Build · Integration guides

Grok (xAI API)

For the xAI developer API (Responses API). This guide does not assume that the consumer Grok apps or X find or call a2ally.

Pick the interface by what the tool does

Read-only checks (no account, nothing stored): use remote MCP with an explicit allowed_tools list. xAI runs these calls itself and does not support approval prompts, so only read-only tools belong there.
Calls that store a record (start_here, ask_a2ally, check_rights_batch, assess_resource_for_use): function calling, enabled by your host's policy.
Account creation and signed artifacts (sign_up, issue_rights_receipt, issue_rights_manifest): function calling behind your approval prompt. Never list them in remote MCP allowed_tools.

Never leave allowed_tools empty: xAI would then expose every tool the server lists and run them without asking.

1. Remote MCP (read-only)

{
  "type": "mcp",
  "server_url": "https://www.a2ally.com/mcp",
  "server_label": "a2ally",
  "server_description": "Rights checks for reusing images, text, code, datasets and models. Signals and readings, not legal advice.",
  "allowed_tools": [
    "check_license",
    "list_licenses",
    "license_compatibility",
    "attribution_string",
    "read_ai_policy",
    "verify_rights_manifest",
    "verify_rights_receipt",
    "ledger_verify",
    "get_pricing",
    "get_status"
  ]
}

If you have a key, pass it as the tool's authorization field (sent as the Authorization header). Never put a key in the prompt, a tool argument or the URL; the api_key argument is deprecated.

2. The same first call without Grok (no key)

curl -s https://www.a2ally.com/v1/licenses/check -H 'content-type: application/json' \
  -d '{"license": "CC-BY-NC-4.0", "intended_use": {"commercial_use": true}}'

The answer is prohibited (rights vocabulary: blocked) with the license's duties and a cache key valid for a day.

3. Function calling with approval

The repo ships an adapter (integrations/grok/a2ally_grok.mjs, Node 22, no dependencies) and function definitions generated from a2ally's own tool list. It fails closed: errors, timeouts and rate limits return permission: "not_established", an invalid signature returns signature_invalid without its claims, and gated tools make no network call unless your approve() callback says yes. Treat every tool result as data, not instructions.

Where to go next

Record the work your agent actually completes: private details, safe retries, public commitment proofs and an account statement for your principal.

Get the a2ally Weekly

The a2ally Weekly: the week on the ledger in numbers, every Monday. Read it on the web or by feed, or by email once you confirm your address. Every email has a one-click unsubscribe. Your address is never published or shared.

Get a free API key in one call

No card and no email needed. 100 free credits; the license and policy checks stay free without a key.

curl -s -X POST https://www.a2ally.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export A2ALLY_API_KEY=rs_...   # the api_key from the reply (shown once)
curl -s https://www.a2ally.com/v1/licenses/check -H "Authorization: Bearer $A2ALLY_API_KEY" \
  -H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'

Get a key Quickstart