registry/internal/validators/registries/oci_test.go
Gaurav Gosain 2280e4da38
Add GitHub Container Registry (GHCR) support for MCP servers (#439)
This commit implements support for publishing MCP servers to GitHub
Container
Registry (ghcr.io) in addition to the existing Docker Hub support,
addressing
Docker Hub rate limiting concerns as requested in #393.

Key changes:
- Add RegistryURLGHCR constant for https://ghcr.io
- Refactor OCI validation to support multiple container registries with
extensible RegistryConfig system
- Implement registry-agnostic authentication system that handles:
  - Docker Hub token-based authentication via auth.docker.io
  - GHCR token-based authentication via ghcr.io/token service
- Update Accept headers to support OCI image indexes for multi-arch
images
- Extract helper functions to reduce cyclomatic complexity and improve
code maintainability
- Add comprehensive test coverage for both Docker Hub and GHCR scenarios
- Include real image testing with github/github-mcp-server and
nkapila6/mcp-local-rag
- Update publishing documentation with GHCR examples and authentication
details

The implementation maintains backward compatibility with existing Docker
Hub
usage while providing a future-proof architecture for adding additional
container registries. All authentication is now handled through proper
token
services for both registries.

Fixes #393

## Motivation and Context
Docker Hub rate limiting has been causing issues for the MCP registry
when validating OCI images. Adding GHCR support provides an alternative
container registry that many MCP server authors are already using,
reducing the load on Docker Hub and providing more options for the
community.

## How Has This Been Tested?
- All existing unit tests continue to pass
- Added comprehensive test coverage for GHCR scenarios including:
  - Non-existent images (proper error handling)
  - Real images without MCP annotations (github/github-mcp-server)  
  - Real images with proper MCP annotations (nkapila6/mcp-local-rag)
  - Registry URL validation for both supported registries
- Tested authentication flow manually using curl commands
- Verified multi-arch image support with OCI index manifests

## Breaking Changes
None. This is a purely additive change that maintains full backward
compatibility with existing Docker Hub configurations.

## Types of changes
- [x] New feature (non-breaking change which adds functionality)
- [x] Documentation update

## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed

## Additional context
The implementation uses a RegistryConfig struct to abstract
registry-specific details like API endpoints, authentication URLs, and
token services. This design makes it straightforward to add support for
additional container registries in the future (such as AWS ECR, Azure
Container Registry, etc.) by simply adding new cases to the
getRegistryConfig function.

The authentication system properly handles the different token services
used by each registry:
- Docker Hub: auth.docker.io with service=registry.docker.io
- GHCR: ghcr.io/token with service=ghcr.io

Both registries now support the full OCI specification including
multi-arch images via OCI image indexes.
2025-09-17 11:56:52 -07:00

177 lines
5 KiB
Go

package registries_test
import (
"context"
"testing"
"github.com/modelcontextprotocol/registry/internal/validators/registries"
"github.com/modelcontextprotocol/registry/pkg/model"
"github.com/stretchr/testify/assert"
)
func TestValidateOCI_RealPackages(t *testing.T) {
ctx := context.Background()
tests := []struct {
name string
packageName string
version string
serverName string
expectError bool
errorMessage string
registryURL string
}{
{
name: "non-existent image should fail",
packageName: generateRandomImageName(),
version: "latest",
serverName: "com.example/test",
expectError: true,
errorMessage: "not found",
},
{
name: "real image without MCP annotation should fail",
packageName: "nginx", // Popular image without MCP annotation
version: "latest",
serverName: "com.example/test",
expectError: true,
errorMessage: "missing required annotation",
},
{
name: "real image with specific tag without MCP annotation should fail",
packageName: "redis",
version: "7-alpine", // Specific tag
serverName: "com.example/test",
expectError: true,
errorMessage: "missing required annotation",
},
{
name: "namespaced image without MCP annotation should fail",
packageName: "hello-world", // Simple image for testing
version: "latest",
serverName: "com.example/test",
expectError: true,
errorMessage: "missing required annotation",
},
{
name: "real image with correct MCP annotation should pass",
packageName: "domdomegg/airtable-mcp-server",
version: "1.7.2",
serverName: "io.github.domdomegg/airtable-mcp-server", // This should match the annotation
expectError: false,
},
{
name: "GHCR image without MCP annotation should fail",
packageName: "actions/runner", // GitHub's action runner image (real image without MCP annotation)
version: "latest",
serverName: "com.example/test",
expectError: true,
errorMessage: "missing required annotation",
registryURL: model.RegistryURLGHCR,
},
{
name: "real GHCR image without MCP annotation should fail",
packageName: "github/github-mcp-server", // Real GitHub MCP server image
version: "main",
serverName: "io.github.github/github-mcp-server",
expectError: true,
errorMessage: "missing required annotation", // Image exists but lacks MCP annotation
registryURL: model.RegistryURLGHCR,
},
{
name: "GHCR image with correct MCP annotation should pass",
packageName: "nkapila6/mcp-local-rag", // Real MCP server with proper annotation
version: "latest",
serverName: "io.github.nkapila6/mcp-local-rag",
expectError: false,
registryURL: model.RegistryURLGHCR,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
t.Skip("Skipping OCI registry tests because we keep hitting DockerHub rate limits")
pkg := model.Package{
RegistryType: model.RegistryTypeOCI,
RegistryBaseURL: tt.registryURL,
Identifier: tt.packageName,
Version: tt.version,
}
err := registries.ValidateOCI(ctx, pkg, tt.serverName)
if tt.expectError {
assert.Error(t, err)
assert.Contains(t, err.Error(), tt.errorMessage)
} else {
assert.NoError(t, err)
}
})
}
}
func TestValidateOCI_UnsupportedRegistry(t *testing.T) {
ctx := context.Background()
pkg := model.Package{
RegistryType: model.RegistryTypeOCI,
RegistryBaseURL: "https://unsupported-registry.com",
Identifier: "test/image",
Version: "latest",
}
err := registries.ValidateOCI(ctx, pkg, "com.example/test")
assert.Error(t, err)
assert.Contains(t, err.Error(), "registry type and base URL do not match")
assert.Contains(t, err.Error(), "Expected: https://docker.io or https://ghcr.io")
}
func TestValidateOCI_SupportedRegistries(t *testing.T) {
ctx := context.Background()
tests := []struct {
name string
registryURL string
expected bool
}{
{
name: "Docker Hub should be supported",
registryURL: model.RegistryURLDocker,
expected: true,
},
{
name: "GHCR should be supported",
registryURL: model.RegistryURLGHCR,
expected: true,
},
{
name: "Unsupported registry should fail",
registryURL: "https://quay.io",
expected: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
pkg := model.Package{
RegistryType: model.RegistryTypeOCI,
RegistryBaseURL: tt.registryURL,
Identifier: "test/image",
Version: "latest",
}
err := registries.ValidateOCI(ctx, pkg, "com.example/test")
if tt.expected {
// Should not fail immediately on registry validation
// (may fail later due to network/image not found, but not due to unsupported registry)
if err != nil {
assert.NotContains(t, err.Error(), "registry type and base URL do not match")
}
} else {
assert.Error(t, err)
assert.Contains(t, err.Error(), "registry type and base URL do not match")
}
})
}
}