Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

ai·rete·rag

PYPI · AI-RETE-RAG-MCP · 3 COMPONENTS · SCANNED SEP 20

Author rules from policy docs, then decide: a Rete engine gives the verdict, an LLM explains why.

+4 this week 81 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
  • 0 of 29 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency45
Schema Quality & AI Usability66
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 1843 tokens (~230/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage71
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 0% of tool parameters carry a description.Fail
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the ai·rete·rag MCP server?

ai·rete·rag runs locally as a PyPI package, launched with uvx ai-rete-rag-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · ai-rete-rag-mcp

# add to Claude Code
claude mcp add com-ai-rete-rag-ai-rete-rag-mcp -- uvx ai-rete-rag-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "com-ai-rete-rag-ai-rete-rag-mcp": {
      "command": "uvx",
      "args": [
        "ai-rete-rag-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "com-ai-rete-rag-ai-rete-rag-mcp": {
      "command": "uvx",
      "args": [
        "ai-rete-rag-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add com-ai-rete-rag-ai-rete-rag-mcp -- uvx ai-rete-rag-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-ai-rete-rag-ai-rete-rag-mcp": {
      "type": "local",
      "command": [
        "uvx",
        "ai-rete-rag-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add com-ai-rete-rag-ai-rete-rag-mcp --command uvx --arg ai-rete-rag-mcp
# ~/.hermes/config.yaml
mcp_servers:
  com-ai-rete-rag-ai-rete-rag-mcp:
    command: "uvx"
    args: ["ai-rete-rag-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "com-ai-rete-rag-ai-rete-rag-mcp": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "ai-rete-rag-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add com-ai-rete-rag-ai-rete-rag-mcp -t stdio -c uvx -a ai-rete-rag-mcp
// mcp.json
{
  "mcpServers": {
    "com-ai-rete-rag-ai-rete-rag-mcp": {
      "command": "uvx",
      "args": [
        "ai-rete-rag-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 +1
    • Stability: 0.97 → pass security
  • 18 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 16 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 14 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 −4
    • Stability: pass → 0.77 functional
  • 12 Sept 26 +1
    • Stability: 0.97 → pass security
  • 10 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 8 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed pypi/ai-rete-rag-mcp@0.7.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem pypi

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted hatchling.build

Background: Why install scripts are a supply-chain risk →

Dependencies 29 packages
Packages resolved 29
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 8 exposed · ~1,727 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
decide ~392

Make a deterministic, auditable decision in a domain. The verdict comes from the domain's rule set (Rete engine, never the LLM), so it is reproducible and compliant. The explanation is generated from the domain's ingested policy documents. Args: domain: Rule-set domain, e.g. "loan", "fraud", "clinical". query: Natural-language question or decision request. facts: Structured facts for working memory, e.g. {"credit_score": 710, "annual_income": 85000}. Use `list_rules` to see which fields a domain's rules test. unstructured_text: Optional free text (an application, a case note); facts are extracted from it automatically and merged. response_mode: "verdict_only" (fastest), "verdict_with_explanation", or "full_audit" (every rule evaluation + retrieved chunks, available on every plan including the free tier). rule_firings come back in causal order: a rule that matched a fact asserted by an earlier firing appears after it, with the derived facts listed under `asserted_facts`. filter_retrieval_with_rules: Pattern 01 — run the rules first and let a fired rule's `retrieval_scope` action narrow which documents the retrieval searches before it runs. extract_from_retrieval: Pattern 02 — parse the retrieved documents into facts and assert them into working memory, so rules fire on what was actually read (not just the facts you passed).

NameTypeReqDescription
domainstringyes
extract_from_retrievalboolean
facts
filter_retrieval_with_rulesboolean
querystringyes
response_modestring
unstructured_text
NameTypeReqDescription
resultstringyes

No examples provided.

get_rule_source ~61

Fetch a domain's rule set as editable YAML (plus the parsed rules and whether you may edit it). Use this before `put_rules` to see the current rules; the built-in demo domains are read-only.

NameTypeReqDescription
domainstringyes
NameTypeReqDescription
resultstringyes

No examples provided.

get_usage ~22

Show this account's decision usage, plan, and remaining monthly quota.

Input schema present but exposes no named parameters.

NameTypeReqDescription
resultstringyes

No examples provided.

import_policy_rules ~193

Convert a written policy document into DRAFT decision rules (LLM-assisted). Returns validated draft rules (when/action, including chained asserts where the policy stages its determinations), derived rule→rule edges, and overlap warnings. Each returned rule carries a `citation` field holding the policy sentence it encodes (also summarized in the top-level `citations` map). NOTHING IS SAVED: review the drafts (and show them to the user), then persist explicitly with `put_rules` — validate first with dry_run=true, and keep each rule's `citation` in the YAML you save so the audit trail back to the policy survives. Args: domain: Domain the rules are drafted for (an owned domain or a new name). policy_text: The policy document text (max ~50k characters).

NameTypeReqDescription
domainstringyes
policy_textstringyes
NameTypeReqDescription
resultstringyes

No examples provided.

ingest_text ~150

Add policy/reference text to a domain's knowledge base. The text is chunked and embedded; explanations for future decisions in this domain will cite it. Creating a new domain claims it for your account (plan limits apply). The built-in demo domains are read-only — ingest into your own domain instead. On team plans, only the domain admin (the member who created the domain, or the subscription owner) can add documents. Args: domain: Domain to ingest into (existing or new). text: The policy or reference text. source: Optional source name shown in the document list.

NameTypeReqDescription
domainstringyes
source
textstringyes
NameTypeReqDescription
resultstringyes

No examples provided.

list_documents ~27

List the documents ingested into a domain's knowledge base.

NameTypeReqDescription
domainstringyes
NameTypeReqDescription
resultstringyes

No examples provided.

list_rules ~169

List the decision rules for one domain (or all domains). Returns each rule's conditions — either a flat AND list (field / operator / value) or a `when` condition tree (nested all/any/not) — plus its verdict, salience, and any asserted facts (`action.assert`, the facts a rule produces for other rules to consume). `edges` lists the derived rule→rule dependencies: src asserts a fact type that dst's conditions test (forward chaining). Each rule may also carry `citation` — the policy sentence it encodes — which is what lets a decision be traced back to the source clause. Also includes overlap warnings. Use this to learn which fact fields a domain expects before calling `decide`.

NameTypeReqDescription
domain
NameTypeReqDescription
resultstringyes

No examples provided.

put_rules ~713

Create or replace a domain's rule set from YAML (self-serve rule authoring). The first save to a new domain claims it for your account (plan limits apply); the built-in demo domains are read-only. Rules are validated before saving — set dry_run=true to validate without persisting. The response reports ok/errors, the parsed rules, and any overlap warnings. YAML format — a list of rules. Flat form (conditions are AND-ed): - name: "Approve" salience: 10 conditions: - type: loan field: credit_score op: ">=" value: 700 action: verdict: "APPROVED" reason: "Credit score meets threshold" Tree form — `when:` holds nested all/any/not condition groups, and an action may assert derived facts that other rules consume (forward chaining; the rule graph derives from these automatically): - name: "Sepsis Screen" salience: 30 when: all: - {type: clinical, field: temperature_f, op: ">=", value: 101.5} - any: - {type: clinical, field: wbc_count, op: ">", value: 12.0} - {type: clinical, field: bands_pct, op: ">", value: 10} action: verdict: "URGENT_ALERT" assert: - {type: sepsis_flag, fields: {severity: high}} - name: "Escalate" salience: 40 when: all: - {type: sepsis_flag, field: severity, op: "==", value: high} - {type: clinical, field: age, op: ">=", value: 65} action: verdict: "ADMIT_ICU" Use either `conditions:` or `when:` per rule, never both. `not` passes when the inner condition does not hold (including when the field is absent). Produce/consume cycles between rules are rejected at validation. An action may also carry `retrieval_scope: { <key>: <value> }` to narrow which documents retrieval searches (Pattern 01). A rule may also carry `citation:` — the policy sentence it encodes. It is stored with the rule and shown beside it in decision a…

NameTypeReqDescription
domainstringyes
dry_runboolean
rules_yamlstringyes
NameTypeReqDescription
resultstringyes

No examples provided.

Common questions

What is the ai·rete·rag MCP server?

ai·rete·rag is an MCP server listed in the public MCP registry as com.ai-rete-rag/ai-rete-rag-mcp. Author rules from policy docs, then decide: a Rete engine gives the verdict, an LLM explains why. This page covers its PyPI package (ai-rete-rag-mcp).

Is the ai·rete·rag MCP server safe to use?

ai·rete·rag scores 81 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the ai·rete·rag MCP server expose?

ai·rete·rag exposes 8 tools: decide, list_rules, ingest_text, list_documents, get_rule_source, and 3 more. Their descriptions and schemas cost roughly 1,727 tokens of context every time the server is loaded.

Is the ai·rete·rag MCP server still maintained?

ai·rete·rag is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the ai·rete·rag MCP server under?

ai·rete·rag declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.