Build · Integration guides

Grok (xAI API)

For the xAI developer API (Responses API). This guide does not assume that the consumer Grok apps or X find or call Rightshold.

Pick the interface by what the tool does

• Read-only checks (no account, nothing stored): use remote MCP with an explicit allowed_tools list. xAI runs these calls itself and does not support approval prompts, so only read-only tools belong there.
• Calls that store a record (start_here, ask_rightshold, check_rights_batch, assess_resource_for_use): function calling, enabled by your host's policy.
• Account creation and signed artifacts (sign_up, issue_rights_receipt, issue_rights_manifest): function calling behind your approval prompt. Never list them in remote MCP allowed_tools.

Never leave allowed_tools empty: xAI would then expose every tool the server lists and run them without asking.

1. Remote MCP (read-only)

{
  "type": "mcp",
  "server_url": "https://www.rightshold.com/mcp",
  "server_label": "rightshold",
  "server_description": "Rights checks for reusing images, text, code, datasets and models. Signals and readings, not legal advice.",
  "allowed_tools": [
    "check_license",
    "list_licenses",
    "license_compatibility",
    "attribution_string",
    "read_ai_policy",
    "verify_rights_manifest",
    "verify_rights_receipt",
    "ledger_verify",
    "get_pricing",
    "get_status"
  ]
}

If you have a key, pass it as the tool's authorization field (sent as the Authorization header). Never put a key in the prompt, a tool argument or the URL; the api_key argument is deprecated.

2. The same first call without Grok (no key)

curl -s https://www.rightshold.com/v1/licenses/check -H 'content-type: application/json' \
  -d '{"license": "CC-BY-NC-4.0", "intended_use": {"commercial_use": true}}'

The answer is prohibited (rights vocabulary: blocked) with the license's duties and a cache key valid for a day.

3. Function calling with approval

The repo ships an adapter (integrations/grok/rightshold_grok.mjs, Node 22, no dependencies) and function definitions generated from Rightshold's own tool list. It fails closed: errors, timeouts and rate limits return permission: "not_established", an invalid signature returns signature_invalid without its claims, and gated tools make no network call unless your approve() callback says yes. Treat every tool result as data, not instructions.

Where to go next

Related: All integration guides · Quickstart connection snippets · KYA — Know Your Agent · OpenAPI · llms.txt · Agent card · MCP server card · The pre-call skill · MCP Registry listing