.env.example

@@ -11,11 +11,6 @@ MCP_REGISTRY_DATABASE_URL=postgres://username:password@localhost:5432/mcp-regist
 # For offline development, use: data/seed.json
 MCP_REGISTRY_SEED_FROM=https://registry.modelcontextprotocol.io/v0/servers
 
-# Validate seed data against the registry rules on import (default: true)
-# Set to false for offline development when seeding from a local file, since
-# data/seed.json is not guaranteed to pass validation
-MCP_REGISTRY_ENABLE_REGISTRY_VALIDATION=true
-
 # GitHub OAuth configuration
 # These creds are for local development with the 'MCP Registry Login (Local)' GitHub App
 # They don't provide any real privileged access, hence why it's okay that they're here
@@ -32,14 +27,6 @@ MCP_REGISTRY_JWT_PRIVATE_KEY=bb2c6b424005acd5df47a9e2c87f446def86dd740c888ea3efb
 # This should be disabled in prod
 MCP_REGISTRY_ENABLE_ANONYMOUS_AUTH=false
 
-# GitHub OIDC token exchange (for `mcp-publisher login github-oidc`)
-# Expected `aud` claim on incoming GitHub Actions OIDC tokens. Must equal the
-# scheme + host that publishers pass via `--registry` (e.g. `https://registry.example.com`).
-# The publisher CLI derives the audience from `--registry` automatically; the server
-# rejects all OIDC exchanges if this is unset, so set it on every deployment that
-# accepts GitHub Actions publishes.
-MCP_REGISTRY_GITHUB_OIDC_AUDIENCE=
-
 # Google Cloud Identity OIDC configuration for admin access
 # Enable OIDC authentication for @modelcontextprotocol.io admin accounts
 MCP_REGISTRY_OIDC_ENABLED=false

.github/copilot-instructions.md

@@ -1,13 +0,0 @@
-# Copilot Instructions for MCP Registry
-
-## Important: Publishing MCP servers
-
-The `data/seed.json` file is seed data for local development only. Do NOT create pull requests that add or modify server entries in `data/seed.json` to publish a server.
-
-To publish an MCP server to the registry, use the `mcp-publisher` CLI tool. See `docs/modelcontextprotocol-io/quickstart.mdx` for instructions.
-
-## Development
-
-- Use `make` targets where possible (run `make help` to see available targets)
-- Run `make check` to run lint, schema validation, and all tests (this also stops any running dev-compose environment)
-- Run `make dev-compose` to start the local development environment

.github/dependabot.yml

@@ -2,29 +2,21 @@ version: 2
 updates:
   - package-ecosystem: gomod
     directory: /
-    groups:
-      go-dependencies:
-        patterns:
-          - "*"
     schedule:
-      interval: weekly
+      interval: daily
   - package-ecosystem: gomod
     directory: /deploy
-    groups:
-      deploy-go-dependencies:
-        patterns:
-          - "*"
     schedule:
-      interval: weekly
+      interval: daily
   - package-ecosystem: github-actions
     directory: /
     groups:
-      github-actions:
+      actions:
         patterns:
           - "*"
     schedule:
-      interval: weekly
-  - package-ecosystem: docker
-    directory: /
+      interval: daily
+  - package-ecosystem: "docker"
+    directory: "/"
     schedule:
-      interval: weekly
+        interval: "daily"

.github/workflows/cancel-pulumi-lock.yml

@@ -24,10 +24,10 @@ jobs:
     environment: ${{ inputs.environment }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
 
       - name: Setup Pulumi
-        uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d
+        uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58
         with:
           pulumi-version: ${{ env.PULUMI_VERSION }}
 

.github/workflows/ci.yml

@@ -16,18 +16,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
 
     - name: Set up Go
-      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
       with:
-        go-version: 'stable'
+        go-version-file: 'go.mod'
         cache: true
 
     - name: Run lint
-      uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a
+      uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47
       with:
-        version: v2.13.1
+        version: v2.4.0
 
     - name: Validate schemas and examples
       run: make validate
@@ -38,9 +38,9 @@ jobs:
     - name: Run govulncheck
       uses: golang/govulncheck-action@v1
       with:
-        go-version-input: 'stable'
+        go-version-input: ''
+        go-version-file: go.mod
         go-package: ./...
-        repo-checkout: false
 
   # All Tests
   tests:
@@ -48,22 +48,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
 
     - name: Set up Go
-      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
       with:
-        go-version: 'stable'
+        go-version-file: 'go.mod'
         cache: true
 
     - name: Set up ko
-      uses: ko-build/setup-ko@v0.10
+      uses: ko-build/setup-ko@v0.9
 
     - name: Run all tests
       run: make test-all
 
     - name: Upload coverage artifacts
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
       with:
         name: coverage-report
         path: |

.github/workflows/claude.yml

@@ -26,7 +26,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
         with:
           fetch-depth: 1
 

.github/workflows/close-invalid-publish-prs.yml

@@ -1,151 +0,0 @@
-name: Close invalid publish PRs
-
-# Stage 2 of 2 (see detect-invalid-publish-prs.yml for stage 1).
-#
-# Runs in the trusted base-repo context (triggered by workflow_run, not by the
-# PR itself), so it has a write token. It picks up the PR number flagged by
-# stage 1 and, after independently re-validating the PR from the API, posts a
-# comment pointing at the publishing docs, labels it `invalid`, and closes it.
-#
-# Trust boundary: the ONLY thing crossing from the untrusted stage is the PR
-# number (sanitized to digits below). We re-derive every decision (state,
-# author, changed files) here, so a wrong/stale artifact can never cause us to
-# close a PR that doesn't actually match.
-
-on:
-  workflow_run:
-    workflows: ["Detect invalid publish PRs"]
-    types: [completed]
-
-permissions:
-  contents: read
-  pull-requests: write
-  issues: write # labels on PRs go through the issues API
-  actions: read # needed to list/download the stage-1 artifact
-
-jobs:
-  close:
-    if: github.event.workflow_run.conclusion == 'success'
-    runs-on: ubuntu-latest
-    env:
-      GH_TOKEN: ${{ github.token }}
-      GH_REPO: ${{ github.repository }}
-      RUN_ID: ${{ github.event.workflow_run.id }}
-      COMMENT_BODY: |
-        Hi @__AUTHOR__ 👋 — thanks for your interest in the MCP Registry!
-
-        It looks like this PR is trying to publish an MCP server by adding or editing server files in this repository (under `servers/`, `data/servers/`, or in `data/seed.json`). That isn't how servers get published, so I'm closing this PR automatically.
-
-        **Servers are published with the [`mcp-publisher`](https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/quickstart.mdx) CLI**, not by opening a pull request against this repo. The CLI verifies that you own your namespace and submits your `server.json` directly to the live registry API.
-
-        To publish your server, follow the **[Publishing Quickstart](https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/quickstart.mdx)**. In short:
-
-        ```bash
-        # Build the publisher CLI
-        make publisher
-
-        # Authenticate (e.g. via GitHub) and publish your server.json
-        ./bin/mcp-publisher login github
-        ./bin/mcp-publisher publish
-        ```
-
-        Note: `data/seed.json` is seed data for **local development only** — adding entries there does not publish anything to the registry.
-
-        If you believe this was closed in error, please leave a comment and a maintainer will take a look. 🙇
-
-        _This is an automated message._
-
-    steps:
-      - name: Check for flagged-pr artifact
-        id: check
-        run: |
-          set -euo pipefail
-          names="$(gh api "repos/$GH_REPO/actions/runs/$RUN_ID/artifacts" --jq '.artifacts[].name' || true)"
-          if printf '%s\n' "$names" | grep -qx "flagged-pr"; then
-            echo "found=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "No flagged-pr artifact on run $RUN_ID; nothing to do."
-            echo "found=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Download flagged PR number
-        if: steps.check.outputs.found == 'true'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: flagged-pr
-          run-id: ${{ github.event.workflow_run.id }}
-          github-token: ${{ github.token }}
-
-      - name: Re-validate and close
-        if: steps.check.outputs.found == 'true'
-        run: |
-          set -euo pipefail
-
-          # Sanitize: the only cross-boundary input. Keep digits only.
-          PR_NUMBER="$(tr -dc '0-9' < pr-number.txt)"
-          if [ -z "$PR_NUMBER" ]; then
-            echo "No valid PR number in artifact; skipping."
-            exit 0
-          fi
-          echo "Re-validating PR #$PR_NUMBER"
-
-          state="$(gh pr view "$PR_NUMBER" --json state --jq '.state')"
-          if [ "$state" != "OPEN" ]; then
-            echo "PR #$PR_NUMBER is $state, not OPEN; skipping."
-            exit 0
-          fi
-
-          # Use the REST endpoint: `gh pr view --json` does not expose an
-          # authorAssociation field, so calling it there exits non-zero and,
-          # under `set -euo pipefail`, aborts the job before we ever close.
-          assoc="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq '.author_association')"
-          case "$assoc" in
-            MEMBER|OWNER|COLLABORATOR)
-              echo "Author association '$assoc' is trusted; skipping."
-              exit 0
-              ;;
-          esac
-
-          # Idempotency: if a maintainer reopens after we labeled it, leave it be.
-          # Capture into a var first so a transient gh failure can't fail open
-          # (an errored fetch piped to grep would otherwise look "not labeled").
-          labels="$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name' || true)"
-          if printf '%s\n' "$labels" | grep -qx "invalid"; then
-            echo "PR #$PR_NUMBER already labeled 'invalid'; skipping."
-            exit 0
-          fi
-
-          # Paginated REST endpoint (gh pr view --json files caps at 100, no pagination).
-          mapfile -t FILES < <(gh api --paginate "repos/$GH_REPO/pulls/$PR_NUMBER/files" --jq '.[].filename')
-          if [ "${#FILES[@]}" -eq 0 ]; then
-            echo "No files for PR #$PR_NUMBER; skipping."
-            exit 0
-          fi
-          # Keep this list in sync with the copy in stage 1.
-          publish_attempt=0
-          other=0
-          for f in "${FILES[@]}"; do
-            if [[ "$f" == servers/* \
-               || "$f" == data/servers/* \
-               || "$f" == data/data/servers/* \
-               || "$f" =~ ^data/[^/]*server\.json$ \
-               || "$f" == "data/seed.json" \
-               || "$f" == "server.json" \
-               || "$f" == "servers.json" ]]; then
-              publish_attempt=1
-            else
-              other=1
-            fi
-          done
-          if [ "$publish_attempt" -ne 1 ] || [ "$other" -ne 0 ]; then
-            echo "PR #$PR_NUMBER no longer matches the publish-attempt pattern; skipping."
-            exit 0
-          fi
-
-          author="$(gh pr view "$PR_NUMBER" --json author --jq '.author.login')"
-          body="${COMMENT_BODY//__AUTHOR__/$author}"
-
-          echo "Commenting on, labeling, and closing PR #$PR_NUMBER"
-          gh pr comment "$PR_NUMBER" --body "$body"
-          gh pr edit "$PR_NUMBER" --add-label "invalid" || echo "Could not add label; continuing."
-          gh pr close "$PR_NUMBER"

.github/workflows/deploy-production.yml

@@ -23,16 +23,16 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
 
       - name: Setup Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
         with:
-          go-version: 'stable'
+          go-version-file: 'go.mod'
           cache: true
 
       - name: Setup Pulumi
-        uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d
+        uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58
         with:
           pulumi-version: ${{ env.PULUMI_VERSION }}
 

.github/workflows/deploy-staging.yml

@@ -22,19 +22,19 @@ jobs:
       packages: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
 
       - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
         with:
-          go-version: 'stable'
+          go-version-file: 'go.mod'
           cache: true
 
       - name: Set up ko
-        uses: ko-build/setup-ko@v0.10
+        uses: ko-build/setup-ko@v0.9
 
       - name: Log in to Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -70,16 +70,16 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
 
       - name: Setup Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
         with:
-          go-version: 'stable'
+          go-version-file: 'go.mod'
           cache: true
 
       - name: Setup Pulumi
-        uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d
+        uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58
         with:
           pulumi-version: ${{ env.PULUMI_VERSION }}
 

.github/workflows/detect-invalid-publish-prs.yml

@@ -1,96 +0,0 @@
-name: Detect invalid publish PRs
-
-# Stage 1 of 2 (see close-invalid-publish-prs.yml for stage 2).
-#
-# Some contributors try to "publish" a server by opening a PR that adds files
-# under servers/ or edits data/seed.json. That is not how publishing works -
-# servers are published with the mcp-publisher CLI against the live registry
-# API. This job only DETECTS such PRs. It runs from the (untrusted) PR context
-# with a read-only token, so it cannot comment on or close anything. When it
-# finds a match it records just the PR number as an artifact; the privileged
-# stage-2 workflow picks that up via workflow_run and acts on it.
-#
-# We never check out or run the PR's code - we only read changed file paths.
-
-on:
-  pull_request:
-    types: [opened, reopened]
-
-permissions:
-  contents: read
-  pull-requests: read
-
-jobs:
-  detect:
-    runs-on: ubuntu-latest
-    env:
-      GH_TOKEN: ${{ github.token }}
-      GH_REPO: ${{ github.repository }}
-      PR_NUMBER: ${{ github.event.pull_request.number }}
-      AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
-    steps:
-      - name: Classify PR
-        id: classify
-        run: |
-          set -euo pipefail
-          match=false
-
-          # Maintainers may legitimately touch these files (e.g. dev seed data),
-          # so never flag their PRs.
-          case "$AUTHOR_ASSOCIATION" in
-            MEMBER|OWNER|COLLABORATOR)
-              echo "Author association '$AUTHOR_ASSOCIATION' is trusted; not flagging."
-              ;;
-            *)
-              # Use the paginated REST endpoint: `gh pr view --json files` caps
-              # at 100 files with no pagination, which could truncate a large PR
-              # and cause a false match.
-              mapfile -t FILES < <(gh api --paginate "repos/$GH_REPO/pulls/$PR_NUMBER/files" --jq '.[].filename')
-              if [ "${#FILES[@]}" -gt 0 ]; then
-                # Flag only if the PR touches *exclusively* publish-attempt files
-                # and nothing else, so that legit PRs touching seed data
-                # alongside real code are left alone.
-                #
-                # Keep this list in sync with the copy in stage 2. It stays an
-                # explicit list rather than a broad `**/server.json` glob:
-                # because we require *every* file to match, an over-broad
-                # pattern would auto-close a legitimate single-file PR.
-                # data/servers/** is here because #1524 put its server.json
-                # there - a natural guess next to data/seed.json - and slipped
-                # through the original servers/**-only list.
-                publish_attempt=0
-                other=0
-                for f in "${FILES[@]}"; do
-                  if [[ "$f" == servers/* \
-                     || "$f" == data/servers/* \
-                     || "$f" == data/data/servers/* \
-                     || "$f" =~ ^data/[^/]*server\.json$ \
-                     || "$f" == "data/seed.json" \
-                     || "$f" == "server.json" \
-                     || "$f" == "servers.json" ]]; then
-                    publish_attempt=1
-                  else
-                    echo "Non-publish file changed: $f"
-                    other=1
-                  fi
-                done
-                if [ "$publish_attempt" -eq 1 ] && [ "$other" -eq 0 ]; then
-                  match=true
-                fi
-              fi
-              ;;
-          esac
-
-          echo "PR #$PR_NUMBER match=$match"
-          echo "match=$match" >> "$GITHUB_OUTPUT"
-          if [ "$match" = "true" ]; then
-            echo "$PR_NUMBER" > pr-number.txt
-          fi
-
-      - name: Record flagged PR number
-        if: steps.classify.outputs.match == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
-        with:
-          name: flagged-pr
-          path: pr-number.txt
-          retention-days: 1

.github/workflows/release.yml

@@ -14,24 +14,26 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
         with:
-          go-version: 'stable'
+          go-version-file: 'go.mod'
           cache: true
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad
+        with:
+          cosign-release: "v2.6.1"
 
       - name: Install Syft
-        uses: anchore/sbom-action/download-syft@v0.24.2
+        uses: anchore/sbom-action/download-syft@v0.20.10
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a
         with:
           distribution: goreleaser
           version: v2.12.0
@@ -45,19 +47,19 @@ jobs:
     needs: goreleaser
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
 
       - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
         with:
-          go-version: 'stable'
+          go-version-file: 'go.mod'
           cache: true
 
       - name: Set up ko
-        uses: ko-build/setup-ko@v0.10
+        uses: ko-build/setup-ko@v0.9
 
       - name: Log in to Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/sync-schema.yml

@@ -1,69 +0,0 @@
-name: Sync Schema
-
-on:
-  workflow_dispatch: # Manual trigger
-  # TODO: Add daily schedule later
-  # schedule:
-  #   - cron: '0 2 * * *'  # Run daily at 2 AM UTC
-
-permissions:
-  contents: write
-
-jobs:
-  sync-schema:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-
-      - name: Checkout static repo
-        uses: actions/checkout@v7
-        with:
-          repository: modelcontextprotocol/static
-          path: static-repo
-
-      - name: Sync schemas from static repo
-        run: |
-          echo "🔍 Syncing schemas from modelcontextprotocol/static..."
-          mkdir -p internal/validators/schemas
-          
-          # Copy all versioned schema files
-          for dir in static-repo/schemas/*/; do
-            if [ -f "$dir/server.schema.json" ]; then
-              version=$(basename "$dir")
-              # Skip draft directory if it exists
-              if [ "$version" != "draft" ]; then
-                output_file="internal/validators/schemas/${version}.json"
-                if [ ! -f "$output_file" ] || ! cmp -s "$dir/server.schema.json" "$output_file"; then
-                  echo "⬇ Adding/updating ${version}/server.schema.json -> ${version}.json"
-                  cp "$dir/server.schema.json" "$output_file"
-                else
-                  echo "✓ ${version} is already up to date"
-                fi
-              fi
-            fi
-          done
-          
-          echo "✅ Schema sync complete"
-
-      - name: Check for changes
-        id: changes
-        run: |
-          # Check for both modified and untracked files
-          if [ -n "$(git status --porcelain internal/validators/schemas/)" ]; then
-            echo "changed=true" >> $GITHUB_OUTPUT
-            git status --porcelain internal/validators/schemas/
-          else
-            echo "changed=false" >> $GITHUB_OUTPUT
-            echo "No changes to schemas"
-          fi
-
-      - name: Commit and push changes
-        if: steps.changes.outputs.changed == 'true'
-        run: |
-          git config --local user.email "action@github.com"
-          git config --local user.name "GitHub Action"
-          git add internal/validators/schemas/
-          git commit -m "Sync schemas from modelcontextprotocol/static [skip ci]"
-          git push

.gitignore

@@ -12,4 +12,4 @@ validate-schemas
 coverage.out
 coverage.html
 deploy/infra/infra
-registry
+registry

.golangci.yml

@@ -22,7 +22,7 @@ linters:
     - gocyclo
     - godox
     - gomoddirectives
-    - gomodguard_v2
+    - gomodguard
     - goprintffuncname
     - gosec
     - grouper
@@ -55,10 +55,6 @@ linters:
       max-complexity: 20
     dupl:
       threshold: 300
-    goconst:
-      # Repeated literals in tests are fixture data ("1.0.0", "Test server", ...);
-      # hoisting them into constants hurts readability more than it helps.
-      ignore-tests: true
     gocognit:
       min-complexity: 51
     nestif:
@@ -70,11 +66,6 @@ linters:
       - common-false-positives
       - legacy
       - std-error-handling
-    rules:
-      # httptest.NewRequest is idiomatic in tests; noctx is not useful there.
-      - path: _test\.go
-        linters:
-          - noctx
     paths:
       - third_party$
       - builtin$

.goreleaser.yaml

@@ -95,24 +95,26 @@ signs:
     cmd: cosign
     args:
       - "sign-blob"
-      - "--bundle=${signature}" # cosign v3+: bundles signature and certificate together
+      - "--output-signature=${signature}"
+      - "--output-certificate=${certificate}"
       - "${artifact}"
       - "--yes" # needed on cosign 2.0.0+
     artifacts: archive
     output: true
-    signature: "${artifact}.sigstore.json"
-
+    certificate: '{{ trimsuffix (trimsuffix .Env.artifact ".zip") ".tar.gz" }}.pem'
+    
   # Also sign checksums file for additional verification
   - id: checksums
     cmd: cosign
     args:
       - "sign-blob"
-      - "--bundle=${signature}" # cosign v3+: bundles signature and certificate together
+      - "--output-signature=${signature}"
+      - "--output-certificate=${certificate}"
       - "${artifact}"
       - "--yes"
     artifacts: checksum
     output: true
-    signature: "${artifact}.sigstore.json"
+    certificate: '{{ trimsuffix .Env.artifact ".txt" }}.pem'
 
 # This section defines the release format.
 archives:

CLAUDE.md

@@ -2,9 +2,3 @@
 _Guidance for Claude Code (claude.ai/code) when working in this repository. If it's also useful to humans (probably most things!), put the instructions in README.md instead._
 
 Import @README.md
-
-## Important: Publishing MCP servers
-
-The `data/seed.json` file is seed data for local development only. Do NOT create pull requests or commits that add server entries to `data/seed.json` as a way to publish a server to the registry.
-
-To publish an MCP server, use the `mcp-publisher` CLI tool. See `docs/modelcontextprotocol-io/quickstart.mdx` for instructions.

CONTRIBUTING.md

@@ -1,40 +0,0 @@
-# Contributing to the MCP Registry
-
-Thank you for your interest in contributing!
-
-## Want to publish an MCP server?
-
-**Do NOT open a pull request to add your server to `data/seed.json`.**
-
-The `data/seed.json` file is seed data used only for local development. Modifying it will not publish your server to the registry.
-
-To publish an MCP server, use the official `mcp-publisher` CLI tool. See the [publishing quickstart guide](docs/modelcontextprotocol-io/quickstart.mdx) for step-by-step instructions.
-
-## Contributing to the registry codebase
-
-We welcome contributions to the registry itself! Here's how to get started:
-
-### Communication channels
-
-We use multiple channels for collaboration - see [modelcontextprotocol.io/community/communication](https://modelcontextprotocol.io/community/communication).
-
-Often (but not always) ideas flow through this pipeline:
-
-- **[Discord](https://modelcontextprotocol.io/community/communication)** - Real-time community discussions
-- **[Discussions](https://github.com/modelcontextprotocol/registry/discussions)** - Propose and discuss product/technical requirements
-- **[Issues](https://github.com/modelcontextprotocol/registry/issues)** - Track well-scoped technical work
-- **[Pull Requests](https://github.com/modelcontextprotocol/registry/pulls)** - Contribute work towards issues
-
-### Development setup
-
-See the [README](README.md#quick-start) for prerequisites and instructions on running the server locally.
-
-### Running checks
-
-```bash
-# Run lint, schema validation, and all tests
-# Note: this also runs `make dev-down`, stopping any running dev-compose environment
-make check
-```
-
-Run `make help` for more available commands.

LICENSE

@@ -1,193 +1,6 @@
-The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
-
-Contributions for which relicensing consent has been obtained are licensed under Apache-2.0. Contributions made by authors who originally licensed their work under the MIT License and who have not yet granted explicit permission to relicense remain licensed under the MIT License.
-
-No rights beyond those granted by the applicable original license are conveyed for such contributions.
-
----
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to the Licensor for inclusion in the Work by the copyright
-      owner or by an individual or Legal Entity authorized to submit on behalf
-      of the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
----
-
 MIT License
 
-Copyright (c) 2024-2025 Model Context Protocol a Series of LF Projects, LLC.
+Copyright (c) 2025 MCP Contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -206,11 +19,3 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
-
----
-
-Creative Commons Attribution 4.0 International (CC-BY-4.0)
-
-Documentation in this project (excluding specifications) is licensed under
-CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
-the full license text.

Makefile

@@ -1,8 +1,5 @@
 .PHONY: help build test test-unit test-integration test-endpoints test-publish test-all lint lint-fix validate validate-schemas validate-examples check ko-build ko-rebuild dev-compose dev-down clean publisher generate-schema check-schema
 
-# Use bash for all commands to support pipefail
-SHELL := /bin/bash
-
 # Default target
 help: ## Show this help message
 	@echo "Available targets:"
@@ -36,7 +33,7 @@ test-unit: ## Run unit tests with coverage (requires PostgreSQL)
 	@sleep 3
 	@echo ""
 	@echo "Running unit tests..."
-	@set -o pipefail; if command -v gotestsum >/dev/null 2>&1; then \
+	@if command -v gotestsum >/dev/null 2>&1; then \
 		gotestsum --format pkgname-and-test-fails -- -race -coverprofile=coverage.out -covermode=atomic ./internal/... ./cmd/... 2>&1 | grep -v "ld: warning:"; \
 	else \
 		go test -race -coverprofile=coverage.out -covermode=atomic ./internal/... ./cmd/... 2>&1 | grep -v "ld: warning:" | grep -v "^ld:"; \

README.md

@@ -2,7 +2,7 @@
 
 The MCP registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.
 
-[**📤 Publish my MCP server**](docs/modelcontextprotocol-io/quickstart.mdx) | [**⚡️ Live API docs**](https://registry.modelcontextprotocol.io/docs) | [**👀 Ecosystem vision**](docs/design/ecosystem-vision.md) | 📖 **[Full documentation](./docs)**
+[**📤 Publish my MCP server**](docs/guides/publishing/publish-server.md) | [**⚡️ Live API docs**](https://registry.modelcontextprotocol.io/docs) | [**👀 Ecosystem vision**](docs/explanations/ecosystem-vision.md) | 📖 **[Full documentation](./docs)**
 
 ## Development Status
 
@@ -10,11 +10,11 @@ The MCP registry provides MCP clients with a list of MCP servers, like an app st
 
 **2025-09-08 update**: The registry has launched in preview 🎉 ([announcement blog post](https://blog.modelcontextprotocol.io/posts/2025-09-08-mcp-registry-preview/)). While the system is now more stable, this is still a preview release and breaking changes or data resets may occur. A general availability (GA) release will follow later. We'd love your feedback in [GitHub discussions](https://github.com/modelcontextprotocol/registry/discussions/new?category=ideas) or in the [#registry-dev Discord](https://discord.com/channels/1358869848138059966/1369487942862504016) ([joining details here](https://modelcontextprotocol.io/community/communication)).
 
-Registry Working Group:
-- **Radoslav (Rado) Dimitrov** (Stacklok) [@rdimitrov](https://github.com/rdimitrov) - WG Lead
+Current key maintainers:
+- **Adam Jones** (Anthropic) [@domdomegg](https://github.com/domdomegg)  
 - **Tadas Antanavicius** (PulseMCP) [@tadasant](https://github.com/tadasant)
-- **Bob Dickinson** (TeamSpark) [@BobDickinson](https://github.com/BobDickinson)
-- **Preeti (Pree) Dewani** (Ravenmail) [@pree-dew](https://github.com/pree-dew)
+- **Toby Padilla** (GitHub) [@toby](https://github.com/toby)
+- **Radoslav (Rado) Dimitrov** (Stacklok) [@rdimitrov](https://github.com/rdimitrov)
 
 ## Contributing
 
@@ -32,9 +32,9 @@ Often (but not always) ideas flow through this pipeline:
 #### Pre-requisites
 
 - **Docker**
-- **Go** - version per the `go` directive in [go.mod](./go.mod); the Go toolchain fetches it for you
+- **Go 1.24.x**
 - **ko** - Container image builder for Go ([installation instructions](https://ko.build/install/))
-- **golangci-lint** - version per the `golangci-lint-action` pin in [ci.yml](./.github/workflows/ci.yml), so local lint matches CI
+- **golangci-lint v2.4.0**
 
 #### Running the server
 
@@ -54,7 +54,7 @@ The setup can be configured with environment variables in [docker-compose.yml](.
 <details>
 <summary>Alternative: Running a pre-built Docker image</summary>
 
-Pre-built Docker images are automatically published to GitHub Container Registry. Note that the image does not bundle PostgreSQL, so you need to run your own and point the registry at it via `MCP_REGISTRY_DATABASE_URL` (see [docker-compose.yml](./docker-compose.yml) for a working example):
+Pre-built Docker images are automatically published to GitHub Container Registry:
 
 ```bash
 # Run latest stable release
@@ -89,13 +89,12 @@ make publisher
 ./bin/mcp-publisher --help
 ```
 
-See [the publisher guide](./docs/modelcontextprotocol-io/quickstart.mdx) for more details.
+See [the publisher guide](./docs/guides/publishing/publish-server.md) for more details.
 
 #### Other commands
 
 ```bash
-# Run lint, schema validation, and all tests
-# Note: this also runs `make dev-down`, stopping any running dev-compose environment
+# Run lint, unit tests and integration tests
 make check
 ```
 
@@ -111,8 +110,7 @@ For Claude and other AI tools: Always prefer make targets over custom commands w
 
 ```
 ├── cmd/                     # Application entry points
-│   ├── publisher/           # Server publishing tool
-│   └── registry/            # Registry API server
+│   └── publisher/           # Server publishing tool
 ├── data/                    # Seed data
 ├── deploy/                  # Deployment configuration (Pulumi)
 ├── docs/                    # Documentation
@@ -121,7 +119,6 @@ For Claude and other AI tools: Always prefer make targets over custom commands w
 │   ├── auth/                # Authentication (GitHub OAuth, JWT, namespace blocking)
 │   ├── config/              # Configuration management
 │   ├── database/            # Data persistence (PostgreSQL)
-│   ├── importer/            # Seed data import
 │   ├── service/             # Business logic
 │   ├── telemetry/           # Metrics and monitoring
 │   └── validators/          # Input validation