modelcontextprotocol/registry
Watch
1
0
Fork
You've already forked registry
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
registry/cmd/publisher
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Radoslav Dimitrov 90baa0528f
 fix: store tokens in ~/.config/mcp-publisher/ instead of cwd (#1166) 
## Summary

Fixes #663

- **Security fix**: `mcp-publisher login` no longer writes
`.mcpregistry_github_token` and `.mcpregistry_registry_token` to the
current working directory. GitHub tokens are kept in memory during the
login→exchange flow and cleared immediately after.
- **Token location**: Unified token moved from `~/.mcp_publisher_token`
to `~/.config/mcp-publisher/token.json` (dir 0700, file 0600), following
the convention used by `gh`, `docker`, and `kubectl`.
- **Dead code removed**: `NeedsLogin()` was on the `Provider` interface
but never called — removed from interface and all 4 implementations.
`forceLogin` field also removed.
- **Auth tests added**: 11 new tests for `GitHubATProvider` (package
previously had 0 tests).
- **Test isolation**: `SetupTestToken` now uses `t.TempDir()` +
`t.Setenv("HOME", ...)` instead of writing to real `$HOME`.

### Breaking change

Users must re-login after upgrading (`mcp-publisher login <method>`).
Existing tokens at `~/.mcp_publisher_token` are not auto-migrated.
`logout` cleans up both old and new locations.

## Test plan

- [x] `make check` passes (lint, unit tests, integration tests)
- [x] `mcp-publisher login none` stores token at
`~/.config/mcp-publisher/token.json`
- [x] No `.mcpregistry_*` files created in cwd after login (with
`--token`, `MCP_GITHUB_TOKEN`, or device flow)
- [x] `mcp-publisher publish` reads token from new location
- [x] `mcp-publisher validate` reads registry URL from new location
- [x] `mcp-publisher logout` cleans up new location, legacy
`~/.mcp_publisher_token`, and cwd `.mcpregistry_*` files
- [x] `mcp-publisher logout` when not logged in shows "Not logged in"
- [x] File permissions: dir 0700, file 0600

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-15 03:23:07 -04:00
..
auth fix: store tokens in ~/.config/mcp-publisher/ instead of cwd (#1166) 2026-04-15 03:23:07 -04:00
commands fix: store tokens in ~/.config/mcp-publisher/ instead of cwd (#1166) 2026-04-15 03:23:07 -04:00
main.go Publisher-managed "deleted" support (#893) 2026-02-27 09:00:07 -08:00
README.md Publisher-managed "deleted" support (#893) 2026-02-27 09:00:07 -08:00

README.md

MCP Publisher Tool - Development

CLI tool for publishing MCP servers to the registry.

These docs are for contributors. See the Publisher User Guide for end-user documentation.

Quick Development Setup

# Build the tool
make publisher

# Test locally 
make dev-compose  # Start local registry
./bin/mcp-publisher init
./bin/mcp-publisher login none --registry=http://localhost:8080
./bin/mcp-publisher publish --registry=http://localhost:8080

Architecture

Commands

  • init - Generate server.json templates with auto-detection
  • login - Handle authentication (github, dns, http, none)
  • publish - Validate and upload servers to registry
  • status - Update server lifecycle status (active, deprecated, deleted)
  • logout - Clear stored credentials

Authentication Providers

  • github - Interactive OAuth flow
  • github-oidc - CI/CD with GitHub Actions
  • dns - Domain verification via DNS TXT records
  • http - Domain verification via HTTPS endpoints
  • none - No auth (testing only)

Signing Providers

Optional: enables dns and http methods to sign out-of-process without direct access to the private key.

  • google-kms - Google KMS signing
  • azure-key-vault - Azure Key Vault signing

Key Files

  • main.go - CLI setup and command routing
  • commands/ - Command implementations with auto-detection logic
  • auth/ - Authentication provider implementations
  • build.sh - Cross-platform build script