Skip to main content
Glama

Issue a Rights Receipt for one asset

issue_rights_receipt

Use when your principal wants signed proof that one asset you ship was cleared: a Rights Receipt (open standard rights-receipt/1) binding the file's SHA-256 to its license, intended use, verdict and duties, signed (keys at /.well-known/jwks.json) and committed to the ledger. Ship it as .rights.json. Call with {"asset": {"sha256": "<64-hex sha256 of the file>", "kind": "font", "name": "Inter.ttf"}, "license": "OFL-1.1", "intended_use": {"commercial_use": true}}.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "asset": "<asset>"
    },
    "name": "issue_rights_receipt"
  }
}

Input Schema

NameRequiredDescriptionDefault
agentNo
assetYesThe file
api_keyNoDeprecated: use Authorization: Bearer <key> (arguments can reach transcripts).
licenseNoSPDX id
ttl_daysNo
attributionNo
resource_idNo
intended_useNoSame shape as check_license
idempotency_keyNoOptional: a retry with the same key returns the first proof.

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed4 schema fields changed
    • addedInput schema / properties / asset / description
      Added value: +"The file"
    • addedInput schema / properties / asset / properties / sha256 / description
      Added value: +"64-hex SHA-256"
    • addedInput schema / properties / intended_use / description
      Added value: +"Same shape as check_license"
    • addedInput schema / properties / license / description
      Added value: +"SPDX id"
  2. Changed2 schema fields changed
    • addedInput schema / properties / api_key / deprecated
      Added value: +true
    • changedInput schema / properties / api_key / description
      Previous value: -"Your Rightshold API key (rs_...). Only needed if your MCP client cannot send Authorization: Bearer <key>."New value: +"Deprecated: use Authorization: Bearer <key> (arguments can reach transcripts)."
  3. Changed1 schema field changed
    • changedInput schema / properties / idempotency_key / description
      Previous value: -"Optional: a retry with the same key returns the proof already issued instead of a second one."New value: +"Optional: a retry with the same key returns the first proof."
  4. Added

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare the safety profile (readOnly=false, openWorld=false, idempotent=false, destructive=false); the description adds substantial context beyond that: the receipt is signed with keys published at /.well-known/jwks.json, it is committed to the ledger, and it should be shipped as <file>.rights.json. It does not explain why idempotentHint is false despite the idempotency_key parameter, and does not describe error or conflict behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is front-loaded with the trigger condition and the receipt's semantics, then closes with a concrete call example that earns its space. It is dense but not padded; the single long opening sentence is a little packed but remains readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, yet the description still usefully specifies the emitted artifact name and signing-key location. For a 9-parameter mutation tool with nested objects it covers the essential path, though the optional parameters (ttl_days, attribution, resource_id, idempotency_key) and auth expectations are left thin.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 56% across 9 parameters, so the schema does a moderate share of the work. The inline JSON example usefully clarifies asset.sha256, kind, name, license and intended_use (and cross-references check_license for its shape), but ttl_days, attribution, resource_id and idempotency_key are never addressed in the description. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource — issuing a Rights Receipt (open standard rights-receipt/1) that binds a file's SHA-256 to its license, intended use, verdict and duties. It is concrete enough to distinguish from read-only siblings like check_license or verify_rights_manifest, but it never names the closest sibling (issue_rights_manifest) to draw the boundary explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear trigger condition: 'Use when your principal wants signed proof that one asset you ship was cleared.' That tells the agent the situation in which this tool applies. However, it offers no when-not guidance and does not compare itself to issue_rights_manifest or check_license, so the agent must infer the boundary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources