registry/internal/validators/registries/nuget.go
Avish Porwal 31e16a18ec
Extra validation for registries (#484)
<!-- Provide a brief summary of your changes -->
Package identifier and version are required for some of the registries
else we won't be able to pull the meta data to validate the packages.

## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
This is in continuation to
https://github.com/modelcontextprotocol/registry/pull/424

## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Unit test.

## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

Co-authored-by: Avish Porwal <avishporwal@microsoft.com>
2025-09-23 23:05:10 +01:00

77 lines
2.3 KiB
Go

package registries
import (
"context"
"errors"
"fmt"
"io"
"net/http"
"strings"
"time"
"github.com/modelcontextprotocol/registry/pkg/model"
)
var (
ErrMissingIdentifierForNuget = errors.New("package identifier is required for NuGet packages")
ErrMissingVersionForNuget = errors.New("package version is required for NuGet packages")
)
// ValidateNuGet validates that a NuGet package contains the correct MCP server name
func ValidateNuGet(ctx context.Context, pkg model.Package, serverName string) error {
// Set default registry base URL if empty
if pkg.RegistryBaseURL == "" {
pkg.RegistryBaseURL = model.RegistryURLNuGet
}
if pkg.Identifier == "" {
return ErrMissingIdentifierForNuget
}
// Validate that the registry base URL matches NuGet exactly
if pkg.RegistryBaseURL != model.RegistryURLNuGet {
return fmt.Errorf("registry type and base URL do not match: '%s' is not valid for registry type '%s'. Expected: %s",
pkg.RegistryBaseURL, model.RegistryTypeNuGet, model.RegistryURLNuGet)
}
client := &http.Client{Timeout: 10 * time.Second}
lowerID := strings.ToLower(pkg.Identifier)
lowerVersion := strings.ToLower(pkg.Version)
if lowerVersion == "" {
return ErrMissingVersionForNuget
}
// Try to get README from the package
readmeURL := fmt.Sprintf("%s/v3-flatcontainer/%s/%s/readme", pkg.RegistryBaseURL, lowerID, lowerVersion)
req, err := http.NewRequestWithContext(ctx, http.MethodGet, readmeURL, nil)
if err != nil {
return fmt.Errorf("failed to create request: %w", err)
}
req.Header.Set("User-Agent", "MCP-Registry-Validator/1.0")
resp, err := client.Do(req)
if err != nil {
return fmt.Errorf("failed to fetch README from NuGet: %w", err)
}
defer resp.Body.Close()
if resp.StatusCode == http.StatusOK {
// Check README content
readmeBytes, err := io.ReadAll(resp.Body)
if err != nil {
return fmt.Errorf("failed to read README content: %w", err)
}
readmeContent := string(readmeBytes)
// Check for mcp-name: format (more specific)
mcpNamePattern := "mcp-name: " + serverName
if strings.Contains(readmeContent, mcpNamePattern) {
return nil // Found as mcp-name: format
}
}
return fmt.Errorf("NuGet package '%s' ownership validation failed. The server name '%s' must appear as 'mcp-name: %s' in the package README. Add it to your package README", pkg.Identifier, serverName, serverName)
}