Watch

Joel Verhagen 88c2e1be16

Enable Google KMS and Azure Key Vault for publisher login tool (#696 )

<!-- Provide a brief summary of your changes -->

## Motivation and Context

This allows the private key used for DNS or HTTP based authentication to
be stored securely in a cloud key management system. These services
often provide HSM storage which makes it very hard to leak the private
key.

The full context is described in my design document here:

https://github.com/modelcontextprotocol/registry/issues/482#issuecomment-3437117171

## How Has This Been Tested?

I have tested it against PROD using an Ed25519 key stored in Google KMS.
I have added unit tests. I have tested both ECDSA P-384 and Ed25519 with
Az KV and Google KMS against a locally running server.

## Breaking Changes

None intended.

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

---------

Co-authored-by: adam jones <domdomegg+git@gmail.com>

2025-10-29 13:23:20 +00:00

1.5 KiB

Raw Blame History

MCP Publisher Tool - Development

CLI tool for publishing MCP servers to the registry.

These docs are for contributors. See the Publisher User Guide for end-user documentation.

Quick Development Setup

# Build the tool
make publisher

# Test locally 
make dev-compose  # Start local registry
./bin/mcp-publisher init
./bin/mcp-publisher login none --registry=http://localhost:8080
./bin/mcp-publisher publish --registry=http://localhost:8080

Architecture

Commands

init - Generate server.json templates with auto-detection
login - Handle authentication (github, dns, http, none)
publish - Validate and upload servers to registry
logout - Clear stored credentials

Authentication Providers

github - Interactive OAuth flow
github-oidc - CI/CD with GitHub Actions
dns - Domain verification via DNS TXT records
http - Domain verification via HTTPS endpoints
none - No auth (testing only)

Signing Providers

Optional: enables dns and http methods to sign out-of-process without direct access to the private key.

google-kms - Google KMS signing
azure-key-vault - Azure Key Vault signing

Key Files

main.go - CLI setup and command routing
commands/ - Command implementations with auto-detection logic
auth/ - Authentication provider implementations
build.sh - Cross-platform build script

1.5 KiB Raw Blame History