diff --git a/examples/arcade-server/README.md b/examples/arcade-server/README.md
index 557f368a..70990a85 100644
--- a/examples/arcade-server/README.md
+++ b/examples/arcade-server/README.md
@@ -2,6 +2,80 @@
 
 An MCP Apps server that lets you browse and play classic arcade games from [archive.org](https://archive.org) directly in an MCP-enabled host.
 
+## Legal Disclaimer
+
+**This is a technical demonstration, not a distribution platform.**
+
+- Games are fetched directly from archive.org's embed system at runtime
+- We do not host, distribute, or store game content
+- **Only games with verified distribution rights can be loaded**
+- Games without verified rights are blocked
+
+### How Rights Verification Works
+
+The server uses a **strict verification system**:
+
+1. **Curated Allowlist**: Games in [`allowlist.ts`](allowlist.ts) have externally documented distribution rights with source URLs (publisher announcements, official websites). Each entry includes legal justification.
+
+2. **Metadata Verification**: For games not in the allowlist, we check archive.org metadata for explicit rights indicators (shareware, freeware, public domain, Creative Commons).
+
+**Games are only allowed if they have verified rights.** Unknown or restricted games are blocked.
+
+### What Games Are Available?
+
+- **Shareware**: First episodes/demos explicitly released for free distribution (DOOM, Duke Nukem, Commander Keen, Wolfenstein 3D, etc.)
+- **Freeware**: Games officially released as free by their publishers (Tyrian 2000, Jill of the Jungle)
+- **Public Domain**: Games with expired or waived copyright
+
+See [`allowlist.ts`](allowlist.ts) for the complete list with legal documentation.
+
+### Emulator Runtimes
+
+Archive.org uses the [Emularity](https://github.com/db48x/emularity) system to run games in the browser. This includes:
+
+| Emulator                                              | License                 | Used For                                     |
+| ----------------------------------------------------- | ----------------------- | -------------------------------------------- |
+| [DOSBox](https://www.dosbox.com/)                     | GPL-2.0+                | DOS games                                    |
+| [EM-DOSBox](https://github.com/dreamlayers/em-dosbox) | GPL-2.0+                | DOSBox compiled to JavaScript via Emscripten |
+| [MAME](https://www.mamedev.org/)                      | BSD-3-Clause / GPL-2.0+ | Arcade games                                 |
+
+**Our relationship with these emulators:**
+
+- We do **not** distribute, bundle, or modify any emulator code
+- Emulators are fetched directly from archive.org at runtime
+- We only proxy archive.org's embed system, which hosts its own copies of these emulators
+- The temporary in-memory caching (see below) is purely for CORS workaround purposes
+
+**License compatibility note:**
+
+The MCP Apps SDK is Apache-2.0 licensed. There is no license conflict because:
+
+1. The arcade-server does **not** bundle, include, or link against GPL emulator code
+2. Emulators are fetched from archive.org at runtime (like loading any CDN resource)
+3. Emulators execute in the user's browser, a separate execution context
+4. This is analogous to embedding a YouTube video - the embedding page isn't a derivative of YouTube's player
+
+If you create a modified version that **bundles** emulator code into the distribution, you must comply with GPL-2.0+ terms (copyleft, source availability).
+
+### Script Re-hosting (CORS Workaround)
+
+The server temporarily caches archive.org's `emulation.min.js` script in memory only (not persisted to disk) to work around browser security restrictions in sandboxed iframes. This is a technical necessity, not redistribution:
+
+- Cache uses `Cache-Control: no-store` headers
+- Cache is cleared on server restart
+- Script is fetched fresh from archive.org on first request
+- No modifications are made beyond replacing `import()` with `loadScript()` for iframe compatibility
+
+### Adding New Games
+
+To add a game to the allowlist, you must provide:
+
+1. **sourceUrl**: A link to an authoritative source documenting distribution rights (publisher website, press release, official announcement)
+2. **legalBasis**: A clear explanation of why the game is legally distributable
+3. **Verification**: Confirm the archive.org identifier works
+
+**When in doubt, do not add the game.**
+
 ## Overview
 
 This example demonstrates serving **external HTML content** as an MCP App resource. The resource is a static loader that uses the MCP Apps protocol to receive tool arguments, then fetches the processed game HTML from a server endpoint. This pattern allows the same resource to display different games based on tool input.
@@ -14,13 +88,17 @@ Key techniques:
 - `baseUriDomains` CSP metadata to allow the base tag
 - Rewriting ES module `import()` to classic `<script src>` loading (for srcdoc iframe compatibility)
 - Local script endpoint to bypass CORS restrictions in sandboxed iframes
+- **Rights checking** to verify distribution permissions before loading games
 
 ## Key Files
 
 - [`server.ts`](server.ts) - MCP server with tool and resource registration
 - [`index.ts`](index.ts) - HTTP transport and Express setup
 - [`game-processor.ts`](game-processor.ts) - Fetches and processes archive.org HTML
-- [`search.ts`](search.ts) - Archive.org search with smart fallbacks
+- [`search.ts`](search.ts) - Archive.org search with smart fallbacks and rights filtering
+- [`rights-checker.ts`](rights-checker.ts) - Analyzes archive.org metadata for distribution rights
+- [`allowlist.ts`](allowlist.ts) - Curated list of verified shareware/freeware games
+- [`types.ts`](types.ts) - Type definitions for rights management
 
 ## Getting Started
 
@@ -45,26 +123,41 @@ The server starts on `http://localhost:3002/mcp` by default. Set the `PORT` envi
 
 ## Tools
 
-| Tool             | Description                                 | UI  |
-| ---------------- | ------------------------------------------- | --- |
-| `search_games`   | Search archive.org for arcade games by name | No  |
-| `get_game_by_id` | Load and play a specific game               | Yes |
+| Tool             | Description                                  | UI  |
+| ---------------- | -------------------------------------------- | --- |
+| `search_games`   | Search for verified shareware/freeware games | No  |
+| `get_game_by_id` | Load and play a verified-rights game         | Yes |
+
+### search_games Parameters
+
+| Parameter    | Type   | Default | Description              |
+| ------------ | ------ | ------- | ------------------------ |
+| `searchTerm` | string | -       | Game name or search term |
+| `maxResults` | number | 10      | Maximum results (1-50)   |
+
+### get_game_by_id Parameters
+
+| Parameter | Type   | Default | Description                         |
+| --------- | ------ | ------- | ----------------------------------- |
+| `gameId`  | string | -       | Archive.org identifier for the game |
 
 ## How It Works
 
 ```
-1. Host calls search_games → Server queries archive.org API → Returns game list
-2. Host calls get_game_by_id → Tool validates gameId and returns success
-3. Host reads resource → Gets static loader with MCP Apps protocol handler
-4. View performs ui/initialize handshake with host
-5. Host sends tool-input with gameId → View fetches /game-html/:gameId
-6. Server fetches embed HTML from archive.org and processes it:
+1. Host calls search_games → Server searches allowlist + archive.org → Returns verified games only
+2. Host calls get_game_by_id → Server verifies rights status
+3. If rights verified → Tool returns success
+4. If rights NOT verified → Tool returns error, game blocked
+5. Host reads resource → Gets static loader with MCP Apps protocol handler
+6. View performs ui/initialize handshake with host
+7. Host sends tool-input with gameId → View fetches /game-html/:gameId
+8. Server fetches embed HTML from archive.org and processes it:
    - Removes archive.org's <base> tag
    - Injects <base href="https://archive.org/"> for URL resolution
    - Rewrites ES module import() to <script src> loading
    - Fetches emulation.min.js, patches it, serves from local endpoint
    - Injects layout CSS for full-viewport display
-7. Game runs: emulator loads ROM, initializes MAME, game is playable
+9. Game runs: emulator loads ROM, initializes MAME, game is playable
 ```
 
 ### Why the Processing?
@@ -75,9 +168,39 @@ Archive.org's game embed pages use ES module `import()` for loading the emulatio
 2. **Serving the patched script** from a local Express endpoint (`/scripts/emulation.js`)
 3. **Using `<script src>`** which is not subject to CORS restrictions, unlike `fetch()` or `import()`
 
-## Example Game IDs
-
-- `arcade_20pacgal` - Ms. Pac-Man / Galaga
-- `arcade_galaga` - Galaga
-- `arcade_sf2` - Street Fighter II
-- `doom-play` - The Ultimate DOOM
+## Available Games (18 Verified Titles)
+
+All games have verified distribution rights. See [`allowlist.ts`](allowlist.ts) for legal documentation.
+
+### id Software Shareware
+
+| Identifier                      | Title                            | Year |
+| ------------------------------- | -------------------------------- | ---- |
+| `doom-play`                     | DOOM                             | 1993 |
+| `msdos_DOOM_1993`               | DOOM (MS-DOS)                    | 1993 |
+| `wolfenstein-3d`                | Wolfenstein 3D                   | 1992 |
+| `w3d-box`                       | Wolfenstein 3D v1.4              | 1993 |
+| `commander_keen_volume_one_131` | Commander Keen: Marooned on Mars | 1990 |
+| `heretic-dos`                   | Heretic                          | 1994 |
+
+### Apogee / 3D Realms Shareware
+
+| Identifier                                      | Title                       | Year |
+| ----------------------------------------------- | --------------------------- | ---- |
+| `duke-nukem2-sw`                                | Duke Nukem II               | 1993 |
+| `3dduke13SW-altcontrols`                        | Duke Nukem 3D               | 1996 |
+| `Bs-aog-sw1`                                    | Blake Stone: Aliens of Gold | 1993 |
+| `rise-of-the-triad-the-hunt-begins-version-1.0` | Rise of the Triad           | 1994 |
+| `biomenace1-sw`                                 | Bio Menace                  | 1993 |
+| `Crystal-cave-sw1`                              | Crystal Caves               | 1991 |
+| `monster-bash1-sw`                              | Monster Bash                | 1993 |
+| `halloween_harry_shareware`                     | Halloween Harry             | 1993 |
+
+### Epic MegaGames Shareware / Freeware
+
+| Identifier                | Title                         | Year |
+| ------------------------- | ----------------------------- | ---- |
+| `Epic-pinball-sw1`        | Epic Pinball                  | 1993 |
+| `radsw20`                 | Radix: Beyond the Void        | 1995 |
+| `msdos_Tyrian_2000_1999`  | Tyrian 2000 (Freeware)        | 1999 |
+| `jill-of-the-jungle-0mhz` | Jill of the Jungle (Freeware) | 1992 |
diff --git a/examples/arcade-server/allowlist.ts b/examples/arcade-server/allowlist.ts
new file mode 100644
index 00000000..3e3ab18e
--- /dev/null
+++ b/examples/arcade-server/allowlist.ts
@@ -0,0 +1,292 @@
+/**
+ * Allowlist of Games with Verified Distribution Rights
+ *
+ * LEGAL NOTICE:
+ * This curated list contains games with EXTERNALLY verified distribution
+ * rights. Each entry includes:
+ * - sourceUrl: Link to authoritative documentation of distribution rights
+ * - legalBasis: Explanation of why the game is legally distributable
+ *
+ * WHY A CURATED ALLOWLIST?
+ * Archive.org metadata (licenseurl, rights, possible_copyright_status) is
+ * used as a fallback in rights-checker.ts, but it is often:
+ * - Empty or missing entirely
+ * - User-submitted without verification
+ * - Inconsistent across similar items
+ *
+ * This allowlist provides higher confidence for known-good games by
+ * requiring external, authoritative sources for each entry.
+ *
+ * ADDING NEW ENTRIES:
+ * - Requires a verifiable sourceUrl (publisher site, press release, etc.)
+ * - Requires a clear legalBasis explanation
+ * - When in doubt, DO NOT add the game
+ *
+ * SHAREWARE MODEL (1990s):
+ * Publishers like id Software and Apogee explicitly encouraged free distribution
+ * of shareware versions. The shareware model allowed anyone to copy and share
+ * the first episode/demo, with the understanding that the full game required
+ * purchase. This was the intended business model, not piracy.
+ *
+ * FREEWARE RELEASES:
+ * Some games were later released as freeware by their rights holders,
+ * with explicit announcements making them free to distribute.
+ */
+
+import type { AllowlistEntry } from "./types.js";
+
+/**
+ * Curated list of games with verified distribution rights.
+ *
+ * DO NOT ADD GAMES WITHOUT:
+ * 1. A verifiable sourceUrl proving distribution rights
+ * 2. A clear legalBasis explanation
+ * 3. Verification that the archive.org identifier works
+ */
+const ALLOWLIST: AllowlistEntry[] = [
+  // ═══════════════════════════════════════════════════════════════════════════
+  // id SOFTWARE SHAREWARE
+  //
+  // id Software pioneered the shareware model. Their shareware releases were
+  // explicitly designed for free distribution. John Carmack and John Romero
+  // have repeatedly confirmed shareware versions are freely distributable.
+  // ═══════════════════════════════════════════════════════════════════════════
+
+  {
+    identifier: "doom-play",
+    displayTitle: "DOOM",
+    rightsNote: "Shareware - id Software (1993)",
+    sourceUrl: "https://doomwiki.org/wiki/Shareware",
+    legalBasis:
+      "DOOM shareware (v1.9) was released by id Software under their shareware " +
+      "model. The DOOM FAQ and original distribution terms explicitly permitted " +
+      "free copying and distribution of the shareware version. id Software's " +
+      "shareware license allowed unlimited redistribution of the unmodified " +
+      "shareware package.",
+  },
+  {
+    identifier: "msdos_DOOM_1993",
+    displayTitle: "DOOM (MS-DOS)",
+    rightsNote: "Shareware - id Software (1993)",
+    sourceUrl: "https://doomwiki.org/wiki/Shareware",
+    legalBasis:
+      "Same legal basis as doom-play. DOOM shareware episode 'Knee-Deep in the " +
+      "Dead' was explicitly released for free distribution by id Software.",
+  },
+  {
+    identifier: "wolfenstein-3d",
+    displayTitle: "Wolfenstein 3D",
+    rightsNote: "Shareware - id Software (1992)",
+    sourceUrl: "https://wolfenstein.fandom.com/wiki/Wolfenstein_3D#Shareware",
+    legalBasis:
+      "Wolfenstein 3D Episode 1 was released as shareware by id Software in 1992. " +
+      "The shareware version was explicitly designed for free distribution to " +
+      "promote sales of the registered version. Original distribution terms " +
+      "permitted unlimited copying of the shareware episode.",
+  },
+  {
+    identifier: "w3d-box",
+    displayTitle: "Wolfenstein 3D v1.4 (Shareware)",
+    rightsNote: "Shareware - id Software (1993)",
+    sourceUrl: "https://wolfenstein.fandom.com/wiki/Wolfenstein_3D#Shareware",
+    legalBasis:
+      "Same legal basis as wolfenstein-3d. This is version 1.4 of the shareware " +
+      "release, still covered by id Software's shareware distribution terms.",
+  },
+  {
+    identifier: "commander_keen_volume_one_131",
+    displayTitle: "Commander Keen: Marooned on Mars",
+    rightsNote: "Shareware - id Software (1990)",
+    sourceUrl: "https://commander-keen.fandom.com/wiki/Shareware",
+    legalBasis:
+      "Commander Keen Episode 1 'Marooned on Mars' was released as shareware by " +
+      "id Software in 1990. Published by Apogee Software under their shareware " +
+      "distribution model. The first episode was always intended for free " +
+      "distribution to encourage purchase of episodes 2-3.",
+  },
+  {
+    identifier: "heretic-dos",
+    displayTitle: "Heretic (Shareware)",
+    rightsNote: "Shareware - id Software/Raven (1994)",
+    sourceUrl: "https://doomwiki.org/wiki/Heretic",
+    legalBasis:
+      "Heretic shareware was released by id Software and Raven Software in 1994. " +
+      "Built on the DOOM engine, it followed the same shareware distribution " +
+      "model. The first episode was freely distributable to promote the full game.",
+  },
+
+  // ═══════════════════════════════════════════════════════════════════════════
+  // APOGEE / 3D REALMS SHAREWARE
+  //
+  // Apogee Software (later 3D Realms) was a pioneer of the shareware model.
+  // Their "Apogee Model" explicitly encouraged free distribution of episode 1.
+  // ═══════════════════════════════════════════════════════════════════════════
+
+  {
+    identifier: "duke-nukem2-sw",
+    displayTitle: "Duke Nukem II (Shareware)",
+    rightsNote: "Shareware - Apogee/3D Realms (1993)",
+    sourceUrl: "https://3drealms.com/catalog/duke-nukem-2_27/",
+    legalBasis:
+      "Duke Nukem II Episode 1 was released as shareware by Apogee Software in " +
+      "1993. Apogee's shareware terms explicitly permitted free distribution of " +
+      "the shareware version. The '-sw' suffix in the identifier confirms this " +
+      "is the shareware release.",
+  },
+  {
+    identifier: "3dduke13SW-altcontrols",
+    displayTitle: "Duke Nukem 3D (Shareware)",
+    rightsNote: "Shareware - 3D Realms (1996)",
+    sourceUrl: "https://3drealms.com/catalog/duke-nukem-3d_702/",
+    legalBasis:
+      "Duke Nukem 3D shareware (v1.3) was released by 3D Realms in 1996. The " +
+      "shareware version containing the first episode 'L.A. Meltdown' was " +
+      "explicitly released for free distribution. 3D Realms' shareware license " +
+      "permitted unlimited redistribution.",
+  },
+  {
+    identifier: "Bs-aog-sw1",
+    displayTitle: "Blake Stone: Aliens of Gold (Shareware)",
+    rightsNote: "Shareware - Apogee (1993)",
+    sourceUrl: "https://3drealms.com/catalog/blake-stone-aliens-of-gold_702/",
+    legalBasis:
+      "Blake Stone: Aliens of Gold was released as shareware by Apogee Software " +
+      "in 1993. The first episode was distributed freely under Apogee's shareware " +
+      "model to encourage purchase of the full game.",
+  },
+  {
+    identifier: "rise-of-the-triad-the-hunt-begins-version-1.0",
+    displayTitle: "Rise of the Triad: The HUNT Begins",
+    rightsNote: "Shareware - Apogee (1994)",
+    sourceUrl: "https://3drealms.com/catalog/rise-of-the-triad_702/",
+    legalBasis:
+      "Rise of the Triad shareware ('The HUNT Begins') was released by Apogee " +
+      "Software in 1994. The shareware version was explicitly designed for free " +
+      "distribution under Apogee's shareware model.",
+  },
+  {
+    identifier: "biomenace1-sw",
+    displayTitle: "Bio Menace (Shareware)",
+    rightsNote: "Shareware - Apogee (1993)",
+    sourceUrl: "https://3drealms.com/catalog/bio-menace_702/",
+    legalBasis:
+      "Bio Menace Episode 1 was released as shareware by Apogee Software in 1993. " +
+      "The game was later released as freeware by 3D Realms in 2005, making all " +
+      "episodes freely distributable.",
+  },
+  {
+    identifier: "Crystal-cave-sw1",
+    displayTitle: "Crystal Caves (Shareware)",
+    rightsNote: "Shareware - Apogee (1991)",
+    sourceUrl: "https://3drealms.com/catalog/crystal-caves_702/",
+    legalBasis:
+      "Crystal Caves Episode 1 was released as shareware by Apogee Software in " +
+      "1991. The first episode was distributed freely under Apogee's shareware " +
+      "model. The game was later released as freeware.",
+  },
+  {
+    identifier: "monster-bash1-sw",
+    displayTitle: "Monster Bash (Shareware)",
+    rightsNote: "Shareware - Apogee (1993)",
+    sourceUrl: "https://3drealms.com/catalog/monster-bash_702/",
+    legalBasis:
+      "Monster Bash Episode 1 was released as shareware by Apogee Software in " +
+      "1993. The first episode was distributed freely under Apogee's shareware " +
+      "model to promote sales of the full game.",
+  },
+  {
+    identifier: "halloween_harry_shareware",
+    displayTitle: "Halloween Harry (Shareware)",
+    rightsNote: "Shareware - Apogee (1993)",
+    sourceUrl: "https://3drealms.com/catalog/alien-carnage_702/",
+    legalBasis:
+      "Halloween Harry (later renamed Alien Carnage) was released as shareware " +
+      "by Apogee Software in 1993. The shareware episode was distributed freely. " +
+      "The full game was later released as freeware by 3D Realms.",
+  },
+
+  // ═══════════════════════════════════════════════════════════════════════════
+  // EPIC MEGAGAMES SHAREWARE / FREEWARE
+  //
+  // Epic MegaGames (now Epic Games) used the shareware model and later
+  // released many titles as freeware.
+  // ═══════════════════════════════════════════════════════════════════════════
+
+  {
+    identifier: "Epic-pinball-sw1",
+    displayTitle: "Epic Pinball (Shareware)",
+    rightsNote: "Shareware - Epic MegaGames (1993)",
+    sourceUrl: "https://en.wikipedia.org/wiki/Epic_Pinball",
+    legalBasis:
+      "Epic Pinball shareware was released by Epic MegaGames in 1993. The " +
+      "shareware version included one table and was freely distributable " +
+      "to promote sales of the full game with additional tables.",
+  },
+  {
+    identifier: "radsw20",
+    displayTitle: "Radix: Beyond the Void (Shareware)",
+    rightsNote: "Shareware - Epic MegaGames (1995)",
+    sourceUrl: "https://en.wikipedia.org/wiki/Radix:_Beyond_the_Void",
+    legalBasis:
+      "Radix: Beyond the Void shareware was released by Epic MegaGames in 1995. " +
+      "The shareware version was freely distributable under Epic's shareware " +
+      "terms to encourage purchase of the registered version.",
+  },
+  {
+    identifier: "msdos_Tyrian_2000_1999",
+    displayTitle: "Tyrian 2000",
+    rightsNote: "Freeware - Epic Games (released free 2004)",
+    sourceUrl: "https://www.camanis.net/tyrian/tyrian2000.php",
+    legalBasis:
+      "Tyrian 2000 was officially released as freeware by Epic Games in 2004. " +
+      "Daniel Cook (original artist) confirmed on his website that Epic Games " +
+      "released the full game for free. The game was later open-sourced as " +
+      "OpenTyrian. Epic's freeware release permits unlimited distribution.",
+  },
+  {
+    identifier: "jill-of-the-jungle-0mhz",
+    displayTitle: "Jill of the Jungle",
+    rightsNote: "Freeware - Epic Games",
+    sourceUrl: "https://archive.org/details/JillOfTheJungle",
+    legalBasis:
+      "Jill of the Jungle was released as freeware by Epic Games (formerly Epic " +
+      "MegaGames). Epic has made several of their classic DOS titles freely " +
+      "available. Note: The exact freeware announcement is harder to locate, " +
+      "making this entry lower confidence than others.",
+  },
+];
+
+// Build a Map for O(1) lookups
+const allowlistMap = new Map<string, AllowlistEntry>(
+  ALLOWLIST.map((entry) => [entry.identifier, entry]),
+);
+
+/**
+ * Checks if a game identifier is in the allowlist.
+ */
+export function isInAllowlist(identifier: string): boolean {
+  return allowlistMap.has(identifier);
+}
+
+/**
+ * Gets the allowlist entry for a game identifier, if it exists.
+ */
+export function getAllowlistEntry(
+  identifier: string,
+): AllowlistEntry | undefined {
+  return allowlistMap.get(identifier);
+}
+
+/**
+ * Gets all allowlist entries.
+ */
+export function getAllAllowlistEntries(): AllowlistEntry[] {
+  return [...ALLOWLIST];
+}
+
+/**
+ * Gets the count of allowlisted games.
+ */
+export function getAllowlistCount(): number {
+  return ALLOWLIST.length;
+}
diff --git a/examples/arcade-server/index.ts b/examples/arcade-server/index.ts
index 79159589..83816718 100644
--- a/examples/arcade-server/index.ts
+++ b/examples/arcade-server/index.ts
@@ -27,6 +27,7 @@ async function main() {
 
   // Serve the modified emulation script (import() rewritten to loadScript()).
   // <script src> is not subject to CORS, so this works from srcdoc iframes.
+  // NOTE: Script is cached in memory only, not persisted to disk.
   app.get("/scripts/emulation.js", (_req: Request, res: Response) => {
     const script = getCachedEmulationScript();
     if (!script) {
@@ -34,7 +35,8 @@ async function main() {
       return;
     }
     res.setHeader("Content-Type", "application/javascript");
-    res.setHeader("Cache-Control", "no-cache");
+    res.setHeader("Cache-Control", "no-store, no-cache, must-revalidate");
+    res.setHeader("Pragma", "no-cache");
     res.send(script);
   });
 
@@ -48,7 +50,8 @@ async function main() {
     try {
       const html = await processGameEmbed(gameId, port);
       res.setHeader("Content-Type", "text/html");
-      res.setHeader("Cache-Control", "no-cache");
+      res.setHeader("Cache-Control", "no-store, no-cache, must-revalidate");
+      res.setHeader("Pragma", "no-cache");
       res.send(html);
     } catch (error) {
       console.error("Failed to load game:", gameId, error);
diff --git a/examples/arcade-server/rights-checker.ts b/examples/arcade-server/rights-checker.ts
new file mode 100644
index 00000000..c6dd1ffd
--- /dev/null
+++ b/examples/arcade-server/rights-checker.ts
@@ -0,0 +1,403 @@
+/**
+ * Rights Checker
+ *
+ * Fetches archive.org metadata and analyzes rights status for games.
+ * Optimized with caching, concurrency limits, and fast timeouts.
+ */
+
+import type { RightsCheckResult, RightsStatus } from "./types.js";
+import { getAllowlistEntry, isInAllowlist } from "./allowlist.js";
+
+// Cache for metadata responses (30-minute TTL for better performance)
+const CACHE_TTL_MS = 30 * 60 * 1000;
+
+interface CacheEntry {
+  result: RightsCheckResult;
+  timestamp: number;
+}
+
+const metadataCache = new Map<string, CacheEntry>();
+
+// Concurrency control
+const MAX_CONCURRENT_REQUESTS = 5;
+let activeRequests = 0;
+const requestQueue: Array<() => void> = [];
+
+/**
+ * Archive.org metadata response structure (partial).
+ */
+interface ArchiveMetadata {
+  metadata?: {
+    licenseurl?: string;
+    rights?: string;
+    possible_copyright_status?: string;
+    collection?: string | string[];
+    mediatype?: string;
+  };
+}
+
+/**
+ * Patterns that indicate permissive rights.
+ */
+const PERMISSIVE_PATTERNS = [
+  /public\s*domain/i,
+  /shareware/i,
+  /freeware/i,
+  /free\s*software/i,
+  /creativecommons/i,
+  /creative\s*commons/i,
+  /cc0/i,
+  /cc-by/i,
+  /cc-by-sa/i,
+  /open\s*source/i,
+  /gpl/i,
+  /mit\s*license/i,
+  /bsd\s*license/i,
+  /apache\s*license/i,
+  /freely\s*distribut/i,
+  /free\s*to\s*distribute/i,
+  /released\s*as\s*free/i,
+  /no\s*known\s*copyright/i,
+  /copyright\s*not\s*renewed/i,
+  /abandonware/i,
+];
+
+/**
+ * Patterns that indicate restricted rights.
+ */
+const RESTRICTED_PATTERNS = [
+  /all\s*rights\s*reserved/i,
+  /copyrighted/i,
+  /proprietary/i,
+  /commercial\s*use\s*prohibited/i,
+];
+
+/**
+ * Checks the copyright/distribution rights status for a game.
+ * Allowlist entries take precedence over metadata checks.
+ */
+export async function checkRights(
+  identifier: string,
+): Promise<RightsCheckResult> {
+  // Check allowlist first (highest priority, instant)
+  const allowlistEntry = getAllowlistEntry(identifier);
+  if (allowlistEntry) {
+    return {
+      status: "allowed",
+      note: allowlistEntry.rightsNote,
+    };
+  }
+
+  // Check cache
+  const cached = metadataCache.get(identifier);
+  if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) {
+    return cached.result;
+  }
+
+  // Fetch metadata from archive.org with concurrency control
+  const result = await fetchWithConcurrencyLimit(identifier);
+
+  // Cache the result
+  metadataCache.set(identifier, {
+    result,
+    timestamp: Date.now(),
+  });
+
+  return result;
+}
+
+/**
+ * Batch check rights for multiple identifiers with optimized concurrency.
+ */
+export async function checkRightsBatch(
+  identifiers: string[],
+): Promise<Map<string, RightsCheckResult>> {
+  const results = new Map<string, RightsCheckResult>();
+
+  // First pass: resolve from allowlist and cache (instant)
+  const needsFetch: string[] = [];
+
+  for (const id of identifiers) {
+    // Check allowlist
+    const allowlistEntry = getAllowlistEntry(id);
+    if (allowlistEntry) {
+      results.set(id, {
+        status: "allowed",
+        note: allowlistEntry.rightsNote,
+      });
+      continue;
+    }
+
+    // Check cache
+    const cached = metadataCache.get(id);
+    if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) {
+      results.set(id, cached.result);
+      continue;
+    }
+
+    needsFetch.push(id);
+  }
+
+  // Second pass: fetch remaining in parallel with concurrency limit
+  if (needsFetch.length > 0) {
+    const fetchResults = await Promise.allSettled(
+      needsFetch.map((id) =>
+        fetchWithConcurrencyLimit(id).then((r) => ({ id, result: r })),
+      ),
+    );
+
+    for (const outcome of fetchResults) {
+      if (outcome.status === "fulfilled") {
+        const { id, result } = outcome.value;
+        results.set(id, result);
+        metadataCache.set(id, { result, timestamp: Date.now() });
+      } else {
+        // On failure, mark as unknown
+        const id = needsFetch[fetchResults.indexOf(outcome)];
+        const result: RightsCheckResult = {
+          status: "unknown",
+          note: "Metadata check failed",
+        };
+        results.set(id, result);
+      }
+    }
+  }
+
+  return results;
+}
+
+/**
+ * Fetches metadata with concurrency limiting.
+ */
+async function fetchWithConcurrencyLimit(
+  identifier: string,
+): Promise<RightsCheckResult> {
+  // Wait for slot if at max concurrency
+  if (activeRequests >= MAX_CONCURRENT_REQUESTS) {
+    await new Promise<void>((resolve) => {
+      requestQueue.push(resolve);
+    });
+  }
+
+  activeRequests++;
+
+  try {
+    return await fetchAndAnalyzeMetadata(identifier);
+  } finally {
+    activeRequests--;
+    // Release next waiting request
+    const next = requestQueue.shift();
+    if (next) next();
+  }
+}
+
+/**
+ * Fetches metadata from archive.org and analyzes rights status.
+ */
+async function fetchAndAnalyzeMetadata(
+  identifier: string,
+): Promise<RightsCheckResult> {
+  // Check if identifier itself indicates shareware/freeware
+  const idCheck = checkIdentifierForRights(identifier);
+  if (idCheck) {
+    return idCheck;
+  }
+
+  try {
+    const url = `https://archive.org/metadata/${encodeURIComponent(identifier)}`;
+
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 3000); // 3 second timeout
+
+    try {
+      const response = await fetch(url, {
+        headers: {
+          "User-Agent": "MCP-Arcade-Server/1.0",
+          Accept: "application/json",
+        },
+        signal: controller.signal,
+      });
+
+      clearTimeout(timeoutId);
+
+      if (!response.ok) {
+        return { status: "unknown", note: "Could not fetch metadata" };
+      }
+
+      const data = (await response.json()) as ArchiveMetadata;
+      return analyzeMetadata(identifier, data);
+    } catch (error) {
+      clearTimeout(timeoutId);
+      throw error;
+    }
+  } catch (error) {
+    // Network errors, timeouts, etc.
+    return {
+      status: "unknown",
+      note: "Metadata check failed",
+    };
+  }
+}
+
+/**
+ * Checks if the identifier itself indicates shareware/freeware status.
+ */
+function checkIdentifierForRights(
+  identifier: string,
+): RightsCheckResult | null {
+  const idLower = identifier.toLowerCase();
+
+  // Common shareware/freeware indicators in identifiers
+  if (
+    idLower.includes("shareware") ||
+    idLower.includes("-sw") ||
+    idLower.endsWith("sw")
+  ) {
+    return {
+      status: "allowed",
+      note: "Identifier indicates shareware",
+    };
+  }
+
+  if (idLower.includes("freeware") || idLower.includes("free-")) {
+    return {
+      status: "allowed",
+      note: "Identifier indicates freeware",
+    };
+  }
+
+  if (idLower.includes("public-domain") || idLower.includes("publicdomain")) {
+    return {
+      status: "allowed",
+      note: "Identifier indicates public domain",
+    };
+  }
+
+  if (idLower.includes("demo")) {
+    return {
+      status: "allowed",
+      note: "Identifier indicates demo version",
+    };
+  }
+
+  return null;
+}
+
+/**
+ * Analyzes archive.org metadata to determine rights status.
+ */
+function analyzeMetadata(
+  identifier: string,
+  data: ArchiveMetadata,
+): RightsCheckResult {
+  const metadata = data.metadata;
+  if (!metadata) {
+    // No metadata, but archive.org is hosting it publicly
+    return {
+      status: "unknown",
+      note: "No metadata available - hosted on archive.org",
+    };
+  }
+
+  // Check licenseurl field
+  const licenseUrl = metadata.licenseurl || "";
+  if (licenseUrl) {
+    if (matchesPermissivePattern(licenseUrl)) {
+      return {
+        status: "allowed",
+        note: `License: ${licenseUrl}`,
+      };
+    }
+  }
+
+  // Check rights field
+  const rights = metadata.rights || "";
+  if (rights) {
+    if (matchesPermissivePattern(rights)) {
+      return {
+        status: "allowed",
+        note: `Rights: ${truncate(rights, 100)}`,
+      };
+    }
+    if (matchesRestrictedPattern(rights)) {
+      return {
+        status: "restricted",
+        note: `Rights: ${truncate(rights, 100)}`,
+      };
+    }
+  }
+
+  // Check possible_copyright_status field
+  const copyrightStatus = metadata.possible_copyright_status || "";
+  if (copyrightStatus) {
+    if (matchesPermissivePattern(copyrightStatus)) {
+      return {
+        status: "allowed",
+        note: `Copyright status: ${copyrightStatus}`,
+      };
+    }
+  }
+
+  // Check if part of known shareware/freeware collections
+  const collections = Array.isArray(metadata.collection)
+    ? metadata.collection
+    : metadata.collection
+      ? [metadata.collection]
+      : [];
+
+  for (const collection of collections) {
+    const lowerCollection = collection.toLowerCase();
+    if (
+      lowerCollection.includes("shareware") ||
+      lowerCollection.includes("freeware") ||
+      lowerCollection.includes("publicdomain")
+    ) {
+      return {
+        status: "allowed",
+        note: `Part of ${collection} collection`,
+      };
+    }
+  }
+
+  // Default to unknown
+  return {
+    status: "unknown",
+    note: "Rights status could not be determined from metadata",
+  };
+}
+
+/**
+ * Checks if text matches any permissive rights pattern.
+ */
+function matchesPermissivePattern(text: string): boolean {
+  return PERMISSIVE_PATTERNS.some((pattern) => pattern.test(text));
+}
+
+/**
+ * Checks if text matches any restricted rights pattern.
+ */
+function matchesRestrictedPattern(text: string): boolean {
+  return RESTRICTED_PATTERNS.some((pattern) => pattern.test(text));
+}
+
+/**
+ * Truncates a string to a maximum length.
+ */
+function truncate(str: string, maxLength: number): string {
+  if (str.length <= maxLength) return str;
+  return str.slice(0, maxLength - 3) + "...";
+}
+
+/**
+ * Clears the metadata cache. Useful for testing.
+ */
+export function clearRightsCache(): void {
+  metadataCache.clear();
+}
+
+/**
+ * Quick check if a game is in the allowlist (does not fetch metadata).
+ */
+export function isAllowlisted(identifier: string): boolean {
+  return isInAllowlist(identifier);
+}
diff --git a/examples/arcade-server/search.ts b/examples/arcade-server/search.ts
index c3f16389..63b38a5b 100644
--- a/examples/arcade-server/search.ts
+++ b/examples/arcade-server/search.ts
@@ -1,10 +1,20 @@
 /**
  * Archive.org Search
  *
- * Searches archive.org for arcade/emulation games with smart fallbacks
- * for underscores, spaces, and partial matches.
+ * Searches for verified shareware/freeware games. Prioritizes the curated
+ * allowlist for instant results, with archive.org metadata fallback.
+ *
+ * Only games with verified distribution rights are returned.
  */
 
+import type { GameSearchResult } from "./types.js";
+import {
+  getAllAllowlistEntries,
+  getAllowlistEntry,
+  isInAllowlist,
+} from "./allowlist.js";
+import { checkRightsBatch } from "./rights-checker.js";
+
 export interface ArchiveOrgSearchResult {
   identifier: string;
   title: string;
@@ -31,12 +41,97 @@ const GAME_COLLECTIONS = [
 ].join(" OR ");
 
 /**
- * Searches archive.org for arcade games matching the given term.
+ * Searches for arcade games matching the given term.
+ * Prioritizes allowlist search (instant) before querying archive.org.
+ *
+ * @param searchTerm - The game name or search term
+ * @param maxResults - Maximum number of results to return (default: 10)
+ * @returns Array of game results with verified rights
  */
 export async function searchArchiveOrgGames(
   searchTerm: string,
   maxResults: number = 10,
-): Promise<ArchiveOrgSearchResult[]> {
+): Promise<GameSearchResult[]> {
+  // FIRST: Search the allowlist (instant, no network calls)
+  const allowlistResults = searchAllowlist(searchTerm, maxResults);
+
+  if (allowlistResults.length >= maxResults) {
+    return allowlistResults;
+  }
+
+  // If we have some allowlist results but not enough, try to supplement with archive.org
+  // But if allowlist already found matches, return those to avoid slow network calls
+  if (allowlistResults.length > 0) {
+    return allowlistResults;
+  }
+
+  // SECOND: Only if no allowlist matches, search archive.org
+  // This is slower but may find games with permissive metadata
+  try {
+    const archiveResults = await searchArchiveOrgWithTimeout(
+      searchTerm,
+      maxResults,
+    );
+    return archiveResults;
+  } catch {
+    // On any error/timeout, return empty (allowlist was already empty)
+    return [];
+  }
+}
+
+/**
+ * Searches the allowlist for matching games (instant, no network).
+ */
+function searchAllowlist(
+  searchTerm: string,
+  maxResults: number,
+): GameSearchResult[] {
+  const normalizedTerm = searchTerm.trim().toLowerCase();
+  const allEntries = getAllAllowlistEntries();
+  const matches: GameSearchResult[] = [];
+
+  // Split search term into words for flexible matching
+  const searchWords = normalizedTerm.split(/\s+/).filter((w) => w.length > 0);
+
+  for (const entry of allEntries) {
+    const titleLower = entry.displayTitle.toLowerCase();
+    const idLower = entry.identifier.toLowerCase();
+
+    // Match if search term is contained in title or ID
+    const directMatch =
+      titleLower.includes(normalizedTerm) || idLower.includes(normalizedTerm);
+
+    // Or if all search words are found in title
+    const wordMatch =
+      searchWords.length > 0 &&
+      searchWords.every(
+        (word) => titleLower.includes(word) || idLower.includes(word),
+      );
+
+    if (directMatch || wordMatch) {
+      matches.push({
+        identifier: entry.identifier,
+        title: entry.displayTitle,
+        rightsStatus: "allowed",
+        rightsNote: entry.rightsNote,
+      });
+
+      if (matches.length >= maxResults) {
+        break;
+      }
+    }
+  }
+
+  return matches;
+}
+
+/**
+ * Searches archive.org with a strict timeout.
+ */
+async function searchArchiveOrgWithTimeout(
+  searchTerm: string,
+  maxResults: number,
+): Promise<GameSearchResult[]> {
   const normalizedTerm = searchTerm.trim();
   const termWithSpaces = normalizedTerm.replace(/_/g, " ");
   const termWithUnderscores = normalizedTerm.replace(/\s+/g, "_");
@@ -49,38 +144,63 @@ export async function searchArchiveOrgGames(
   ].filter((term, index, self) => term && self.indexOf(term) === index);
 
   const exactQuery = `title:(${exactVariations.join(" OR ")})`;
+  const fetchLimit = maxResults * 2;
 
-  // Step 1: Search with exact terms in game collections
-  let games = await performSearch(exactQuery, true, maxResults);
+  // Single search attempt with tight timeout
+  let games = await performSearch(exactQuery, true, fetchLimit);
 
-  // Step 2: Broader search with individual words in title
   if (games.length === 0 && words.length > 1) {
     const broaderQuery = `title:(${exactVariations.join(" OR ")} OR ${words.join(" OR ")})`;
-    games = await performSearch(broaderQuery, true, maxResults);
+    games = await performSearch(broaderQuery, true, fetchLimit);
   }
 
-  // Step 3: Search without collection filter as final fallback
   if (games.length === 0) {
-    const fallbackQuery =
-      words.length > 1
-        ? `title:(${exactVariations.join(" OR ")} OR ${words.join(" OR ")})`
-        : exactQuery;
-
-    try {
-      games = await performSearch(fallbackQuery, false, maxResults);
-      games = games.filter(
-        (doc) =>
-          doc.identifier.startsWith("arcade_") ||
-          doc.identifier.startsWith("msdos_") ||
-          doc.identifier.includes("game") ||
-          doc.mediatype === "software",
-      );
-    } catch {
-      // Continue with empty results
+    return [];
+  }
+
+  // Filter to allowlist entries first (fast check, no metadata fetch)
+  const allowlistFiltered = games
+    .filter((game) => isInAllowlist(game.identifier))
+    .map((game) => {
+      const entry = getAllowlistEntry(game.identifier)!;
+      return {
+        identifier: game.identifier,
+        title: game.title,
+        description: game.description,
+        year: game.year,
+        creator: game.creator,
+        rightsStatus: "allowed" as const,
+        rightsNote: entry.rightsNote,
+      };
+    });
+
+  if (allowlistFiltered.length > 0) {
+    return allowlistFiltered.slice(0, maxResults);
+  }
+
+  // If no allowlist matches, check metadata for verified rights
+  const limitedGames = games.slice(0, 10);
+  const rightsMap = await checkRightsBatch(
+    limitedGames.map((g) => g.identifier),
+  );
+
+  const verified: GameSearchResult[] = [];
+  for (const game of limitedGames) {
+    const rights = rightsMap.get(game.identifier);
+    if (rights?.status === "allowed") {
+      verified.push({
+        identifier: game.identifier,
+        title: game.title,
+        description: game.description,
+        year: game.year,
+        creator: game.creator,
+        rightsStatus: "allowed",
+        rightsNote: rights.note,
+      });
     }
   }
 
-  return games;
+  return verified.slice(0, maxResults);
 }
 
 async function performSearch(
@@ -94,19 +214,30 @@ async function performSearch(
 
   const searchUrl = `https://archive.org/advancedsearch.php?q=${encodeURIComponent(fullQuery)}&fl[]=identifier&fl[]=title&fl[]=mediatype&fl[]=description&fl[]=year&fl[]=creator&output=json&rows=${encodeURIComponent(String(maxResults))}`;
 
-  const response = await fetch(searchUrl, {
-    headers: {
-      "User-Agent": "MCP-Arcade-Server/1.0",
-      Accept: "application/json",
-    },
-  });
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), 5000); // 5 second timeout
 
-  if (!response.ok) {
-    throw new Error(`Archive.org API returned status ${response.status}`);
-  }
+  try {
+    const response = await fetch(searchUrl, {
+      headers: {
+        "User-Agent": "MCP-Arcade-Server/1.0",
+        Accept: "application/json",
+      },
+      signal: controller.signal,
+    });
 
-  const data = (await response.json()) as ArchiveOrgSearchResponse;
-  if (!data?.response?.docs) return [];
+    clearTimeout(timeoutId);
 
-  return data.response.docs.filter((doc) => doc.identifier);
+    if (!response.ok) {
+      return [];
+    }
+
+    const data = (await response.json()) as ArchiveOrgSearchResponse;
+    if (!data?.response?.docs) return [];
+
+    return data.response.docs.filter((doc) => doc.identifier);
+  } catch {
+    clearTimeout(timeoutId);
+    return [];
+  }
 }
diff --git a/examples/arcade-server/server.ts b/examples/arcade-server/server.ts
index f3c20cc2..1b8bc503 100644
--- a/examples/arcade-server/server.ts
+++ b/examples/arcade-server/server.ts
@@ -3,6 +3,9 @@
  *
  * MCP server for browsing and playing arcade games from archive.org.
  * Fetches game HTML server-side and serves it as an inline MCP App resource.
+ *
+ * IMPORTANT: Only games with verified distribution rights (shareware, freeware,
+ * public domain) can be loaded. See allowlist.ts for the curated list.
  */
 
 import {
@@ -13,6 +16,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 import { z } from "zod";
 import { searchArchiveOrgGames } from "./search.js";
+import { checkRights } from "./rights-checker.js";
 
 const GAME_VIEWER_RESOURCE_URI = "ui://arcade/game-viewer";
 
@@ -44,12 +48,13 @@ export function createServer(port: number): McpServer {
     "search_games",
     {
       description:
-        "Searches archive.org for arcade games matching the search term. Returns a list of game identifiers and titles sorted by relevance.",
+        "Searches for shareware, freeware, and public domain arcade games. " +
+        "Only returns games with verified distribution rights.",
       inputSchema: z.object({
         searchTerm: z
           .string()
           .describe(
-            'The game name or search term (e.g., "doom", "pacman", "mario").',
+            'The game name or search term (e.g., "doom", "commander keen", "tyrian").',
           ),
         maxResults: z
           .number()
@@ -81,7 +86,7 @@ export function createServer(port: number): McpServer {
             content: [
               {
                 type: "text",
-                text: `No arcade games found for "${searchTerm}". Try a different search term.`,
+                text: `No verified-rights games found for "${searchTerm}". Try a different search term, or check the allowlist for available games.`,
               },
             ],
           };
@@ -93,6 +98,8 @@ export function createServer(port: number): McpServer {
           description: game.description || null,
           year: game.year || null,
           creator: game.creator || null,
+          rightsStatus: game.rightsStatus,
+          rightsNote: game.rightsNote || null,
         }));
 
         return {
@@ -100,7 +107,12 @@ export function createServer(port: number): McpServer {
             {
               type: "text",
               text: JSON.stringify(
-                { total: games.length, searchTerm, games: gameData },
+                {
+                  total: games.length,
+                  searchTerm,
+                  note: "All results have verified distribution rights (shareware, freeware, or public domain)",
+                  games: gameData,
+                },
                 null,
                 2,
               ),
@@ -127,12 +139,14 @@ export function createServer(port: number): McpServer {
     {
       title: "Play Arcade Game",
       description:
-        "Loads and displays a playable arcade game from archive.org by its identifier.",
+        "Loads and displays a playable arcade game from archive.org. " +
+        "Only games with verified distribution rights (shareware, freeware, public domain) can be loaded. " +
+        "Use search_games first to find available games.",
       inputSchema: z.object({
         gameId: z
           .string()
           .describe(
-            'The archive.org identifier (e.g., "doom-play", "arcade_20pacgal").',
+            'The archive.org identifier for a verified-rights game (e.g., "doom-play", "heretic-dos").',
           ),
       }) as any,
       _meta: {
@@ -153,8 +167,32 @@ export function createServer(port: number): McpServer {
         };
       }
 
+      // Check rights status - only allow verified games
+      const rights = await checkRights(gameId);
+
+      if (rights.status !== "allowed") {
+        return {
+          content: [
+            {
+              type: "text",
+              text:
+                `Error: Cannot load "${gameId}" - distribution rights not verified.\n` +
+                `Status: ${rights.note || "Rights status unknown"}\n\n` +
+                `Only shareware, freeware, and public domain games can be loaded. ` +
+                `Use search_games to find available games.`,
+            },
+          ],
+          isError: true,
+        };
+      }
+
       return {
-        content: [{ type: "text", text: `Loading arcade game: ${gameId}` }],
+        content: [
+          {
+            type: "text",
+            text: `Loading arcade game: ${gameId}\nRights: ${rights.note || "Verified for distribution"}`,
+          },
+        ],
       };
     },
   );
diff --git a/examples/arcade-server/types.ts b/examples/arcade-server/types.ts
new file mode 100644
index 00000000..83517d56
--- /dev/null
+++ b/examples/arcade-server/types.ts
@@ -0,0 +1,59 @@
+/**
+ * Type definitions for rights management in the Arcade Server.
+ */
+
+/**
+ * Rights status for a game:
+ * - "allowed": Verified shareware, freeware, or public domain
+ * - "unknown": Rights status could not be determined
+ * - "restricted": Known to be copyrighted without distribution permission
+ */
+export type RightsStatus = "allowed" | "unknown" | "restricted";
+
+/**
+ * Extended game search result with rights information.
+ */
+export interface GameSearchResult {
+  identifier: string;
+  title: string;
+  description?: string;
+  year?: string;
+  creator?: string;
+  rightsStatus: RightsStatus;
+  rightsNote?: string;
+}
+
+/**
+ * Entry in the curated allowlist of verified-rights games.
+ *
+ * Each entry must have documented legal basis for distribution rights.
+ * This is NOT based on archive.org metadata (which is unreliable),
+ * but on external, verifiable sources.
+ */
+export interface AllowlistEntry {
+  /** Archive.org identifier for the game */
+  identifier: string;
+  /** Human-readable game title */
+  displayTitle: string;
+  /** Brief description of rights status (shown to users) */
+  rightsNote: string;
+  /**
+   * URL to external source documenting distribution rights.
+   * This should be an authoritative source (publisher announcement,
+   * official website, press release, etc.) - NOT archive.org metadata.
+   */
+  sourceUrl: string;
+  /**
+   * Detailed legal justification explaining why this game is
+   * legally distributable. Should reference the sourceUrl.
+   */
+  legalBasis: string;
+}
+
+/**
+ * Result from the rights checker.
+ */
+export interface RightsCheckResult {
+  status: RightsStatus;
+  note?: string;
+}