Signed, deterministic compliance state per object per jurisdiction, resolved upstream.
Quick Install
Automated & IDE SetupCopy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.
Manual Client & Custom JSON ConfigExpand JSON ▾
Client Config & Setup
Remote HTTPChoose your client or environment
Target File:
💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.
Documentation Overview
RCO-A2A
rco-a2a.ai — Regulatory Compliance Object resolver for AI Agents. Signed, versioned, per-jurisdiction compliance state. mcp.rco-a2a.ai
A Regulatory Compliance Object (RCO) is the signed, deterministic, machine-verifiable compliance state of one object in one jurisdiction: a GTIN in an SM-ECO-10060 member node, resolved upstream against that jurisdiction's versioned rule set and served as one record with one signal and one state. Agents consume the result of the rules, not the rules themselves. The record names the rule set it was resolved under (id, version, hash), the evidence it rests on, the issuer and the key that signed it; the agent reads the record, verifies the signature, and acts. Nothing is resolved at request time and nothing is narrative.
Canonical endpoint: https://mcp.rco-a2a.ai/mcp (streamable-http, no auth on the read tools, typed errors).
This repository is the MIT protocol layer and the connect kit: the record schema, rule-set schema, issuer-registry schema, tool contract, signature test vectors and fleet manifest under schema/, plus runnable examples against the live resolver. The GSC rail (records, rule sets, keys, fleet operation) is a proprietary GSC service. Nothing here carries a key, a secret or a customer.
Tools
| Tool | What it does |
|---|---|
resolve_compliance | Return the current signed RCO for an object in a jurisdiction. Inside the resolved universe an unknown object returns a pre-resolved, signed CPG-404 record; outside it the typed error record_not_found. |
get_record | Return any RCO by record_id, including superseded records: the audit trail, retained byte-identical. |
list_issuers | Return the signed consortium issuer registry, verbatim as published at consortium-10060.org/issuers.json. |
list_rule_sets | List the versioned rule sets in force and formerly in force for a jurisdiction: id, version, hash, effective dates, artifact URL. Never the regulation text. |
publish_record | Issuer-only. The one write path in the suite: publishes a signed RCO to the partner rail (rco-a2a-cpg.ai) and accepts only what already verifies against the issuer's own registered key. Behind the partner door, key per issuer. |
Keyring and record signing
- Keyring: https://dpuone.ai/.well-known/jwks.json. GSC records carry
key_idgsc-rco-2026-08andverification_urlpointing at that keyring; the keyring is rooted in the signed issuer registry at https://consortium-10060.org/issuers.json. - Signature: detached JWS Compact Serialization (RFC 7515 with RFC 7797
b64:false), ES256 over the RFC 8785 canonical JSON of the record with thesignaturemember removed. The signature field isBASE64URL(protected) || '..' || BASE64URL(signature). Verification verifies every byte of the canonical signing payload; nothing claims to reproduce signature bytes. Test vectors with a published test key:schema/v1.2/signature-test-vectors.json. - Trust anchor: the consortium key
gsc-consortium-2026-08is pinned on the dpuone keyring page and in DNS at_trust-anchor.consortium-10060.org.
Current record-holding records
The record-holder is the pair GTIN × jurisdiction; nothing else is a unit. resolve_compliance returns the current record for the pair. When a pair is re-resolved, a new record is issued with the next sequence number and its supersedes field names the record it replaces; the superseded record is never modified or removed and stays retrievable by get_record. The record_id carries the sequence: rco:<issuer>:<object_id>:<jurisdiction>:<n>. The published list of current record-holding pairs on the GSC rail is https://rco-a2a.ai/schema/v1.3/record-holders.json.
Examples
| Walk | Python | TypeScript |
|---|---|---|
one worked territory (IT-ECO-10060, GTIN 00990832300082): resolve_compliance, verify the signature against the keyring, get_record on the record and down its supersedes chain; then the same chain walk on the rail's one supersession pair, for the shape of a chain with depth | examples/rco_walk.py | examples/rco_walk.ts |
Python 3 standard library (cryptography for the signature check when installed). TypeScript runs on Node 24 as-is (node examples/rco_walk.ts) with no dependencies. Each script prints what it got and stops. Live endpoint only.
The full 19-territory pull for the elyssah case study, with the re-cut script, lives in the elyssah connect kit: https://github.com/greencore-solutions/elyssah/tree/main/rco — it pulls from this resolver; it is not duplicated here.
Sources on the wire
https://rco-a2a.ai · https://rco-a2a-bpc.ai (GSC rail) · https://rco-a2a-cpg.ai (partner rail) · https://status.rco-a2a.ai · https://dpuone.ai/.well-known/jwks.json · https://consortium-10060.org/issuers.json · https://sm-eco-10060.org · https://acm-68000.org
Registry listing: io.github.greencore-solutions/rco-a2a. Anthropic connector directory: rco-a2a.
GreenCore Solutions Corp. — 4611 Viking Way, Suite #260, Richmond BC V6V 2K9 Canada GSC Agentic Pty Ltd — Level 1, 63-73 Ann Street, Surry Hills NSW 2010, Australia
Operated by GreenCore Solutions Corp. · https://gsc-em.com · @GSC_Rail_ai · @ACM68000
Related MCP Servers
Reviews
No reviews yet — be the first to share how this listing worked for you.
Frequently Asked Questions about RCO A2A Regulatory Compliance Objects
AllMCPs Directory Badge
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
Badge Style:
Live Dynamic SVG Preview
Markdown (GitHub README)
[](https://allmcps.com/mcp/rco-a2a-regulatory-compliance-objects)HTML Embed
<a href="https://allmcps.com/mcp/rco-a2a-regulatory-compliance-objects"><img src="https://allmcps.com/api/badge/rco-a2a-regulatory-compliance-objects?style=directory" alt="RCO A2A Regulatory Compliance Objects on AllMCPs" /></a>Technical Specs & Signals
CategoryDeveloper Tools
36Quality signal: Fair · 36/100How this signal is calculated ▾
Server availabilityNot measured
Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.
Verified ownership10/20
Documentation & tools16/30
Adoption & activity1/15
Community engagement0/10
A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.
Own this project?
This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.
Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.
Claim & get free dofollowShare & Embed
Add our SVG badge (dark/light directory styles) or embeddable widget to your site.