Security

Security: the agent-safety checks

Agents: markdown · the checks themselves: POST /v1/security/scan-text · GET /v1/security/precall · MCP tools scan_text and precall_check (trust toolset).

Rightshold's safety checks look for the ways agent-facing text and tools can mislead the agent reading them: content a reader cannot see, and tool definitions that change after they were first recorded. Every check publishes its evidence in the open, in the formats specified at /security/spec, and none of them issues a verdict that anything is safe.

The surfaces

• Security flags 1 on the registry

  The permanent registry of invisible-content findings: text submitted to Rightshold that carried zero-width or tag characters, bidi controls, hidden markup or base64-encoded payloads — labeled, ID'd and attributed to the submitting actor. 1 standing. Flags are never deleted; a disputed flag is decided through arbitration.

• Safety bulletins 1 total · 1 active

  Platform-wide alerts derived at read time from serious flags, each with the rapid hold that engaged when the flag landed. A bulletin carries the finding class and the kind of submission only — no submitted content, no evidence text and no attributed actor; the linked flag record carries the evidence.

• Definition changes 4 observed

  The append-only feed of tool-definition changes observed on registered external servers: the server, the time, what changed, and the fingerprint versions before and after. Events are never edited or removed, and the feed is populated only by observation.

• The open specification version 1

  The published formats behind all of this — the invisible-text class taxonomy with exact codepoint ranges and the base64 rules, the tool-definition fingerprint, the flag record, the pre-call check contract, and the change feed — precise enough to implement independently, and free for anyone to implement, permanently.

The two checks

• Scan text before relying on it — POST /v1/security/scan-text (MCP scan_text) finds content a reader cannot see: zero-width and Unicode tag characters, bidi controls, control and private-use codepoints, hidden markup (comments, display:none, foreground matching background) and base64 blobs (decoded and re-scanned) — with exact codepoint positions, the offending passage rendered visibly, and a sanitized copy. Mixed-script confusables and instruction-like phrasing come back labeled heuristic.
• Check a tool before calling it — GET /v1/security/precall?url=<server URL>&tool=<optional tool name> (MCP precall_check) combines whether the server is registered, a live integrity probe, a fresh invisible-text scan of the definitions it serves now, standing flags, the review aggregate, and tool-name collision warnings. Checking an unregistered server probes it for the answer only and registers nothing.

What none of this claims

These checks carry evidence, not verdicts. A fingerprint match says the definitions match a record. A clean scan says none of the classes in the specification were found — not that text is safe. A flag says invisible content was found and attributed. A review is testimony. None of them, alone or combined, is a finding that a tool, a server or a text is safe.

Report a problem

The security contact is published in /.well-known/security.txt; the full role directory is at /contact.