auth: Add DNS auth (#279)

Fixes #270
Closes #233

Adds support for DNS-based authentication for proving ownership of a
particular domain. E.g. if you can add a TXT record to `anthropic.com`,
you can publish anything at `com.anthropic/*` or `com.anthropic.*`.

Notes:
- Uses Ed25519 signatures with 15-second timestamp windows to prevent
replay attacks
- Supports multiple public keys in DNS TXT records for key rotation
scenarios
- Publisher CLI supports DNS auth via --dns-domain and --dns-private-key
flags
- Includes key generation commands in publisher README for easy setup

## Motivation and Context

This implements DNS-based public/private key authentication to allow
people to actually publish at their own domains. Currently,
authentication requires GitHub accounts which limits publishing to the
io.github.* namespace.

DNS-based auth enables:
- Publishing under your actual domain (e.g., com.anthropic/* for
anthropic.com)
- Independence from GitHub or other external auth providers
- Organizations managing their own keys and access to publishing

## How Has This Been Tested?

- Unit tests cover signature verification, DNS TXT parsing, timestamp
validation, and error cases
- Tested locally by editing my own DNS records
- All existing auth methods covered by passing tests

## Breaking Changes

None

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed

## Additional context

Will be adding HTTP challenge auth in a similar way as a separate PR,
e.g. for verifying you own `github.com` by hosting a
`github.com/.well-known/mcp-server-challenge` or similar. Just
mentioning this as we discussed HTTP challenges as closely related to
DNS challenges elsewhere, and want to reassure reviewer that this hasn't
been forgotten with this approach. :) Update: tracking the HTTP auth in
https://github.com/modelcontextprotocol/registry/issues/280

tools/publisher/main.go

@@ -97,12 +97,16 @@ func publishCommand() error {
 	var mcpFilePath string
 	var forceLogin bool
 	var authMethod string
+	var dnsDomain string
+	var dnsPrivateKey string
 
 	// Command-line flags for configuration
 	publishFlags.StringVar(&registryURL, "registry-url", "", "URL of the registry (required)")
 	publishFlags.StringVar(&mcpFilePath, "mcp-file", "", "path to the MCP file (required)")
 	publishFlags.BoolVar(&forceLogin, "login", false, "force a new login even if a token exists")
 	publishFlags.StringVar(&authMethod, "auth-method", "github-at", "authentication method (default: github-at)")
+	publishFlags.StringVar(&dnsDomain, "dns-domain", "", "domain name for DNS authentication (required for dns auth method)")
+	publishFlags.StringVar(&dnsPrivateKey, "dns-private-key", "", "64-character hex seed for DNS authentication (required for dns auth method)")
 
 	// Set custom usage function
 	publishFlags.Usage = func() {
@@ -111,10 +115,12 @@ func publishCommand() error {
 		fmt.Fprint(os.Stdout, "Publish a server.json file to the registry\n")
 		fmt.Fprint(os.Stdout, "\n")
 		fmt.Fprint(os.Stdout, "Flags:\n")
-		fmt.Fprint(os.Stdout, "  --registry-url string    URL of the registry (required)\n")
-		fmt.Fprint(os.Stdout, "  --mcp-file string        path to the MCP file (required)\n")
-		fmt.Fprint(os.Stdout, "  --login                  force a new login even if a token exists\n")
-		fmt.Fprint(os.Stdout, "  --auth-method string     authentication method (default: github-at)\n")
+		fmt.Fprint(os.Stdout, "  --registry-url string       URL of the registry (required)\n")
+		fmt.Fprint(os.Stdout, "  --mcp-file string           path to the MCP file (required)\n")
+		fmt.Fprint(os.Stdout, "  --login                     force a new login even if a token exists\n")
+		fmt.Fprint(os.Stdout, "  --auth-method string        authentication method (default: github-at)\n")
+		fmt.Fprint(os.Stdout, "  --dns-domain string         domain name for DNS authentication\n")
+		fmt.Fprint(os.Stdout, "  --dns-private-key string    64-character hex seed for DNS authentication\n")
 	}
 
 	if err := publishFlags.Parse(os.Args[2:]); err != nil {
@@ -140,6 +146,9 @@ func publishCommand() error {
 	case "github-oidc":
 		log.Println("Using GitHub Actions OIDC for authentication")
 		authProvider = auth.NewGitHubOIDCProvider(registryURL)
+	case "dns":
+		log.Println("Using DNS-based authentication")
+		authProvider = auth.NewDNSProvider(registryURL, dnsDomain, dnsPrivateKey)
 	case "none":
 		log.Println("Using anonymous authentication")
 		authProvider = auth.NewNoneProvider(registryURL)