{"name":"io.github.greencore-solutions/rco-a2a","slug":"greencore-solutions-rco-a2a","title":"RCO-A2A - Regulatory Compliance Objects","description":"Signed, deterministic compliance state per object per jurisdiction, resolved upstream","url":"https://mcp.market/server/greencore-solutions-rco-a2a","rating":null,"grade":"B","score":79,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":23,"stars":0,"forks":0,"downloads_week":null,"last_push_at":"2026-09-17T14:35:44.000Z","license":"MIT"},"claimed":false,"transport":"remote","callable_via_gateway":true,"default_price_micros":0,"repository":"https://github.com/greencore-solutions/rco-a2a","website":"https://rco-a2a.ai","version":"1.0.2","remotes":[{"type":"streamable-http","url":"https://mcp.rco-a2a.ai/mcp"}],"packages":[],"tools":[{"name":"get_record","description":"Return any RCO by record_id, including superseded records - the audit trail, retained byte-identical.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"record_id":{"type":"string","pattern":"^rco:[a-z0-9-]+:(gtin:[0-9]{14}|host:([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,63}):([A-Z]{2}-ECO-10060|apex):[1-9][0-9]*$"}},"required":["record_id"]}},{"name":"list_issuers","description":"Return the signed consortium issuer registry document, verbatim as published at consortium-10060.org/issuers.json.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"list_rule_sets","description":"List the versioned rule sets in force and formerly in force for a jurisdiction: id, version, hash, effective dates, artifact URL. Never the regulation text.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"jurisdiction":{"type":"string","enum":["EU-ECO-10060","FR-ECO-10060","DE-ECO-10060","ES-ECO-10060","IT-ECO-10060","NL-ECO-10060","PL-ECO-10060","CH-ECO-10060","UK-ECO-10060","BE-ECO-10060","PT-ECO-10060","AT-ECO-10060","IE-ECO-10060","CZ-ECO-10060","DK-ECO-10060","SE-ECO-10060","FI-ECO-10060","NO-ECO-10060","GR-ECO-10060","US-ECO-10060","CA-ECO-10060","MX-ECO-10060","BR-ECO-10060","AR-ECO-10060","CL-ECO-10060","CO-ECO-10060","CR-ECO-10060","DO-ECO-10060","EC-ECO-10060","GT-ECO-10060","PA-ECO-10060","PE-ECO-10060","UY-ECO-10060","AU-ECO-10060","JP-ECO-10060","KR-ECO-10060","SG-ECO-10060","IN-ECO-10060","ID-ECO-10060","MY-ECO-10060","PH-ECO-10060","TH-ECO-10060","VN-ECO-10060","AE-ECO-10060","SA-ECO-10060","IL-ECO-10060","TR-ECO-10060","MA-ECO-10060","ZA-ECO-10060","apex"]}},"required":["jurisdiction"]}},{"name":"publish_record","description":"Publish a signed Regulatory Compliance Object to the partner rail (rco-a2a-cpg.ai). The ONLY write path in the suite, and it accepts only what already verifies: the record must be schema-valid RCO v1.3, its issuer must be a cpg-rail issuer active in the signed consortium registry, its verification_url must equal that issuer's registry JWKS URL, its detached JWS must verify against that JWKS, and its record_id (and any supersession) must be consistent. GSC never authors a partner record and never holds a partner private key: GSC verifies, receipts to Azure Confidential Ledger, and serves. A submitted record is never modified. Idempotent: republishing a byte-identical record returns the same receipt. Typed errors only.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"record":{"$comment":"Record wire version stays 1.0. Cross-field checks a JSON Schema cannot express are normative in the specification and enforced by the published validator: (a) resolved_at < valid_until; (b) record_id's issuer/object/jurisdiction segments equal issuer.id, object_id and jurisdiction; (c) supersedes, when present, differs from record_id only in its trailing sequence number, which is exactly one lower; (d) GTINs are zero-padded GTIN-14 with a valid GS1 check digit; (e) host object_ids are lowercase, punycode-encoded, no trailing dot. record_id keeps its colons on the wire; a filesystem mirror replaces each colon with an underscore (CEO ruling 2026-08-29). GB is rejected as invalid_jurisdiction naming the valid set — UK is the member code (permanent GB=UK rule). Verification VERIFIES every byte of the canonical signing payload; nothing claims to reproduce signature bytes (ECDSA is randomized). v1.3 adds the optional case_study boolean and the unit rule: record-holders are keyed GTIN x jurisdiction only (NG-11 s2k). Served flat since 1.0.2 (no alternation constructs; the signal discriminator binds the state); the full contract schema is https://rco-a2a.ai/schema/v1.4/resolve_compliance.tool.json and is what the validator enforces.","type":"object","required":["rco_version","record_id","object_id","jurisdiction","signal","state","resolved_at","valid_until","supersedes","eco_ref","rule_set","evidence_refs","issuer","key_id","verification_url","signature"],"properties":{"rco_version":{"const":"1.0"},"record_id":{"type":"string","pattern":"^rco:[a-z0-9-]+:(gtin:[0-9]{14}|host:([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,63}):([A-Z]{2}-ECO-10060|apex):[1-9][0-9]*$"},"object_id":{"type":"string","pattern":"^(gtin:[0-9]{14}|host:([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,63})$"},"jurisdiction":{"enum":["EU-ECO-10060","FR-ECO-10060","DE-ECO-10060","ES-ECO-10060","IT-ECO-10060","NL-ECO-10060","PL-ECO-10060","CH-ECO-10060","UK-ECO-10060","BE-ECO-10060","PT-ECO-10060","AT-ECO-10060","IE-ECO-10060","CZ-ECO-10060","DK-ECO-10060","SE-ECO-10060","FI-ECO-10060","NO-ECO-10060","GR-ECO-10060","US-ECO-10060","CA-ECO-10060","MX-ECO-10060","BR-ECO-10060","AR-ECO-10060","CL-ECO-10060","CO-ECO-10060","CR-ECO-10060","DO-ECO-10060","EC-ECO-10060","GT-ECO-10060","PA-ECO-10060","PE-ECO-10060","UY-ECO-10060","AU-ECO-10060","JP-ECO-10060","KR-ECO-10060","SG-ECO-10060","IN-ECO-10060","ID-ECO-10060","MY-ECO-10060","PH-ECO-10060","TH-ECO-10060","VN-ECO-10060","AE-ECO-10060","SA-ECO-10060","IL-ECO-10060","TR-ECO-10060","MA-ECO-10060","ZA-ECO-10060","apex"],"$comment":"The 49 SM-ECO-10060 member jurisdictions + EU bloc + apex, generated from the signed member registry. GB is rejected; UK is the code."},"signal":{"enum":["CPG-000","CPG-200","CPG-300","CPG-403","CPG-404","CPG-451","CPG-500"],"$comment":"Discriminator. Each signal binds exactly one state: CPG-000=NOT_APPLICABLE, CPG-200=ALLOW, CPG-300=CONDITIONAL, CPG-403=RESTRICT, CPG-404=NOT_FOUND, CPG-451=ESCALATE, CPG-500=SYSTEM_ERROR. conditions: required non-empty for CPG-300, forbidden otherwise. Enforced by the validator."},"state":{"enum":["NOT_APPLICABLE","ALLOW","CONDITIONAL","RESTRICT","NOT_FOUND","ESCALATE","SYSTEM_ERROR"]},"conditions":{"type":"array","items":{"type":"object","required":["code","ref"],"properties":{"code":{"type":"string","minLength":1},"ref":{"type":"string","format":"uri"}}}},"resolved_at":{"type":"string","format":"date-time"},"valid_until":{"type":"string","format":"date-time"},"supersedes":{"type":["string","null"],"pattern":"^rco:[a-z0-9-]+:(gtin:[0-9]{14}|host:([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,63}):([A-Z]{2}-ECO-10060|apex):[1-9][0-9]*$"},"eco_ref":{"type":["object","null"],"required":["url","hash"],"properties":{"url":{"type":"string","format":"uri"},"hash":{"type":"string","pattern":"^sha256:[a-f0-9]{64}$"}}},"rule_set":{"type":"object","required":["id","version","hash","effective_from"],"properties":{"id":{"type":"string"},"version":{"type":"string","pattern":"^20[0-9]{2}\\.(0[1-9]|1[0-2])(\\.[0-9]+)?$"},"hash":{"type":"string","pattern":"^sha256:[a-f0-9]{64}$"},"effective_from":{"type":"string","format":"date-time"}}},"evidence_refs":{"type":"array","items":{"type":"object","required":["kind","url","hash"],"properties":{"kind":{"enum":["esg-credential","dpu-proof","eco-object","other"]},"url":{"type":"string","format":"uri"},"hash":{"type":"string","pattern":"^sha256:[a-f0-9]{64}$"}}}},"issuer":{"type":"object","required":["id","rail","name"],"properties":{"id":{"type":"string","pattern":"^[a-z0-9-]+$"},"rail":{"enum":["bpc","cpg"]},"name":{"type":"string","minLength":1}}},"key_id":{"type":"string","minLength":1},"verification_url":{"type":"string","format":"uri","$comment":"Cross-check only. The verification root is the signed consortium issuer registry: consumers resolve issuer.id there and take the JWKS URL from the registry; mismatch with this field fails verification."},"signature":{"type":"string","pattern":"^[A-Za-z0-9_-]+\\.\\.[A-Za-z0-9_-]+$","description":"Detached JWS Compact Serialization (RFC 7515) with unencoded payload (RFC 7797): BASE64URL(protected header {alg:ES256, b64:false, crit:[b64], kid}) '..' BASE64URL(ES256 raw R||S). Signing input = ASCII(BASE64URL(protected header) '.') || RFC 8785 canonical JSON of the record with this member removed. Test vectors: signature-test-vectors.json."},"case_study":{"type":"boolean","default":false,"$comment":"v1.3 (CEO close-out ruling): true marks a labelled case-study record (e.g. the elyssah worked chain); never counted in the real-maker number. Absent = false."}}}},"required":["record"]}},{"name":"resolve_compliance","description":"Return the current signed Regulatory Compliance Object for an object in a jurisdiction. Deterministic. Inside the resolved universe (SPEC v1.2 pairs.json + the jurisdiction doors' own objects) an unknown object returns a pre-resolved, signed CPG-404 record; outside it the typed error record_not_found is returned - nothing is signed at request time. Never narrative.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"object_id":{"type":"string","pattern":"^(gtin:[0-9]{14}|host:([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,63})$"},"jurisdiction":{"type":"string","enum":["EU-ECO-10060","FR-ECO-10060","DE-ECO-10060","ES-ECO-10060","IT-ECO-10060","NL-ECO-10060","PL-ECO-10060","CH-ECO-10060","UK-ECO-10060","BE-ECO-10060","PT-ECO-10060","AT-ECO-10060","IE-ECO-10060","CZ-ECO-10060","DK-ECO-10060","SE-ECO-10060","FI-ECO-10060","NO-ECO-10060","GR-ECO-10060","US-ECO-10060","CA-ECO-10060","MX-ECO-10060","BR-ECO-10060","AR-ECO-10060","CL-ECO-10060","CO-ECO-10060","CR-ECO-10060","DO-ECO-10060","EC-ECO-10060","GT-ECO-10060","PA-ECO-10060","PE-ECO-10060","UY-ECO-10060","AU-ECO-10060","JP-ECO-10060","KR-ECO-10060","SG-ECO-10060","IN-ECO-10060","ID-ECO-10060","MY-ECO-10060","PH-ECO-10060","TH-ECO-10060","VN-ECO-10060","AE-ECO-10060","SA-ECO-10060","IL-ECO-10060","TR-ECO-10060","MA-ECO-10060","ZA-ECO-10060","apex"]}},"required":["object_id","jurisdiction"]}}],"scan":{"score":79,"grade":"B","scanned_at":"2026-09-19T00:26:29.739Z","report":{"scannerVersion":"0.1.3","scannedAt":"2026-09-19T00:26:29.725Z","components":{"code":{"score":-1,"max":25,"notes":["remote-only server, no package to scan"]},"reliability":{"score":20,"max":20,"notes":["remote reachable in 1736ms"]},"poisoning":{"score":15,"max":15,"notes":["5 tool descriptions checked"]},"auth":{"score":3,"max":15,"notes":["open endpoint exposes 1 write-action tools with no auth"]},"maintenance":{"score":15,"max":15,"notes":["last push 1 days ago"]},"identity":{"score":6,"max":10,"notes":["registry namespace matches repository owner"]}},"findings":[{"id":"auth.open-write","severity":"high","component":"auth","title":"Write-action tools reachable without authentication"}],"inputs":{"probes":[{"url":"https://mcp.rco-a2a.ai/mcp","reachable":true,"authRequired":false,"latencyMs":1736,"serverInfo":{"name":"rco-a2a","version":"1.0.2"}}],"packages":[],"repo":{"found":true,"owner":"greencore-solutions","repo":"rco-a2a","archived":false,"pushedAt":"2026-09-17T14:35:44Z","stars":0,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/279137771?v=4","ownerCreatedAt":"2026-04-24T22:25:54Z","license":"MIT"},"icon":{"url":"https://rco-a2a.ai/logo.svg","source":"site"},"presence":{"stars":0,"forks":0,"downloadsWeek":null,"license":"MIT","lastPushAt":"2026-09-17T14:35:44.000Z","score":23}}}},"grade_history":[{"kind":"restore","fromGrade":"D","toGrade":"B","reason":"score 79: Write-action tools reachable without authentication","createdAt":"2026-09-19T00:26:31.167Z"}],"reviews":[]}