feat: Add support for MCP Bundles (MCPB) in registry (#295)

## Motivation and Context
- Add MCPB as a new registry_name option
- Add file_hashes field to package model for integrity verification
- Implement URL validation restricting MCPB packages to GitHub/GitLab
hosts
- Require SHA-256 hash for all MCPB packages
- Add example MCPB package in documentation
- Update schemas and OpenAPI specification

See issue #260

## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->

## Breaking Changes
N/A, registry has not yet been launched

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [x] I have added or updated documentation as needed

---------

Co-authored-by: Adam Jones <adamj+git@anthropic.com>

internal/database/import_test.go

@@ -98,6 +98,14 @@ func TestReadSeedFile_RegistryURL(t *testing.T) {
 		Server: model.ServerDetail{
 			Name:        "Test Server 1",
 			Description: "First test server",
+			Packages: []model.Package{
+				{
+					RegistryType:    "npm",
+					RegistryBaseURL: "https://registry.npmjs.org",
+					Identifier:      "test-package-1",
+					Version:         "1.0.0",
+				},
+			},
 		},
 		XIOModelContextProtocolRegistry: map[string]interface{}{
 			"id":           "server-1",
@@ -109,6 +117,14 @@ func TestReadSeedFile_RegistryURL(t *testing.T) {
 		Server: model.ServerDetail{
 			Name:        "Test Server 2",
 			Description: "Second test server",
+			Packages: []model.Package{
+				{
+					RegistryType:    "npm",
+					RegistryBaseURL: "https://registry.npmjs.org",
+					Identifier:      "test-package-2",
+					Version:         "2.0.0",
+				},
+			},
 		},
 		XIOModelContextProtocolRegistry: map[string]interface{}{
 			"id":           "server-2",
@@ -118,24 +134,26 @@ func TestReadSeedFile_RegistryURL(t *testing.T) {
 	}
 
 	serverDetail1 := model.ServerDetail{
-		Name: "Test Server 1",
+		Name:        "Test Server 1",
 		Description: "First test server",
 		Packages: []model.Package{
 			{
-				RegistryName: "npm",
-				Name:    "test-package-1",
-				Version: "1.0.0",
+				RegistryType:    "npm",
+				RegistryBaseURL: "https://registry.npmjs.org",
+				Identifier:      "test-package-1",
+				Version:         "1.0.0",
 			},
 		},
 	}
 	serverDetail2 := model.ServerDetail{
-		Name: "Test Server 2",
+		Name:        "Test Server 2",
 		Description: "Second test server",
 		Packages: []model.Package{
 			{
-				RegistryName: "npm",
-				Name:    "test-package-2",
-				Version: "2.0.0",
+				RegistryType:    "npm",
+				RegistryBaseURL: "https://registry.npmjs.org",
+				Identifier:      "test-package-2",
+				Version:         "2.0.0",
 			},
 		},
 	}
@@ -177,6 +195,12 @@ func TestReadSeedFile_RegistryURL(t *testing.T) {
 					// No NextCursor means end of pagination
 				},
 			}
+		default:
+			// No more pages
+			response = PaginatedResponse{
+				Servers:  []model.ServerResponse{},
+				Metadata: &Metadata{},
+			}
 		}
 
 		w.Header().Set("Content-Type", "application/json")
@@ -212,6 +236,16 @@ func TestReadSeedFile_RegistryURL(t *testing.T) {
 	assert.Equal(t, "Test Server 1", result[0].ServerJSON.Name)
 	assert.Equal(t, "Test Server 2", result[1].ServerJSON.Name)
 
+	// Verify packages were imported with new schema
+	assert.Len(t, result[0].ServerJSON.Packages, 1)
+	assert.Equal(t, "npm", result[0].ServerJSON.Packages[0].RegistryType)
+	assert.Equal(t, "https://registry.npmjs.org", result[0].ServerJSON.Packages[0].RegistryBaseURL)
+	assert.Equal(t, "test-package-1", result[0].ServerJSON.Packages[0].Identifier)
+	assert.Len(t, result[1].ServerJSON.Packages, 1)
+	assert.Equal(t, "npm", result[1].ServerJSON.Packages[0].RegistryType)
+	assert.Equal(t, "https://registry.npmjs.org", result[1].ServerJSON.Packages[0].RegistryBaseURL)
+	assert.Equal(t, "test-package-2", result[1].ServerJSON.Packages[0].Identifier)
+
 	// Verify metadata was extracted
 	assert.Equal(t, "server-1", result[0].RegistryMetadata.ID)
 	assert.Equal(t, "server-2", result[1].RegistryMetadata.ID)

internal/model/model.go

@@ -88,13 +88,18 @@ type Argument struct {
 }
 
 type Package struct {
-	RegistryName         string          `json:"registry_name" bson:"registry_name"`
-	Name                 string          `json:"name" bson:"name"`
-	Version              string          `json:"version" bson:"version"`
-	RunTimeHint          string          `json:"runtime_hint,omitempty" bson:"runtime_hint,omitempty"`
-	RuntimeArguments     []Argument      `json:"runtime_arguments,omitempty" bson:"runtime_arguments,omitempty"`
-	PackageArguments     []Argument      `json:"package_arguments,omitempty" bson:"package_arguments,omitempty"`
-	EnvironmentVariables []KeyValueInput `json:"environment_variables,omitempty" bson:"environment_variables,omitempty"`
+	// RegistryType indicates how to download packages (e.g., "npm", "pypi", "docker-hub", "mcpb")
+	RegistryType         string            `json:"registry_type,omitempty" bson:"registry_type,omitempty"`
+	// RegistryBaseURL is the base URL of the package registry
+	RegistryBaseURL      string            `json:"registry_base_url,omitempty" bson:"registry_base_url,omitempty"`
+	// Identifier is the package identifier - either a package name (for registries) or URL (for direct downloads)
+	Identifier           string            `json:"identifier,omitempty" bson:"identifier,omitempty"`
+	Version              string            `json:"version,omitempty" bson:"version,omitempty"`
+	FileSHA256           string            `json:"file_sha256,omitempty" bson:"file_sha256,omitempty"`
+	RunTimeHint          string            `json:"runtime_hint,omitempty" bson:"runtime_hint,omitempty"`
+	RuntimeArguments     []Argument        `json:"runtime_arguments,omitempty" bson:"runtime_arguments,omitempty"`
+	PackageArguments     []Argument        `json:"package_arguments,omitempty" bson:"package_arguments,omitempty"`
+	EnvironmentVariables []KeyValueInput   `json:"environment_variables,omitempty" bson:"environment_variables,omitempty"`
 }
 
 // Remote represents a remote connection endpoint

internal/service/registry_service.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net/url"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
@@ -68,6 +70,61 @@ func (s *registryServiceImpl) GetByID(id string) (*model.ServerResponse, error)
 	return &response, nil
 }
 
+// validateMCPBPackage validates MCPB packages
+func validateMCPBPackage(host string) error {
+	allowedHosts := []string{
+		"github.com",
+		"www.github.com",
+		"gitlab.com",
+		"www.gitlab.com",
+	}
+
+	isAllowed := false
+	for _, allowed := range allowedHosts {
+		if host == allowed {
+			isAllowed = true
+			break
+		}
+	}
+
+	if !isAllowed {
+		return fmt.Errorf("MCPB packages must be hosted on allowlisted providers (GitHub or GitLab). Host '%s' is not allowed", host)
+	}
+	
+	return nil
+}
+
+// validatePackage validates packages to ensure they meet requirements
+func validatePackage(pkg *model.Package) error {
+	registryType := strings.ToLower(pkg.RegistryType)
+	
+	// For direct download packages (mcpb or direct URLs)
+	if registryType == "mcpb" || 
+	   strings.HasPrefix(pkg.Identifier, "http://") || strings.HasPrefix(pkg.Identifier, "https://") {
+		parsedURL, err := url.Parse(pkg.Identifier)
+		if err != nil {
+			return fmt.Errorf("invalid package URL: %w", err)
+		}
+		
+		host := strings.ToLower(parsedURL.Host)
+		
+		// For MCPB packages, validate they're from allowed hosts
+		if registryType == "mcpb" || strings.HasSuffix(strings.ToLower(pkg.Identifier), ".mcpb") {
+			return validateMCPBPackage(host)
+		}
+		
+		// For other URL-based packages, just ensure it's valid
+		if parsedURL.Scheme == "" || parsedURL.Host == "" {
+			return fmt.Errorf("package URL must be a valid absolute URL")
+		}
+		return nil
+	}
+	
+	// For registry-based packages, no special validation needed
+	// Registry types like "npm", "pypi", "docker-hub", "nuget" are all valid
+	return nil
+}
+
 // Publish publishes a server with separated extensions
 func (s *registryServiceImpl) Publish(req model.PublishRequest) (*model.ServerResponse, error) {
 	// Create a timeout context for the database operation
@@ -84,6 +141,13 @@ func (s *registryServiceImpl) Publish(req model.PublishRequest) (*model.ServerRe
 		return nil, err
 	}
 
+	// Validate all packages
+	for _, pkg := range req.Server.Packages {
+		if err := validatePackage(&pkg); err != nil {
+			return nil, fmt.Errorf("validation failed: %w", err)
+		}
+	}
+
 	// Validate reverse-DNS namespace matching for remote URLs
 	if err := model.ValidateRemoteNamespaceMatch(req.Server); err != nil {
 		return nil, err

internal/validators/validators.go

@@ -59,7 +59,7 @@ type PackageValidator struct{}
 
 // Validate checks if the package details are valid
 func (pv *PackageValidator) Validate(obj *model.Package) error {
-	if !HasNoSpaces(obj.Name) {
+	if !HasNoSpaces(obj.Identifier) {
 		return ErrPackageNameHasSpaces
 	}
 

internal/validators/validators_test.go

@@ -31,8 +31,9 @@ func TestObjectValidator_Validate(t *testing.T) {
 				},
 				Packages: []model.Package{
 					{
-						Name:         "test-package",
-						RegistryName: "npm",
+						Identifier:      "test-package",
+						RegistryType:    "npm",
+						RegistryBaseURL: "https://registry.npmjs.org",
 					},
 				},
 				Remotes: []model.Remote{
@@ -102,8 +103,9 @@ func TestObjectValidator_Validate(t *testing.T) {
 				},
 				Packages: []model.Package{
 					{
-						Name:         "test package with spaces",
-						RegistryName: "npm",
+						Identifier:      "test package with spaces",
+						RegistryType:    "npm",
+						RegistryBaseURL: "https://registry.npmjs.org",
 					},
 				},
 			},
@@ -123,12 +125,14 @@ func TestObjectValidator_Validate(t *testing.T) {
 				},
 				Packages: []model.Package{
 					{
-						Name:         "valid-package",
-						RegistryName: "npm",
+						Identifier:      "valid-package",
+						RegistryType:    "npm",
+						RegistryBaseURL: "https://registry.npmjs.org",
 					},
 					{
-						Name:         "invalid package", // Has space
-						RegistryName: "pip",
+						Identifier:      "invalid package", // Has space
+						RegistryType:    "pypi",
+						RegistryBaseURL: "https://pypi.org",
 					},
 				},
 			},