Mirror of https://github.com/modelcontextprotocol/registry — A community driven registry service for Model Context Protocol (MCP) servers.
  • Go 92.9%
  • PLpgSQL 3.1%
  • HTML 1.9%
  • Shell 1.6%
  • Makefile 0.5%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Radoslav Dimitrov 43402d8f6f
fix(publisher): document --algorithm for ECDSA login and fix validate --help (#1519)
Two real defects, plus the CLI reference claims that go with them.

## 1. ECDSA P-384 login instructions cannot work

Every "ECDSA P-384" tab ran the *identical* command to the Ed25519 tab.
Since `--algorithm` defaults to ed25519
([login.go:100](https://github.com/modelcontextprotocol/registry/blob/main/cmd/publisher/commands/login.go#L100)),
a 96-hex key is rejected outright. Verified against a freshly generated
P-384 key:

```
$ mcp-publisher login dns --domain=example.com --private-key=$KEY
Signing in process using key algorithm ed25519
Error: failed to get token: failed to sign timestamp: invalid seed length: expected 32 bytes, got 48

$ mcp-publisher login dns --algorithm ecdsap384 --domain=example.com --private-key=$KEY
Signing in process using key algorithm ecdsap384
Expected proof record:                      # works
```

`--algorithm` is registered at
[login.go:129](https://github.com/modelcontextprotocol/registry/blob/main/cmd/publisher/commands/login.go#L129)
and described correctly by the CLI's own help, but `grep -rn algorithm
docs/` had **zero** hits for it. Anyone following the ECDSA path in the
docs hit that error with nothing to tell them why.

Fixed at all four in-process ECDSA sites (2 in `authentication.mdx`, 2
in `cli/commands.md`), with a note that cloud signing providers derive
the algorithm from the key itself so the flag does not apply to them.

## 2. `mcp-publisher validate --help` was broken

```
$ mcp-publisher validate --help
Unknown command: validate
...
Use 'mcp-publisher <command> --help' for more information about a command.
```

It printed the very instruction that had just failed. `main.go`
intercepted `--help` for all subcommands and called `printCommandHelp`,
whose switch had no `validate` case — making `ValidateCommand`'s own
help block
([validate.go:120-129](https://github.com/modelcontextprotocol/registry/blob/main/cmd/publisher/commands/validate.go#L120))
unreachable.

Rather than paste a third copy of the help text, `printCommandHelp` now
returns whether it handled the command, and the caller falls through to
normal dispatch when it did not. Commands own their own `--help`, and
any future command with this shape works automatically.

| Command | Before | After |
|---|---|---|
| `validate --help` | `Unknown command`, exit 0 | prints its help, exit
0 |
| `publish --help` | works | works |
| `init -h` | works | works |
| `bogus --help` | `Unknown command`, exit 0 | `Unknown command`, **exit
1** |

## 3. CLI reference corrections

- **`--registry` is not global.** It exists only on `login`; other
commands read the URL from the stored token. `publish --registry=URL`
silently treats the flag as the `server.json` path.
`cmd/publisher/README.md` had exactly this broken example.
- **`--token` was undocumented** despite `github-actions.mdx:123`
depending on it. Now documented, noting it is `login github` only.
- **`init` takes no flags** and does not prompt; it writes `TODO:`
placeholders. The reference said `init [options]` and "Prompts for
missing required fields".
- **Refreshed the `--help` transcript** in `quickstart.mdx`, which
listed only 4 of 6 commands. Now byte-for-byte identical to real output
(diffed).
- **Added `validate`** to the command list in `cmd/publisher/README.md`.

## Verification

`go build` and `go test ./cmd/...` pass. All four help paths exercised
with exit codes checked. The 23 `goconst` findings in `validate_test.go`
are pre-existing — identical count on pristine `main`, none in
`main.go`. Quickstart transcript diffed against real output.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-10 16:25:00 +03:00
.githooks Add linting documentation and pre-commit hooks (#177) 2025-07-15 09:31:17 -07:00
.github build(deps): bump docker/login-action from 4.4.0 to 4.6.0 in the actions group (#1492) 2026-08-07 01:30:37 +03:00
.vscode Move publisher CLI from tools/ to cmd/ (#326) 2025-08-29 14:45:36 +01:00
cmd fix(publisher): document --algorithm for ECDSA login and fix validate --help (#1519) 2026-08-10 16:25:00 +03:00
data chore: Release server.json schema version 2025-12-11 (#841) 2025-12-12 09:33:57 -08:00
deploy build(deps): bump github.com/go-git/go-git/v6 from 6.0.0-alpha.4 to 6.0.0-alpha.5 in /deploy (#1514) 2026-08-10 15:18:42 +03:00
docs fix(publisher): document --algorithm for ECDSA login and fix validate --help (#1519) 2026-08-10 16:25:00 +03:00
internal docs: add cargo and crates.io to schema examples (#1511) 2026-08-10 15:19:06 +03:00
pkg fix(cargo): harden README fetch, clarify status handling, strengthen tests (#1330) 2026-06-04 17:34:54 -04:00
scripts docs: update API endpoint documentation from /v0/ to /v0.1/ (#802) 2025-12-04 13:02:45 -08:00
tests/integration fix: store tokens in ~/.config/mcp-publisher/ instead of cwd (#1166) 2026-04-15 03:23:07 -04:00
tools fix(admin): use PATCH status endpoints in takedown script and runbook (#1518) 2026-08-10 16:24:06 +03:00
.env.example docs: document GitHub OIDC audience binding for self-hosters and CI users (#1230) 2026-04-29 20:56:53 -04:00
.gitignore Enhanced server.json validation (phase 1) (#636) 2026-01-16 00:49:39 +02:00
.golangci.yml Stop pinning Go to patch versions, use stable in CI (#1137) 2026-04-09 11:57:21 -04:00
.goreleaser.yaml Update Goreleaser and Cosign (#839) 2025-12-11 08:43:57 -08:00
.ko.dockerignore Use ko in favour of docker build (#708) 2025-10-29 15:16:11 +00:00
.ko.yaml Use ko in favour of docker build (#708) 2025-10-29 15:16:11 +00:00
CHANGES.md Added /validate endpoint and modified mcp-publish so that all validation happens there (#896) 2026-02-04 15:52:07 +02:00
CLAUDE.md Add contributing guidelines to prevent seed.json PRs (#1079) 2026-03-22 07:42:18 -07:00
complete.md docs(complete): align publish CLI flags with implementation (closes #767) (#1278) 2026-05-11 09:01:52 -04:00
CONTRIBUTING.md Add contributing guidelines to prevent seed.json PRs (#1079) 2026-03-22 07:42:18 -07:00
docker-compose.yml Use ko in favour of docker build (#708) 2025-10-29 15:16:11 +00:00
go.mod build(deps): bump cloud.google.com/go/kms from 1.32.0 to 1.33.0 (#1491) 2026-08-07 01:30:21 +03:00
go.sum build(deps): bump cloud.google.com/go/kms from 1.32.0 to 1.33.0 (#1491) 2026-08-07 01:30:21 +03:00
LICENSE chore: update licensing to Apache 2.0 for new contributions (#887) 2026-01-13 11:11:20 +02:00
Makefile Ensure tests are failing CI (#840) 2025-12-11 09:56:57 +02:00
README.md docs: remove Tadas as WG Lead (#1493) 2026-08-07 01:29:25 +03:00
SECURITY.md Update SECURITY.md to use GitHub Security Advisories (#977) 2026-02-18 23:36:23 -08:00

MCP Registry

The MCP registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.

📤 Publish my MCP server | ⚡️ Live API docs | 👀 Ecosystem vision | 📖 Full documentation

Development Status

2025-10-24 update: The Registry API has entered an API freeze (v0.1) 🎉. For the next month or more, the API will remain stable with no breaking changes, allowing integrators to confidently implement support. This freeze applies to v0.1 while development continues on v0. We'll use this period to validate the API in real-world integrations and gather feedback to shape v1 for general availability. Thank you to everyone for your contributions and patience—your involvement has been key to getting us here!

2025-09-08 update: The registry has launched in preview 🎉 (announcement blog post). While the system is now more stable, this is still a preview release and breaking changes or data resets may occur. A general availability (GA) release will follow later. We'd love your feedback in GitHub discussions or in the #registry-dev Discord (joining details here).

Registry Working Group:

Contributing

We use multiple channels for collaboration - see modelcontextprotocol.io/community/communication.

Often (but not always) ideas flow through this pipeline:

  • Discord - Real-time community discussions
  • Discussions - Propose and discuss product/technical requirements
  • Issues - Track well-scoped technical work
  • Pull Requests - Contribute work towards issues

Quick start:

Pre-requisites

Running the server

# Start full development environment
make dev-compose

This starts the registry at localhost:8080 with PostgreSQL. The database uses ephemeral storage and is reset each time you restart the containers, ensuring a clean state for development and testing.

Note: The registry uses ko to build container images. The make dev-compose command automatically builds the registry image with ko and loads it into your local Docker daemon before starting the services.

By default, the registry seeds from the production API with a filtered subset of servers (to keep startup fast). This ensures your local environment mirrors production behavior and all seed data passes validation. For offline development you can seed from a file without validation with MCP_REGISTRY_SEED_FROM=data/seed.json MCP_REGISTRY_ENABLE_REGISTRY_VALIDATION=false make dev-compose.

The setup can be configured with environment variables in docker-compose.yml - see .env.example for a reference.

Alternative: Running a pre-built Docker image

Pre-built Docker images are automatically published to GitHub Container Registry. Note that the image does not bundle PostgreSQL, so you need to run your own and point the registry at it via MCP_REGISTRY_DATABASE_URL (see docker-compose.yml for a working example):

# Run latest stable release
docker run -p 8080:8080 ghcr.io/modelcontextprotocol/registry:latest

# Run latest from main branch (continuous deployment)
docker run -p 8080:8080 ghcr.io/modelcontextprotocol/registry:main

# Run specific release version
docker run -p 8080:8080 ghcr.io/modelcontextprotocol/registry:v1.0.0

# Run development build from main branch
docker run -p 8080:8080 ghcr.io/modelcontextprotocol/registry:main-20250906-abc123d

Available tags:

  • Releases: latest, v1.0.0, v1.1.0, etc.
  • Continuous: main (latest main branch build)
  • Development: main-<date>-<sha> (specific commit builds)

Publishing a server

To publish a server, we've built a simple CLI. You can use it with:

# Build the latest CLI
make publisher

# Use it!
./bin/mcp-publisher --help

See the publisher guide for more details.

Other commands

# Run lint, unit tests and integration tests
make check

There are also a few more helpful commands for development. Run make help to learn more, or look in Makefile.

Architecture

Project Structure

├── cmd/                     # Application entry points
│   └── publisher/           # Server publishing tool
├── data/                    # Seed data
├── deploy/                  # Deployment configuration (Pulumi)
├── docs/                    # Documentation
├── internal/                # Private application code
│   ├── api/                 # HTTP handlers and routing
│   ├── auth/                # Authentication (GitHub OAuth, JWT, namespace blocking)
│   ├── config/              # Configuration management
│   ├── database/            # Data persistence (PostgreSQL)
│   ├── service/             # Business logic
│   ├── telemetry/           # Metrics and monitoring
│   └── validators/          # Input validation
├── pkg/                     # Public packages
│   ├── api/                 # API types and structures
│   │   └── v0/              # Version 0 API types
│   └── model/               # Data models for server.json
├── scripts/                 # Development and testing scripts
├── tests/                   # Integration tests
└── tools/                   # CLI tools and utilities
    └── validate-*.sh        # Schema validation tools

Authentication

Publishing supports multiple authentication methods:

  • GitHub OAuth - For publishing by logging into GitHub
  • GitHub OIDC - For publishing from GitHub Actions
  • DNS verification - For proving ownership of a domain and its subdomains
  • HTTP verification - For proving ownership of a domain

The registry validates namespace ownership when publishing. E.g. to publish...:

  • io.github.domdomegg/my-cool-mcp you must login to GitHub as domdomegg, or be in a GitHub Action on domdomegg's repos
  • me.adamjones/my-cool-mcp you must prove ownership of adamjones.me via DNS or HTTP challenge

Community Projects

Check out community projects to explore notable registry-related work created by the community.

More documentation

See the documentation for more details if your question has not been answered here!