ai·rete·rag
PYPI · AI-RETE-RAG-MCP · 3 COMPONENTS · SCANNED SEP 20
Author rules from policy docs, then decide: a Rete engine gives the verdict, an LLM explains why.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 0 of 29 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 27 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability66
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1843 tokens (~230/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the ai·rete·rag MCP server?
ai·rete·rag runs locally as a PyPI package, launched with uvx ai-rete-rag-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · ai-rete-rag-mcp
claude mcp add com-ai-rete-rag-ai-rete-rag-mcp -- uvx ai-rete-rag-mcp
{
"mcpServers": {
"com-ai-rete-rag-ai-rete-rag-mcp": {
"command": "uvx",
"args": [
"ai-rete-rag-mcp"
]
}
}
} {
"servers": {
"com-ai-rete-rag-ai-rete-rag-mcp": {
"command": "uvx",
"args": [
"ai-rete-rag-mcp"
]
}
}
} codex mcp add com-ai-rete-rag-ai-rete-rag-mcp -- uvx ai-rete-rag-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-ai-rete-rag-ai-rete-rag-mcp": {
"type": "local",
"command": [
"uvx",
"ai-rete-rag-mcp"
],
"enabled": true
}
}
} openclaw mcp add com-ai-rete-rag-ai-rete-rag-mcp --command uvx --arg ai-rete-rag-mcp
mcp_servers:
com-ai-rete-rag-ai-rete-rag-mcp:
command: "uvx"
args: ["ai-rete-rag-mcp"] {
"McpServers": {
"com-ai-rete-rag-ai-rete-rag-mcp": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"ai-rete-rag-mcp"
]
}
}
} assistant mcp add com-ai-rete-rag-ai-rete-rag-mcp -t stdio -c uvx -a ai-rete-rag-mcp
{
"mcpServers": {
"com-ai-rete-rag-ai-rete-rag-mcp": {
"command": "uvx",
"args": [
"ai-rete-rag-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
- Stability: 0.97 → pass security
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 −4
- Stability: pass → 0.77 functional
- 12 Sept 26 +1
- Stability: 0.97 → pass security
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 8 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/ai-rete-rag-mcp@0.7.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 29 packages
| Packages resolved | 29 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
decide Make a decision ~392
Make a deterministic, auditable decision in a domain. The verdict comes from the domain's rule set (Rete engine, never the LLM), so it is reproducible and compliant. The explanation is generated from the domain's ingested policy documents. Args: domain: Rule-set domain, e.g. "loan", "fraud", "clinical". query: Natural-language question or decision request. facts: Structured facts for working memory, e.g. {"credit_score": 710, "annual_income": 85000}. Use `list_rules` to see which fields a domain's rules test. unstructured_text: Optional free text (an application, a case note); facts are extracted from it automatically and merged. response_mode: "verdict_only" (fastest), "verdict_with_explanation", or "full_audit" (every rule evaluation + retrieved chunks, available on every plan including the free tier). rule_firings come back in causal order: a rule that matched a fact asserted by an earlier firing appears after it, with the derived facts listed under `asserted_facts`. filter_retrieval_with_rules: Pattern 01 — run the rules first and let a fired rule's `retrieval_scope` action narrow which documents the retrieval searches before it runs. extract_from_retrieval: Pattern 02 — parse the retrieved documents into facts and assert them into working memory, so rules fire on what was actually read (not just the facts you passed).
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | – |
| extract_from_retrieval | boolean | – | – |
| facts | – | – | – |
| filter_retrieval_with_rules | boolean | – | – |
| query | string | yes | – |
| response_mode | string | – | – |
| unstructured_text | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
get_rule_source Get rule source (YAML) ~61
Fetch a domain's rule set as editable YAML (plus the parsed rules and whether you may edit it). Use this before `put_rules` to see the current rules; the built-in demo domains are read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
get_usage Check usage and quota ~22
Show this account's decision usage, plan, and remaining monthly quota.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
import_policy_rules Draft rules from a policy ~193
Convert a written policy document into DRAFT decision rules (LLM-assisted). Returns validated draft rules (when/action, including chained asserts where the policy stages its determinations), derived rule→rule edges, and overlap warnings. Each returned rule carries a `citation` field holding the policy sentence it encodes (also summarized in the top-level `citations` map). NOTHING IS SAVED: review the drafts (and show them to the user), then persist explicitly with `put_rules` — validate first with dry_run=true, and keep each rule's `citation` in the YAML you save so the audit trail back to the policy survives. Args: domain: Domain the rules are drafted for (an owned domain or a new name). policy_text: The policy document text (max ~50k characters).
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | – |
| policy_text | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
ingest_text Ingest policy text ~150
Add policy/reference text to a domain's knowledge base. The text is chunked and embedded; explanations for future decisions in this domain will cite it. Creating a new domain claims it for your account (plan limits apply). The built-in demo domains are read-only — ingest into your own domain instead. On team plans, only the domain admin (the member who created the domain, or the subscription owner) can add documents. Args: domain: Domain to ingest into (existing or new). text: The policy or reference text. source: Optional source name shown in the document list.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | – |
| source | – | – | – |
| text | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_documents List documents ~27
List the documents ingested into a domain's knowledge base.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_rules List rules ~169
List the decision rules for one domain (or all domains). Returns each rule's conditions — either a flat AND list (field / operator / value) or a `when` condition tree (nested all/any/not) — plus its verdict, salience, and any asserted facts (`action.assert`, the facts a rule produces for other rules to consume). `edges` lists the derived rule→rule dependencies: src asserts a fact type that dst's conditions test (forward chaining). Each rule may also carry `citation` — the policy sentence it encodes — which is what lets a decision be traced back to the source clause. Also includes overlap warnings. Use this to learn which fact fields a domain expects before calling `decide`.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
put_rules Save rules ~713
Create or replace a domain's rule set from YAML (self-serve rule authoring). The first save to a new domain claims it for your account (plan limits apply); the built-in demo domains are read-only. Rules are validated before saving — set dry_run=true to validate without persisting. The response reports ok/errors, the parsed rules, and any overlap warnings. YAML format — a list of rules. Flat form (conditions are AND-ed): - name: "Approve" salience: 10 conditions: - type: loan field: credit_score op: ">=" value: 700 action: verdict: "APPROVED" reason: "Credit score meets threshold" Tree form — `when:` holds nested all/any/not condition groups, and an action may assert derived facts that other rules consume (forward chaining; the rule graph derives from these automatically): - name: "Sepsis Screen" salience: 30 when: all: - {type: clinical, field: temperature_f, op: ">=", value: 101.5} - any: - {type: clinical, field: wbc_count, op: ">", value: 12.0} - {type: clinical, field: bands_pct, op: ">", value: 10} action: verdict: "URGENT_ALERT" assert: - {type: sepsis_flag, fields: {severity: high}} - name: "Escalate" salience: 40 when: all: - {type: sepsis_flag, field: severity, op: "==", value: high} - {type: clinical, field: age, op: ">=", value: 65} action: verdict: "ADMIT_ICU" Use either `conditions:` or `when:` per rule, never both. `not` passes when the inner condition does not hold (including when the field is absent). Produce/consume cycles between rules are rejected at validation. An action may also carry `retrieval_scope: { <key>: <value> }` to narrow which documents retrieval searches (Pattern 01). A rule may also carry `citation:` — the policy sentence it encodes. It is stored with the rule and shown beside it in decision a…
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | – |
| dry_run | boolean | – | – |
| rules_yaml | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
What is the ai·rete·rag MCP server?
ai·rete·rag is an MCP server listed in the public MCP registry as com.ai-rete-rag/ai-rete-rag-mcp. Author rules from policy docs, then decide: a Rete engine gives the verdict, an LLM explains why. This page covers its PyPI package (ai-rete-rag-mcp).
Is the ai·rete·rag MCP server safe to use?
ai·rete·rag scores 81 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the ai·rete·rag MCP server expose?
ai·rete·rag exposes 8 tools: decide, list_rules, ingest_text, list_documents, get_rule_source, and 3 more. Their descriptions and schemas cost roughly 1,727 tokens of context every time the server is loaded.
Is the ai·rete·rag MCP server still maintained?
ai·rete·rag is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the ai·rete·rag MCP server under?
ai·rete·rag declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.