registry/internal/validators/schemas/2025-10-11.json
Bob Dickinson fc88cf0870
Enhanced server.json validation (phase 1) (#636)
Added schema validation and support for exhaustive and more detailed
validation to existing validators. Added new `mcp-publisher validate`
command. No change to any existing tests or behavior other than the new
command.

## Motivation and Context

Many currently published servers fail schema validation. Of those that
pass, many have semantic/logical errors or other errors that make them
impossible to configure, or their configuration when applied doesn't
generate correct MCP server configuration (per their own documentation).

To address this, we need better tooling to validate servers and to
inform server publishers of errors, issues, and best practices in a way
that is clear and actionable, both during server development and at time
of publishing.

I have started a discussion about the broader topic:
https://github.com/modelcontextprotocol/registry/discussions/635

There is also a fairly detailed document describing the design,
architecture, implementation, future plans, etc. See [Enhanced
Validation Design](docs/explanations/proposed-enhanced-validation.md)

This PR is the first step in the process of improving validation. It
adds schema validation and updates all existing validators to use a new
model that allows them to track context and return rich and exhaustive
results. This has been done in a way that is backward compatible
(ValidateServerJSON is unchanged as are all existing validation unit
tests).

There is a new `mcp-publisher` command called `validate` that is
currenty the only place that schema validation and enhanced
(exhaustive/rich) validation results are exposed.

### Changes

Internal Validation improvements
- Schema validation has been implemented and is available as an option
in validation methods (defaults to off)
- Existing validators track the JSON path (context) of the attribute
they're evaluating, passing it to any child validators
- Existing validators are exhaustive (return all issues, not failing
fast on the first error)
- Existing validators return rich validation results, including:
  - type (schema, semantic, linter)
  - severity (error, warn, info)
  - path (JSON path to server.json element)
  - reference (to the schema element or rule that triggered the result)
  - message (currently the same as previous error message)

A new `validate` command has been added to `mcp-publisher` so publishers
can evaluate their server.json before publishing
- Includes new schema validation and previous semantic validation
- Shows full details of all issues encountered during validation

### Usage

Given a server.json that looks like this:

```json
{
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-09-29/server.schema.json",
  "name": "io.github.BobDickinson/registry",
  "description": "An MCP server that provides [describe what your server does]",
  "repository": {
    "url": "",
    "source": ""
  },
  "version": "=1.0.0",
  "packages": [
    {
      "registryType": "oci",
      "registryBaseUrl": "https://docker.io",
      "identifier": "registry",
      "version": "1.0.0",
      "transport": {
        "type": "sse"
      },
      "packageArguments": [
        {
          "type": "named",
          "name": "--mode",
          "description": "Operation mode",
          "format": "foo"
        }
      ],
      "environmentVariables": [
        {
          "description": "Your API key for the service",
          "isRequired": true,
          "format": "string",
          "isSecret": true,
          "name": "YOUR_API_KEY"
        }
      ]
    }
  ]
}
```

Run the command: 

`mcp-publisher validate server.json`

Which will produce the output:

```bash
❌ Validation failed with 5 issue(s):

1. [error] packages.0.packageArguments.0.format (schema)
   value must be one of "string", "number", "boolean", "filepath"
   Reference: #/definitions/Input/properties/format/enum from: [#/definitions/ServerDetail]/properties/packages/items/[#/definitions/Package]/properties/packageArguments/items/[#/definitions/Argument]/else/[#/definitions/NamedArgument]/allOf/0/[#/definitions/InputWithVariables]/allOf/0/[#/definitions/Input]/properties/format/enum

2. [error] packages.0.transport (schema)
   missing required fields: 'url'
   Reference: #/definitions/SseTransport/required from: [#/definitions/ServerDetail]/properties/packages/items/[#/definitions/Package]/properties/transport/else/else/[#/definitions/SseTransport]/required

3. [error] repository.url (schema)
   '' has invalid format 'uri'
   Reference: #/definitions/Repository/properties/url/format from: [#/definitions/ServerDetail]/properties/repository/[#/definitions/Repository]/properties/url/format

4. [error] version (semantic)
   version must be a specific version, not a range: "=1.0.0"
   Reference: version-looks-like-range

5. [error] packages[0].transport.url (semantic)
   url is required for sse transport type
   Reference: streamable-transport-url-required

Error: validation failed
```

Note in the results above:
- All errors contain the JSON path of the triggering element from
server.json.
- The first three errors are schema errors detected during schema
validation. The `Reference` provided contains an absolute path to the
schema rule that was violated, followed by the full schema path that
enforced that rule (with $ref redirect values substited and enclosed in
square brackets).
- The error messages provided by the existing semantic validators are
exactly the same as the previous error messages those validators
produced.

In the final solution we would remove semantic validators that are
redundant to schema validation (as in number 5 above). We have the
option to use the structured data produced by schema validation to
replace the generic schema validation message with a more descriptive
message if that is an issue (in particular, if the only argument for an
ad-hoc validator is that is produces a better/cleaner message, we would
just move that message creation code to the schema error result
formatter and special case it as opposed to having a redundant
validator).

### What's Next

If this general direction is supported and this PR is accepted, a fast
follow would include:

- Add new validators (infliuenced by observed issues) for both semantic
errors and best practices
- Require passing schema validation (in addition to improved semantic
validation) in order to publish
- Remove existing validation code that is redundant to schema validation
(ensuring error messages remain intelligible)
- Update validation client code and tests to handle the new rich return
types natively

### Issues

Schema validation requires embedding the `server.schema.json` file into
the validators package via `go:embed`, which is restricted from
embedding files outside of the package. For this reason we copy the
schema file into a schema subdir (via a prep target in the makefile) and
we .gitignore it. I tried cleaning up the copy in the make clean target,
but then the linter would complain about the embed target being missing
if it wasn't there during development. I also considered just checking
in the schema file and assuming a separate workflow for updating the
embedded schema file, but it's not clear what that workflow would be or
how it would be maintained. I'm open to a different approach, but the
schema file does need to be embedded somehow for schema validation to
work.

## How Has This Been Tested?
All existing validation tests pass, new tests implemented and all pass.

## Breaking Changes
No breaking changes, no behavior change except new `validate` command

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [X] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [X] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [X] My code follows the repository's style guidelines
- [X] New and existing tests pass locally
- [X] I have added appropriate error handling
- [X] I have added or updated documentation as needed

---------

Co-authored-by: GitHub Action <action@github.com>
2026-01-16 00:49:39 +02:00

549 lines
20 KiB
JSON

{
"$comment": "This file is auto-generated from docs/reference/api/openapi.yaml. Do not edit manually. Run 'make generate-schema' to update.",
"$id": "https://static.modelcontextprotocol.io/schemas/2025-10-11/server.schema.json",
"$ref": "#/definitions/ServerDetail",
"$schema": "http://json-schema.org/draft-07/schema#",
"definitions": {
"Argument": {
"anyOf": [
{
"$ref": "#/definitions/PositionalArgument"
},
{
"$ref": "#/definitions/NamedArgument"
}
],
"description": "Warning: Arguments construct command-line parameters that may contain user-provided input. This creates potential command injection risks if clients execute commands in a shell environment. For example, a malicious argument value like ';rm -rf ~/Development' could execute dangerous commands. Clients should prefer non-shell execution methods (e.g., posix_spawn) when possible to eliminate injection risks entirely. Where not possible, clients should obtain consent from users or agents to run the resolved command before execution."
},
"Icon": {
"description": "An optionally-sized icon that can be displayed in a user interface.",
"properties": {
"mimeType": {
"description": "Optional MIME type override if the source MIME type is missing or generic. Must be one of: image/png, image/jpeg, image/jpg, image/svg+xml, image/webp.",
"enum": [
"image/png",
"image/jpeg",
"image/jpg",
"image/svg+xml",
"image/webp"
],
"example": "image/png",
"type": "string"
},
"sizes": {
"description": "Optional array of strings that specify sizes at which the icon can be used. Each string should be in WxH format (e.g., '48x48', '96x96') or 'any' for scalable formats like SVG. If not provided, the client should assume that the icon can be used at any size.",
"examples": [
[
"48x48",
"96x96"
],
[
"any"
]
],
"items": {
"pattern": "^(\\d+x\\d+|any)$",
"type": "string"
},
"type": "array"
},
"src": {
"description": "A standard URI pointing to an icon resource. Must be an HTTPS URL. Consumers SHOULD take steps to ensure URLs serving icons are from the same domain as the server or a trusted domain. Consumers SHOULD take appropriate precautions when consuming SVGs as they can contain executable JavaScript.",
"example": "https://example.com/icon.png",
"format": "uri",
"maxLength": 255,
"type": "string"
},
"theme": {
"description": "Optional specifier for the theme this icon is designed for. 'light' indicates the icon is designed to be used with a light background, and 'dark' indicates the icon is designed to be used with a dark background. If not provided, the client should assume the icon can be used with any theme.",
"enum": [
"light",
"dark"
],
"type": "string"
}
},
"required": [
"src"
],
"type": "object"
},
"Input": {
"properties": {
"choices": {
"description": "A list of possible values for the input. If provided, the user must select one of these values.",
"example": [],
"items": {
"type": "string"
},
"type": "array"
},
"default": {
"description": "The default value for the input. This should be a valid value for the input. If you want to provide input examples or guidance, use the `placeholder` field instead.",
"type": "string"
},
"description": {
"description": "A description of the input, which clients can use to provide context to the user.",
"type": "string"
},
"format": {
"default": "string",
"description": "Specifies the input format. Supported values include `filepath`, which should be interpreted as a file on the user's filesystem.\n\nWhen the input is converted to a string, booleans should be represented by the strings \"true\" and \"false\", and numbers should be represented as decimal values.",
"enum": [
"string",
"number",
"boolean",
"filepath"
],
"type": "string"
},
"isRequired": {
"default": false,
"type": "boolean"
},
"isSecret": {
"default": false,
"description": "Indicates whether the input is a secret value (e.g., password, token). If true, clients should handle the value securely.",
"type": "boolean"
},
"placeholder": {
"description": "A placeholder for the input to be displaying during configuration. This is used to provide examples or guidance about the expected form or content of the input.",
"type": "string"
},
"value": {
"description": "The value for the input. If this is not set, the user may be prompted to provide a value. If a value is set, it should not be configurable by end users.\n\nIdentifiers wrapped in `{curly_braces}` will be replaced with the corresponding properties from the input `variables` map. If an identifier in braces is not found in `variables`, or if `variables` is not provided, the `{curly_braces}` substring should remain unchanged.\n",
"type": "string"
}
},
"type": "object"
},
"InputWithVariables": {
"allOf": [
{
"$ref": "#/definitions/Input"
},
{
"properties": {
"variables": {
"additionalProperties": {
"$ref": "#/definitions/Input"
},
"description": "A map of variable names to their values. Keys in the input `value` that are wrapped in `{curly_braces}` will be replaced with the corresponding variable values.",
"type": "object"
}
},
"type": "object"
}
]
},
"KeyValueInput": {
"allOf": [
{
"$ref": "#/definitions/InputWithVariables"
},
{
"properties": {
"name": {
"description": "Name of the header or environment variable.",
"example": "SOME_VARIABLE",
"type": "string"
}
},
"required": [
"name"
],
"type": "object"
}
]
},
"NamedArgument": {
"allOf": [
{
"$ref": "#/definitions/InputWithVariables"
},
{
"properties": {
"isRepeated": {
"default": false,
"description": "Whether the argument can be repeated multiple times.",
"type": "boolean"
},
"name": {
"description": "The flag name, including any leading dashes.",
"example": "--port",
"type": "string"
},
"type": {
"enum": [
"named"
],
"example": "named",
"type": "string"
}
},
"required": [
"type",
"name"
],
"type": "object"
}
],
"description": "A command-line `--flag={value}`."
},
"Package": {
"properties": {
"environmentVariables": {
"description": "A mapping of environment variables to be set when running the package.",
"items": {
"$ref": "#/definitions/KeyValueInput"
},
"type": "array"
},
"fileSha256": {
"description": "SHA-256 hash of the package file for integrity verification. Required for MCPB packages and optional for other package types. Authors are responsible for generating correct SHA-256 hashes when creating server.json. If present, MCP clients must validate the downloaded file matches the hash before running packages to ensure file integrity.",
"example": "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce",
"pattern": "^[a-f0-9]{64}$",
"type": "string"
},
"identifier": {
"description": "Package identifier - either a package name (for registries) or URL (for direct downloads)",
"examples": [
"@modelcontextprotocol/server-brave-search",
"https://github.com/example/releases/download/v1.0.0/package.mcpb"
],
"type": "string"
},
"packageArguments": {
"description": "A list of arguments to be passed to the package's binary.",
"items": {
"$ref": "#/definitions/Argument"
},
"type": "array"
},
"registryBaseUrl": {
"description": "Base URL of the package registry",
"examples": [
"https://registry.npmjs.org",
"https://pypi.org",
"https://docker.io",
"https://api.nuget.org",
"https://github.com",
"https://gitlab.com"
],
"format": "uri",
"type": "string"
},
"registryType": {
"description": "Registry type indicating how to download packages (e.g., 'npm', 'pypi', 'oci', 'nuget', 'mcpb')",
"examples": [
"npm",
"pypi",
"oci",
"nuget",
"mcpb"
],
"type": "string"
},
"runtimeArguments": {
"description": "A list of arguments to be passed to the package's runtime command (such as docker or npx). The `runtimeHint` field should be provided when `runtimeArguments` are present.",
"items": {
"$ref": "#/definitions/Argument"
},
"type": "array"
},
"runtimeHint": {
"description": "A hint to help clients determine the appropriate runtime for the package. This field should be provided when `runtimeArguments` are present.",
"examples": [
"npx",
"uvx",
"docker",
"dnx"
],
"type": "string"
},
"transport": {
"anyOf": [
{
"$ref": "#/definitions/StdioTransport"
},
{
"$ref": "#/definitions/StreamableHttpTransport"
},
{
"$ref": "#/definitions/SseTransport"
}
],
"description": "Transport protocol configuration for the package"
},
"version": {
"description": "Package version. Must be a specific version. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '\u003e=1.2.3', '1.x', '1.*').",
"example": "1.0.2",
"minLength": 1,
"not": {
"const": "latest"
},
"type": "string"
}
},
"required": [
"registryType",
"identifier",
"transport"
],
"type": "object"
},
"PositionalArgument": {
"allOf": [
{
"$ref": "#/definitions/InputWithVariables"
},
{
"anyOf": [
{
"required": [
"valueHint"
]
},
{
"required": [
"value"
]
}
],
"properties": {
"isRepeated": {
"default": false,
"description": "Whether the argument can be repeated multiple times in the command line.",
"type": "boolean"
},
"type": {
"enum": [
"positional"
],
"example": "positional",
"type": "string"
},
"valueHint": {
"description": "An identifier for the positional argument. It is not part of the command line. It may be used by client configuration as a label identifying the argument. It is also used to identify the value in transport URL variable substitution.",
"example": "file_path",
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}
],
"description": "A positional input is a value inserted verbatim into the command line."
},
"Repository": {
"description": "Repository metadata for the MCP server source code. Enables users and security experts to inspect the code, improving transparency.",
"properties": {
"id": {
"description": "Repository identifier from the hosting service (e.g., GitHub repo ID). Owned and determined by the source forge. Should remain stable across repository renames and may be used to detect repository resurrection attacks - if a repository is deleted and recreated, the ID should change. For GitHub, use: gh api repos/\u003cowner\u003e/\u003crepo\u003e --jq '.id'",
"example": "b94b5f7e-c7c6-d760-2c78-a5e9b8a5b8c9",
"type": "string"
},
"source": {
"description": "Repository hosting service identifier. Used by registries to determine validation and API access methods.",
"example": "github",
"type": "string"
},
"subfolder": {
"description": "Optional relative path from repository root to the server location within a monorepo or nested package structure. Must be a clean relative path.",
"example": "src/everything",
"type": "string"
},
"url": {
"description": "Repository URL for browsing source code. Should support both web browsing and git clone operations.",
"example": "https://github.com/modelcontextprotocol/servers",
"format": "uri",
"type": "string"
}
},
"required": [
"url",
"source"
],
"type": "object"
},
"ServerDetail": {
"description": "Schema for a static representation of an MCP server. Used in various contexts related to discovery, installation, and configuration.",
"properties": {
"$schema": {
"description": "JSON Schema URI for this server.json format",
"example": "https://static.modelcontextprotocol.io/schemas/2025-10-11/server.schema.json",
"format": "uri",
"type": "string"
},
"_meta": {
"description": "Extension metadata using reverse DNS namespacing for vendor-specific data",
"properties": {
"io.modelcontextprotocol.registry/publisher-provided": {
"additionalProperties": true,
"description": "Publisher-provided metadata for downstream registries",
"example": {
"buildInfo": {
"commit": "abc123def456",
"pipelineId": "build-789",
"timestamp": "2023-12-01T10:30:00Z"
},
"tool": "publisher-cli",
"version": "1.2.3"
},
"type": "object"
}
},
"type": "object"
},
"description": {
"description": "Clear human-readable explanation of server functionality. Should focus on capabilities, not implementation details.",
"example": "MCP server providing weather data and forecasts via OpenWeatherMap API",
"maxLength": 100,
"minLength": 1,
"type": "string"
},
"icons": {
"description": "Optional set of sized icons that the client can display in a user interface. Clients that support rendering icons MUST support at least the following MIME types: image/png and image/jpeg (safe, universal compatibility). Clients SHOULD also support: image/svg+xml (scalable but requires security precautions) and image/webp (modern, efficient format).",
"items": {
"$ref": "#/definitions/Icon"
},
"type": "array"
},
"name": {
"description": "Server name in reverse-DNS format. Must contain exactly one forward slash separating namespace from server name.",
"example": "io.github.user/weather",
"maxLength": 200,
"minLength": 3,
"pattern": "^[a-zA-Z0-9.-]+/[a-zA-Z0-9._-]+$",
"type": "string"
},
"packages": {
"items": {
"$ref": "#/definitions/Package"
},
"type": "array"
},
"remotes": {
"items": {
"anyOf": [
{
"$ref": "#/definitions/StreamableHttpTransport"
},
{
"$ref": "#/definitions/SseTransport"
}
]
},
"type": "array"
},
"repository": {
"$ref": "#/definitions/Repository",
"description": "Optional repository metadata for the MCP server source code. Recommended for transparency and security inspection."
},
"title": {
"description": "Optional human-readable title or display name for the MCP server. MCP subregistries or clients MAY choose to use this for display purposes.",
"example": "Weather API",
"maxLength": 100,
"minLength": 1,
"type": "string"
},
"version": {
"description": "Version string for this server. SHOULD follow semantic versioning (e.g., '1.0.2', '2.1.0-alpha'). Equivalent of Implementation.version in MCP specification. Non-semantic versions are allowed but may not sort predictably. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '\u003e=1.2.3', '1.x', '1.*').",
"example": "1.0.2",
"maxLength": 255,
"type": "string"
},
"websiteUrl": {
"description": "Optional URL to the server's homepage, documentation, or project website. This provides a central link for users to learn more about the server. Particularly useful when the server has custom installation instructions or setup requirements.",
"example": "https://modelcontextprotocol.io/examples",
"format": "uri",
"type": "string"
}
},
"required": [
"name",
"description",
"version"
],
"type": "object"
},
"SseTransport": {
"properties": {
"headers": {
"description": "HTTP headers to include",
"items": {
"$ref": "#/definitions/KeyValueInput"
},
"type": "array"
},
"type": {
"description": "Transport type",
"enum": [
"sse"
],
"example": "sse",
"type": "string"
},
"url": {
"description": "Server-Sent Events endpoint URL",
"example": "https://mcp-fs.example.com/sse",
"format": "uri",
"type": "string"
}
},
"required": [
"type",
"url"
],
"type": "object"
},
"StdioTransport": {
"properties": {
"type": {
"description": "Transport type",
"enum": [
"stdio"
],
"example": "stdio",
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
},
"StreamableHttpTransport": {
"properties": {
"headers": {
"description": "HTTP headers to include",
"items": {
"$ref": "#/definitions/KeyValueInput"
},
"type": "array"
},
"type": {
"description": "Transport type",
"enum": [
"streamable-http"
],
"example": "streamable-http",
"type": "string"
},
"url": {
"description": "URL template for the streamable-http transport. Variables in {curly_braces} reference argument valueHints, argument names, or environment variable names. After variable substitution, this should produce a valid URI.",
"example": "https://api.example.com/mcp",
"type": "string"
}
},
"required": [
"type",
"url"
],
"type": "object"
}
},
"title": "server.json defining a Model Context Protocol (MCP) server"
}