316cbb08eeFixes #270 Closes #233 Adds support for DNS-based authentication for proving ownership of a particular domain. E.g. if you can add a TXT record to `anthropic.com`, you can publish anything at `com.anthropic/*` or `com.anthropic.*`. Notes: - Uses Ed25519 signatures with 15-second timestamp windows to prevent replay attacks - Supports multiple public keys in DNS TXT records for key rotation scenarios - Publisher CLI supports DNS auth via --dns-domain and --dns-private-key flags - Includes key generation commands in publisher README for easy setup ## Motivation and Context This implements DNS-based public/private key authentication to allow people to actually publish at their own domains. Currently, authentication requires GitHub accounts which limits publishing to the io.github.* namespace. DNS-based auth enables: - Publishing under your actual domain (e.g., com.anthropic/* for anthropic.com) - Independence from GitHub or other external auth providers - Organizations managing their own keys and access to publishing ## How Has This Been Tested? - Unit tests cover signature verification, DNS TXT parsing, timestamp validation, and error cases - Tested locally by editing my own DNS records - All existing auth methods covered by passing tests ## Breaking Changes None ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply. --> - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Additional context Will be adding HTTP challenge auth in a similar way as a separate PR, e.g. for verifying you own `github.com` by hosting a `github.com/.well-known/mcp-server-challenge` or similar. Just mentioning this as we discussed HTTP challenges as closely related to DNS challenges elsewhere, and want to reassure reviewer that this hasn't been forgotten with this approach. :) Update: tracking the HTTP auth in https://github.com/modelcontextprotocol/registry/issues/280
25 lines
714 B
Go
25 lines
714 B
Go
package auth
|
|
|
|
import (
|
|
"github.com/danielgtaylor/huma/v2"
|
|
"github.com/modelcontextprotocol/registry/internal/config"
|
|
)
|
|
|
|
// RegisterAuthEndpoints registers all authentication endpoints
|
|
func RegisterAuthEndpoints(api huma.API, cfg *config.Config) {
|
|
// Register GitHub access token authentication endpoint
|
|
RegisterGitHubATEndpoint(api, cfg)
|
|
|
|
// Register GitHub OIDC authentication endpoint
|
|
RegisterGitHubOIDCEndpoint(api, cfg)
|
|
|
|
// Register DNS-based authentication endpoint
|
|
RegisterDNSEndpoint(api, cfg)
|
|
|
|
// Register anonymous authentication endpoint
|
|
RegisterNoneEndpoint(api, cfg)
|
|
|
|
// Future auth providers can be registered here:
|
|
// RegisterGitLabEndpoint(api, cfg)
|
|
// RegisterOIDCEndpoint(api, cfg)
|
|
}
|