Rival Regulatory Toolkit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Rival Regulatory Toolkit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Open-source SDK, CLI, MCP server, and schemas for connecting AI agents to Rival's source-grounded regulatory retrieval API.
https://api.tryrival.aiThis repository is the developer and agent connectivity layer for Rival. It is intentionally read-only in its first release: agents can search, retrieve source text, trace citations, list authorities, and inspect recent filings. Workspace actions, document review, evidence requests, filings, and task creation remain behind managed Rival access and human review gates.
npm install @tryrival/regulatory-toolkitFor local development from source:
npm install
npm run buildexport RIVAL_API_KEY="rv_live_..."
export RIVAL_API_BASE_URL="https://api.tryrival.ai"For local evaluation without API access:
export RIVAL_FIXTURE_MODE=trueimport { RivalRegulatoryClient } from '@tryrival/regulatory-toolkit';
const rival = new RivalRegulatoryClient({
apiKey: process.env.RIVAL_API_KEY,
});
const results = await rival.searchRegulatoryCorpus({
query: '49 CFR 195.573',
limit: 5,
});
console.log(results.results[0]?.source.citation);rival-regulatory search "49 CFR 195.573"
rival-regulatory source "cfr-49-195-573"
rival-regulatory trace "49 CFR 195.573"
rival-regulatory authoritiesFixture mode:
rival-regulatory search "pipeline corrosion" --fixtureRun from npm:
npx -y @tryrival/regulatory-toolkit mcpRun from the public GitHub repo:
RIVAL_FIXTURE_MODE=true npx -y github:rival-intelligence/rival-regulatory-toolkit mcpFixture mode:
RIVAL_FIXTURE_MODE=true npx -y @tryrival/regulatory-toolkit mcpClaude Desktop example:
{
"mcpServers": {
"rival-regulatory": {
"command": "npx",
"args": ["-y", "@tryrival/regulatory-toolkit", "mcp"],
"env": {
"RIVAL_API_KEY": "rv_live_...",
"RIVAL_API_BASE_URL": "https://api.tryrival.ai"
}
}
}
}Available MCP tools:
search_regulatory_corpusretrieve_source_texttrace_citationlist_authoritiesget_recent_filingsDocker belongs in this repository because many compliance, legal, consulting, energy, and infrastructure teams will run agent tools inside controlled environments. The image runs the MCP server and reads credentials from environment variables.
docker build -t rival-regulatory-toolkit .
docker run --rm -i \
-e RIVAL_API_KEY="$RIVAL_API_KEY" \
-e RIVAL_API_BASE_URL="https://api.tryrival.ai" \
rival-regulatory-toolkitFixture mode:
docker run --rm -i -e RIVAL_FIXTURE_MODE=true rival-regulatory-toolkitSee docs/self-hosting.md for deployment notes.
The API contract starts with five read-only endpoints:
GET /api/v1/searchGET /api/v1/sources/{source_id}GET /api/v1/citations/traceGET /api/v1/authoritiesGET /api/v1/filings/recentThe contract lives in openapi/rival-regulatory-api.yaml.
This toolkit does not submit filings, alter compliance records, close corrective actions, delete evidence, or take workspace actions. It is a source retrieval and citation layer for agents and developer systems. Regulated work still requires qualified human review.
This toolkit is not legal, engineering, environmental, safety, or compliance advice. Teams are responsible for validating applicability, obligations, filings, and operational decisions with qualified professionals.
npm install
npm run build
npm testApache-2.0
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.