modelcontextprotocol/registry
Watch
1
0
Fork
You've already forked registry
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
registry/cmd/publisher
History
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Radoslav Dimitrov 3f89fc2b1f
 auth: bind GitHub OIDC token exchange to a per-deployment audience (#1229) 
## What this does

The publisher CLI now derives the OIDC audience to request from the
`--registry` URL instead of using a fixed constant, and the server
validates the token's `aud` claim against a new per-deployment env var
(`MCP_REGISTRY_GITHUB_OIDC_AUDIENCE`).

Production sets this env var to
`https://registry.modelcontextprotocol.io` (and per-environment URL
elsewhere), so the deployment only accepts tokens that were requested
for it.

## Compatibility

This is a breaking change for older `mcp-publisher` binaries that still
request the legacy hardcoded audience. After this rolls to a deployment,
users on old `mcp-publisher` will see a clear `invalid audience:
expected …, got […]` error and need to upgrade. Users following the
documented `releases/latest` install pattern get the new binary
automatically.

## Test plan

- [ ] CI green
- [ ] Run a synthetic publish from a real GitHub Actions workflow
against staging after deploy
- [ ] Confirm an older `mcp-publisher` against the same staging deploy
returns the expected `invalid audience` error

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-29 20:27:26 -04:00
..
auth auth: bind GitHub OIDC token exchange to a per-deployment audience (#1229) 2026-04-29 20:27:26 -04:00
commands fix(publisher): honor mcpName as the authoritative server name in init (#1195) 2026-04-25 07:14:11 -07:00
main.go Publisher-managed "deleted" support (#893) 2026-02-27 09:00:07 -08:00
README.md Publisher-managed "deleted" support (#893) 2026-02-27 09:00:07 -08:00

README.md

MCP Publisher Tool - Development

CLI tool for publishing MCP servers to the registry.

These docs are for contributors. See the Publisher User Guide for end-user documentation.

Quick Development Setup

# Build the tool
make publisher

# Test locally 
make dev-compose  # Start local registry
./bin/mcp-publisher init
./bin/mcp-publisher login none --registry=http://localhost:8080
./bin/mcp-publisher publish --registry=http://localhost:8080

Architecture

Commands

  • init - Generate server.json templates with auto-detection
  • login - Handle authentication (github, dns, http, none)
  • publish - Validate and upload servers to registry
  • status - Update server lifecycle status (active, deprecated, deleted)
  • logout - Clear stored credentials

Authentication Providers

  • github - Interactive OAuth flow
  • github-oidc - CI/CD with GitHub Actions
  • dns - Domain verification via DNS TXT records
  • http - Domain verification via HTTPS endpoints
  • none - No auth (testing only)

Signing Providers

Optional: enables dns and http methods to sign out-of-process without direct access to the private key.

  • google-kms - Google KMS signing
  • azure-key-vault - Azure Key Vault signing

Key Files

  • main.go - CLI setup and command routing
  • commands/ - Command implementations with auto-detection logic
  • auth/ - Authentication provider implementations
  • build.sh - Cross-platform build script