Mirror of https://github.com/modelcontextprotocol/registry — A community driven registry service for Model Context Protocol (MCP) servers.
  • Go 92.9%
  • PLpgSQL 3.1%
  • HTML 1.9%
  • Shell 1.6%
  • Makefile 0.5%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
adam jones 5746e7e99b
Remove OIDC authorization flow to fix data race vulnerability (#526)
## Summary

Fixes a concurrent map access vulnerability in the OIDC handler that
could cause remote unauthenticated DoS.

## Changes

- Removed OIDC authorization flow endpoints ( and )
- Removed the unsynchronized  map that caused the data race
- Kept only the OIDC token exchange endpoint ()
- Simplified  by removing OAuth2 flow dependencies

The map was being accessed concurrently by the start (write) and
callback (read/delete) endpoints without synchronization, causing
runtime panics. Since the token exchange flow doesn't require session
state, removing the authorization flow eliminates the vulnerability
entirely.
2025-09-22 13:41:32 +01:00
.githooks Add linting documentation and pre-commit hooks (#177) 2025-07-15 09:31:17 -07:00
.github Set workflow permissions to resolve CodeQL warnings (#474) 2025-09-18 11:22:18 -04:00
.vscode Move publisher CLI from tools/ to cmd/ (#326) 2025-08-29 14:45:36 +01:00
cmd Introduce serverId, rename id to versionId (#465) 2025-09-21 15:00:09 +03:00
data Introduce serverId, rename id to versionId (#465) 2025-09-21 15:00:09 +03:00
deploy docs: add kubectl configuration instructions for GKE access (#514) 2025-09-19 23:04:32 +03:00
docs Introduce serverId, rename id to versionId (#465) 2025-09-21 15:00:09 +03:00
internal Remove OIDC authorization flow to fix data race vulnerability (#526) 2025-09-22 13:41:32 +01:00
pkg Introduce serverId, rename id to versionId (#465) 2025-09-21 15:00:09 +03:00
scripts Introduce serverId, rename id to versionId (#465) 2025-09-21 15:00:09 +03:00
tests/integration Introduce serverId, rename id to versionId (#465) 2025-09-21 15:00:09 +03:00
tools Introduce serverId, rename id to versionId (#465) 2025-09-21 15:00:09 +03:00
.dockerignore fix(docker): ignore local mongo .db during rebuild 2025-05-25 12:41:19 -07:00
.env.example config: remove unused database and logging configuration options (#349) 2025-09-03 16:02:02 +01:00
.gitignore Introduce serverId, rename id to versionId (#465) 2025-09-21 15:00:09 +03:00
.golangci.yml Disable ireturn linter rule (#307) 2025-08-26 15:16:43 +01:00
.goreleaser.yaml Split registry and mcp-publisher into seperate release assets (#377) 2025-09-08 14:06:45 -07:00
CLAUDE.md Consolidate documentation and remove redundancy (#222) 2025-08-06 16:05:07 +01:00
complete.md Fix race conditions in concurrent server publishing (#528) 2025-09-22 12:16:05 +01:00
docker-compose.yml Introduce serverId, rename id to versionId (#465) 2025-09-21 15:00:09 +03:00
Dockerfile Bump Go to 1.25 (#456) 2025-09-12 10:01:40 +00:00
go.mod build(deps): bump go.opentelemetry.io/otel/exporters/prometheus from 0.59.1 to 0.60.0 (#468) 2025-09-13 23:38:36 +03:00
go.sum build(deps): bump go.opentelemetry.io/otel/exporters/prometheus from 0.59.1 to 0.60.0 (#468) 2025-09-13 23:38:36 +03:00
LICENSE Update LICENSE copyright holder to MCP Contributors (#293) 2025-08-21 09:11:42 -06:00
Makefile Introduce Goreleaser (#366) 2025-09-08 11:03:39 -07:00
README.md Fix blog post announcement link (#397) 2025-09-10 06:40:21 -07:00

MCP Registry

The MCP registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.

📤 Publish my MCP server | ⚡️ Live API docs | 👀 Ecosystem vision | 📖 Full documentation

Development Status

2025-09-08 update: The registry has launched in preview 🎉 (announcement blog post). While the system is now more stable, this is still a preview release and breaking changes or data resets may occur. A general availability (GA) release will follow later. We'd love your feedback in GitHub discussions or in the #registry-dev Discord (joining details here).

Current key maintainers:

Contributing

We use multiple channels for collaboration - see modelcontextprotocol.io/community/communication.

Often (but not always) ideas flow through this pipeline:

  • Discord - Real-time community discussions
  • Discussions - Propose and discuss product/technical requirements
  • Issues - Track well-scoped technical work
  • Pull Requests - Contribute work towards issues

Quick start:

Pre-requisites

  • Docker
  • Go 1.24.x
  • golangci-lint v2.4.0

Running the server

# Start full development environment
make dev-compose

This starts the registry at localhost:8080 with PostgreSQL and seed data. It can be configured with environment variables in docker-compose.yml - see .env.example for a reference.

Alternative: Local setup without Docker

Prerequisites:

  • PostgreSQL running locally
  • Go 1.24.x installed
# Build and run locally
make build
make dev-local

The service runs on localhost:8080 by default. This can be configured with environment variables in .env - see .env.example for a reference.

Alternative: Running a pre-built Docker image

Pre-built Docker images are automatically published to GitHub Container Registry:

# Run latest stable release
docker run -p 8080:8080 ghcr.io/modelcontextprotocol/registry:latest

# Run latest from main branch (continuous deployment)
docker run -p 8080:8080 ghcr.io/modelcontextprotocol/registry:main

# Run specific release version
docker run -p 8080:8080 ghcr.io/modelcontextprotocol/registry:v1.0.0

# Run development build from main branch
docker run -p 8080:8080 ghcr.io/modelcontextprotocol/registry:main-20250906-abc123d

Available tags:

  • Releases: latest, v1.0.0, v1.1.0, etc.
  • Continuous: main (latest main branch build)
  • Development: main-<date>-<sha> (specific commit builds)

Publishing a server

To publish a server, we've built a simple CLI. You can use it with:

# Build the latest CLI
make publisher

# Use it!
./bin/mcp-publisher --help

See the publisher guide for more details.

Other commands

# Run lint, unit tests and integration tests
make check

There are also a few more helpful commands for development. Run make help to learn more, or look in Makefile.

Architecture

Project Structure

├── cmd/                     # Application entry points
│   └── publisher/           # Server publishing tool
├── data/                    # Seed data
├── deploy/                  # Deployment configuration (Pulumi)
├── docs/                    # Documentation
├── internal/                # Private application code
│   ├── api/                 # HTTP handlers and routing
│   ├── auth/                # Authentication (GitHub OAuth, JWT, namespace blocking)
│   ├── config/              # Configuration management
│   ├── database/            # Data persistence (PostgreSQL, in-memory)
│   ├── service/             # Business logic
│   ├── telemetry/           # Metrics and monitoring
│   └── validators/          # Input validation
├── pkg/                     # Public packages
│   ├── api/                 # API types and structures
│   │   └── v0/              # Version 0 API types
│   └── model/               # Data models for server.json
├── scripts/                 # Development and testing scripts
├── tests/                   # Integration tests
└── tools/                   # CLI tools and utilities
    └── validate-*.sh        # Schema validation tools

Authentication

Publishing supports multiple authentication methods:

  • GitHub OAuth - For publishing by logging into GitHub
  • GitHub OIDC - For publishing from GitHub Actions
  • DNS verification - For proving ownership of a domain and its subdomains
  • HTTP verification - For proving ownership of a domain

The registry validates namespace ownership when publishing. E.g. to publish...:

  • io.github.domdomegg/my-cool-mcp you must login to GitHub as domdomegg, or be in a GitHub Action on domdomegg's repos
  • me.adamjones/my-cool-mcp you must prove ownership of adamjones.me via DNS or HTTP challenge

More documentation

See the documentation for more details if your question has not been answered here!