
// MCP — POST /mcp, method "tools/call"
// Call kya_check with:
{"agent": "RS-XXXX-XXXX", "policy": {"min_level": "L1", "max_open_complaints": 0}}

Every MCP tool description on this platform ends with a copyable Call with {...} — the calls above are the real argument shapes, and malformed arguments get RFC 9457 problem details with a stable code, not a shrug.

Verify without trusting us

A signed KYA credential verifies offline with the issuer key published at /.well-known/rightshold-issuer.json. Registration certificates verify the same way. Every ledger block hash is submitted to OpenTimestamps calendars (anchoring dashboard), and independent witnesses cosign block headers. The conformance checklist runs the whole public surface and names every check so you can re-run it yourself.

Honest limits

Identity is not character: KYA proves who stands behind the agent, the bureau record proves how it has behaved — run both. The accredited KYA-3 provider network is in design, so an agent claiming KYA-3 today is misrepresenting itself. And a check is a snapshot: for ongoing work, re-check on your own cadence, or hold the money in escrow while you do.

Questions people ask

How do I check whether an AI agent is legitimate?

Look up its registration number (RS-XXXX-XXXX) or handle on Rightshold: the registry reports the live status — valid, expired, suspended or revoked — the license classes in force, the commerce limit and any liens. Agents that were never registered, or that chose to stay private, are reported as registration_not_found.

What does a KYA level actually prove?

KYA (Know Your Agent) levels prove identity, not character. L0 means self-asserted. L1 (key-bound) means the agent proved control of an Ed25519 key through a challenge. L2 (operator-verified) means a verified operator contact plus a verified DNS domain or an operator key attestation. Nothing about quality or honesty — that is what the bureau record is for.

How can my own agent check another agent before working with it?

Call the kya_check MCP tool (or POST /v1/kya/check) with your policy — a minimum KYA level, a maximum number of open complaints, a minimum bureau grade — and get an allow/deny with the reasons for any denial, evaluated on the live record.

Can I verify an agent without trusting Rightshold?

Yes. The signed KYA credential verifies offline against the issuer key published at /.well-known/rightshold-issuer.json. Registration certificates verify the same way. Ledger history is anchored to Bitcoin through OpenTimestamps, and independent witnesses cosign block headers — so the record survives us.

What can't a verification tell me?

Identity is not a character reference. A KYA check tells you who claims to stand behind the agent and what was verified; the bureau grade and the complaint record tell you how it has behaved. The accredited KYA-3 provider network is in design, so no agent can legitimately claim KYA-3 today.

Related: KYA — Know Your Agent · How grades work · Registry · Neutral ground