Reflect the latest registry changes in openapi.yaml (#345)

<!-- Provide a brief summary of your changes -->

## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR:
* Adds a new `transport` type used in Package and Remotes
* Added `docker` to the `runtime_hint` examples
* Added support for templated URLs. It is available for streamable-http
and sse transports for Packages. I didn't thought of reasons to have
this for Remotes, but we can enable it if needed.
* Added validation for templated URLs so we can ensure all referenced
placeholder variables are available.
* For streamable-http and SSE transport types the URL is now a required
property
* Updated the publisher init command to reflect these changes
* Updated the seed.json file
* Added unit tests for the transport type related changes
* Updated the server.json schema and the external pkg structs to reflect
the new transport type
* Updated the examples

Thanks to @kkkarthik for spotting it! 🙏 

## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Ran the tests locally

## Breaking Changes
<!-- Will users need to update their code or configurations? -->
Yes

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

---------

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
This commit is contained in:
Radoslav Dimitrov 2025-09-05 23:07:08 +03:00 • committed by GitHub
commit e0e51eae37
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 1192 additions and 488 deletions

View file

@ -30,10 +30,51 @@ func HasNoSpaces(s string) bool {
return !strings.Contains(s, " ")
}
// IsValidURL checks if a URL is in valid format
// extractTemplateVariables extracts template variables from a URL string
// e.g., "http://{host}:{port}/mcp" returns ["host", "port"]
func extractTemplateVariables(url string) []string {
re := regexp.MustCompile(`\{([^}]+)\}`)
matches := re.FindAllStringSubmatch(url, -1)
var variables []string
for _, match := range matches {
if len(match) > 1 {
variables = append(variables, match[1])
}
}
return variables
}
// replaceTemplateVariables replaces template variables with placeholder values for URL validation
func replaceTemplateVariables(rawURL string) string {
// Replace common template variables with valid placeholder values for parsing
templateReplacements := map[string]string{
"{host}": "example.com",
"{port}": "8080",
"{path}": "api",
"{protocol}": "http",
"{scheme}": "http",
}
result := rawURL
for placeholder, replacement := range templateReplacements {
result = strings.ReplaceAll(result, placeholder, replacement)
}
// Handle any remaining {variable} patterns with generic placeholder
re := regexp.MustCompile(`\{[^}]+\}`)
result = re.ReplaceAllString(result, "placeholder")
return result
}
// IsValidURL checks if a URL is in valid format (basic structure validation)
func IsValidURL(rawURL string) bool {
// Replace template variables with placeholders for parsing
testURL := replaceTemplateVariables(rawURL)
// Parse the URL
u, err := url.Parse(rawURL)
u, err := url.Parse(testURL)
if err != nil {
return false
}
@ -43,8 +84,67 @@ func IsValidURL(rawURL string) bool {
return false
}
if u.Host == "" || u.Hostname() == "localhost" {
if u.Host == "" {
return false
}
return true
}
// IsValidRemoteURL checks if a URL is valid for remotes (stricter than packages - no localhost allowed)
func IsValidRemoteURL(rawURL string) bool {
// First check basic URL structure
if !IsValidURL(rawURL) {
return false
}
// Parse the URL to check for localhost restriction
u, err := url.Parse(rawURL)
if err != nil {
return false
}
// Reject localhost URLs for remotes (security/production concerns)
hostname := u.Hostname()
if hostname == "localhost" || hostname == "127.0.0.1" || strings.HasSuffix(hostname, ".localhost") {
return false
}
return true
}
// IsValidTemplatedURL validates a URL with template variables against available variables
// For packages: validates that template variables reference package arguments or environment variables
// For remotes: disallows template variables entirely
func IsValidTemplatedURL(rawURL string, availableVariables []string, allowTemplates bool) bool {
// First check basic URL structure
if !IsValidURL(rawURL) {
return false
}
// Extract template variables from URL
templateVars := extractTemplateVariables(rawURL)
// If no templates are found, it's a valid static URL
if len(templateVars) == 0 {
return true
}
// If templates are not allowed (e.g., for remotes), reject URLs with templates
if !allowTemplates {
return false
}
// Validate that all template variables are available
availableSet := make(map[string]bool)
for _, v := range availableVariables {
availableSet[v] = true
}
for _, templateVar := range templateVars {
if !availableSet[templateVar] {
return false
}
}
return true
}

View file

@ -34,7 +34,7 @@ func ValidateServerJSON(serverJSON *apiv0.ServerJSON) error {
// Validate all remotes
for _, remote := range serverJSON.Remotes {
if err := validateRemote(&remote); err != nil {
if err := validateTransport(&remote); err != nil {
return err
}
}
@ -81,6 +81,12 @@ func validatePackageField(obj *model.Package) error {
}
}
// Validate transport with template variable support
availableVariables := collectAvailableVariables(obj)
if err := validatePackageTransport(&obj.Transport, availableVariables); err != nil {
return fmt.Errorf("invalid transport: %w", err)
}
return nil
}
@ -130,11 +136,83 @@ func validateArgumentValueFields(name, value, defaultValue string) error {
return nil
}
func validateRemote(obj *model.Remote) error {
if !IsValidURL(obj.URL) {
return fmt.Errorf("%w: %s", ErrInvalidRemoteURL, obj.URL)
// collectAvailableVariables collects all available template variables from a package
func collectAvailableVariables(pkg *model.Package) []string {
var variables []string
// Add environment variable names
for _, env := range pkg.EnvironmentVariables {
variables = append(variables, env.Name)
}
// Add runtime argument names and value hints
for _, arg := range pkg.RuntimeArguments {
if arg.Name != "" {
variables = append(variables, arg.Name)
}
if arg.ValueHint != "" {
variables = append(variables, arg.ValueHint)
}
}
// Add package argument names and value hints
for _, arg := range pkg.PackageArguments {
if arg.Name != "" {
variables = append(variables, arg.Name)
}
if arg.ValueHint != "" {
variables = append(variables, arg.ValueHint)
}
}
return variables
}
// validatePackageTransport validates a package's transport with templating support
func validatePackageTransport(transport *model.Transport, availableVariables []string) error {
// Validate transport type is supported
switch transport.Type {
case model.TransportTypeStdio:
// No additional validation needed for stdio - URL should be empty
return nil
case model.TransportTypeStreamableHTTP, model.TransportTypeSSE:
// URL is required for streamable-http and sse
if transport.URL == "" {
return fmt.Errorf("url is required for %s transport type", transport.Type)
}
// Validate URL format with template variable support
if !IsValidTemplatedURL(transport.URL, availableVariables, true) {
// Check if it's a template variable issue or basic URL issue
templateVars := extractTemplateVariables(transport.URL)
if len(templateVars) > 0 {
return fmt.Errorf("%w: template variables in URL %s reference undefined variables. Available variables: %v",
ErrInvalidRemoteURL, transport.URL, availableVariables)
}
return fmt.Errorf("%w: %s", ErrInvalidRemoteURL, transport.URL)
}
return nil
default:
return fmt.Errorf("unsupported transport type: %s", transport.Type)
}
}
// validateTransport validates a remote transport (no templating allowed)
func validateTransport(obj *model.Transport) error {
// Validate transport type is supported - remotes only support streamable-http and sse
switch obj.Type {
case model.TransportTypeStreamableHTTP, model.TransportTypeSSE:
// URL is required for streamable-http and sse
if obj.URL == "" {
return fmt.Errorf("url is required for %s transport type", obj.Type)
}
// Validate URL format (no templates allowed for remotes, no localhost)
if !IsValidRemoteURL(obj.URL) {
return fmt.Errorf("%w: %s", ErrInvalidRemoteURL, obj.URL)
}
return nil
default:
return fmt.Errorf("unsupported transport type for remotes: %s (only streamable-http and sse are supported)", obj.Type)
}
return nil
}
// ValidatePublishRequest validates a complete publish request including extensions

View file

@ -35,11 +35,15 @@ func TestValidate(t *testing.T) {
Identifier: "test-package",
RegistryType: "npm",
RegistryBaseURL: "https://registry.npmjs.org",
Transport: model.Transport{
Type: "stdio",
},
},
},
Remotes: []model.Remote{
Remotes: []model.Transport{
{
URL: "https://example.com/remote",
Type: "streamable-http",
URL: "https://example.com/remote",
},
},
},
@ -107,6 +111,9 @@ func TestValidate(t *testing.T) {
Identifier: "test package with spaces",
RegistryType: "npm",
RegistryBaseURL: "https://registry.npmjs.org",
Transport: model.Transport{
Type: "stdio",
},
},
},
},
@ -129,11 +136,17 @@ func TestValidate(t *testing.T) {
Identifier: "valid-package",
RegistryType: "npm",
RegistryBaseURL: "https://registry.npmjs.org",
Transport: model.Transport{
Type: "stdio",
},
},
{
Identifier: "invalid package", // Has space
RegistryType: "pypi",
RegistryBaseURL: "https://pypi.org",
Transport: model.Transport{
Type: "stdio",
},
},
},
},
@ -151,9 +164,10 @@ func TestValidate(t *testing.T) {
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Remotes: []model.Remote{
Remotes: []model.Transport{
{
URL: "not-a-valid-url",
Type: "streamable-http",
URL: "not-a-valid-url",
},
},
},
@ -171,9 +185,10 @@ func TestValidate(t *testing.T) {
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Remotes: []model.Remote{
Remotes: []model.Transport{
{
URL: "example.com/remote",
Type: "streamable-http",
URL: "example.com/remote",
},
},
},
@ -191,9 +206,10 @@ func TestValidate(t *testing.T) {
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Remotes: []model.Remote{
Remotes: []model.Transport{
{
URL: "http://localhost",
Type: "streamable-http",
URL: "http://localhost",
},
},
},
@ -211,9 +227,10 @@ func TestValidate(t *testing.T) {
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Remotes: []model.Remote{
Remotes: []model.Transport{
{
URL: "http://localhost:3000",
Type: "streamable-http",
URL: "http://localhost:3000",
},
},
},
@ -231,12 +248,14 @@ func TestValidate(t *testing.T) {
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Remotes: []model.Remote{
Remotes: []model.Transport{
{
URL: "https://valid.com/remote",
Type: "streamable-http",
URL: "https://valid.com/remote",
},
{
URL: "invalid-url",
Type: "streamable-http",
URL: "invalid-url",
},
},
},
@ -272,7 +291,7 @@ func TestValidate(t *testing.T) {
Version: "1.0.0",
},
Packages: []model.Package{},
Remotes: []model.Remote{},
Remotes: []model.Transport{},
},
expectedError: "",
},
@ -303,8 +322,11 @@ func TestValidate_RemoteNamespaceMatch(t *testing.T) {
name: "valid match - example.com domain",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Remotes: []model.Remote{
{URL: "https://example.com/mcp"},
Remotes: []model.Transport{
{
Type: "streamable-http",
URL: "https://example.com/mcp",
},
},
},
expectError: false,
@ -313,8 +335,11 @@ func TestValidate_RemoteNamespaceMatch(t *testing.T) {
name: "valid match - subdomain mcp.example.com",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Remotes: []model.Remote{
{URL: "https://mcp.example.com/endpoint"},
Remotes: []model.Transport{
{
Type: "streamable-http",
URL: "https://mcp.example.com/endpoint",
},
},
},
expectError: false,
@ -323,8 +348,11 @@ func TestValidate_RemoteNamespaceMatch(t *testing.T) {
name: "valid match - api subdomain",
serverDetail: apiv0.ServerJSON{
Name: "com.example/api-server",
Remotes: []model.Remote{
{URL: "https://api.example.com/mcp"},
Remotes: []model.Transport{
{
Type: "streamable-http",
URL: "https://api.example.com/mcp",
},
},
},
expectError: false,
@ -333,8 +361,11 @@ func TestValidate_RemoteNamespaceMatch(t *testing.T) {
name: "invalid - wrong domain",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Remotes: []model.Remote{
{URL: "https://google.com/mcp"},
Remotes: []model.Transport{
{
Type: "streamable-http",
URL: "https://google.com/mcp",
},
},
},
expectError: true,
@ -344,8 +375,11 @@ func TestValidate_RemoteNamespaceMatch(t *testing.T) {
name: "invalid - different domain entirely",
serverDetail: apiv0.ServerJSON{
Name: "com.microsoft/server",
Remotes: []model.Remote{
{URL: "https://api.github.com/endpoint"},
Remotes: []model.Transport{
{
Type: "streamable-http",
URL: "https://api.github.com/endpoint",
},
},
},
expectError: true,
@ -355,8 +389,11 @@ func TestValidate_RemoteNamespaceMatch(t *testing.T) {
name: "invalid URL format",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test",
Remotes: []model.Remote{
{URL: "not-a-valid-url"},
Remotes: []model.Transport{
{
Type: "streamable-http",
URL: "not-a-valid-url",
},
},
},
expectError: true,
@ -366,7 +403,7 @@ func TestValidate_RemoteNamespaceMatch(t *testing.T) {
name: "empty remotes array",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test",
Remotes: []model.Remote{},
Remotes: []model.Transport{},
},
expectError: false,
},
@ -374,9 +411,15 @@ func TestValidate_RemoteNamespaceMatch(t *testing.T) {
name: "multiple valid remotes - different subdomains",
serverDetail: apiv0.ServerJSON{
Name: "com.example/server",
Remotes: []model.Remote{
{URL: "https://api.example.com/sse"},
{URL: "https://mcp.example.com/websocket"},
Remotes: []model.Transport{
{
Type: "streamable-http",
URL: "https://api.example.com/sse",
},
{
Type: "streamable-http",
URL: "https://mcp.example.com/websocket",
},
},
},
expectError: false,
@ -385,9 +428,15 @@ func TestValidate_RemoteNamespaceMatch(t *testing.T) {
name: "one valid, one invalid remote",
serverDetail: apiv0.ServerJSON{
Name: "com.example/server",
Remotes: []model.Remote{
{URL: "https://example.com/sse"},
{URL: "https://google.com/websocket"},
Remotes: []model.Transport{
{
Type: "streamable-http",
URL: "https://example.com/sse",
},
{
Type: "streamable-http",
URL: "https://google.com/websocket",
},
},
},
expectError: true,
@ -679,6 +728,363 @@ func TestValidateArgument_ValidValueFields(t *testing.T) {
}
// Helper function to create a valid server with a specific argument for testing
func TestValidate_TransportValidation(t *testing.T) {
tests := []struct {
name string
serverDetail apiv0.ServerJSON
expectedError string
}{
// Package transport tests - stdio (no URL required)
{
name: "package transport stdio without URL",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Packages: []model.Package{
{
Identifier: "test-package",
RegistryType: "npm",
Transport: model.Transport{
Type: "stdio",
},
},
},
},
expectedError: "",
},
{
name: "package transport stdio with URL (should still work)",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Packages: []model.Package{
{
Identifier: "test-package",
RegistryType: "npm",
Transport: model.Transport{
Type: "stdio",
URL: "ignored-for-stdio",
},
},
},
},
expectedError: "",
},
// Package transport tests - streamable-http (URL required)
{
name: "package transport streamable-http with valid URL",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Packages: []model.Package{
{
Identifier: "test-package",
RegistryType: "npm",
Transport: model.Transport{
Type: "streamable-http",
URL: "https://example.com/mcp",
},
},
},
},
expectedError: "",
},
{
name: "package transport streamable-http with templated URL",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Packages: []model.Package{
{
Identifier: "test-package",
RegistryType: "npm",
Transport: model.Transport{
Type: "streamable-http",
URL: "http://{host}:{port}/mcp",
},
EnvironmentVariables: []model.KeyValueInput{
{Name: "host"},
{Name: "port"},
},
},
},
},
expectedError: "",
},
{
name: "package transport streamable-http without URL",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Packages: []model.Package{
{
Identifier: "test-package",
RegistryType: "npm",
Transport: model.Transport{
Type: "streamable-http",
},
},
},
},
expectedError: "url is required for streamable-http transport type",
},
{
name: "package transport streamable-http with templated URL missing variables",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Packages: []model.Package{
{
Identifier: "test-package",
RegistryType: "npm",
Transport: model.Transport{
Type: "streamable-http",
URL: "http://{host}:{port}/mcp",
},
// Missing host and port variables
},
},
},
expectedError: "template variables in URL",
},
// Package transport tests - sse (URL required)
{
name: "package transport sse with valid URL",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Packages: []model.Package{
{
Identifier: "test-package",
RegistryType: "npm",
Transport: model.Transport{
Type: "sse",
URL: "https://example.com/events",
},
},
},
},
expectedError: "",
},
{
name: "package transport sse without URL",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Packages: []model.Package{
{
Identifier: "test-package",
RegistryType: "npm",
Transport: model.Transport{
Type: "sse",
},
},
},
},
expectedError: "url is required for sse transport type",
},
// Package transport tests - unsupported type
{
name: "package transport unsupported type",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Packages: []model.Package{
{
Identifier: "test-package",
RegistryType: "npm",
Transport: model.Transport{
Type: "websocket",
},
},
},
},
expectedError: "unsupported transport type: websocket",
},
// Remote transport tests - streamable-http
{
name: "remote transport streamable-http with valid URL",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Remotes: []model.Transport{
{
Type: "streamable-http",
URL: "https://example.com/mcp",
},
},
},
expectedError: "",
},
{
name: "remote transport streamable-http without URL",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Remotes: []model.Transport{
{
Type: "streamable-http",
},
},
},
expectedError: "url is required for streamable-http transport type",
},
// Remote transport tests - sse
{
name: "remote transport sse with valid URL",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Remotes: []model.Transport{
{
Type: "sse",
URL: "https://example.com/events",
},
},
},
expectedError: "",
},
{
name: "remote transport sse without URL",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Remotes: []model.Transport{
{
Type: "sse",
},
},
},
expectedError: "url is required for sse transport type",
},
// Remote transport tests - unsupported types
{
name: "remote transport stdio not supported",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Remotes: []model.Transport{
{
Type: "stdio",
},
},
},
expectedError: "unsupported transport type for remotes: stdio",
},
{
name: "remote transport unsupported type",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Remotes: []model.Transport{
{
Type: "websocket",
URL: "wss://example.com/ws",
},
},
},
expectedError: "unsupported transport type for remotes: websocket",
},
// Localhost URL tests - packages vs remotes
{
name: "package transport allows localhost URLs",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Packages: []model.Package{
{
Identifier: "test-package",
RegistryType: "npm",
Transport: model.Transport{
Type: "streamable-http",
URL: "http://localhost:3000/mcp",
},
},
},
},
expectedError: "",
},
{
name: "remote transport rejects localhost URLs",
serverDetail: apiv0.ServerJSON{
Name: "com.example/test-server",
Description: "A test server",
VersionDetail: model.VersionDetail{
Version: "1.0.0",
},
Remotes: []model.Transport{
{
Type: "streamable-http",
URL: "http://localhost:3000/mcp",
},
},
},
expectedError: "invalid remote URL",
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
err := validators.ValidateServerJSON(&tt.serverDetail)
if tt.expectedError == "" {
assert.NoError(t, err)
} else {
assert.Error(t, err)
assert.Contains(t, err.Error(), tt.expectedError)
}
})
}
}
func TestValidate_RegistryTypesAndUrls(t *testing.T) {
testCases := []struct {
tcName string
@ -735,6 +1141,9 @@ func TestValidate_RegistryTypesAndUrls(t *testing.T) {
RegistryType: tc.registryType,
RegistryBaseURL: tc.baseURL,
Version: tc.version,
Transport: model.Transport{
Type: "stdio",
},
},
},
}
@ -768,12 +1177,16 @@ func createValidServerWithArgument(arg model.Argument) apiv0.ServerJSON {
Identifier: "test-package",
RegistryType: "npm",
RegistryBaseURL: "https://registry.npmjs.org",
Transport: model.Transport{
Type: "stdio",
},
RuntimeArguments: []model.Argument{arg},
},
},
Remotes: []model.Remote{
Remotes: []model.Transport{
{
URL: "https://example.com/remote",
Type: "streamable-http",
URL: "https://example.com/remote",
},
},
}