## Motivation and Context
Logs will help in fixing issues quickly, thereby reducing the downtime
and MTTD.
## How Has This Been Tested?
End to end local setup is tested
## Breaking Changes
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
- It handles container logs for mcp-registry pods.
- It supports k8sattributes resources which helps in identifying from
where the logs are coming.
- Supports victorialogs and it's plugin in grafana.
<img width="1129" height="383" alt="Screenshot 2025-09-15 at 1 43 51 AM"
src="https://github.com/user-attachments/assets/a560c541-721d-415c-a0a8-8cbe008c3af6"
/>
<img width="1134" height="703" alt="Screenshot 2025-09-15 at 1 44 34 AM"
src="https://github.com/user-attachments/assets/8b5b4132-9fc3-4b8e-8027-27c7787070f1"
/>
<img width="1134" height="727" alt="Screenshot 2025-09-15 at 1 46 10 AM"
src="https://github.com/user-attachments/assets/bcdb4d9d-cea1-4d88-8dd5-fa4cdb51031f"
/>
---------
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
This commit implements support for publishing MCP servers to GitHub
Container
Registry (ghcr.io) in addition to the existing Docker Hub support,
addressing
Docker Hub rate limiting concerns as requested in #393.
Key changes:
- Add RegistryURLGHCR constant for https://ghcr.io
- Refactor OCI validation to support multiple container registries with
extensible RegistryConfig system
- Implement registry-agnostic authentication system that handles:
- Docker Hub token-based authentication via auth.docker.io
- GHCR token-based authentication via ghcr.io/token service
- Update Accept headers to support OCI image indexes for multi-arch
images
- Extract helper functions to reduce cyclomatic complexity and improve
code maintainability
- Add comprehensive test coverage for both Docker Hub and GHCR scenarios
- Include real image testing with github/github-mcp-server and
nkapila6/mcp-local-rag
- Update publishing documentation with GHCR examples and authentication
details
The implementation maintains backward compatibility with existing Docker
Hub
usage while providing a future-proof architecture for adding additional
container registries. All authentication is now handled through proper
token
services for both registries.
Fixes#393
## Motivation and Context
Docker Hub rate limiting has been causing issues for the MCP registry
when validating OCI images. Adding GHCR support provides an alternative
container registry that many MCP server authors are already using,
reducing the load on Docker Hub and providing more options for the
community.
## How Has This Been Tested?
- All existing unit tests continue to pass
- Added comprehensive test coverage for GHCR scenarios including:
- Non-existent images (proper error handling)
- Real images without MCP annotations (github/github-mcp-server)
- Real images with proper MCP annotations (nkapila6/mcp-local-rag)
- Registry URL validation for both supported registries
- Tested authentication flow manually using curl commands
- Verified multi-arch image support with OCI index manifests
## Breaking Changes
None. This is a purely additive change that maintains full backward
compatibility with existing Docker Hub configurations.
## Types of changes
- [x] New feature (non-breaking change which adds functionality)
- [x] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
The implementation uses a RegistryConfig struct to abstract
registry-specific details like API endpoints, authentication URLs, and
token services. This design makes it straightforward to add support for
additional container registries in the future (such as AWS ECR, Azure
Container Registry, etc.) by simply adding new cases to the
getRegistryConfig function.
The authentication system properly handles the different token services
used by each registry:
- Docker Hub: auth.docker.io with service=registry.docker.io
- GHCR: ghcr.io/token with service=ghcr.io
Both registries now support the full OCI specification including
multi-arch images via OCI image indexes.
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
NuGet package deployment option is mentioned in the
[guidelines](https://github.com/modelcontextprotocol/registry/blob/main/docs/guides/publishing/publish-server.md#configure-deployment-methods)
for publishing MCP Server to the registry, but `NuGet` is not mentioned
in the top of the page.
<img width="617" height="134" alt="image (3)"
src="https://github.com/user-attachments/assets/e64559f4-5ab5-44f3-922b-82dda1e781db"
/>
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Documentation update
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No breaking changes
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Bumps the actions group with 1 update:
[anchore/sbom-action](https://github.com/anchore/sbom-action).
Updates `anchore/sbom-action` from 0.20.5 to 0.20.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anchore/sbom-action/releases">anchore/sbom-action's
releases</a>.</em></p>
<blockquote>
<h2>v0.20.6</h2>
<h2>Changes in v0.20.6</h2>
<ul>
<li>chore(deps): update Syft to v1.33.0 (<a
href="https://redirect.github.com/anchore/sbom-action/issues/537">#537</a>)
[[<a
href="https://github.com/apps/anchore-actions-token-generator">anchore-actions-token-generator[bot]</a>](<a
href="https://github.com/%5Banchore-actions-token-generator%5Bbot%5D%5D(https://github.com/apps/anchore-actions-token-generator))%5D">https://github.com/[anchore-actions-token-generator[bot]](https://github.com/apps/anchore-actions-token-generator))]</a></li>
<li>chore: update actions library to resolve critical vulnerability (<a
href="https://redirect.github.com/anchore/sbom-action/issues/536">#536</a>)
[<a href="https://github.com/spiffcs">spiffcs</a>]</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="f8bdd1d8ac"><code>f8bdd1d</code></a>
chore(deps): update Syft to v1.33.0 (<a
href="https://redirect.github.com/anchore/sbom-action/issues/537">#537</a>)</li>
<li><a
href="c2c9a6de90"><code>c2c9a6d</code></a>
chore: update actions library to resolve critical sec (<a
href="https://redirect.github.com/anchore/sbom-action/issues/536">#536</a>)</li>
<li><a
href="039eeb235f"><code>039eeb2</code></a>
chore(deps): update Syft to v1.32.0 (<a
href="https://redirect.github.com/anchore/sbom-action/issues/533">#533</a>)</li>
<li>See full diff in <a
href="https://github.com/anchore/sbom-action/compare/v0.20.5...v0.20.6">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
Added validation to reject server names with multiple slashes, ensuring
consistency between JSON schema pattern and API validation.
- Count slashes in parseServerName() and reject if > 1
- Add ErrMultipleSlashesInServerName error constant
- Add unit tests in validators_test.go
- Add integration test in publish_test.go
## Motivation and Context
Fixes#471. The JSON schema regex pattern `^[^/]+/[^/]+$` only allows a
single slash in server names, but the API validation was not enforcing
this constraint. This inconsistency
allowed invalid server names like `com.example/server/path` to be
published.
## How Has This Been Tested?
- Unit tests added to verify slash validation logic
- Integration tests added to verify the publish endpoint rejects
multi-slash names
- Tested various edge cases: trailing slashes, consecutive slashes,
URL-like paths
- All existing tests pass
## Breaking Changes
None. This change only adds validation to reject previously invalid
server names that shouldn't have been accepted.
## Types of changes
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
- The fix ensures server names follow the intended format:
`namespace/name` (e.g., `com.example/my-server`)
- This validation aligns the API behavior with the existing JSON schema
regex pattern
- Test coverage includes edge cases like `com.example//server`,
`com.example/server/`, and `a/b/c/d/e/f`
- The error message clearly indicates the issue: "server name cannot
contain multiple slashes"
Bumps the actions group with 1 update:
[sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).
Updates `sigstore/cosign-installer` from 3.9.2 to 3.10.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/cosign-installer/releases">sigstore/cosign-installer's
releases</a>.</em></p>
<blockquote>
<h2>v3.10.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump default Cosign to v2.6.0 in <a
href="https://redirect.github.com/sigstore/cosign-installer/pull/200">sigstore/cosign-installer#200</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/sigstore/cosign-installer/compare/v3.9.2...v3.10.0">https://github.com/sigstore/cosign-installer/compare/v3.9.2...v3.10.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d7543c93d8"><code>d7543c9</code></a>
Bump default Cosign to v2.6.0 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/200">#200</a>)</li>
<li><a
href="920f20f8c1"><code>920f20f</code></a>
Bump actions/setup-go from 5.5.0 to 6.0.0 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/199">#199</a>)</li>
<li><a
href="bb9dfc10d2"><code>bb9dfc1</code></a>
Bump actions/github-script from 7.0.1 to 8.0.0 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/198">#198</a>)</li>
<li><a
href="074636bf86"><code>074636b</code></a>
Bump actions/checkout from 4.2.2 to 5.0.0 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/197">#197</a>)</li>
<li>See full diff in <a
href="d58896d6a1...d7543c93d8">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from
0.30.0 to 0.31.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="014cf778b4"><code>014cf77</code></a>
all: upgrade go directive to at least 1.24.0 [generated]</li>
<li><a
href="3c76ce5d23"><code>3c76ce5</code></a>
endpoints: correct Naver OAuth2 endpoint URLs</li>
<li>See full diff in <a
href="https://github.com/golang/oauth2/compare/v0.30.0...v0.31.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/prometheus/client_golang](https://github.com/prometheus/client_golang)
from 1.23.0 to 1.23.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/client_golang/releases">github.com/prometheus/client_golang's
releases</a>.</em></p>
<blockquote>
<h2>v1.23.2 - 2025-09-05</h2>
<p>This release is made to upgrade to prometheus/common v0.66.1, which
drops the dependencies github.com/grafana/regexp and go.uber.org/atomic
and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in
replacement). There are no functional changes.</p>
<!-- raw HTML omitted -->
<ul>
<li>[release-1.23] Upgrade to prometheus/common@v0.66.1 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1869">prometheus/client_golang#1869</a></li>
<li>[release-1.23] Cut v1.23.2 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1870">prometheus/client_golang#1870</a></li>
</ul>
<!-- raw HTML omitted -->
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/client_golang/compare/v1.23.1...v1.23.2">https://github.com/prometheus/client_golang/compare/v1.23.1...v1.23.2</a></p>
<h2>v1.23.1 - 2025-09-04</h2>
<p>This release is made to be compatible with a backwards incompatible
API change in prometheus/common v0.66.0. There are no functional
changes.</p>
<!-- raw HTML omitted -->
<ul>
<li>[release-1.23] Upgrade to prometheus/common v0.66 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1866">prometheus/client_golang#1866</a></li>
<li>[release-1.23] Cut v1.23.1 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1867">prometheus/client_golang#1867</a></li>
</ul>
<!-- raw HTML omitted -->
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.1">https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md">github.com/prometheus/client_golang's
changelog</a>.</em></p>
<blockquote>
<h2>1.23.2 / 2025-09-05</h2>
<p>This release is made to upgrade to prometheus/common v0.66.1, which
drops the dependencies github.com/grafana/regexp and go.uber.org/atomic
and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in
replacement).
There are no functional changes.</p>
<h2>1.23.1 / 2025-09-04</h2>
<p>This release is made to be compatible with a backwards incompatible
API change
in prometheus/common v0.66.0. There are no functional changes.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="8179a56081"><code>8179a56</code></a>
Cut v1.23.2 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1870">#1870</a>)</li>
<li><a
href="4142b5908b"><code>4142b59</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/client_golang/issues/1869">#1869</a>
from prometheus/arve/upgrade-common</li>
<li><a
href="4ff40f0d91"><code>4ff40f0</code></a>
Cut v1.23.1 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1867">#1867</a>)</li>
<li><a
href="989b029894"><code>989b029</code></a>
Upgrade to prometheus/common v0.66 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1866">#1866</a>)</li>
<li>See full diff in <a
href="https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.2">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
- Removes version comment tags (e.g. `#v4`, `#v5`) from all GitHub
Actions workflow files
- These tags become incorrect when Dependabot updates the action SHAs
- The SHA pins are sufficient for version control
## Context
This addresses @domdomegg's comment in #453 about these tags becoming
outdated when using Dependabot. The SHAs already provide version
pinning, making the comment tags redundant and potentially misleading.
## Changes
- Removed version tags from all `uses:` statements in
`.github/workflows/*.yml`
- No functional changes to workflows
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR:
* Bumps Go to the latest stable version
* Moves away from setting the Go version as an env var in favour of
reading it automatically from the go.mod file (better consistency)
Closes: #447
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Locally
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR updates the publishing docs with information about
remote MCP servers.
Motivated by
https://github.com/modelcontextprotocol/registry/discussions/438
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Simplifies the GitHub Actions publishing guide to be more concise and
easier to follow:
## Changes
- Streamlined MCP publisher installation with single-line curl command
(no more chmod/directory operations)
- Condensed authentication methods into compact sections
- Reduced language-specific examples to essential steps only
- Updated GitHub Actions to use latest versions (v5)
- Made test/build steps optional with `--if-present` flag
- Added helpful AI assistant prompt tip to publish-server.md
## Result
The guide is now much more succinct while maintaining all essential
information, following the same simplified approach as the main
publishing guide.
Bumps
[go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib)
from 0.62.0 to 0.63.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/releases">go.opentelemetry.io/contrib/instrumentation/runtime's
releases</a>.</em></p>
<blockquote>
<h2>Release
v1.38.0/v2.0.0/v0.63.0/v0.32.0/v0.18.0/v0.13.0/v0.11.0/v0.10.0</h2>
<h2>Overview</h2>
<p>This release is the last to support [Go 1.23]. The next release will
require at least [Go 1.24].</p>
<h3>Added</h3>
<ul>
<li>Add v2 version of AWS EC2 detector
<code>go.opentelemetry.io/contrib/detectors/aws/ec2/v2</code> due to
deprecation of <code>github.com/aws/aws-sdk-go</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6961">#6961</a>)</li>
<li>Add the unit <code>ns</code> to deprecated runtime metrics
<code>process.runtime.go.gc.pause_total_ns</code> and
<code>process.runtime.go.gc.pause_ns</code> in
<code>go.opentelemetry.io/contrib/instrumentation/runtime</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7490">#7490</a>)</li>
<li>The <code>go.opentelemetry.io/contrib/detectors/autodetect</code>
package is added to automatically compose user defined
<code>resource.Detector</code>s at runtime. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7522">#7522</a>)</li>
<li>Add the <code>WithLoggerProviderOptions</code>,
<code>WithMeterProviderOptions</code> and
<code>WithTracerProviderOptions</code> options to <code>NewSDK</code> to
allow passing custom options to providers in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7552">#7552</a>)</li>
<li>Set <code>SeverityText</code> field to logrus hook in
<code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7553">#7553</a>)</li>
<li>Add the <code>WithTraceAttributeFn</code> option to
<code>go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-lambda-go/otellambda</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7556">#7556</a>)</li>
<li>Add support for HTTP server metrics in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7668">#7668</a>)</li>
<li>Support testing of [Go 1.25]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7732">#7732</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Change the default span name to be <code>GET /path</code> so it
complies with the HTTP semantic conventions in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7551">#7551</a>)</li>
<li>Transform attribute values of
<code>go.opentelemetry.io/otel/attribute.Value</code> and
<code>go.opentelemetry.io/otel/log.Value</code> types to appropriate
<code>go.opentelemetry.io/otel/log.Value</code> type instead of
<code>log.StringValue</code> in the modules below. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7660">#7660</a>)
<ul>
<li><code>go.opentelemetry.io/contrib/bridges/otellogr</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otellogrus</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otelslog</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otelzap</code></li>
</ul>
</li>
<li>The <code>Severity</code> type from
<code>go.opentelemetry.io/contrib/processors/minsev</code> now
implements the <code>fmt.Stringer</code>,
<code>encoding.TextMarshaler</code>,
<code>encoding.TextUnmarshaler</code>,
<code>encoding.TextAppender</code>, <code>json.Marshaler</code>, and
<code>json.Unmarshaler</code> interfaces. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7652">#7652</a>)</li>
<li>The <code>SeverityVar</code> type from
<code>go.opentelemetry.io/contrib/processors/minsev</code> now
implements the <code>fmt.Stringer</code>,
<code>encoding.TextMarshaler</code>,
<code>encoding.TextUnmarshaler</code>, and
<code>encoding.TextAppender</code> interfaces. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7652">#7652</a>)</li>
<li>Change the faas.max_memory unit to be bytes instead of MB to comply
with the semantic conventions in
<code>go.opentelemetry.io/contrib/detectors/aws/lambda</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7745">#7745</a>)</li>
<li><code>Severity.Severity()</code> in
<code>go.opentelemetry.io/contrib/processors/minsev</code> now returns
<code>log.SeverityTrace1</code> for severities less than
<code>minsev.SeverityTrace1</code> and <code>log.SeverityFatal4</code>
for severities greater than <code>minsev.SeverityFatal4</code> instead
of <code>log.SeverityUndefined</code>. All other conversions are the
same. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7748">#7748</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Improve the ECS detector correctness in
<code>go.opentelemetry.io/contrib/detectors/aws/ecs</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7607">#7607</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li><code>WithSpanOptions</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
is deprecated. It is only used by the deprecated interceptor, and is
unused by <code>NewClientHandler</code> and
<code>NewServerHandler</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7601">#7601</a>)</li>
<li><code>Extract</code> and <code>Inject</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
are deprecated. These functions were initially exposed in the public
API, but are now considered unnecessary. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7689">#7689</a>)</li>
<li>The <code>go.opentelemetry.io/contrib/detectors/aws/ec2</code>
package is deprecated, use
<code>go.opentelemetry.io/contrib/detectors/aws/ec2/v2</code> instead.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7725">#7725</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Remove support for the <code>OTEL_SEMCONV_STABILITY_OPT_IN</code>
environment variable as well as support for semantic conventions v1.20.0
in the modules below. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7584">#7584</a>)
<ul>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code></li>
</ul>
</li>
<li>The deprecated <code>StreamClientInterceptor</code> function from
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
is removed. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7646">#7646</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/runtime's
changelog</a>.</em></p>
<blockquote>
<h2>[1.38.0/2.0.0/0.63.0/0.32.0/0.18.0/0.13.0/0.11.0/0.10.0] -
2025-08-29</h2>
<p>This release is the last to support [Go 1.23].
The next release will require at least [Go 1.24].</p>
<h3>Added</h3>
<ul>
<li>Add v2 version of AWS EC2 detector
<code>go.opentelemetry.io/contrib/detectors/aws/ec2/v2</code> due to
deprecation of <code>github.com/aws/aws-sdk-go</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6961">#6961</a>)</li>
<li>Add the unit <code>ns</code> to deprecated runtime metrics
<code>process.runtime.go.gc.pause_total_ns</code> and
<code>process.runtime.go.gc.pause_ns</code> in
<code>go.opentelemetry.io/contrib/instrumentation/runtime</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7490">#7490</a>)</li>
<li>The <code>go.opentelemetry.io/contrib/detectors/autodetect</code>
package is added to automatically compose user defined
<code>resource.Detector</code>s at runtime. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7522">#7522</a>)</li>
<li>Add the <code>WithLoggerProviderOptions</code>,
<code>WithMeterProviderOptions</code> and
<code>WithTracerProviderOptions</code> options to <code>NewSDK</code> to
allow passing custom options to providers in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7552">#7552</a>)</li>
<li>Set <code>SeverityText</code> field to logrus hook in
<code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7553">#7553</a>)</li>
<li>Add the <code>WithTraceAttributeFn</code> option to
<code>go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-lambda-go/otellambda</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7556">#7556</a>)</li>
<li>Add support for HTTP server metrics in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7668">#7668</a>)</li>
<li>Support testing of [Go 1.25]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7732">#7732</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Change the default span name to be <code>GET /path</code> so it
complies with the HTTP semantic conventions in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7551">#7551</a>)</li>
<li>Transform attribute values of
<code>go.opentelemetry.io/otel/attribute.Value</code> and
<code>go.opentelemetry.io/otel/log.Value</code> types to appropriate
<code>go.opentelemetry.io/otel/log.Value</code> type instead of
<code>log.StringValue</code> in the modules below. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7660">#7660</a>)
<ul>
<li><code>go.opentelemetry.io/contrib/bridges/otellogr</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otellogrus</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otelslog</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otelzap</code></li>
</ul>
</li>
<li>The <code>Severity</code> type from
<code>go.opentelemetry.io/contrib/processors/minsev</code> now
implements the <code>fmt.Stringer</code>,
<code>encoding.TextMarshaler</code>,
<code>encoding.TextUnmarshaler</code>,
<code>encoding.TextAppender</code>, <code>json.Marshaler</code>, and
<code>json.Unmarshaler</code> interfaces. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7652">#7652</a>)</li>
<li>The <code>SeverityVar</code> type from
<code>go.opentelemetry.io/contrib/processors/minsev</code> now
implements the <code>fmt.Stringer</code>,
<code>encoding.TextMarshaler</code>,
<code>encoding.TextUnmarshaler</code>, and
<code>encoding.TextAppender</code> interfaces. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7652">#7652</a>)</li>
<li>Change the faas.max_memory unit to be bytes instead of MB to comply
with the semantic conventions in
<code>go.opentelemetry.io/contrib/detectors/aws/lambda</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7745">#7745</a>)</li>
<li><code>Severity.Severity()</code> in
<code>go.opentelemetry.io/contrib/processors/minsev</code> now returns
<code>log.SeverityTrace1</code> for severities less than
<code>minsev.SeverityTrace1</code> and <code>log.SeverityFatal4</code>
for severities greater than <code>minsev.SeverityFatal4</code> instead
of <code>log.SeverityUndefined</code>.
All other conversions are the same. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7748">#7748</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Improve the ECS detector correctness in
<code>go.opentelemetry.io/contrib/detectors/aws/ecs</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7607">#7607</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li><code>WithSpanOptions</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
is deprecated.
It is only used by the deprecated interceptor, and is unused by
<code>NewClientHandler</code> and <code>NewServerHandler</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7601">#7601</a>)</li>
<li><code>Extract</code> and <code>Inject</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
are deprecated.
These functions were initially exposed in the public API, but are now
considered unnecessary. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7689">#7689</a>)</li>
<li>The <code>go.opentelemetry.io/contrib/detectors/aws/ec2</code>
package is deprecated, use
<code>go.opentelemetry.io/contrib/detectors/aws/ec2/v2</code> instead.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7725">#7725</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Remove support for the <code>OTEL_SEMCONV_STABILITY_OPT_IN</code>
environment variable as well as support for semantic conventions v1.20.0
in the modules below. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7584">#7584</a>)
<ul>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code></li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="80c9316336"><code>80c9316</code></a>
Release v1.38.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7827">#7827</a>)</li>
<li><a
href="e84e5f0d33"><code>e84e5f0</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7825">#7825</a>)</li>
<li><a
href="621dff0c68"><code>621dff0</code></a>
Upgrade to go.opentelemetry.io/otel dependencies (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7808">#7808</a>)</li>
<li><a
href="00d0862286"><code>00d0862</code></a>
chore(deps): update module go.opentelemetry.io/build-tools to v0.27.0
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7822">#7822</a>)</li>
<li><a
href="63dd859ea7"><code>63dd859</code></a>
chore(deps): update module github.com/gordonklaus/ineffassign to v0.2.0
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7820">#7820</a>)</li>
<li><a
href="45f7b9d732"><code>45f7b9d</code></a>
chore(deps): update module github.com/mgechev/revive to v1.12.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7821">#7821</a>)</li>
<li><a
href="cb554a651f"><code>cb554a6</code></a>
fix(deps): update module github.com/stretchr/testify to v1.11.1 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7817">#7817</a>)</li>
<li><a
href="fcb2c96de6"><code>fcb2c96</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7815">#7815</a>)</li>
<li><a
href="7ac87bd923"><code>7ac87bd</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7812">#7812</a>)</li>
<li><a
href="38fe9803bf"><code>38fe980</code></a>
chore(deps): update github.com/lufia/plan9stats digest to 24949be (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7809">#7809</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.62.0...zpages/v0.63.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.7.5
to 5.7.6.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jackc/pgx/blob/master/CHANGELOG.md">github.com/jackc/pgx/v5's
changelog</a>.</em></p>
<blockquote>
<h1>5.7.6 (September 8, 2025)</h1>
<ul>
<li>Use ParseConfigError in pgx.ParseConfig and pgxpool.ParseConfig
(Yurasov Ilia)</li>
<li>Add PrepareConn hook to pgxpool (Jonathan Hall)</li>
<li>Reduce allocations in QueryContext (Dominique Lefevre)</li>
<li>Add MarshalJSON and UnmarshalJSON for pgtype.Uint32 (Panos
Koutsovasilis)</li>
<li>Configure ping behavior on pgxpool with ShouldPing (Christian
Kiely)</li>
<li>zeronull int types implement Int64Valuer and Int64Scanner (Li
Zeghong)</li>
<li>Fix panic when receiving terminate connection message during
CopyFrom (Michal Drausowski)</li>
<li>Fix statement cache not being invalidated on error during batch
(Muhammadali Nazarov)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a2fca03743"><code>a2fca03</code></a>
Release v5.7.6</li>
<li><a
href="95fc31294f"><code>95fc312</code></a>
Add link to github.com/KoNekoD/pgx-colon-query-rewriter</li>
<li><a
href="5534fa9a02"><code>5534fa9</code></a>
Improve Rows docs</li>
<li><a
href="a295d68811"><code>a295d68</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2368">#2368</a> from
zeghong/zeronull-int-valuer</li>
<li><a
href="03f32c06bd"><code>03f32c0</code></a>
Merge branch 'master' into zeronull-int-valuer</li>
<li><a
href="82fbe49fec"><code>82fbe49</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2372">#2372</a> from
WGH-/improve-batch-doc</li>
<li><a
href="594d9d65dc"><code>594d9d6</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2367">#2367</a> from
zeghong/zeronull-int-scanner</li>
<li><a
href="5a18241971"><code>5a18241</code></a>
Merge branch 'master' into zeronull-int-scanner</li>
<li><a
href="cc34da5884"><code>cc34da5</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2370">#2370</a> from
Saurabh2402/improvement/setup-linters</li>
<li><a
href="dd81f81e2f"><code>dd81f81</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2369">#2369</a> from
zeghong/go-doc-links</li>
<li>Additional commits viewable in <a
href="https://github.com/jackc/pgx/compare/v5.7.5...v5.7.6">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.27.0 to
0.28.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1759e969da"><code>1759e96</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="f060e16ef6"><code>f060e16</code></a>
all: upgrade go directive to at least 1.24.0 [generated]</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.27.0...v0.28.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
Previously running `docker-compose up` the first time, Docker would pull
the official Docker Hub registry container, instead of building the MCP
registry locally. This PR ensures the registry image is never pulled,
and that it has a descriptive name locally without clashing with
existing local container images.
The `make dev-compose` command already enforces container build. This
change only helps those who interface with the `docker-compose`
configuration through other means.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
To validate the issue, clone the repository locally. Ensure none of the
images referenced by `docker-compose` exist locally:
```bash
docker rm -f registry postgres
docker rmi registry postgres:16-alpine
```
Run `docker-compose up` without the `--build` flag. Notice that both
`registry` and `postgres` images are pulled from Docker Hub. Registry
prints the following start up logs - showing it's _a_ registry but of
the wrong kind :)
```
registry | time="2025-09-11T11:16:23.966357009Z" level=debug msg="using \"text\" logging formatter"
registry | time="2025-09-11T11:16:23.967075675Z" level=warning msg="No HTTP secret provided - generated random secret. This may cause problems with uploads if multiple registries are behind a load-balancer. To provide a shared secret, fill in http.secret in the configuration file or set the REGISTRY_HTTP_SECRET environment variable." environment=development go.version=go1.23.7 instance.id=566edec9-5208-4bd9-ab38-9e97d3f3b5b5 service=registry version=3.0.0
registry | time="2025-09-11T11:16:23.9671568Z" level=info msg="redis not configured" environment=development go.version=go1.23.7 instance.id=566edec9-5208-4bd9-ab38-9e97d3f3b5b5 service=registry version=3.0.0
registry | time="2025-09-11T11:16:23.967193342Z" level=info msg="Starting upload purge in 31m0s" environment=development go.version=go1.23.7 instance.id=566edec9-5208-4bd9-ab38-9e97d3f3b5b5 service=registry version=3.0.0
registry | time="2025-09-11T11:16:23.967215509Z" level=info msg="using inmemory blob descriptor cache" environment=development go.version=go1.23.7 instance.id=566edec9-5208-4bd9-ab38-9e97d3f3b5b5 service=registry version=3.0.0
registry | time="2025-09-11T11:16:23.967348634Z" level=info msg="providing prometheus metrics on /metrics"
registry | time="2025-09-11T11:16:23.968138634Z" level=info msg="debug server listening :5001"
registry | time="2025-09-11T11:16:23.9681758Z" level=info msg="listening on [::]:5000" environment=development go.version=go1.23.7 instance.id=566edec9-5208-4bd9-ab38-9e97d3f3b5b5 service=registry version=3.0.0
```
Checkout the proposed change. When `docker-compose up` is ran it builds
the registry container and launches it.
```
$ docker-compose up
[+] Running 0/0
[+] Running 0/1stry Building 0.1s
[+] Building 8.7s (18/18) FINISHED docker:desktop-linux
...
registry | 2025/09/11 11:20:12 Starting MCP Registry Application vdev (commit: unknown)
...
```
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
None.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
1. Pins the Github Action workflow hashes under `.github/workflows` to
full-length commit SHAs.
2. Adds a base level `.github/dependabot.yml` config to keep these (and
other go/Docker) deps up to date.
## Motivation and Context
- Github's [security
guide](https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions)
recommends using the immutable SHA of an action when consuming third
party actions.
- Depdendabot makes ongoing dep house keeping manageable.
## Summary
- Move package version 'remarks' to 'description' field in JSON schema
(remarks is not a standard JSON schema field)
- Confirmed non-semver version test coverage already exists
Addresses followup comments from #435.
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: adam jones <domdomegg@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
Currently there are a couple shortcomings I found in the
server.schema.json:
- It uses `https://json-schema.org/draft/2020-12/schema` which is
unfortunately [not supported by VS
Code](https://github.com/microsoft/vscode/issues/165219)
- The Package schema does not require properties that are required by
the service
This means that need to round trip with the publish endpoint (perhaps
spinning CI builds) to get the server.json right. It would be great if
we could shift left and get indications in VS Code easier.
I propose we downgrade the schema to
`http://json-schema.org/draft-07/schema#`. The only difference for us is
the name of `$def` pointers.
I looked that [SchemaStore](https://github.com/SchemaStore/schemastore)
and it looks like `draft-07` is by far the most popular. I believe the
concession of using an older schema is worth it to get VS Code editor
hints.
Schema version | Count in SchemaStore
-- | --
`http://json-schema.org/draft-04/schema#` | 292
`http://json-schema.org/draft-07/schema#` | 1972
`https://json-schema.org/draft/2019-09/schema` | 4
`https://json-schema.org/draft/2020-12/schema` | 4
<!-- Why is this change needed? What problem does it solve? -->
## Open questions
- [ ] Should package `transport` actually be required? Or should `stdio`
be assumed?
- [ ] Should package `registry_base_url` be required? All of the
examples have it it's not required by the publish endpoint.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
I have tried the new schema inside VS Code and I get helpful warning.
For example, these are the warnings for the old schema.
<img width="1561" height="919" alt="image"
src="https://github.com/user-attachments/assets/474170b8-acf8-4dca-a3d9-66c68c0d1902"
/>
I have run these:
`go run .\tools\validate-examples\main.go`
`go run .\tools\validate-schemas\main.go `
## Breaking Changes
I don't think these are breaking changes. I am expressing what the
publish endpoint enforces at runtime.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
<!-- Provide a brief summary of your changes -->
Validates that server versions are not ranges.
**NB:** This also introduces `validateVersion` as a check on the
top-level `ValidateServerJSON`, as previously we were only checking
version ranges of packages via `validatePackageField` (i.e. `latest`
would have still been a valid top level server version), despite #413's
wording suggesting otherwise.
## Motivation and Context
Solves https://github.com/modelcontextprotocol/registry/issues/415
## How Has This Been Tested?
Tests added in `internal/validators/validators_test.go`
`make check` is clean.
## Breaking Changes
As per @domdomegg's comment, we should
> check nobody has done this in the existing registry data (if they
have, we should explore and understand why people have done this / if
it's valid etc.).
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
## Summary
- Add URL encoding for package identifiers and versions in NPM registry
requests
- Fixes issue where scoped packages like @hellocoop/admin-mcp failed
validation due to unencoded @ and / symbols
- Add unit tests for scoped NPM packages to prevent regression
Fixes#409
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
Remove 'Test Before Publishing' and 'Notification Setup' sections from
github-actions.md as these steps are redundant since the publisher API
already handles validation.
Fixes#432
Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: adam jones <domdomegg@users.noreply.github.com>
Fixes#49
This PR removes 36 servers from the seed file that had package entries
pointing to non-existent packages on PyPI or npm registries.
## Summary
The issue reported that many servers in the registry had `packages`
fields referencing non-existent packages. These servers either never
published to package registries or used incorrect identifiers.
## Changes
- **Removed 36 servers** that had invalid package references
- Created validation tools to identify and fix these issues
## Affected Servers
Servers removed include those pointing to non-existent:
- PyPI packages: mcp-aiven, inkeep-mcp-server, needle-mcp, and others
- npm packages: redis-mcp-server, mcp-server-applescript, ppl-ai, and
others
The registry now contains only servers with valid, installable packages.
Claude wrote this extra test while I was doing some other work
experimenting with stuff, seems useful to have!
Also deleted the unnecessary expectedServers, because we basically never
assert on it.
Adds optional website_url field to the server.json schema allowing
publishers to provide a url to the server's homepage, documentation, or
project website. This provides a central link for users to learn more
about the server. Particularly useful when the server has custom
installation instructions or setup requirements.
Issue: #183
PR: #130
Discussion: #274
## Motivation and Context
This change addresses the need identified in #130, #183 and #274 for a
standardized way to direct users to an official landing page similar to
`homepage` used in NPM
([example](https://www.npmjs.com/package/@modelcontextprotocol/sdk)). It
is also serves as a viable option for MCP Servers that don't follow
typical package manager patterns (e.g., embedded in a Desktop app).
## How Has This Been Tested?
- Schema validation: All 13 example server.json files validate
successfully against the updated schema
- Go validator tests: Added additional test cases covering URL format
validation and namespace matching
- Run all checks: Updated example files to work with anonymous
publishing and verified `make check` passes
## Breaking Changes
None. The website_url field is optional and backward compatible with
existing server.json files.
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
Security considerations:
- Website URL validation enforces that the domain matches the
publisher's reverse-DNS namespace
- HTTP/HTTPS protocols are required (no file:// or other schemes)
- Validation is consistent with existing remote URL validation patterns
## Summary
- Clarifies that the `mcp-name` format can be included in comments
within README files for both PyPI and NuGet packages
- This allows publishers to hide this technical detail from end-user
documentation while still enabling registry discovery
## Context
The current documentation doesn't make it clear that the `mcp-name` line
can be hidden in a comment, which might lead publishers to include
visible technical details in their package documentation when they
prefer to keep it clean for end users.
<!-- Provide a brief summary of your changes -->
Adding validation for version and identifier for packages.
## Motivation and Context
While debugging a bug, I found out that we need exact version to be
there in package to fetch from npm, otherwise we won't be able to parse
the response as it returns all versions. Even if we do, we still need to
go and figure out which version have the mcpname associated with while
iterating over all versions. So, we should make mandatory to have
identifier and version present in the given package object if we want to
validate package association with registries.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
UTs.
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Co-authored-by: Avish Porwal <avishporwal@microsoft.com>
Resolves#419 where URLs with trailing slashes like `/v0/servers/` would
return empty responses instead of proper data.
**Changes**:
- Added TrailingSlashMiddleware that redirects trailing slash URLs with
301 status
- Preserves root path ('/') without redirecting
- Uses HTTP 301 Moved Permanently to indicate canonical form
- Added comprehensive test coverage for the middleware
This follows REST API best practices and is consistent with how major Go
web frameworks handle trailing slash normalization.
Generated with [Claude Code](https://claude.ai/code)
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: adam jones <domdomegg@users.noreply.github.com>
## Summary
The permission error now displays what namespaces the user has
permission to publish and what namespace they attempted to publish. This
helps users debug permission mismatches more easily.
Helps mitigate #398 to enable us to figure out what's going on
## Summary
- Adds validation to prevent servers from being published with version
string "latest"
- "latest" is now a reserved keyword that cannot be used as a version
string
## Implementation
- Added `ErrReservedVersionString` error constant
- Created `validateVersion` function to check for reserved version
strings
- Integrated validation into the package field validation flow
- Added comprehensive test coverage
---
This is so we can potentially support things like
https://github.com/modelcontextprotocol/registry/discussions/333 in
future more easily, as I imagine we might want to.
Update FAQ to clarify that the registry is primarily designed for
subregistries rather than individual clients or end-users.
I saw MCP client applications were listed here, which I think is not
what we were intending.
## Motivation and Context
We just want to highlight that Docker Hub will support this project with
updates to the `docker mcp` cli and the [mcp
hub](https://hub.docker.com/mcp) catalog.
The publishing guide incorrectly suggested users could verify their
server by directly accessing `/servers/{server-name}` or
`/v0/servers/{server-name}`, but the API only supports:
1. **Search by name**: `GET /v0/servers?search={server-name}`
2. **Get by UUID**: `GET /v0/servers/{uuid}`
This PR updates the documentation to show the correct verification
method using the search endpoint.
Fixes#410
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR should fix the recent "conn busy" issue caused by the
PostgreSQL implementation using a single database connection (*pgx.Conn)
instead of a connection pool (*pgxpool.Pool). When multiple concurrent
requests try to access the endpoint, they would conflict trying to use
the same connection.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Builds locally
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Related to #400, #405 and #407
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
When using `mcp-publisher publish ...`, output the new server `ID` if
publishing is successful.
## Motivation and Context
It's useful to know this during testing. It means that you don't have to
go and search for the new server ID afterwards. Once we have the
`v0/servers/{name}/{version}`, I think we could consider removing this
again.
## How Has This Been Tested?
I've been using this while I test publishing to locally running
registries.
## Breaking Changes
none
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
Fix broken blog post announcement link. Currently users are redirected
to the getting started mcp docs.
## Motivation and Context
The existing link redirects to
https://modelcontextprotocol.io/docs/getting-started/intro. The actual
blog post is on the `blog` subdomain.
https://blog.modelcontextprotocol.io/posts/2025-09-08-mcp-registry-preview/
## How Has This Been Tested?
N/A - docs only change
## Breaking Changes
N/A
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
summary
- use the indexed primary key (`id`) for `getbyid`, `updateserver`, and
list ordering/cursor, instead of extracting `_meta...id` from jsonb
- in `updateserver`, error if the body tries to change the id; set
`meta.official.id` when missing
changes
- database: `getbyid` → `where id = $1`
- database: `updateserver` → `where id = $2`; fail on id mismatch; set
id if missing
- database: `list` orders by `id` and paginates via `id > $cursor`
- no schema or api changes
<details>
<summary>performance</summary>
- env: repo docker compose postgres, 5k–10k rows, warm cache
- getbyid: `id` ≈ 0.02 ms vs jsonb path ≈ 0.80 ms
- update: `id` ≈ 0.15 ms vs jsonb path ≈ 0.78 ms
- list (limit 100): order by `id` ≈ 0.13 ms vs jsonb path id ≈ 2.24 ms
(~17x slower)
</details>
<details>
<summary>explain analyze snippets</summary>
getbyid by `id`
```
Index Scan using idx_benchmark_servers_id on benchmark_servers (actual time≈0.01–0.02 ms)
Buffers: shared hit≈3
```
getbyid by jsonb path
```
Seq Scan on benchmark_servers (actual time≈0.43–0.83 ms)
Filter: ((value->'_meta'->'io.modelcontextprotocol.registry/official'->>'id') = $1)
Rows Removed by Filter: ≈4999
Buffers: shared hit≈455
```
update by `id`
```
Update on benchmark_servers …
-> Index Scan using idx_benchmark_servers_id … (actual time≈0.007 ms)
Execution Time: ≈0.15 ms
```
update by jsonb path
```
Update on benchmark_servers …
-> Seq Scan on benchmark_servers … Rows Removed by Filter: ≈4999
Execution Time: ≈0.78 ms
```
</details>
<details>
<summary>reproduce quickly</summary>
- start postgres: `docker compose up -d postgres`
- create a simple table (id varchar pk, value jsonb) with several
thousand rows
- compare plans: `explain (analyze, buffers) select value from … where
id = $1` vs the jsonb path predicate
</details>
---------
Co-authored-by: Adam Jones <adamj@anthropic.com>
## Summary
- Update development status to reflect preview launch
- Add navigation links for publishing, API docs, and ecosystem vision
- Include announcement blog post link
- Add feedback channels (GitHub discussions and Discord)
## Summary
- Consolidate ServerListResponse and Metadata types into pkg/api/v0
- Remove duplication between handler and API types
- Change metadata from optional pointer to required value
- Remove unused Total field from Metadata
Fixes#385
Updates DNS authentication documentation to correctly specify that TXT
records should be placed at the root domain (e.g., `example.com`) rather
than the `_mcp-registry` subdomain.
The implementation correctly looks up TXT records at the root domain,
but the documentation incorrectly instructed users to create records at
`_mcp-registry.<domain>`. This mismatch was causing authentication
failures.
## Why use root domain instead of subdomain?
The root domain approach is clearer: if you want to publish to
`com.example/my-server`, you authenticate with `example.com`, not
`_mcp-registry.example.com`.
It also aligns with other TXT DNS standards, e.g. SPF. (That said, there
are other DNS standards that use subdomains e.g. DKIM 🤷)
## Changes
- Updated publish-server.md to remove `_mcp-registry.` prefix from DNS
examples
- Updated CLI commands reference documentation
- Updated namespacing explanation documentation
## Summary
Simplifies the installation instructions in the publisher guide by:
- Auto-detecting platform using `uname` and PowerShell built-ins for a
single copy-paste command
- Moving build-from-source to a collapsible details section to emphasize
the recommended pre-built binary approach
- Removing unnecessary `chmod +x` since tar preserves executable
permissions
- Adding explicit support for WSL
This makes it much easier for users to get started - they can now just
copy one command instead of picking from 4+ platform-specific options.
## Summary
Add per-environment concurrency groups to staging and production
deployment jobs to prevent Pulumi stack lock conflicts when multiple PRs
are merged simultaneously.
- `deploy-staging` job gets `deploy-staging` concurrency group
- `deploy-production` job gets `deploy-production` concurrency group
- Both use `cancel-in-progress: false` to queue deployments safely
This eliminates CI noise from failed parallel deployments while
maintaining deployment reliability.
Fixes#375
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR updates the publishing docs to refer to the
mcp-publisher release assets from v1.0.0.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Locally
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
## Summary
Simplified the schema structure by:
- Replacing `version_detail.version` with direct `version` field
- Removing unused `release_date` field from seed data
- Updating all API types, models, and tests to match new structure
- Maintaining backwards compatibility in API responses
This change makes the schema more intuitive and reduces nesting depth.
Preeti Dewani
Gaurav Gosain
Kartheek Penagamuri
dependabot[bot]
Ossama Lafhel
adam jones
Radoslav Dimitrov
Ville Vesilehto
Frenchie
Joel Verhagen
Kalle Bylin
Avish Porwal
Jim Clark
BorenTsai
nate nowack
Rui Chen