From 2ca4ae99778eca3e922525a101a202a6a3669d90 Mon Sep 17 00:00:00 2001 From: Joel Verhagen Date: Tue, 18 Nov 2025 02:58:10 -0500 Subject: [PATCH] Add support for ACR (Azure Container Registry) and MCR (Microsoft Container Registry) (#754) ## Motivation and Context Microsoft uses `mcr.microsoft.com` to host our public containers. These are syndicated to Docker Hub but image references use `mcr.microsoft.com` which is not currently supported by the Official MCP Registry. See https://github.com/modelcontextprotocol/registry/issues/753. Microsoft teams want to use MCR-based images for Microsoft MCP servers. I believe we should be adding ACR support as well, so that our customers using Azure Container Registry can use the MCP Registry as well. In short, MCR is used for Microsoft managed containers. ACR is a solution for Azure customers to host their own containers. ## How Has This Been Tested? Unit tests. Manual test: local push of a server.json with `mcr.microsoft.com/azure-sdk/azure-mcp:2.0.0-beta.1` and `azurearcjumpstart.azurecr.io/hello-arc:latest` in it. The error is now about missing annotation not unsupported OCI registry. ## Breaking Changes No. ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Additional context --- docs/guides/publishing/publish-server.md | 2 ++ docs/reference/faq.md | 3 +++ .../server-json/official-registry-requirements.md | 2 ++ internal/validators/registries/oci.go | 9 +++++++++ internal/validators/registries/oci_test.go | 12 ++++++++++++ 5 files changed, 28 insertions(+) diff --git a/docs/guides/publishing/publish-server.md b/docs/guides/publishing/publish-server.md index 80eefed..ea0ebab 100644 --- a/docs/guides/publishing/publish-server.md +++ b/docs/guides/publishing/publish-server.md @@ -317,6 +317,8 @@ The official MCP registry supports: - Docker Hub (`docker.io`) - GitHub Container Registry (`ghcr.io`) - Google Artifact Registry (any `*.pkg.dev` domain) +- Azure Container Registry (`*.azurecr.io`) +- Microsoft Container Registry (`mcr.microsoft.com`) diff --git a/docs/reference/faq.md b/docs/reference/faq.md index 5474a49..034ccb1 100644 --- a/docs/reference/faq.md +++ b/docs/reference/faq.md @@ -62,6 +62,9 @@ This applies to both locally-run and remote servers. - NuGet.org (.NET packages) - GitHub Container Registry (GHCR) - Docker Hub +- Google Artifact Registry (`*.pkg.dev` domains) +- Azure Container Registry (`*.azurecr.io` domains) +- Microsoft Container Registry (MCR) More can be added as the community desires; feel free to open an issue if you are interested in building support for another registry. diff --git a/docs/reference/server-json/official-registry-requirements.md b/docs/reference/server-json/official-registry-requirements.md index f33ed8c..6ab2325 100644 --- a/docs/reference/server-json/official-registry-requirements.md +++ b/docs/reference/server-json/official-registry-requirements.md @@ -42,6 +42,8 @@ Only trusted public registries are supported. Private registries and alternative - Docker Hub (`docker.io`) - GitHub Container Registry (`ghcr.io`) - Google Artifact Registry (`*.pkg.dev`) + - Azure Container Registry (`*.azurecr.io`) + - Microsoft Container Registry (`mcr.microsoft.com`) - **MCPB**: `https://github.com` releases and `https://gitlab.com` releases only ## `_meta` Namespace Restrictions diff --git a/internal/validators/registries/oci.go b/internal/validators/registries/oci.go index 211e578..6932d7f 100644 --- a/internal/validators/registries/oci.go +++ b/internal/validators/registries/oci.go @@ -33,7 +33,10 @@ var allowedOCIRegistries = map[string]bool{ "index.docker.io": true, // Docker Hub index // GitHub Container Registry "ghcr.io": true, + // Microsoft Container Registry + "mcr.microsoft.com": true, // Google Artifact Registry (*.pkg.dev pattern handled in isAllowedRegistry) + // Azure Container Registry (*.azurecr.io pattern handled in isAllowedRegistry) } // ValidateOCI validates that an OCI image contains the correct MCP server name annotation. @@ -47,6 +50,7 @@ var allowedOCIRegistries = map[string]bool{ // - Docker Hub (docker.io) // - GitHub Container Registry (ghcr.io) // - Google Artifact Registry (*.pkg.dev) +// - Microsoft Container Registry (mcr.microsoft.com) func ValidateOCI(ctx context.Context, pkg model.Package, serverName string) error { if pkg.Identifier == "" { return ErrMissingIdentifierForOCI @@ -149,5 +153,10 @@ func isAllowedRegistry(registry string) bool { return true } + // Azure Container Registry: *.azurecr.io + if strings.HasSuffix(registry, ".azurecr.io") { + return true + } + return false } diff --git a/internal/validators/registries/oci_test.go b/internal/validators/registries/oci_test.go index 3b02fd2..64e319d 100644 --- a/internal/validators/registries/oci_test.go +++ b/internal/validators/registries/oci_test.go @@ -51,6 +51,18 @@ func TestValidateOCI_RegistryAllowlist(t *testing.T) { expectError: true, errorMsg: "missing required annotation", }, + { + name: "MCR should be allowed", + identifier: "mcr.microsoft.com/dotnet/aspire-dashboard:9.5.0", + expectError: true, + errorMsg: "missing required annotation", + }, + { + name: "ACR should be allowed", + identifier: "azurearcjumpstart.azurecr.io/hello-arc:latest", + expectError: true, + errorMsg: "missing required annotation", + }, // Disallowed registries {