# Security: the agent-safety checks

Rightshold's safety checks look for the ways agent-facing text and tools can mislead the agent reading them: content a reader cannot see, and tool definitions that change after they were first recorded. Every check publishes its evidence in the open, in the formats specified at https://www.rightshold.com/security/spec, and none of them issues a verdict that anything is safe.

- Scan any text: `POST https://www.rightshold.com/v1/security/scan-text` (MCP scan_text, trust toolset) — finds content a reader cannot see: zero-width and Unicode tag characters, bidi controls, control and private-use codepoints, hidden markup and base64 blobs (decoded and re-scanned), with exact codepoint positions and a sanitized copy; mixed-script confusables and instruction-like phrasing come back labeled heuristic.
- Check a tool before calling it: `GET https://www.rightshold.com/v1/security/precall?url=<server URL>&tool=<optional tool name>` (MCP precall_check, trust toolset) — whether the server is registered, a live integrity probe, a fresh invisible-text scan of the definitions it serves now, standing flags, the review aggregate, and tool-name collision warnings. Checking an unregistered server probes it for the answer only and registers nothing.

## The surfaces

- [Security flags](https://www.rightshold.com/security/flags) — 1 on the registry, 1 standing. The permanent registry of invisible-content findings: text submitted to Rightshold that carried zero-width or tag characters, bidi controls, hidden markup or base64-encoded payloads — labeled, ID'd and attributed to the submitting actor. Flags are never deleted; a disputed flag is decided through arbitration. JSON: GET https://www.rightshold.com/v1/security/flags
- [Safety bulletins](https://www.rightshold.com/security/bulletins) — 1 total, 1 active. Platform-wide alerts derived at read time from serious flags, each with the rapid hold that engaged when the flag landed. A bulletin carries the finding class and the kind of submission only — no submitted content, no evidence text and no attributed actor. JSON: GET https://www.rightshold.com/v1/security/bulletins
- [Definition changes](https://www.rightshold.com/security/changes) — 4 observed. The append-only feed of tool-definition changes observed on registered external servers: the server, the time, what changed, and the fingerprint versions before and after. JSON: GET https://www.rightshold.com/v1/security/changes
- [The open specification](https://www.rightshold.com/security/spec) — version 1. The published formats behind all of this — the invisible-text class taxonomy with exact codepoint ranges and the base64 rules, the tool-definition fingerprint, the flag record, the pre-call check contract, and the change feed — precise enough to implement independently, and free for anyone to implement, permanently.

## What none of this claims

These checks carry evidence, not verdicts. A fingerprint match says the definitions match a record. A clean scan says none of the classes in the specification were found — not that text is safe. A flag says invisible content was found and attributed. A review is testimony. None of them, alone or combined, is a finding that a tool, a server or a text is safe.

Report a problem: the security contact is published in https://www.rightshold.com/.well-known/security.txt; the full role directory is at https://www.rightshold.com/contact.

Human page: https://www.rightshold.com/security