modelcontextprotocol/registry
Watch
1
0
Fork
You've already forked registry
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(oci): add support for Quay.io registry (#1150)

Browse source 
Adds support for the Quay.io container registry to the OCI validator.
This allows MCP servers hosted on Quay.io to be registered and validated
by the official registry.

## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->

Quay.io is a major, trusted public OCI registry widely used by the
cloud-native and open-source communities. Currently, attempting to
publish a server using a Quay image results in an unsupported OCI
registry error. This change enables developers to use Quay.io as a
first-class hosting option for their MCP server images.

## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
- **Unit Tests:** Updated `internal/validators/registries/oci_test.go`
to transition Quay.io from a rejected test case to an allowed one.
- **Pattern Matching:** Verified that the allowlist correctly handles
both specific image identifiers and general pattern matching for the
`quay.io` host.
- **Local Validation:** Ran `make check` to ensure no regressions in the
existing OCI validation logic.

## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No. This is an additive change that expands the allowlist of supported
registries. Existing configurations are unaffected.

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
The implementation follows the existing pattern for OCI registries:
1. Added a `RegistryURLQuay` constant to `pkg/model` for consistency.
2. Hardcoded `quay.io` into the `allowedOCIRegistries` map in the
validator to minimize architectural complexity.
3. Updated all relevant documentation files (`package-types.mdx`,
`generic-server-json.md`, and `official-registry-requirements.md`) to
ensure the source of truth is updated across the project.
4. Validation remains scoped to public images; no private registry
authentication was added for this host.

Signed-off-by: Mikel Olasagasti Uranga <mikel@olasagasti.info>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
This commit is contained in:
Mikel Olasagasti Uranga 2026-04-24 12:11:46 +02:00 • committed by GitHub
commit 7c446e75ad
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
7 changed files with 47 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/modelcontextprotocol-io/package-types.mdx
View file

@ -131,6 +131,7 @@ For Docker/OCI images, the MCP Registry currently supports:
- Docker Hub (`docker.io`)
- GitHub Container Registry (`ghcr.io`)
- Quay.io (`quay.io`)
- Google Artifact Registry (any `*.pkg.dev` domain)
- Azure Container Registry (`*.azurecr.io`)
- Microsoft Container Registry (`mcr.microsoft.com`)
@ -156,7 +157,7 @@ Docker/OCI images use `"registryType": "oci"` in `server.json`. For example:
}
```
The format of `identifier` is `registry/namespace/repository:tag`. For example, `docker.io/user/app:1.0.0` or `ghcr.io/user/app:1.0.0`. The tag can also be specified as a digest.
The format of `identifier` is `registry/namespace/repository:tag`. For example, `docker.io/user/app:1.0.0`, `ghcr.io/user/app:1.0.0`, or `quay.io/myorg/my-mcp-server:1.0.0`. The tag can also be specified as a digest.
### Ownership Verification

20
docs/reference/server-json/generic-server-json.md
View file

@ -264,6 +264,26 @@ This will essentially instruct the MCP client to execute `dnx Knapcode.SampleMcp
}
```
The same `registryType` / `identifier` pattern works for other supported OCI hosts. For example, an image on Quay.io:
```json
{
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"name": "io.github.example/quay-sample-mcp",
"description": "Example MCP server distributed as an OCI image on Quay.io",
"version": "1.0.0",
"packages": [
{
"registryType": "oci",
"identifier": "quay.io/myorg/my-mcp-server:1.0.0",
"transport": {
"type": "stdio"
}
}
]
}
```
### Remote Server Example
```json

1
docs/reference/server-json/official-registry-requirements.md
View file

@ -36,6 +36,7 @@ Only trusted public registries are supported. Private registries and alternative
- **Docker/OCI**:
- Docker Hub (`docker.io`)
- GitHub Container Registry (`ghcr.io`)
- Quay.io (`quay.io`)
- Google Artifact Registry (`*.pkg.dev`)
- Azure Container Registry (`*.azurecr.io`)
- Microsoft Container Registry (`mcr.microsoft.com`)

3
internal/validators/registries/oci.go
View file

@ -33,6 +33,8 @@ var allowedOCIRegistries = map[string]bool{
"index.docker.io": true, // Docker Hub index
// GitHub Container Registry
"ghcr.io": true,
// Red Hat Quay
"quay.io": true,
// Microsoft Container Registry
"mcr.microsoft.com": true,
// Google Artifact Registry (*.pkg.dev pattern handled in isAllowedRegistry)
@ -49,6 +51,7 @@ var allowedOCIRegistries = map[string]bool{
// Supported registries:
// - Docker Hub (docker.io)
// - GitHub Container Registry (ghcr.io)
// - Quay.io (quay.io)
// - Google Artifact Registry (*.pkg.dev)
// - Microsoft Container Registry (mcr.microsoft.com)
func ValidateOCI(ctx context.Context, pkg model.Package, serverName string) error {

24
internal/validators/registries/oci_test.go
View file

@ -66,6 +66,13 @@ func TestValidateOCI_RegistryAllowlist(t *testing.T) {
errorMsg: "missing required annotation",
mustNotContainMsg: "unsupported OCI registry",
},
{
name: "Quay.io should be allowed",
identifier: "quay.io/prometheus/node-exporter:v1.7.0",
expectError: true,
errorMsg: "missing required annotation",
mustNotContainMsg: "unsupported OCI registry",
},
// Removed ACR test with non-existent host - ACR support is tested elsewhere
// Disallowed registries
@ -75,12 +82,6 @@ func TestValidateOCI_RegistryAllowlist(t *testing.T) {
expectError: true,
errorMsg: "unsupported OCI registry",
},
{
name: "Quay.io should be rejected",
identifier: "quay.io/test/image:latest",
expectError: true,
errorMsg: "unsupported OCI registry",
},
{
name: "ECR Public should be rejected",
identifier: "public.ecr.aws/test/image:latest",
@ -134,8 +135,9 @@ func TestValidateOCI_RegistryAllowlist(t *testing.T) {
}
func TestValidateOCI_RegistryPatterns(t *testing.T) {
// This test verifies registry pattern matching (wildcards like *.azurecr.io and *.pkg.dev)
// without relying on external images that may not exist
// Verifies allowlist behavior: wildcard hosts (*.azurecr.io, *.pkg.dev) and fixed hosts
// like quay.io. shouldFail=false means the error must not be "unsupported OCI registry"
// (validation may still error later, for example missing annotation or image not found).
tests := []struct {
name string
identifier string
@ -156,6 +158,12 @@ func TestValidateOCI_RegistryPatterns(t *testing.T) {
identifier: "us-west1-docker.pkg.dev/project/repo/image:tag",
shouldFail: false,
},
{
name: "Quay.io host should be allowed",
identifier: "quay.io/nonexistent/mcp-registry-fake-repo:v1",
// Past allowlist; fake repo typically yields "does not exist", not unsupported registry
shouldFail: false,
},
{
name: "GCR should be rejected at registry check",
identifier: "gcr.io/project/image:latest",

7
pkg/model/constants.go
View file

@ -11,11 +11,12 @@ const (
// Registry Base URLs - supported package registry base URLs
const (
RegistryURLNPM = "https://registry.npmjs.org"
RegistryURLPyPI = "https://pypi.org"
RegistryURLNuGet = "https://api.nuget.org/v3/index.json"
RegistryURLGitHub = "https://github.com"
RegistryURLGitLab = "https://gitlab.com"
RegistryURLNPM = "https://registry.npmjs.org"
RegistryURLNuGet = "https://api.nuget.org/v3/index.json"
RegistryURLPyPI = "https://pypi.org"
RegistryURLQuay = "https://quay.io"
)
// Transport Types - supported remote transport protocols

2
tools/validate-examples/main.go
View file

@ -33,7 +33,7 @@ func main() {
func runValidation() error {
// Define what we validate and how
expectedServerJSONCount := 15
expectedServerJSONCount := 16
targets := []validationTarget{
{
path: filepath.Join("docs", "reference", "server-json", "generic-server-json.md"),