Bumps
[github.com/prometheus/client_golang](https://github.com/prometheus/client_golang)
from 1.23.0 to 1.23.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/client_golang/releases">github.com/prometheus/client_golang's
releases</a>.</em></p>
<blockquote>
<h2>v1.23.2 - 2025-09-05</h2>
<p>This release is made to upgrade to prometheus/common v0.66.1, which
drops the dependencies github.com/grafana/regexp and go.uber.org/atomic
and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in
replacement). There are no functional changes.</p>
<!-- raw HTML omitted -->
<ul>
<li>[release-1.23] Upgrade to prometheus/common@v0.66.1 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1869">prometheus/client_golang#1869</a></li>
<li>[release-1.23] Cut v1.23.2 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1870">prometheus/client_golang#1870</a></li>
</ul>
<!-- raw HTML omitted -->
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/client_golang/compare/v1.23.1...v1.23.2">https://github.com/prometheus/client_golang/compare/v1.23.1...v1.23.2</a></p>
<h2>v1.23.1 - 2025-09-04</h2>
<p>This release is made to be compatible with a backwards incompatible
API change in prometheus/common v0.66.0. There are no functional
changes.</p>
<!-- raw HTML omitted -->
<ul>
<li>[release-1.23] Upgrade to prometheus/common v0.66 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1866">prometheus/client_golang#1866</a></li>
<li>[release-1.23] Cut v1.23.1 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1867">prometheus/client_golang#1867</a></li>
</ul>
<!-- raw HTML omitted -->
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.1">https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md">github.com/prometheus/client_golang's
changelog</a>.</em></p>
<blockquote>
<h2>1.23.2 / 2025-09-05</h2>
<p>This release is made to upgrade to prometheus/common v0.66.1, which
drops the dependencies github.com/grafana/regexp and go.uber.org/atomic
and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in
replacement).
There are no functional changes.</p>
<h2>1.23.1 / 2025-09-04</h2>
<p>This release is made to be compatible with a backwards incompatible
API change
in prometheus/common v0.66.0. There are no functional changes.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="8179a56081"><code>8179a56</code></a>
Cut v1.23.2 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1870">#1870</a>)</li>
<li><a
href="4142b5908b"><code>4142b59</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/client_golang/issues/1869">#1869</a>
from prometheus/arve/upgrade-common</li>
<li><a
href="4ff40f0d91"><code>4ff40f0</code></a>
Cut v1.23.1 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1867">#1867</a>)</li>
<li><a
href="989b029894"><code>989b029</code></a>
Upgrade to prometheus/common v0.66 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1866">#1866</a>)</li>
<li>See full diff in <a
href="https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.2">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
- Removes version comment tags (e.g. `#v4`, `#v5`) from all GitHub
Actions workflow files
- These tags become incorrect when Dependabot updates the action SHAs
- The SHA pins are sufficient for version control
## Context
This addresses @domdomegg's comment in #453 about these tags becoming
outdated when using Dependabot. The SHAs already provide version
pinning, making the comment tags redundant and potentially misleading.
## Changes
- Removed version tags from all `uses:` statements in
`.github/workflows/*.yml`
- No functional changes to workflows
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR:
* Bumps Go to the latest stable version
* Moves away from setting the Go version as an env var in favour of
reading it automatically from the go.mod file (better consistency)
Closes: #447
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Locally
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR updates the publishing docs with information about
remote MCP servers.
Motivated by
https://github.com/modelcontextprotocol/registry/discussions/438
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Simplifies the GitHub Actions publishing guide to be more concise and
easier to follow:
## Changes
- Streamlined MCP publisher installation with single-line curl command
(no more chmod/directory operations)
- Condensed authentication methods into compact sections
- Reduced language-specific examples to essential steps only
- Updated GitHub Actions to use latest versions (v5)
- Made test/build steps optional with `--if-present` flag
- Added helpful AI assistant prompt tip to publish-server.md
## Result
The guide is now much more succinct while maintaining all essential
information, following the same simplified approach as the main
publishing guide.
Bumps
[go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib)
from 0.62.0 to 0.63.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/releases">go.opentelemetry.io/contrib/instrumentation/runtime's
releases</a>.</em></p>
<blockquote>
<h2>Release
v1.38.0/v2.0.0/v0.63.0/v0.32.0/v0.18.0/v0.13.0/v0.11.0/v0.10.0</h2>
<h2>Overview</h2>
<p>This release is the last to support [Go 1.23]. The next release will
require at least [Go 1.24].</p>
<h3>Added</h3>
<ul>
<li>Add v2 version of AWS EC2 detector
<code>go.opentelemetry.io/contrib/detectors/aws/ec2/v2</code> due to
deprecation of <code>github.com/aws/aws-sdk-go</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6961">#6961</a>)</li>
<li>Add the unit <code>ns</code> to deprecated runtime metrics
<code>process.runtime.go.gc.pause_total_ns</code> and
<code>process.runtime.go.gc.pause_ns</code> in
<code>go.opentelemetry.io/contrib/instrumentation/runtime</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7490">#7490</a>)</li>
<li>The <code>go.opentelemetry.io/contrib/detectors/autodetect</code>
package is added to automatically compose user defined
<code>resource.Detector</code>s at runtime. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7522">#7522</a>)</li>
<li>Add the <code>WithLoggerProviderOptions</code>,
<code>WithMeterProviderOptions</code> and
<code>WithTracerProviderOptions</code> options to <code>NewSDK</code> to
allow passing custom options to providers in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7552">#7552</a>)</li>
<li>Set <code>SeverityText</code> field to logrus hook in
<code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7553">#7553</a>)</li>
<li>Add the <code>WithTraceAttributeFn</code> option to
<code>go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-lambda-go/otellambda</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7556">#7556</a>)</li>
<li>Add support for HTTP server metrics in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7668">#7668</a>)</li>
<li>Support testing of [Go 1.25]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7732">#7732</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Change the default span name to be <code>GET /path</code> so it
complies with the HTTP semantic conventions in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7551">#7551</a>)</li>
<li>Transform attribute values of
<code>go.opentelemetry.io/otel/attribute.Value</code> and
<code>go.opentelemetry.io/otel/log.Value</code> types to appropriate
<code>go.opentelemetry.io/otel/log.Value</code> type instead of
<code>log.StringValue</code> in the modules below. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7660">#7660</a>)
<ul>
<li><code>go.opentelemetry.io/contrib/bridges/otellogr</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otellogrus</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otelslog</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otelzap</code></li>
</ul>
</li>
<li>The <code>Severity</code> type from
<code>go.opentelemetry.io/contrib/processors/minsev</code> now
implements the <code>fmt.Stringer</code>,
<code>encoding.TextMarshaler</code>,
<code>encoding.TextUnmarshaler</code>,
<code>encoding.TextAppender</code>, <code>json.Marshaler</code>, and
<code>json.Unmarshaler</code> interfaces. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7652">#7652</a>)</li>
<li>The <code>SeverityVar</code> type from
<code>go.opentelemetry.io/contrib/processors/minsev</code> now
implements the <code>fmt.Stringer</code>,
<code>encoding.TextMarshaler</code>,
<code>encoding.TextUnmarshaler</code>, and
<code>encoding.TextAppender</code> interfaces. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7652">#7652</a>)</li>
<li>Change the faas.max_memory unit to be bytes instead of MB to comply
with the semantic conventions in
<code>go.opentelemetry.io/contrib/detectors/aws/lambda</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7745">#7745</a>)</li>
<li><code>Severity.Severity()</code> in
<code>go.opentelemetry.io/contrib/processors/minsev</code> now returns
<code>log.SeverityTrace1</code> for severities less than
<code>minsev.SeverityTrace1</code> and <code>log.SeverityFatal4</code>
for severities greater than <code>minsev.SeverityFatal4</code> instead
of <code>log.SeverityUndefined</code>. All other conversions are the
same. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7748">#7748</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Improve the ECS detector correctness in
<code>go.opentelemetry.io/contrib/detectors/aws/ecs</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7607">#7607</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li><code>WithSpanOptions</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
is deprecated. It is only used by the deprecated interceptor, and is
unused by <code>NewClientHandler</code> and
<code>NewServerHandler</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7601">#7601</a>)</li>
<li><code>Extract</code> and <code>Inject</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
are deprecated. These functions were initially exposed in the public
API, but are now considered unnecessary. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7689">#7689</a>)</li>
<li>The <code>go.opentelemetry.io/contrib/detectors/aws/ec2</code>
package is deprecated, use
<code>go.opentelemetry.io/contrib/detectors/aws/ec2/v2</code> instead.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7725">#7725</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Remove support for the <code>OTEL_SEMCONV_STABILITY_OPT_IN</code>
environment variable as well as support for semantic conventions v1.20.0
in the modules below. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7584">#7584</a>)
<ul>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code></li>
</ul>
</li>
<li>The deprecated <code>StreamClientInterceptor</code> function from
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
is removed. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7646">#7646</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/runtime's
changelog</a>.</em></p>
<blockquote>
<h2>[1.38.0/2.0.0/0.63.0/0.32.0/0.18.0/0.13.0/0.11.0/0.10.0] -
2025-08-29</h2>
<p>This release is the last to support [Go 1.23].
The next release will require at least [Go 1.24].</p>
<h3>Added</h3>
<ul>
<li>Add v2 version of AWS EC2 detector
<code>go.opentelemetry.io/contrib/detectors/aws/ec2/v2</code> due to
deprecation of <code>github.com/aws/aws-sdk-go</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6961">#6961</a>)</li>
<li>Add the unit <code>ns</code> to deprecated runtime metrics
<code>process.runtime.go.gc.pause_total_ns</code> and
<code>process.runtime.go.gc.pause_ns</code> in
<code>go.opentelemetry.io/contrib/instrumentation/runtime</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7490">#7490</a>)</li>
<li>The <code>go.opentelemetry.io/contrib/detectors/autodetect</code>
package is added to automatically compose user defined
<code>resource.Detector</code>s at runtime. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7522">#7522</a>)</li>
<li>Add the <code>WithLoggerProviderOptions</code>,
<code>WithMeterProviderOptions</code> and
<code>WithTracerProviderOptions</code> options to <code>NewSDK</code> to
allow passing custom options to providers in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7552">#7552</a>)</li>
<li>Set <code>SeverityText</code> field to logrus hook in
<code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7553">#7553</a>)</li>
<li>Add the <code>WithTraceAttributeFn</code> option to
<code>go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-lambda-go/otellambda</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7556">#7556</a>)</li>
<li>Add support for HTTP server metrics in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7668">#7668</a>)</li>
<li>Support testing of [Go 1.25]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7732">#7732</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Change the default span name to be <code>GET /path</code> so it
complies with the HTTP semantic conventions in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7551">#7551</a>)</li>
<li>Transform attribute values of
<code>go.opentelemetry.io/otel/attribute.Value</code> and
<code>go.opentelemetry.io/otel/log.Value</code> types to appropriate
<code>go.opentelemetry.io/otel/log.Value</code> type instead of
<code>log.StringValue</code> in the modules below. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7660">#7660</a>)
<ul>
<li><code>go.opentelemetry.io/contrib/bridges/otellogr</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otellogrus</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otelslog</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otelzap</code></li>
</ul>
</li>
<li>The <code>Severity</code> type from
<code>go.opentelemetry.io/contrib/processors/minsev</code> now
implements the <code>fmt.Stringer</code>,
<code>encoding.TextMarshaler</code>,
<code>encoding.TextUnmarshaler</code>,
<code>encoding.TextAppender</code>, <code>json.Marshaler</code>, and
<code>json.Unmarshaler</code> interfaces. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7652">#7652</a>)</li>
<li>The <code>SeverityVar</code> type from
<code>go.opentelemetry.io/contrib/processors/minsev</code> now
implements the <code>fmt.Stringer</code>,
<code>encoding.TextMarshaler</code>,
<code>encoding.TextUnmarshaler</code>, and
<code>encoding.TextAppender</code> interfaces. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7652">#7652</a>)</li>
<li>Change the faas.max_memory unit to be bytes instead of MB to comply
with the semantic conventions in
<code>go.opentelemetry.io/contrib/detectors/aws/lambda</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7745">#7745</a>)</li>
<li><code>Severity.Severity()</code> in
<code>go.opentelemetry.io/contrib/processors/minsev</code> now returns
<code>log.SeverityTrace1</code> for severities less than
<code>minsev.SeverityTrace1</code> and <code>log.SeverityFatal4</code>
for severities greater than <code>minsev.SeverityFatal4</code> instead
of <code>log.SeverityUndefined</code>.
All other conversions are the same. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7748">#7748</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Improve the ECS detector correctness in
<code>go.opentelemetry.io/contrib/detectors/aws/ecs</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7607">#7607</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li><code>WithSpanOptions</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
is deprecated.
It is only used by the deprecated interceptor, and is unused by
<code>NewClientHandler</code> and <code>NewServerHandler</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7601">#7601</a>)</li>
<li><code>Extract</code> and <code>Inject</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
are deprecated.
These functions were initially exposed in the public API, but are now
considered unnecessary. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7689">#7689</a>)</li>
<li>The <code>go.opentelemetry.io/contrib/detectors/aws/ec2</code>
package is deprecated, use
<code>go.opentelemetry.io/contrib/detectors/aws/ec2/v2</code> instead.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7725">#7725</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Remove support for the <code>OTEL_SEMCONV_STABILITY_OPT_IN</code>
environment variable as well as support for semantic conventions v1.20.0
in the modules below. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7584">#7584</a>)
<ul>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code></li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="80c9316336"><code>80c9316</code></a>
Release v1.38.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7827">#7827</a>)</li>
<li><a
href="e84e5f0d33"><code>e84e5f0</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7825">#7825</a>)</li>
<li><a
href="621dff0c68"><code>621dff0</code></a>
Upgrade to go.opentelemetry.io/otel dependencies (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7808">#7808</a>)</li>
<li><a
href="00d0862286"><code>00d0862</code></a>
chore(deps): update module go.opentelemetry.io/build-tools to v0.27.0
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7822">#7822</a>)</li>
<li><a
href="63dd859ea7"><code>63dd859</code></a>
chore(deps): update module github.com/gordonklaus/ineffassign to v0.2.0
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7820">#7820</a>)</li>
<li><a
href="45f7b9d732"><code>45f7b9d</code></a>
chore(deps): update module github.com/mgechev/revive to v1.12.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7821">#7821</a>)</li>
<li><a
href="cb554a651f"><code>cb554a6</code></a>
fix(deps): update module github.com/stretchr/testify to v1.11.1 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7817">#7817</a>)</li>
<li><a
href="fcb2c96de6"><code>fcb2c96</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7815">#7815</a>)</li>
<li><a
href="7ac87bd923"><code>7ac87bd</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7812">#7812</a>)</li>
<li><a
href="38fe9803bf"><code>38fe980</code></a>
chore(deps): update github.com/lufia/plan9stats digest to 24949be (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7809">#7809</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.62.0...zpages/v0.63.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.7.5
to 5.7.6.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jackc/pgx/blob/master/CHANGELOG.md">github.com/jackc/pgx/v5's
changelog</a>.</em></p>
<blockquote>
<h1>5.7.6 (September 8, 2025)</h1>
<ul>
<li>Use ParseConfigError in pgx.ParseConfig and pgxpool.ParseConfig
(Yurasov Ilia)</li>
<li>Add PrepareConn hook to pgxpool (Jonathan Hall)</li>
<li>Reduce allocations in QueryContext (Dominique Lefevre)</li>
<li>Add MarshalJSON and UnmarshalJSON for pgtype.Uint32 (Panos
Koutsovasilis)</li>
<li>Configure ping behavior on pgxpool with ShouldPing (Christian
Kiely)</li>
<li>zeronull int types implement Int64Valuer and Int64Scanner (Li
Zeghong)</li>
<li>Fix panic when receiving terminate connection message during
CopyFrom (Michal Drausowski)</li>
<li>Fix statement cache not being invalidated on error during batch
(Muhammadali Nazarov)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a2fca03743"><code>a2fca03</code></a>
Release v5.7.6</li>
<li><a
href="95fc31294f"><code>95fc312</code></a>
Add link to github.com/KoNekoD/pgx-colon-query-rewriter</li>
<li><a
href="5534fa9a02"><code>5534fa9</code></a>
Improve Rows docs</li>
<li><a
href="a295d68811"><code>a295d68</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2368">#2368</a> from
zeghong/zeronull-int-valuer</li>
<li><a
href="03f32c06bd"><code>03f32c0</code></a>
Merge branch 'master' into zeronull-int-valuer</li>
<li><a
href="82fbe49fec"><code>82fbe49</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2372">#2372</a> from
WGH-/improve-batch-doc</li>
<li><a
href="594d9d65dc"><code>594d9d6</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2367">#2367</a> from
zeghong/zeronull-int-scanner</li>
<li><a
href="5a18241971"><code>5a18241</code></a>
Merge branch 'master' into zeronull-int-scanner</li>
<li><a
href="cc34da5884"><code>cc34da5</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2370">#2370</a> from
Saurabh2402/improvement/setup-linters</li>
<li><a
href="dd81f81e2f"><code>dd81f81</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2369">#2369</a> from
zeghong/go-doc-links</li>
<li>Additional commits viewable in <a
href="https://github.com/jackc/pgx/compare/v5.7.5...v5.7.6">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.27.0 to
0.28.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1759e969da"><code>1759e96</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="f060e16ef6"><code>f060e16</code></a>
all: upgrade go directive to at least 1.24.0 [generated]</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.27.0...v0.28.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
Previously running `docker-compose up` the first time, Docker would pull
the official Docker Hub registry container, instead of building the MCP
registry locally. This PR ensures the registry image is never pulled,
and that it has a descriptive name locally without clashing with
existing local container images.
The `make dev-compose` command already enforces container build. This
change only helps those who interface with the `docker-compose`
configuration through other means.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
To validate the issue, clone the repository locally. Ensure none of the
images referenced by `docker-compose` exist locally:
```bash
docker rm -f registry postgres
docker rmi registry postgres:16-alpine
```
Run `docker-compose up` without the `--build` flag. Notice that both
`registry` and `postgres` images are pulled from Docker Hub. Registry
prints the following start up logs - showing it's _a_ registry but of
the wrong kind :)
```
registry | time="2025-09-11T11:16:23.966357009Z" level=debug msg="using \"text\" logging formatter"
registry | time="2025-09-11T11:16:23.967075675Z" level=warning msg="No HTTP secret provided - generated random secret. This may cause problems with uploads if multiple registries are behind a load-balancer. To provide a shared secret, fill in http.secret in the configuration file or set the REGISTRY_HTTP_SECRET environment variable." environment=development go.version=go1.23.7 instance.id=566edec9-5208-4bd9-ab38-9e97d3f3b5b5 service=registry version=3.0.0
registry | time="2025-09-11T11:16:23.9671568Z" level=info msg="redis not configured" environment=development go.version=go1.23.7 instance.id=566edec9-5208-4bd9-ab38-9e97d3f3b5b5 service=registry version=3.0.0
registry | time="2025-09-11T11:16:23.967193342Z" level=info msg="Starting upload purge in 31m0s" environment=development go.version=go1.23.7 instance.id=566edec9-5208-4bd9-ab38-9e97d3f3b5b5 service=registry version=3.0.0
registry | time="2025-09-11T11:16:23.967215509Z" level=info msg="using inmemory blob descriptor cache" environment=development go.version=go1.23.7 instance.id=566edec9-5208-4bd9-ab38-9e97d3f3b5b5 service=registry version=3.0.0
registry | time="2025-09-11T11:16:23.967348634Z" level=info msg="providing prometheus metrics on /metrics"
registry | time="2025-09-11T11:16:23.968138634Z" level=info msg="debug server listening :5001"
registry | time="2025-09-11T11:16:23.9681758Z" level=info msg="listening on [::]:5000" environment=development go.version=go1.23.7 instance.id=566edec9-5208-4bd9-ab38-9e97d3f3b5b5 service=registry version=3.0.0
```
Checkout the proposed change. When `docker-compose up` is ran it builds
the registry container and launches it.
```
$ docker-compose up
[+] Running 0/0
[+] Running 0/1stry Building 0.1s
[+] Building 8.7s (18/18) FINISHED docker:desktop-linux
...
registry | 2025/09/11 11:20:12 Starting MCP Registry Application vdev (commit: unknown)
...
```
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
None.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
1. Pins the Github Action workflow hashes under `.github/workflows` to
full-length commit SHAs.
2. Adds a base level `.github/dependabot.yml` config to keep these (and
other go/Docker) deps up to date.
## Motivation and Context
- Github's [security
guide](https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions)
recommends using the immutable SHA of an action when consuming third
party actions.
- Depdendabot makes ongoing dep house keeping manageable.
## Summary
- Move package version 'remarks' to 'description' field in JSON schema
(remarks is not a standard JSON schema field)
- Confirmed non-semver version test coverage already exists
Addresses followup comments from #435.
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: adam jones <domdomegg@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
Currently there are a couple shortcomings I found in the
server.schema.json:
- It uses `https://json-schema.org/draft/2020-12/schema` which is
unfortunately [not supported by VS
Code](https://github.com/microsoft/vscode/issues/165219)
- The Package schema does not require properties that are required by
the service
This means that need to round trip with the publish endpoint (perhaps
spinning CI builds) to get the server.json right. It would be great if
we could shift left and get indications in VS Code easier.
I propose we downgrade the schema to
`http://json-schema.org/draft-07/schema#`. The only difference for us is
the name of `$def` pointers.
I looked that [SchemaStore](https://github.com/SchemaStore/schemastore)
and it looks like `draft-07` is by far the most popular. I believe the
concession of using an older schema is worth it to get VS Code editor
hints.
Schema version | Count in SchemaStore
-- | --
`http://json-schema.org/draft-04/schema#` | 292
`http://json-schema.org/draft-07/schema#` | 1972
`https://json-schema.org/draft/2019-09/schema` | 4
`https://json-schema.org/draft/2020-12/schema` | 4
<!-- Why is this change needed? What problem does it solve? -->
## Open questions
- [ ] Should package `transport` actually be required? Or should `stdio`
be assumed?
- [ ] Should package `registry_base_url` be required? All of the
examples have it it's not required by the publish endpoint.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
I have tried the new schema inside VS Code and I get helpful warning.
For example, these are the warnings for the old schema.
<img width="1561" height="919" alt="image"
src="https://github.com/user-attachments/assets/474170b8-acf8-4dca-a3d9-66c68c0d1902"
/>
I have run these:
`go run .\tools\validate-examples\main.go`
`go run .\tools\validate-schemas\main.go `
## Breaking Changes
I don't think these are breaking changes. I am expressing what the
publish endpoint enforces at runtime.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
<!-- Provide a brief summary of your changes -->
Validates that server versions are not ranges.
**NB:** This also introduces `validateVersion` as a check on the
top-level `ValidateServerJSON`, as previously we were only checking
version ranges of packages via `validatePackageField` (i.e. `latest`
would have still been a valid top level server version), despite #413's
wording suggesting otherwise.
## Motivation and Context
Solves https://github.com/modelcontextprotocol/registry/issues/415
## How Has This Been Tested?
Tests added in `internal/validators/validators_test.go`
`make check` is clean.
## Breaking Changes
As per @domdomegg's comment, we should
> check nobody has done this in the existing registry data (if they
have, we should explore and understand why people have done this / if
it's valid etc.).
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
## Summary
- Add URL encoding for package identifiers and versions in NPM registry
requests
- Fixes issue where scoped packages like @hellocoop/admin-mcp failed
validation due to unencoded @ and / symbols
- Add unit tests for scoped NPM packages to prevent regression
Fixes#409
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
Remove 'Test Before Publishing' and 'Notification Setup' sections from
github-actions.md as these steps are redundant since the publisher API
already handles validation.
Fixes#432
Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: adam jones <domdomegg@users.noreply.github.com>
Fixes#49
This PR removes 36 servers from the seed file that had package entries
pointing to non-existent packages on PyPI or npm registries.
## Summary
The issue reported that many servers in the registry had `packages`
fields referencing non-existent packages. These servers either never
published to package registries or used incorrect identifiers.
## Changes
- **Removed 36 servers** that had invalid package references
- Created validation tools to identify and fix these issues
## Affected Servers
Servers removed include those pointing to non-existent:
- PyPI packages: mcp-aiven, inkeep-mcp-server, needle-mcp, and others
- npm packages: redis-mcp-server, mcp-server-applescript, ppl-ai, and
others
The registry now contains only servers with valid, installable packages.
Claude wrote this extra test while I was doing some other work
experimenting with stuff, seems useful to have!
Also deleted the unnecessary expectedServers, because we basically never
assert on it.
Adds optional website_url field to the server.json schema allowing
publishers to provide a url to the server's homepage, documentation, or
project website. This provides a central link for users to learn more
about the server. Particularly useful when the server has custom
installation instructions or setup requirements.
Issue: #183
PR: #130
Discussion: #274
## Motivation and Context
This change addresses the need identified in #130, #183 and #274 for a
standardized way to direct users to an official landing page similar to
`homepage` used in NPM
([example](https://www.npmjs.com/package/@modelcontextprotocol/sdk)). It
is also serves as a viable option for MCP Servers that don't follow
typical package manager patterns (e.g., embedded in a Desktop app).
## How Has This Been Tested?
- Schema validation: All 13 example server.json files validate
successfully against the updated schema
- Go validator tests: Added additional test cases covering URL format
validation and namespace matching
- Run all checks: Updated example files to work with anonymous
publishing and verified `make check` passes
## Breaking Changes
None. The website_url field is optional and backward compatible with
existing server.json files.
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
Security considerations:
- Website URL validation enforces that the domain matches the
publisher's reverse-DNS namespace
- HTTP/HTTPS protocols are required (no file:// or other schemes)
- Validation is consistent with existing remote URL validation patterns
## Summary
- Clarifies that the `mcp-name` format can be included in comments
within README files for both PyPI and NuGet packages
- This allows publishers to hide this technical detail from end-user
documentation while still enabling registry discovery
## Context
The current documentation doesn't make it clear that the `mcp-name` line
can be hidden in a comment, which might lead publishers to include
visible technical details in their package documentation when they
prefer to keep it clean for end users.
<!-- Provide a brief summary of your changes -->
Adding validation for version and identifier for packages.
## Motivation and Context
While debugging a bug, I found out that we need exact version to be
there in package to fetch from npm, otherwise we won't be able to parse
the response as it returns all versions. Even if we do, we still need to
go and figure out which version have the mcpname associated with while
iterating over all versions. So, we should make mandatory to have
identifier and version present in the given package object if we want to
validate package association with registries.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
UTs.
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Co-authored-by: Avish Porwal <avishporwal@microsoft.com>
Resolves#419 where URLs with trailing slashes like `/v0/servers/` would
return empty responses instead of proper data.
**Changes**:
- Added TrailingSlashMiddleware that redirects trailing slash URLs with
301 status
- Preserves root path ('/') without redirecting
- Uses HTTP 301 Moved Permanently to indicate canonical form
- Added comprehensive test coverage for the middleware
This follows REST API best practices and is consistent with how major Go
web frameworks handle trailing slash normalization.
Generated with [Claude Code](https://claude.ai/code)
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: adam jones <domdomegg@users.noreply.github.com>
## Summary
The permission error now displays what namespaces the user has
permission to publish and what namespace they attempted to publish. This
helps users debug permission mismatches more easily.
Helps mitigate #398 to enable us to figure out what's going on
## Summary
- Adds validation to prevent servers from being published with version
string "latest"
- "latest" is now a reserved keyword that cannot be used as a version
string
## Implementation
- Added `ErrReservedVersionString` error constant
- Created `validateVersion` function to check for reserved version
strings
- Integrated validation into the package field validation flow
- Added comprehensive test coverage
---
This is so we can potentially support things like
https://github.com/modelcontextprotocol/registry/discussions/333 in
future more easily, as I imagine we might want to.
Update FAQ to clarify that the registry is primarily designed for
subregistries rather than individual clients or end-users.
I saw MCP client applications were listed here, which I think is not
what we were intending.
## Motivation and Context
We just want to highlight that Docker Hub will support this project with
updates to the `docker mcp` cli and the [mcp
hub](https://hub.docker.com/mcp) catalog.
The publishing guide incorrectly suggested users could verify their
server by directly accessing `/servers/{server-name}` or
`/v0/servers/{server-name}`, but the API only supports:
1. **Search by name**: `GET /v0/servers?search={server-name}`
2. **Get by UUID**: `GET /v0/servers/{uuid}`
This PR updates the documentation to show the correct verification
method using the search endpoint.
Fixes#410
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR should fix the recent "conn busy" issue caused by the
PostgreSQL implementation using a single database connection (*pgx.Conn)
instead of a connection pool (*pgxpool.Pool). When multiple concurrent
requests try to access the endpoint, they would conflict trying to use
the same connection.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Builds locally
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Related to #400, #405 and #407
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
When using `mcp-publisher publish ...`, output the new server `ID` if
publishing is successful.
## Motivation and Context
It's useful to know this during testing. It means that you don't have to
go and search for the new server ID afterwards. Once we have the
`v0/servers/{name}/{version}`, I think we could consider removing this
again.
## How Has This Been Tested?
I've been using this while I test publishing to locally running
registries.
## Breaking Changes
none
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
Fix broken blog post announcement link. Currently users are redirected
to the getting started mcp docs.
## Motivation and Context
The existing link redirects to
https://modelcontextprotocol.io/docs/getting-started/intro. The actual
blog post is on the `blog` subdomain.
https://blog.modelcontextprotocol.io/posts/2025-09-08-mcp-registry-preview/
## How Has This Been Tested?
N/A - docs only change
## Breaking Changes
N/A
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
summary
- use the indexed primary key (`id`) for `getbyid`, `updateserver`, and
list ordering/cursor, instead of extracting `_meta...id` from jsonb
- in `updateserver`, error if the body tries to change the id; set
`meta.official.id` when missing
changes
- database: `getbyid` → `where id = $1`
- database: `updateserver` → `where id = $2`; fail on id mismatch; set
id if missing
- database: `list` orders by `id` and paginates via `id > $cursor`
- no schema or api changes
<details>
<summary>performance</summary>
- env: repo docker compose postgres, 5k–10k rows, warm cache
- getbyid: `id` ≈ 0.02 ms vs jsonb path ≈ 0.80 ms
- update: `id` ≈ 0.15 ms vs jsonb path ≈ 0.78 ms
- list (limit 100): order by `id` ≈ 0.13 ms vs jsonb path id ≈ 2.24 ms
(~17x slower)
</details>
<details>
<summary>explain analyze snippets</summary>
getbyid by `id`
```
Index Scan using idx_benchmark_servers_id on benchmark_servers (actual time≈0.01–0.02 ms)
Buffers: shared hit≈3
```
getbyid by jsonb path
```
Seq Scan on benchmark_servers (actual time≈0.43–0.83 ms)
Filter: ((value->'_meta'->'io.modelcontextprotocol.registry/official'->>'id') = $1)
Rows Removed by Filter: ≈4999
Buffers: shared hit≈455
```
update by `id`
```
Update on benchmark_servers …
-> Index Scan using idx_benchmark_servers_id … (actual time≈0.007 ms)
Execution Time: ≈0.15 ms
```
update by jsonb path
```
Update on benchmark_servers …
-> Seq Scan on benchmark_servers … Rows Removed by Filter: ≈4999
Execution Time: ≈0.78 ms
```
</details>
<details>
<summary>reproduce quickly</summary>
- start postgres: `docker compose up -d postgres`
- create a simple table (id varchar pk, value jsonb) with several
thousand rows
- compare plans: `explain (analyze, buffers) select value from … where
id = $1` vs the jsonb path predicate
</details>
---------
Co-authored-by: Adam Jones <adamj@anthropic.com>
## Summary
- Update development status to reflect preview launch
- Add navigation links for publishing, API docs, and ecosystem vision
- Include announcement blog post link
- Add feedback channels (GitHub discussions and Discord)
## Summary
- Consolidate ServerListResponse and Metadata types into pkg/api/v0
- Remove duplication between handler and API types
- Change metadata from optional pointer to required value
- Remove unused Total field from Metadata
Fixes#385
Updates DNS authentication documentation to correctly specify that TXT
records should be placed at the root domain (e.g., `example.com`) rather
than the `_mcp-registry` subdomain.
The implementation correctly looks up TXT records at the root domain,
but the documentation incorrectly instructed users to create records at
`_mcp-registry.<domain>`. This mismatch was causing authentication
failures.
## Why use root domain instead of subdomain?
The root domain approach is clearer: if you want to publish to
`com.example/my-server`, you authenticate with `example.com`, not
`_mcp-registry.example.com`.
It also aligns with other TXT DNS standards, e.g. SPF. (That said, there
are other DNS standards that use subdomains e.g. DKIM 🤷)
## Changes
- Updated publish-server.md to remove `_mcp-registry.` prefix from DNS
examples
- Updated CLI commands reference documentation
- Updated namespacing explanation documentation
## Summary
Simplifies the installation instructions in the publisher guide by:
- Auto-detecting platform using `uname` and PowerShell built-ins for a
single copy-paste command
- Moving build-from-source to a collapsible details section to emphasize
the recommended pre-built binary approach
- Removing unnecessary `chmod +x` since tar preserves executable
permissions
- Adding explicit support for WSL
This makes it much easier for users to get started - they can now just
copy one command instead of picking from 4+ platform-specific options.
## Summary
Add per-environment concurrency groups to staging and production
deployment jobs to prevent Pulumi stack lock conflicts when multiple PRs
are merged simultaneously.
- `deploy-staging` job gets `deploy-staging` concurrency group
- `deploy-production` job gets `deploy-production` concurrency group
- Both use `cancel-in-progress: false` to queue deployments safely
This eliminates CI noise from failed parallel deployments while
maintaining deployment reliability.
Fixes#375
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR updates the publishing docs to refer to the
mcp-publisher release assets from v1.0.0.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Locally
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
## Summary
Simplified the schema structure by:
- Replacing `version_detail.version` with direct `version` field
- Removing unused `release_date` field from seed data
- Updating all API types, models, and tests to match new structure
- Maintaining backwards compatibility in API responses
This change makes the schema more intuitive and reduces nesting depth.
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR splits the release assets into 2 - one for the registry
and one for the mcp-publisher CLI.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Locally
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
## Summary
- Adds `updated_since`, `search`, and `version` query parameters to `GET
/v0/servers`
- Enables incremental synchronization via RFC3339 timestamp filtering
- Provides simple substring search on server names
- Supports latest version filtering with `version=latest`
This implementation provides the core filtering capabilities needed for
efficient registry synchronization and improved server discovery.
Fixes#291Fixes#135
## Summary
- Add comprehensive security warnings to the `Argument` type in
server.schema.json
- Warn about command injection risks from user-provided input in
arguments
- Include concrete example of malicious payload (`;rm -rf
~/Development`)
- Recommend non-shell execution methods and user consent for safer
command execution
Fixes#41
## Summary
- Changes the API title from "MCP Registry API" to "Official MCP
Registry"
- Redirects root path to GitHub docs instead of /docs endpoint
- Adds GitHub repo and docs links to API description
Fixes#370
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
Fixing a missing dependency for Goreleaser (needed to generate SBOMs)
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR addresses the feedback comments from #366
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
## Summary
Updates the `_meta` field structure to be compliant with the MCP
specification by using proper `prefix/name` format for vendor
extensions.
### Changes
- **Registry metadata**: `io.modelcontextprotocol.registry` →
`io.modelcontextprotocol.registry/official`
- **Publisher metadata**: `publisher` →
`io.modelcontextprotocol.registry/publisher-provided`
- **Database migration**: Updates indexes to use new field paths
- **Updated all code**: Service layer, validators, tests, and seed data
### Format Before
```json
{
"_meta": {
"publisher": { "license": "MIT" },
"io.modelcontextprotocol.registry": { "id": "...", "is_latest": true }
}
}
```
### Format After
```json
{
"_meta": {
"io.modelcontextprotocol.registry/publisher-provided": { "license": "MIT" },
"io.modelcontextprotocol.registry/official": { "id": "...", "is_latest": true }
}
}
```
This resolves the naming collision with the planned top-level
`publisher` field and ensures compliance with MCP specification
requirements.
Fixes#356
dependabot[bot]
adam jones
Radoslav Dimitrov
Ville Vesilehto
Frenchie
Joel Verhagen
Kalle Bylin
Avish Porwal
Jim Clark
BorenTsai
nate nowack
Rui Chen