How do I install Rco A2a?

Rco A2a is a remote plugin. You do not need to install anything locally. Add the server URL to your AI app's MCP configuration and you are ready to go.

Is Rco A2a safe to use?

Yes. Rco A2a passed MCP Marketplace's automated security scan with a score of 10/10 (low risk). Every server on MCP Marketplace is security-scanned before it's listed; see the full security report on this page for the findings and permissions.

What AI apps work with Rco A2a?

Rco A2a uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Rco A2a MCP Server

by Greencore Solutions

Developer ToolsLow Risk10.0MCP RegistryRemote

Free

Server data from the Official MCP Registry

Signed, deterministic compliance state per object per jurisdiction, resolved upstream

About

Signed, deterministic compliance state per object per jurisdiction, resolved upstream

Remote endpoints: streamable-http: https://mcp.rco-a2a.ai/mcp

Security Report

10.0

Low Risk10.0Low Risk

Valid MCP server (1 strong, 0 medium validity signals). No known CVEs in dependencies. Imported from the Official MCP Registry.

5 tools verified · Open access · No issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Found in Source Code

Found by scanning the linked source code. This listing connects to a hosted endpoint, so none of this runs on your machine: it describes what the server software does where it is hosted.

HTTP Network Access

Connects to external APIs or services over the internet.

How to Connect

Remote Plugin

No local installation needed. Your AI client connects to the remote endpoint directly.

Add this to your MCP configuration to connect:

{
  "mcpServers": {
    "io-github-greencore-solutions-rco-a2a": {
      "url": "https://mcp.rco-a2a.ai/mcp"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

RCO-A2A

rco-a2a.ai — Regulatory Compliance Object resolver for AI Agents. Signed, versioned, per-jurisdiction compliance state. mcp.rco-a2a.ai

A Regulatory Compliance Object (RCO) is the signed, deterministic, machine-verifiable compliance state of one object in one jurisdiction: a GTIN in an SM-ECO-10060 member node, resolved upstream against that jurisdiction's versioned rule set and served as one record with one signal and one state. Agents consume the result of the rules, not the rules themselves. The record names the rule set it was resolved under (id, version, hash), the evidence it rests on, the issuer and the key that signed it; the agent reads the record, verifies the signature, and acts. Nothing is resolved at request time and nothing is narrative.

Canonical endpoint: https://mcp.rco-a2a.ai/mcp (streamable-http, no auth on the read tools, typed errors).

This repository is the MIT protocol layer and the connect kit: the record schema, rule-set schema, issuer-registry schema, tool contract, signature test vectors and fleet manifest under schema/, plus runnable examples against the live resolver. The GSC rail (records, rule sets, keys, fleet operation) is a proprietary GSC service. Nothing here carries a key, a secret or a customer.

Tools

Tool	What it does
`resolve_compliance`	Return the current signed RCO for an object in a jurisdiction. Inside the resolved universe an unknown object returns a pre-resolved, signed CPG-404 record; outside it the typed error `record_not_found`.
`get_record`	Return any RCO by record_id, including superseded records: the audit trail, retained byte-identical.
`list_issuers`	Return the signed consortium issuer registry, verbatim as published at consortium-10060.org/issuers.json.
`list_rule_sets`	List the versioned rule sets in force and formerly in force for a jurisdiction: id, version, hash, effective dates, artifact URL. Never the regulation text.
`publish_record`	Issuer-only. The one write path in the suite: publishes a signed RCO to the partner rail (rco-a2a-cpg.ai) and accepts only what already verifies against the issuer's own registered key. Behind the partner door, key per issuer.

Keyring and record signing

Keyring: https://dpuone.ai/.well-known/jwks.json. GSC records carry key_id gsc-rco-2026-08 and verification_url pointing at that keyring; the keyring is rooted in the signed issuer registry at https://consortium-10060.org/issuers.json.
Signature: detached JWS Compact Serialization (RFC 7515 with RFC 7797 b64:false), ES256 over the RFC 8785 canonical JSON of the record with the signature member removed. The signature field is BASE64URL(protected) || '..' || BASE64URL(signature). Verification verifies every byte of the canonical signing payload; nothing claims to reproduce signature bytes. Test vectors with a published test key: schema/v1.2/signature-test-vectors.json.
Trust anchor: the consortium key gsc-consortium-2026-08 is pinned on the dpuone keyring page and in DNS at _trust-anchor.consortium-10060.org.

Current record-holding records

The record-holder is the pair GTIN × jurisdiction; nothing else is a unit. resolve_compliance returns the current record for the pair. When a pair is re-resolved, a new record is issued with the next sequence number and its supersedes field names the record it replaces; the superseded record is never modified or removed and stays retrievable by get_record. The record_id carries the sequence: rco:<issuer>:<object_id>:<jurisdiction>:<n>. The published list of current record-holding pairs on the GSC rail is https://rco-a2a.ai/schema/v1.3/record-holders.json.

Examples

Walk	Python	TypeScript
one worked territory (IT-ECO-10060, GTIN 00990832300082): `resolve_compliance`, verify the signature against the keyring, `get_record` on the record and down its `supersedes` chain; then the same chain walk on the rail's one supersession pair, for the shape of a chain with depth	`examples/rco_walk.py`	`examples/rco_walk.ts`

Python 3 standard library (cryptography for the signature check when installed). TypeScript runs on Node 24 as-is (node examples/rco_walk.ts) with no dependencies. Each script prints what it got and stops. Live endpoint only.

The full 19-territory pull for the elyssah case study, with the re-cut script, lives in the elyssah connect kit: https://github.com/greencore-solutions/elyssah/tree/main/rco — it pulls from this resolver; it is not duplicated here.

Sources on the wire

https://rco-a2a.ai · https://rco-a2a-bpc.ai (GSC rail) · https://rco-a2a-cpg.ai (partner rail) · https://status.rco-a2a.ai · https://dpuone.ai/.well-known/jwks.json · https://consortium-10060.org/issuers.json · https://sm-eco-10060.org · https://acm-68000.org

Registry listing: io.github.greencore-solutions/rco-a2a. Anthropic connector directory: rco-a2a.

GreenCore Solutions Corp. — 4611 Viking Way, Suite #260, Richmond BC V6V 2K9 Canada GSC Agentic Pty Ltd — Level 1, 63-73 Ann Street, Surry Hills NSW 2010, Australia

Operated by GreenCore Solutions Corp. · https://gsc-em.com · @GSC_Rail_ai · @ACM68000

Reviews

No reviews yet

Be the first to review this server!

More Developer Tools MCP Servers

Fetch

Free

by Modelcontextprotocol · Developer Tools

Web content fetching and conversion for efficient LLM usage

Git

Free

by Modelcontextprotocol · Developer Tools

Read, search, and manipulate Git repositories programmatically

Toleno

Free

by Toleno · Developer Tools

Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.

MCP Marketplace

Free

by mcp-marketplace · Developer Tools

Search and install MCP servers from inside your AI client.

mcp-creator-python

Free

by mcp-marketplace · Developer Tools

Create, build, and publish Python MCP servers to PyPI — conversationally.

FinAgent

Free

by mcp-marketplace · Finance

Free stock data and market news for any MCP-compatible AI assistant.