Compare commits
166 changed files with 4683 additions and 12107 deletions
13
.env.example
13
.env.example
|
|
@ -11,11 +11,6 @@ MCP_REGISTRY_DATABASE_URL=postgres://username:password@localhost:5432/mcp-regist
|
|||
# For offline development, use: data/seed.json
|
||||
MCP_REGISTRY_SEED_FROM=https://registry.modelcontextprotocol.io/v0/servers
|
||||
|
||||
# Validate seed data against the registry rules on import (default: true)
|
||||
# Set to false for offline development when seeding from a local file, since
|
||||
# data/seed.json is not guaranteed to pass validation
|
||||
MCP_REGISTRY_ENABLE_REGISTRY_VALIDATION=true
|
||||
|
||||
# GitHub OAuth configuration
|
||||
# These creds are for local development with the 'MCP Registry Login (Local)' GitHub App
|
||||
# They don't provide any real privileged access, hence why it's okay that they're here
|
||||
|
|
@ -32,14 +27,6 @@ MCP_REGISTRY_JWT_PRIVATE_KEY=bb2c6b424005acd5df47a9e2c87f446def86dd740c888ea3efb
|
|||
# This should be disabled in prod
|
||||
MCP_REGISTRY_ENABLE_ANONYMOUS_AUTH=false
|
||||
|
||||
# GitHub OIDC token exchange (for `mcp-publisher login github-oidc`)
|
||||
# Expected `aud` claim on incoming GitHub Actions OIDC tokens. Must equal the
|
||||
# scheme + host that publishers pass via `--registry` (e.g. `https://registry.example.com`).
|
||||
# The publisher CLI derives the audience from `--registry` automatically; the server
|
||||
# rejects all OIDC exchanges if this is unset, so set it on every deployment that
|
||||
# accepts GitHub Actions publishes.
|
||||
MCP_REGISTRY_GITHUB_OIDC_AUDIENCE=
|
||||
|
||||
# Google Cloud Identity OIDC configuration for admin access
|
||||
# Enable OIDC authentication for @modelcontextprotocol.io admin accounts
|
||||
MCP_REGISTRY_OIDC_ENABLED=false
|
||||
|
|
|
|||
13
.github/copilot-instructions.md
vendored
13
.github/copilot-instructions.md
vendored
|
|
@ -1,13 +0,0 @@
|
|||
# Copilot Instructions for MCP Registry
|
||||
|
||||
## Important: Publishing MCP servers
|
||||
|
||||
The `data/seed.json` file is seed data for local development only. Do NOT create pull requests that add or modify server entries in `data/seed.json` to publish a server.
|
||||
|
||||
To publish an MCP server to the registry, use the `mcp-publisher` CLI tool. See `docs/modelcontextprotocol-io/quickstart.mdx` for instructions.
|
||||
|
||||
## Development
|
||||
|
||||
- Use `make` targets where possible (run `make help` to see available targets)
|
||||
- Run `make check` to run lint, schema validation, and all tests (this also stops any running dev-compose environment)
|
||||
- Run `make dev-compose` to start the local development environment
|
||||
22
.github/dependabot.yml
vendored
22
.github/dependabot.yml
vendored
|
|
@ -3,28 +3,28 @@ updates:
|
|||
- package-ecosystem: gomod
|
||||
directory: /
|
||||
groups:
|
||||
go-dependencies:
|
||||
opentelemetry:
|
||||
patterns:
|
||||
- "*"
|
||||
- "go.opentelemetry.io/*"
|
||||
schedule:
|
||||
interval: weekly
|
||||
interval: daily
|
||||
- package-ecosystem: gomod
|
||||
directory: /deploy
|
||||
groups:
|
||||
deploy-go-dependencies:
|
||||
opentelemetry:
|
||||
patterns:
|
||||
- "*"
|
||||
- "go.opentelemetry.io/*"
|
||||
schedule:
|
||||
interval: weekly
|
||||
interval: daily
|
||||
- package-ecosystem: github-actions
|
||||
directory: /
|
||||
groups:
|
||||
github-actions:
|
||||
actions:
|
||||
patterns:
|
||||
- "*"
|
||||
schedule:
|
||||
interval: weekly
|
||||
- package-ecosystem: docker
|
||||
directory: /
|
||||
interval: daily
|
||||
- package-ecosystem: "docker"
|
||||
directory: "/"
|
||||
schedule:
|
||||
interval: weekly
|
||||
interval: "daily"
|
||||
|
|
|
|||
4
.github/workflows/cancel-pulumi-lock.yml
vendored
4
.github/workflows/cancel-pulumi-lock.yml
vendored
|
|
@ -24,10 +24,10 @@ jobs:
|
|||
environment: ${{ inputs.environment }}
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
||||
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
|
||||
|
||||
- name: Setup Pulumi
|
||||
uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d
|
||||
uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58
|
||||
with:
|
||||
pulumi-version: ${{ env.PULUMI_VERSION }}
|
||||
|
||||
|
|
|
|||
23
.github/workflows/ci.yml
vendored
23
.github/workflows/ci.yml
vendored
|
|
@ -16,18 +16,18 @@ jobs:
|
|||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
||||
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
|
||||
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5
|
||||
with:
|
||||
go-version: 'stable'
|
||||
go-version-file: 'go.mod'
|
||||
cache: true
|
||||
|
||||
- name: Run lint
|
||||
uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a
|
||||
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20
|
||||
with:
|
||||
version: v2.13.1
|
||||
version: v2.4.0
|
||||
|
||||
- name: Validate schemas and examples
|
||||
run: make validate
|
||||
|
|
@ -38,7 +38,8 @@ jobs:
|
|||
- name: Run govulncheck
|
||||
uses: golang/govulncheck-action@v1
|
||||
with:
|
||||
go-version-input: 'stable'
|
||||
go-version-input: ''
|
||||
go-version-file: go.mod
|
||||
go-package: ./...
|
||||
repo-checkout: false
|
||||
|
||||
|
|
@ -48,22 +49,22 @@ jobs:
|
|||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
||||
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
|
||||
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5
|
||||
with:
|
||||
go-version: 'stable'
|
||||
go-version-file: 'go.mod'
|
||||
cache: true
|
||||
|
||||
- name: Set up ko
|
||||
uses: ko-build/setup-ko@v0.10
|
||||
uses: ko-build/setup-ko@v0.9
|
||||
|
||||
- name: Run all tests
|
||||
run: make test-all
|
||||
|
||||
- name: Upload coverage artifacts
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
|
||||
with:
|
||||
name: coverage-report
|
||||
path: |
|
||||
|
|
|
|||
2
.github/workflows/claude.yml
vendored
2
.github/workflows/claude.yml
vendored
|
|
@ -26,7 +26,7 @@ jobs:
|
|||
actions: read
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
||||
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
|
|
|
|||
151
.github/workflows/close-invalid-publish-prs.yml
vendored
151
.github/workflows/close-invalid-publish-prs.yml
vendored
|
|
@ -1,151 +0,0 @@
|
|||
name: Close invalid publish PRs
|
||||
|
||||
# Stage 2 of 2 (see detect-invalid-publish-prs.yml for stage 1).
|
||||
#
|
||||
# Runs in the trusted base-repo context (triggered by workflow_run, not by the
|
||||
# PR itself), so it has a write token. It picks up the PR number flagged by
|
||||
# stage 1 and, after independently re-validating the PR from the API, posts a
|
||||
# comment pointing at the publishing docs, labels it `invalid`, and closes it.
|
||||
#
|
||||
# Trust boundary: the ONLY thing crossing from the untrusted stage is the PR
|
||||
# number (sanitized to digits below). We re-derive every decision (state,
|
||||
# author, changed files) here, so a wrong/stale artifact can never cause us to
|
||||
# close a PR that doesn't actually match.
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["Detect invalid publish PRs"]
|
||||
types: [completed]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
issues: write # labels on PRs go through the issues API
|
||||
actions: read # needed to list/download the stage-1 artifact
|
||||
|
||||
jobs:
|
||||
close:
|
||||
if: github.event.workflow_run.conclusion == 'success'
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
GH_REPO: ${{ github.repository }}
|
||||
RUN_ID: ${{ github.event.workflow_run.id }}
|
||||
COMMENT_BODY: |
|
||||
Hi @__AUTHOR__ 👋 — thanks for your interest in the MCP Registry!
|
||||
|
||||
It looks like this PR is trying to publish an MCP server by adding or editing server files in this repository (under `servers/`, `data/servers/`, or in `data/seed.json`). That isn't how servers get published, so I'm closing this PR automatically.
|
||||
|
||||
**Servers are published with the [`mcp-publisher`](https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/quickstart.mdx) CLI**, not by opening a pull request against this repo. The CLI verifies that you own your namespace and submits your `server.json` directly to the live registry API.
|
||||
|
||||
To publish your server, follow the **[Publishing Quickstart](https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/quickstart.mdx)**. In short:
|
||||
|
||||
```bash
|
||||
# Build the publisher CLI
|
||||
make publisher
|
||||
|
||||
# Authenticate (e.g. via GitHub) and publish your server.json
|
||||
./bin/mcp-publisher login github
|
||||
./bin/mcp-publisher publish
|
||||
```
|
||||
|
||||
Note: `data/seed.json` is seed data for **local development only** — adding entries there does not publish anything to the registry.
|
||||
|
||||
If you believe this was closed in error, please leave a comment and a maintainer will take a look. 🙇
|
||||
|
||||
_This is an automated message._
|
||||
|
||||
steps:
|
||||
- name: Check for flagged-pr artifact
|
||||
id: check
|
||||
run: |
|
||||
set -euo pipefail
|
||||
names="$(gh api "repos/$GH_REPO/actions/runs/$RUN_ID/artifacts" --jq '.artifacts[].name' || true)"
|
||||
if printf '%s\n' "$names" | grep -qx "flagged-pr"; then
|
||||
echo "found=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "No flagged-pr artifact on run $RUN_ID; nothing to do."
|
||||
echo "found=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
- name: Download flagged PR number
|
||||
if: steps.check.outputs.found == 'true'
|
||||
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
||||
with:
|
||||
name: flagged-pr
|
||||
run-id: ${{ github.event.workflow_run.id }}
|
||||
github-token: ${{ github.token }}
|
||||
|
||||
- name: Re-validate and close
|
||||
if: steps.check.outputs.found == 'true'
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
# Sanitize: the only cross-boundary input. Keep digits only.
|
||||
PR_NUMBER="$(tr -dc '0-9' < pr-number.txt)"
|
||||
if [ -z "$PR_NUMBER" ]; then
|
||||
echo "No valid PR number in artifact; skipping."
|
||||
exit 0
|
||||
fi
|
||||
echo "Re-validating PR #$PR_NUMBER"
|
||||
|
||||
state="$(gh pr view "$PR_NUMBER" --json state --jq '.state')"
|
||||
if [ "$state" != "OPEN" ]; then
|
||||
echo "PR #$PR_NUMBER is $state, not OPEN; skipping."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Use the REST endpoint: `gh pr view --json` does not expose an
|
||||
# authorAssociation field, so calling it there exits non-zero and,
|
||||
# under `set -euo pipefail`, aborts the job before we ever close.
|
||||
assoc="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq '.author_association')"
|
||||
case "$assoc" in
|
||||
MEMBER|OWNER|COLLABORATOR)
|
||||
echo "Author association '$assoc' is trusted; skipping."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
# Idempotency: if a maintainer reopens after we labeled it, leave it be.
|
||||
# Capture into a var first so a transient gh failure can't fail open
|
||||
# (an errored fetch piped to grep would otherwise look "not labeled").
|
||||
labels="$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name' || true)"
|
||||
if printf '%s\n' "$labels" | grep -qx "invalid"; then
|
||||
echo "PR #$PR_NUMBER already labeled 'invalid'; skipping."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Paginated REST endpoint (gh pr view --json files caps at 100, no pagination).
|
||||
mapfile -t FILES < <(gh api --paginate "repos/$GH_REPO/pulls/$PR_NUMBER/files" --jq '.[].filename')
|
||||
if [ "${#FILES[@]}" -eq 0 ]; then
|
||||
echo "No files for PR #$PR_NUMBER; skipping."
|
||||
exit 0
|
||||
fi
|
||||
# Keep this list in sync with the copy in stage 1.
|
||||
publish_attempt=0
|
||||
other=0
|
||||
for f in "${FILES[@]}"; do
|
||||
if [[ "$f" == servers/* \
|
||||
|| "$f" == data/servers/* \
|
||||
|| "$f" == data/data/servers/* \
|
||||
|| "$f" =~ ^data/[^/]*server\.json$ \
|
||||
|| "$f" == "data/seed.json" \
|
||||
|| "$f" == "server.json" \
|
||||
|| "$f" == "servers.json" ]]; then
|
||||
publish_attempt=1
|
||||
else
|
||||
other=1
|
||||
fi
|
||||
done
|
||||
if [ "$publish_attempt" -ne 1 ] || [ "$other" -ne 0 ]; then
|
||||
echo "PR #$PR_NUMBER no longer matches the publish-attempt pattern; skipping."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
author="$(gh pr view "$PR_NUMBER" --json author --jq '.author.login')"
|
||||
body="${COMMENT_BODY//__AUTHOR__/$author}"
|
||||
|
||||
echo "Commenting on, labeling, and closing PR #$PR_NUMBER"
|
||||
gh pr comment "$PR_NUMBER" --body "$body"
|
||||
gh pr edit "$PR_NUMBER" --add-label "invalid" || echo "Could not add label; continuing."
|
||||
gh pr close "$PR_NUMBER"
|
||||
8
.github/workflows/deploy-production.yml
vendored
8
.github/workflows/deploy-production.yml
vendored
|
|
@ -23,16 +23,16 @@ jobs:
|
|||
cancel-in-progress: false
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
||||
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
|
||||
|
||||
- name: Setup Go
|
||||
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
|
||||
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5
|
||||
with:
|
||||
go-version: 'stable'
|
||||
go-version-file: 'go.mod'
|
||||
cache: true
|
||||
|
||||
- name: Setup Pulumi
|
||||
uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d
|
||||
uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58
|
||||
with:
|
||||
pulumi-version: ${{ env.PULUMI_VERSION }}
|
||||
|
||||
|
|
|
|||
18
.github/workflows/deploy-staging.yml
vendored
18
.github/workflows/deploy-staging.yml
vendored
|
|
@ -22,19 +22,19 @@ jobs:
|
|||
packages: write
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
||||
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
|
||||
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5
|
||||
with:
|
||||
go-version: 'stable'
|
||||
go-version-file: 'go.mod'
|
||||
cache: true
|
||||
|
||||
- name: Set up ko
|
||||
uses: ko-build/setup-ko@v0.10
|
||||
uses: ko-build/setup-ko@v0.9
|
||||
|
||||
- name: Log in to Container Registry
|
||||
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
|
||||
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
|
|
@ -70,16 +70,16 @@ jobs:
|
|||
cancel-in-progress: false
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
||||
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
|
||||
|
||||
- name: Setup Go
|
||||
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
|
||||
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5
|
||||
with:
|
||||
go-version: 'stable'
|
||||
go-version-file: 'go.mod'
|
||||
cache: true
|
||||
|
||||
- name: Setup Pulumi
|
||||
uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d
|
||||
uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58
|
||||
with:
|
||||
pulumi-version: ${{ env.PULUMI_VERSION }}
|
||||
|
||||
|
|
|
|||
96
.github/workflows/detect-invalid-publish-prs.yml
vendored
96
.github/workflows/detect-invalid-publish-prs.yml
vendored
|
|
@ -1,96 +0,0 @@
|
|||
name: Detect invalid publish PRs
|
||||
|
||||
# Stage 1 of 2 (see close-invalid-publish-prs.yml for stage 2).
|
||||
#
|
||||
# Some contributors try to "publish" a server by opening a PR that adds files
|
||||
# under servers/ or edits data/seed.json. That is not how publishing works -
|
||||
# servers are published with the mcp-publisher CLI against the live registry
|
||||
# API. This job only DETECTS such PRs. It runs from the (untrusted) PR context
|
||||
# with a read-only token, so it cannot comment on or close anything. When it
|
||||
# finds a match it records just the PR number as an artifact; the privileged
|
||||
# stage-2 workflow picks that up via workflow_run and acts on it.
|
||||
#
|
||||
# We never check out or run the PR's code - we only read changed file paths.
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, reopened]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: read
|
||||
|
||||
jobs:
|
||||
detect:
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
GH_REPO: ${{ github.repository }}
|
||||
PR_NUMBER: ${{ github.event.pull_request.number }}
|
||||
AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
|
||||
steps:
|
||||
- name: Classify PR
|
||||
id: classify
|
||||
run: |
|
||||
set -euo pipefail
|
||||
match=false
|
||||
|
||||
# Maintainers may legitimately touch these files (e.g. dev seed data),
|
||||
# so never flag their PRs.
|
||||
case "$AUTHOR_ASSOCIATION" in
|
||||
MEMBER|OWNER|COLLABORATOR)
|
||||
echo "Author association '$AUTHOR_ASSOCIATION' is trusted; not flagging."
|
||||
;;
|
||||
*)
|
||||
# Use the paginated REST endpoint: `gh pr view --json files` caps
|
||||
# at 100 files with no pagination, which could truncate a large PR
|
||||
# and cause a false match.
|
||||
mapfile -t FILES < <(gh api --paginate "repos/$GH_REPO/pulls/$PR_NUMBER/files" --jq '.[].filename')
|
||||
if [ "${#FILES[@]}" -gt 0 ]; then
|
||||
# Flag only if the PR touches *exclusively* publish-attempt files
|
||||
# and nothing else, so that legit PRs touching seed data
|
||||
# alongside real code are left alone.
|
||||
#
|
||||
# Keep this list in sync with the copy in stage 2. It stays an
|
||||
# explicit list rather than a broad `**/server.json` glob:
|
||||
# because we require *every* file to match, an over-broad
|
||||
# pattern would auto-close a legitimate single-file PR.
|
||||
# data/servers/** is here because #1524 put its server.json
|
||||
# there - a natural guess next to data/seed.json - and slipped
|
||||
# through the original servers/**-only list.
|
||||
publish_attempt=0
|
||||
other=0
|
||||
for f in "${FILES[@]}"; do
|
||||
if [[ "$f" == servers/* \
|
||||
|| "$f" == data/servers/* \
|
||||
|| "$f" == data/data/servers/* \
|
||||
|| "$f" =~ ^data/[^/]*server\.json$ \
|
||||
|| "$f" == "data/seed.json" \
|
||||
|| "$f" == "server.json" \
|
||||
|| "$f" == "servers.json" ]]; then
|
||||
publish_attempt=1
|
||||
else
|
||||
echo "Non-publish file changed: $f"
|
||||
other=1
|
||||
fi
|
||||
done
|
||||
if [ "$publish_attempt" -eq 1 ] && [ "$other" -eq 0 ]; then
|
||||
match=true
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
echo "PR #$PR_NUMBER match=$match"
|
||||
echo "match=$match" >> "$GITHUB_OUTPUT"
|
||||
if [ "$match" = "true" ]; then
|
||||
echo "$PR_NUMBER" > pr-number.txt
|
||||
fi
|
||||
|
||||
- name: Record flagged PR number
|
||||
if: steps.classify.outputs.match == 'true'
|
||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
|
||||
with:
|
||||
name: flagged-pr
|
||||
path: pr-number.txt
|
||||
retention-days: 1
|
||||
22
.github/workflows/release.yml
vendored
22
.github/workflows/release.yml
vendored
|
|
@ -14,24 +14,24 @@ jobs:
|
|||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
||||
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
|
||||
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5
|
||||
with:
|
||||
go-version: 'stable'
|
||||
go-version-file: 'go.mod'
|
||||
cache: true
|
||||
|
||||
- name: Install cosign
|
||||
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
|
||||
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
|
||||
|
||||
- name: Install Syft
|
||||
uses: anchore/sbom-action/download-syft@v0.24.2
|
||||
uses: anchore/sbom-action/download-syft@v0.22.2
|
||||
|
||||
- name: Run GoReleaser
|
||||
uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94
|
||||
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a
|
||||
with:
|
||||
distribution: goreleaser
|
||||
version: v2.12.0
|
||||
|
|
@ -45,19 +45,19 @@ jobs:
|
|||
needs: goreleaser
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
||||
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
|
||||
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5
|
||||
with:
|
||||
go-version: 'stable'
|
||||
go-version-file: 'go.mod'
|
||||
cache: true
|
||||
|
||||
- name: Set up ko
|
||||
uses: ko-build/setup-ko@v0.10
|
||||
uses: ko-build/setup-ko@v0.9
|
||||
|
||||
- name: Log in to Container Registry
|
||||
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
|
||||
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
|
|
|
|||
4
.github/workflows/sync-schema.yml
vendored
4
.github/workflows/sync-schema.yml
vendored
|
|
@ -15,10 +15,10 @@ jobs:
|
|||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v7
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: Checkout static repo
|
||||
uses: actions/checkout@v7
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
repository: modelcontextprotocol/static
|
||||
path: static-repo
|
||||
|
|
|
|||
|
|
@ -22,7 +22,7 @@ linters:
|
|||
- gocyclo
|
||||
- godox
|
||||
- gomoddirectives
|
||||
- gomodguard_v2
|
||||
- gomodguard
|
||||
- goprintffuncname
|
||||
- gosec
|
||||
- grouper
|
||||
|
|
@ -55,10 +55,6 @@ linters:
|
|||
max-complexity: 20
|
||||
dupl:
|
||||
threshold: 300
|
||||
goconst:
|
||||
# Repeated literals in tests are fixture data ("1.0.0", "Test server", ...);
|
||||
# hoisting them into constants hurts readability more than it helps.
|
||||
ignore-tests: true
|
||||
gocognit:
|
||||
min-complexity: 51
|
||||
nestif:
|
||||
|
|
@ -70,11 +66,6 @@ linters:
|
|||
- common-false-positives
|
||||
- legacy
|
||||
- std-error-handling
|
||||
rules:
|
||||
# httptest.NewRequest is idiomatic in tests; noctx is not useful there.
|
||||
- path: _test\.go
|
||||
linters:
|
||||
- noctx
|
||||
paths:
|
||||
- third_party$
|
||||
- builtin$
|
||||
|
|
|
|||
0
CHANGES.md
Normal file
0
CHANGES.md
Normal file
|
|
@ -2,9 +2,3 @@
|
|||
_Guidance for Claude Code (claude.ai/code) when working in this repository. If it's also useful to humans (probably most things!), put the instructions in README.md instead._
|
||||
|
||||
Import @README.md
|
||||
|
||||
## Important: Publishing MCP servers
|
||||
|
||||
The `data/seed.json` file is seed data for local development only. Do NOT create pull requests or commits that add server entries to `data/seed.json` as a way to publish a server to the registry.
|
||||
|
||||
To publish an MCP server, use the `mcp-publisher` CLI tool. See `docs/modelcontextprotocol-io/quickstart.mdx` for instructions.
|
||||
|
|
|
|||
|
|
@ -1,40 +0,0 @@
|
|||
# Contributing to the MCP Registry
|
||||
|
||||
Thank you for your interest in contributing!
|
||||
|
||||
## Want to publish an MCP server?
|
||||
|
||||
**Do NOT open a pull request to add your server to `data/seed.json`.**
|
||||
|
||||
The `data/seed.json` file is seed data used only for local development. Modifying it will not publish your server to the registry.
|
||||
|
||||
To publish an MCP server, use the official `mcp-publisher` CLI tool. See the [publishing quickstart guide](docs/modelcontextprotocol-io/quickstart.mdx) for step-by-step instructions.
|
||||
|
||||
## Contributing to the registry codebase
|
||||
|
||||
We welcome contributions to the registry itself! Here's how to get started:
|
||||
|
||||
### Communication channels
|
||||
|
||||
We use multiple channels for collaboration - see [modelcontextprotocol.io/community/communication](https://modelcontextprotocol.io/community/communication).
|
||||
|
||||
Often (but not always) ideas flow through this pipeline:
|
||||
|
||||
- **[Discord](https://modelcontextprotocol.io/community/communication)** - Real-time community discussions
|
||||
- **[Discussions](https://github.com/modelcontextprotocol/registry/discussions)** - Propose and discuss product/technical requirements
|
||||
- **[Issues](https://github.com/modelcontextprotocol/registry/issues)** - Track well-scoped technical work
|
||||
- **[Pull Requests](https://github.com/modelcontextprotocol/registry/pulls)** - Contribute work towards issues
|
||||
|
||||
### Development setup
|
||||
|
||||
See the [README](README.md#quick-start) for prerequisites and instructions on running the server locally.
|
||||
|
||||
### Running checks
|
||||
|
||||
```bash
|
||||
# Run lint, schema validation, and all tests
|
||||
# Note: this also runs `make dev-down`, stopping any running dev-compose environment
|
||||
make check
|
||||
```
|
||||
|
||||
Run `make help` for more available commands.
|
||||
21
README.md
21
README.md
|
|
@ -10,11 +10,11 @@ The MCP registry provides MCP clients with a list of MCP servers, like an app st
|
|||
|
||||
**2025-09-08 update**: The registry has launched in preview 🎉 ([announcement blog post](https://blog.modelcontextprotocol.io/posts/2025-09-08-mcp-registry-preview/)). While the system is now more stable, this is still a preview release and breaking changes or data resets may occur. A general availability (GA) release will follow later. We'd love your feedback in [GitHub discussions](https://github.com/modelcontextprotocol/registry/discussions/new?category=ideas) or in the [#registry-dev Discord](https://discord.com/channels/1358869848138059966/1369487942862504016) ([joining details here](https://modelcontextprotocol.io/community/communication)).
|
||||
|
||||
Registry Working Group:
|
||||
- **Radoslav (Rado) Dimitrov** (Stacklok) [@rdimitrov](https://github.com/rdimitrov) - WG Lead
|
||||
Current key maintainers:
|
||||
- **Adam Jones** (Anthropic) [@domdomegg](https://github.com/domdomegg)
|
||||
- **Tadas Antanavicius** (PulseMCP) [@tadasant](https://github.com/tadasant)
|
||||
- **Bob Dickinson** (TeamSpark) [@BobDickinson](https://github.com/BobDickinson)
|
||||
- **Preeti (Pree) Dewani** (Ravenmail) [@pree-dew](https://github.com/pree-dew)
|
||||
- **Toby Padilla** (GitHub) [@toby](https://github.com/toby)
|
||||
- **Radoslav (Rado) Dimitrov** (Stacklok) [@rdimitrov](https://github.com/rdimitrov)
|
||||
|
||||
## Contributing
|
||||
|
||||
|
|
@ -32,9 +32,9 @@ Often (but not always) ideas flow through this pipeline:
|
|||
#### Pre-requisites
|
||||
|
||||
- **Docker**
|
||||
- **Go** - version per the `go` directive in [go.mod](./go.mod); the Go toolchain fetches it for you
|
||||
- **Go 1.24.x**
|
||||
- **ko** - Container image builder for Go ([installation instructions](https://ko.build/install/))
|
||||
- **golangci-lint** - version per the `golangci-lint-action` pin in [ci.yml](./.github/workflows/ci.yml), so local lint matches CI
|
||||
- **golangci-lint v2.4.0**
|
||||
|
||||
#### Running the server
|
||||
|
||||
|
|
@ -54,7 +54,7 @@ The setup can be configured with environment variables in [docker-compose.yml](.
|
|||
<details>
|
||||
<summary>Alternative: Running a pre-built Docker image</summary>
|
||||
|
||||
Pre-built Docker images are automatically published to GitHub Container Registry. Note that the image does not bundle PostgreSQL, so you need to run your own and point the registry at it via `MCP_REGISTRY_DATABASE_URL` (see [docker-compose.yml](./docker-compose.yml) for a working example):
|
||||
Pre-built Docker images are automatically published to GitHub Container Registry:
|
||||
|
||||
```bash
|
||||
# Run latest stable release
|
||||
|
|
@ -94,8 +94,7 @@ See [the publisher guide](./docs/modelcontextprotocol-io/quickstart.mdx) for mor
|
|||
#### Other commands
|
||||
|
||||
```bash
|
||||
# Run lint, schema validation, and all tests
|
||||
# Note: this also runs `make dev-down`, stopping any running dev-compose environment
|
||||
# Run lint, unit tests and integration tests
|
||||
make check
|
||||
```
|
||||
|
||||
|
|
@ -111,8 +110,7 @@ For Claude and other AI tools: Always prefer make targets over custom commands w
|
|||
|
||||
```
|
||||
├── cmd/ # Application entry points
|
||||
│ ├── publisher/ # Server publishing tool
|
||||
│ └── registry/ # Registry API server
|
||||
│ └── publisher/ # Server publishing tool
|
||||
├── data/ # Seed data
|
||||
├── deploy/ # Deployment configuration (Pulumi)
|
||||
├── docs/ # Documentation
|
||||
|
|
@ -121,7 +119,6 @@ For Claude and other AI tools: Always prefer make targets over custom commands w
|
|||
│ ├── auth/ # Authentication (GitHub OAuth, JWT, namespace blocking)
|
||||
│ ├── config/ # Configuration management
|
||||
│ ├── database/ # Data persistence (PostgreSQL)
|
||||
│ ├── importer/ # Seed data import
|
||||
│ ├── service/ # Business logic
|
||||
│ ├── telemetry/ # Metrics and monitoring
|
||||
│ └── validators/ # Input validation
|
||||
|
|
|
|||
21
SECURITY.md
21
SECURITY.md
|
|
@ -1,21 +0,0 @@
|
|||
# Security Policy
|
||||
|
||||
Thank you for helping keep the Model Context Protocol and its ecosystem secure.
|
||||
|
||||
## Reporting Security Issues
|
||||
|
||||
If you discover a security vulnerability in this repository, please report it through
|
||||
the [GitHub Security Advisory process](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability)
|
||||
for this repository.
|
||||
|
||||
Please **do not** report security vulnerabilities through public GitHub issues, discussions,
|
||||
or pull requests.
|
||||
|
||||
## What to Include
|
||||
|
||||
To help us triage and respond quickly, please include:
|
||||
|
||||
- A description of the vulnerability
|
||||
- Steps to reproduce the issue
|
||||
- The potential impact
|
||||
- Any suggested fixes (optional)
|
||||
|
|
@ -14,20 +14,15 @@ make publisher
|
|||
make dev-compose # Start local registry
|
||||
./bin/mcp-publisher init
|
||||
./bin/mcp-publisher login none --registry=http://localhost:8080
|
||||
./bin/mcp-publisher publish
|
||||
./bin/mcp-publisher publish --registry=http://localhost:8080
|
||||
```
|
||||
|
||||
`publish` takes the registry URL from the token saved by `login`, so it accepts no `--registry`
|
||||
flag — passing one would be read as the `server.json` path.
|
||||
|
||||
## Architecture
|
||||
|
||||
### Commands
|
||||
- **`init`** - Generate server.json templates with auto-detection
|
||||
- **`login`** - Handle authentication (github, dns, http, none)
|
||||
- **`login`** - Handle authentication (github, dns, http, none)
|
||||
- **`publish`** - Validate and upload servers to registry
|
||||
- **`status`** - Update server lifecycle status (active, deprecated, deleted)
|
||||
- **`validate`** - Validate server.json without publishing
|
||||
- **`logout`** - Clear stored credentials
|
||||
|
||||
### Authentication Providers
|
||||
|
|
@ -48,3 +43,4 @@ Optional: enables `dns` and `http` methods to sign out-of-process without direct
|
|||
- **`main.go`** - CLI setup and command routing
|
||||
- **`commands/`** - Command implementations with auto-detection logic
|
||||
- **`auth/`** - Authentication provider implementations
|
||||
- **`build.sh`** - Cross-platform build script
|
||||
|
|
|
|||
|
|
@ -64,8 +64,8 @@ func (d Signer) GetSignedTimestamp(ctx context.Context) (*string, []byte, error)
|
|||
fmt.Fprintln(os.Stdout, "Successfully read the public key from Key Vault.")
|
||||
auth.PrintEcdsaP384KeyInfo(ecdsa.PublicKey{
|
||||
Curve: elliptic.P384(),
|
||||
X: new(big.Int).SetBytes(keyResp.Key.X), //nolint:staticcheck // SA1019: needs crypto/ecdh refactor
|
||||
Y: new(big.Int).SetBytes(keyResp.Key.Y), //nolint:staticcheck // SA1019: needs crypto/ecdh refactor
|
||||
X: new(big.Int).SetBytes(keyResp.Key.X),
|
||||
Y: new(big.Int).SetBytes(keyResp.Key.Y),
|
||||
})
|
||||
|
||||
timestamp := auth.GetTimestamp()
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue