db43896209## Summary Follow-up to #1229. Three small doc additions so the new audience requirement is discoverable without reading the source: - `.env.example` lists `MCP_REGISTRY_GITHUB_OIDC_AUDIENCE` alongside the other registry env vars, with a note that the value must match the scheme+host that publishers pass via `--registry`. - The publisher CLI reference (`docs/reference/cli/commands.md`) explains that the CLI derives the audience from `--registry` and that self-hosters must set the matching env var on the registry side. - The GitHub Actions troubleshooting table (`docs/modelcontextprotocol-io/github-actions.mdx`) maps the new `invalid audience` error to the user-facing fix (upgrade `mcp-publisher`). No code changes — docs only. ## Test plan - [ ] CI green (markdown lint / link checks if any) - [ ] Eyeball-render the troubleshooting table on the modelcontextprotocol.io preview to confirm the new row formats correctly 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
48 lines
2.3 KiB
Shell
48 lines
2.3 KiB
Shell
# MCP Registry Configuration
|
|
|
|
# Server configuration
|
|
MCP_REGISTRY_SERVER_ADDRESS=:8080
|
|
MCP_REGISTRY_VERSION=dev
|
|
|
|
# Database configuration
|
|
MCP_REGISTRY_DATABASE_URL=postgres://username:password@localhost:5432/mcp-registry
|
|
|
|
# Path or URL to import seed data (supports local files and HTTP URLs)
|
|
# For offline development, use: data/seed.json
|
|
MCP_REGISTRY_SEED_FROM=https://registry.modelcontextprotocol.io/v0/servers
|
|
|
|
# GitHub OAuth configuration
|
|
# These creds are for local development with the 'MCP Registry Login (Local)' GitHub App
|
|
# They don't provide any real privileged access, hence why it's okay that they're here
|
|
# The staging and prod credentials client secrets are sensitive and are stored in encrypted form in ./deploy
|
|
MCP_REGISTRY_GITHUB_CLIENT_ID=Iv23licy3GSiM9Km5jtd
|
|
MCP_REGISTRY_GITHUB_CLIENT_SECRET=0e8db54879b02c29adef51795586f3c510a9341d
|
|
|
|
# JWT configuration
|
|
# This should be a 32-byte Ed25519 seed (not the full private key). Generate a new seed with: `openssl rand -hex 32`
|
|
MCP_REGISTRY_JWT_PRIVATE_KEY=bb2c6b424005acd5df47a9e2c87f446def86dd740c888ea3efb825b23f7ef47c
|
|
|
|
# Anonymous authentication for development/testing only
|
|
# When enabled, allows anyone to get tokens for publishing to io.modelcontextprotocol.anonymous/* namespace
|
|
# This should be disabled in prod
|
|
MCP_REGISTRY_ENABLE_ANONYMOUS_AUTH=false
|
|
|
|
# GitHub OIDC token exchange (for `mcp-publisher login github-oidc`)
|
|
# Expected `aud` claim on incoming GitHub Actions OIDC tokens. Must equal the
|
|
# scheme + host that publishers pass via `--registry` (e.g. `https://registry.example.com`).
|
|
# The publisher CLI derives the audience from `--registry` automatically; the server
|
|
# rejects all OIDC exchanges if this is unset, so set it on every deployment that
|
|
# accepts GitHub Actions publishes.
|
|
MCP_REGISTRY_GITHUB_OIDC_AUDIENCE=
|
|
|
|
# Google Cloud Identity OIDC configuration for admin access
|
|
# Enable OIDC authentication for @modelcontextprotocol.io admin accounts
|
|
MCP_REGISTRY_OIDC_ENABLED=false
|
|
# Example for Google Cloud Identity issuer
|
|
MCP_REGISTRY_OIDC_ISSUER=https://accounts.google.com
|
|
MCP_REGISTRY_OIDC_CLIENT_ID=1234.apps.googleusercontent.com
|
|
# Require @modelcontextprotocol.io Google Workspace domain
|
|
MCP_REGISTRY_OIDC_EXTRA_CLAIMS=[{"hd":"modelcontextprotocol.io"}]
|
|
# Grant admin permissions to OIDC-authenticated users
|
|
MCP_REGISTRY_OIDC_EDIT_PERMISSIONS=*
|
|
MCP_REGISTRY_OIDC_PUBLISH_PERMISSIONS=*
|