registry/tools/validate-examples/main.go
Wolfe-James 685e354b2f
feat: add cargo (crates.io) as a package registry type (#1207)
> **Update — 2026-06-01 (commit 1f3be53)**
>
> - **All @P4ST4S review feedback addressed** — positive-path hermetic
mock + live anchor against `rust-faf-mcp v0.3.1`; 5xx routed as
transient; doc comment qualified. See the [close-out
comment](https://github.com/modelcontextprotocol/registry/pull/1207#issuecomment-4589711057)
for the per-item breakdown.
> - **Runtime-model question RESOLVED** — `package-types.mdx` documents
cargo and MCPB as both first-class Rust MCP distribution paths (cargo
for source-distributed, MCPB for prebuilt-binary). The "Open question"
section below was the original draft framing; the doc now ships the
resolution.
> - **Cargo-specific gotcha discovered and documented** — crates.io
strips HTML comments during README rendering, unlike PyPI/NuGet.
`package-types.mdx` now spells this out so cargo authors don't ship
invisible mcp-name tokens (which is exactly what happened to
`rust-faf-mcp v0.3.0`; fixed in v0.3.1).
> - **Stale reference removed in this update** — the "Out of scope" line
mentioning `docs/guides/publishing/publish-cargo.md` pointed at a path
that doesn't exist. The canonical per-type doc is
`docs/modelcontextprotocol-io/package-types.mdx`; the Cargo section has
been added there directly.
> - **Two real-world Rust MCP servers queued for day-one register**:
`rust-faf-mcp v0.3.1` (live, end-to-end validated by the new live test)
and `perfetto-mcp-rs` ([@0xZOne](https://github.com/0xZOne) in #1055).
> - **Tests:** 19/19 cargo tests pass (16 existing + 2 hermetic + 1 live
anchor). `make validate` clean. `golangci-lint` 0 issues.

---

Adds support for `registryType: cargo` so Rust MCP servers published to
crates.io can be registered through the
documented validation flow rather than the MCPB binary-packaging
workaround. Closes #1055.

  ## Motivation and Context

#1055 noted that crates.io has ~1,800 MCP-related packages with no
direct path into the registry — only the MCPB
binary-packaging workaround. This PR adds first-class support for cargo
as a package registry type: schema +
API surface, validator, integration tests, and a documented example. The
publishing guide
(`docs/guides/publishing/publish-cargo.md`) follows on this branch once
the runtime-model direction in
  **Additional context** is settled.

  ## How Has This Been Tested?

- **`make validate`** — clean. Schema-vs-openapi sync verified; 17/17
examples in `generic-server-json.md`
validate against the schema; `expectedServerJSONCount` bumped 16 → 17 to
match the new Cargo example.
- **`go test ./internal/validators/...`** — passes. 16 cargo validator
sub-cases across 4 test functions, run
  against real crates.io (~2.5s wall):
    - Input validation rejection paths
- Registry-baseURL rejection (4 variants: different host, trailing
slash, http-not-https, subdomain typo)
- Ownership validation against real crates (`serde`, `tokio`, `rand`) —
all correctly rejected for missing
  `mcp-name` token
- Server-name format variations (canonical `io.github.OWNER/REPO`,
multi-hyphen, underscore, numeric suffix)
- **Positive-path test** — gated on `rust-faf-mcp` v0.2.3+ being
published with `mcp-name:
io.github.Wolfe-Jam/rust-faf-mcp` in its README. Reserved as a TODO in
`cargo_test.go`; uncomments to become the
   live anchor once that publish lands.
- **Local `make test-unit`** — not run due to a Go toolchain version
quirk on my workstation (project
auto-downloads 1.26.0; my local `go` is 1.25.6, causing compile
mismatch). CI will exercise the full
  PostgreSQL-backed suite.

  ## Breaking Changes

None. This is an additive change — `cargo` joins the supported
`registryType` enum alongside
`npm`/`pypi`/`nuget`/`oci`/`mcpb`. Existing publishes continue to work
unchanged.

  ## Types of changes

  - [x] New feature (non-breaking change which adds functionality)
- [x] Documentation update (new Cargo example in
`generic-server-json.md`)

  ## Checklist

- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
  - [x] My code follows the repository's style guidelines
  - [x] New and existing tests pass locally
  - [x] I have added appropriate error handling
  - [x] I have added or updated documentation as needed

  ## Additional context

  ### Validator design — two-call retrieval on the documented API

`internal/validators/registries/cargo.go` mirrors the PyPI validator's
README-token approach (substring-match
`mcp-name: <serverName>`), with a two-call retrieval pattern to stay on
the documented public crates.io API:

1. `GET /api/v1/crates/{name}/{version}/readme` returns 200 OK with a
JSON pointer (`{"url":
"https://static.crates.io/readmes/.../...html"}`) — crates.io hands us
the URL rather than emitting a 302.
2. Follow the pointer to the rendered HTML; substring-match for the
token.

The two-call pattern stays on the documented public surface. The CDN URL
layout is observed-stable, but treating
it as the entry point would mean depending on an undocumented path. With
two calls, crates.io controls where
the README lives — if they move it, the metadata endpoint hands us the
new URL.

Missing crates and missing versions surface as **403** from the CDN
(S3's default for missing keys), not 404.
The validator treats any non-200 as "not found" and surfaces the actual
status code in the error message.

  ### Open question — runtime model

Cargo's runtime model is genuinely different from npm/PyPI/NuGet. `cargo
install` is one-time (binary lands on
PATH at `~/.cargo/bin`), not per-invocation like `npx`, `uvx`, or `dnx`
(the new one in .NET 10 SDK Preview 6+).
The new Cargo example in `generic-server-json.md` annotates this
honestly and omits `runtimeHint`.

If a different framing is preferred — e.g. recommending **MCPB**
(prebuilt binary distribution via GitHub
Releases) as the primary path for Rust MCP servers instead of cargo —
happy to adjust the documentation
accordingly. The schema + validator code in this PR is **additive** and
doesn't force a recommendation either
way; a Rust author who chooses cargo can use it, and one who prefers
MCPB still can.

  ### Out of scope (deferred)

- **`docs/guides/publishing/publish-cargo.md`** — follows on this branch
once the runtime-model direction above
  is settled.
- **Publisher CLI `Cargo.toml` autodetect** in
`cmd/publisher/commands/init.go` — separate concern, separate PR.
- **Positive-path validator test** — gated on `rust-faf-mcp` v0.2.3+
publishing as noted in *How Has This Been
  Tested?*.

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
2026-06-03 10:56:43 -04:00

243 lines
7 KiB
Go

// validate-examples validates JSON examples in documentation files
// against both schema.json and Go validators.
package main
import (
"bytes"
"encoding/json"
"fmt"
"log"
"os"
"path/filepath"
"regexp"
"strings"
"github.com/modelcontextprotocol/registry/internal/validators"
apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0"
jsonschema "github.com/santhosh-tekuri/jsonschema/v5"
)
type validationTarget struct {
path string
requireSchema bool
expectedCount *int
}
func main() {
log.SetFlags(0) // Remove timestamp from logs
if err := runValidation(); err != nil {
log.Fatalf("Error: %v", err)
}
}
func runValidation() error {
// Define what we validate and how
expectedServerJSONCount := 17
targets := []validationTarget{
{
path: filepath.Join("docs", "reference", "server-json", "generic-server-json.md"),
requireSchema: false,
expectedCount: &expectedServerJSONCount,
},
{
path: filepath.Join("docs", "modelcontextprotocol-io", "package-types.mdx"),
requireSchema: true,
expectedCount: nil, // No count validation for guide
},
{
path: filepath.Join("docs", "modelcontextprotocol-io", "quickstart.mdx"),
requireSchema: true,
expectedCount: nil, // No count validation for guide
},
{
path: filepath.Join("docs", "modelcontextprotocol-io", "remote-servers.mdx"),
requireSchema: true,
expectedCount: nil, // No count validation for guide
},
}
schemaPath := filepath.Join("docs", "reference", "server-json", "draft", "server.schema.json")
baseSchema, err := compileSchema(schemaPath)
if err != nil {
return fmt.Errorf("failed to compile server.schema.json: %w", err)
}
for _, target := range targets {
if err := validateFile(target, baseSchema); err != nil {
return err
}
log.Println()
}
log.Println("All validations passed!")
return nil
}
func validateFile(target validationTarget, baseSchema *jsonschema.Schema) error {
examples, err := extractExamples(target.path, target.requireSchema)
if err != nil {
return fmt.Errorf("failed to extract examples from %s: %w", target.path, err)
}
log.Printf("Validating %s: found %d examples\n", target.path, len(examples))
if target.expectedCount != nil && len(examples) != *target.expectedCount {
return fmt.Errorf("expected %d examples in %s but found %d - if this is intentional, update expectedCount in tools/validate-examples/main.go",
*target.expectedCount, target.path, len(examples))
}
if len(examples) == 0 {
log.Println(" No examples to validate")
return nil
}
log.Println()
validatedCount := 0
for i, example := range examples {
log.Printf(" Example %d (line %d):", i+1, example.line)
if validateExample(example, baseSchema) {
validatedCount++
}
log.Println()
}
if validatedCount != len(examples) {
return fmt.Errorf("validation failed for %s: expected %d examples to pass but only %d did",
target.path, len(examples), validatedCount)
}
return nil
}
func validateExample(ex example, baseSchema *jsonschema.Schema) bool {
var data any
if err := json.Unmarshal([]byte(ex.content), &data); err != nil {
log.Printf(" ❌ Invalid JSON: %v", err)
return false
}
// Extract server portion if this is a PublishRequest format
serverData := data
publishRequestValid := true
if dataMap, ok := data.(map[string]any); ok {
if server, exists := dataMap["server"]; exists {
// This is a PublishRequest format - validate only expected properties exist
for key := range dataMap {
if key != "server" && key != "x-publisher" {
log.Printf(" Invalid PublishRequest property: ❌ %s (only 'server' and optional 'x-publisher' are allowed)", key)
publishRequestValid = false
}
}
serverData = server
}
}
baseValid := validateAgainstSchema(serverData, baseSchema, "server.schema.json")
goValidatorValid := validateWithObjectValidator(serverData)
// Only count as validated if all validations passed
return publishRequestValid && baseValid && goValidatorValid
}
func validateAgainstSchema(data any, schema *jsonschema.Schema, schemaName string) bool {
if err := schema.Validate(data); err != nil {
log.Printf(" Validating against %s: ❌", schemaName)
log.Printf(" Error: %v", err)
return false
}
log.Printf(" Validating against %s: ✅", schemaName)
return true
}
func validateWithObjectValidator(serverData any) bool {
var serverDetail apiv0.ServerJSON
serverDataBytes, err := json.Marshal(serverData)
if err != nil {
log.Printf(" Validating with Go Validator: ❌")
log.Printf(" Error marshaling server data: %v", err)
return false
}
if err := json.Unmarshal(serverDataBytes, &serverDetail); err != nil {
log.Printf(" Validating with Go Validator: ❌")
log.Printf(" Error unmarshaling to ServerDetail: %v", err)
return false
}
// ValidateServerJSON returns all validation results; using FirstError() to preserve existing behavior
// In future, consider displaying all issues from result.Issues for comprehensive feedback
result := validators.ValidateServerJSON(&serverDetail, validators.ValidationSchemaVersionAndSemantic)
if err := result.FirstError(); err != nil {
log.Printf(" Validating with Go Validator: ❌")
log.Printf(" Error: %v", err)
return false
}
log.Printf(" Validating with Go Validator: ✅")
return true
}
type example struct {
content string
line int
}
func extractExamples(path string, requireSchema bool) ([]example, error) {
data, err := os.ReadFile(path)
if err != nil {
return nil, err
}
content := string(data)
// Regex to match JSON code blocks in markdown
re := regexp.MustCompile("(?s)```json(?: [^\r\n]+)?\r?\n(.*?)\r?\n```")
matches := re.FindAllStringSubmatchIndex(content, -1)
var examples []example
for _, match := range matches {
if len(match) < 4 {
return nil, fmt.Errorf("invalid match - expected at least 4 indices but got %d", len(match))
}
start, end := match[2], match[3]
jsonContent := content[start:end]
// Filter by $schema if required
if requireSchema && !strings.Contains(jsonContent, "$schema") {
continue
}
line := 1 + strings.Count(content[:start], "\n")
examples = append(examples, example{
content: jsonContent,
line: line,
})
}
return examples, nil
}
func compileSchema(path string) (*jsonschema.Schema, error) {
compiler := jsonschema.NewCompiler()
compiler.Draft = jsonschema.Draft7
// For registry-schema.json, we need to register the base schema it references
if strings.Contains(path, "registry-schema.json") {
basePath := filepath.Join(filepath.Dir(path), "server.schema.json")
baseData, err := os.ReadFile(basePath)
if err != nil {
return nil, fmt.Errorf("failed to read base schema: %w", err)
}
// Add the base schema to the compiler with the expected URL
if err := compiler.AddResource("https://static.modelcontextprotocol.io/schemas/2025-09-16/server.schema.json", bytes.NewReader(baseData)); err != nil {
return nil, fmt.Errorf("failed to add base schema resource: %w", err)
}
}
return compiler.Compile(path)
}