From 02697bc10d0e4d7020b96036b12f982df07617f4 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sun, 11 Oct 2026 22:54:20 +0300 Subject: [PATCH 1/4] Catch nested server.json publish PRs and clarify publishing guidance --- .github/workflows/close-invalid-publish-prs.yml | 3 ++- .github/workflows/detect-invalid-publish-prs.yml | 8 ++++---- CLAUDE.md | 4 +++- README.md | 2 ++ 4 files changed, 11 insertions(+), 6 deletions(-) diff --git a/.github/workflows/close-invalid-publish-prs.yml b/.github/workflows/close-invalid-publish-prs.yml index 53ce498f7..3286e8b66 100644 --- a/.github/workflows/close-invalid-publish-prs.yml +++ b/.github/workflows/close-invalid-publish-prs.yml @@ -34,7 +34,7 @@ jobs: COMMENT_BODY: | Hi @__AUTHOR__ 👋 — thanks for your interest in the MCP Registry! - It looks like this PR is trying to publish an MCP server by adding or editing server files in this repository (under `servers/`, `data/servers/`, or in `data/seed.json`). That isn't how servers get published, so I'm closing this PR automatically. + It looks like this PR is trying to publish an MCP server by adding or editing server files in this repository (such as `server.json` at any location, files under `servers/` or `data/servers/`, or entries in `data/seed.json`). That isn't how servers get published, so I'm closing this PR automatically. **Servers are published with the [`mcp-publisher`](https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/quickstart.mdx) CLI**, not by opening a pull request against this repo. The CLI verifies that you own your namespace and submits your `server.json` directly to the live registry API. @@ -131,6 +131,7 @@ jobs: || "$f" =~ ^data/[^/]*server\.json$ \ || "$f" == "data/seed.json" \ || "$f" == "server.json" \ + || "$f" == **/server.json \ || "$f" == "servers.json" ]]; then publish_attempt=1 else diff --git a/.github/workflows/detect-invalid-publish-prs.yml b/.github/workflows/detect-invalid-publish-prs.yml index 816e169fc..5f7894c46 100644 --- a/.github/workflows/detect-invalid-publish-prs.yml +++ b/.github/workflows/detect-invalid-publish-prs.yml @@ -51,10 +51,9 @@ jobs: # and nothing else, so that legit PRs touching seed data # alongside real code are left alone. # - # Keep this list in sync with the copy in stage 2. It stays an - # explicit list rather than a broad `**/server.json` glob: - # because we require *every* file to match, an over-broad - # pattern would auto-close a legitimate single-file PR. + # Keep this list in sync with the copy in stage 2. + # Match server.json at any depth, including namespace paths + # like io.quickbrew/mcp-server/server.json from #1698. # data/servers/** is here because #1524 put its server.json # there - a natural guess next to data/seed.json - and slipped # through the original servers/**-only list. @@ -67,6 +66,7 @@ jobs: || "$f" =~ ^data/[^/]*server\.json$ \ || "$f" == "data/seed.json" \ || "$f" == "server.json" \ + || "$f" == **/server.json \ || "$f" == "servers.json" ]]; then publish_attempt=1 else diff --git a/CLAUDE.md b/CLAUDE.md index 8e8969e45..8aab6a517 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -5,6 +5,8 @@ Import @README.md ## Important: Publishing MCP servers +Publishing an MCP server does NOT happen through a pull request to this repository. Do NOT create a PR that adds a `server.json` or a server directory anywhere in this repository to publish or list a server, including under a namespace such as `io.example/my-server/server.json`. Even merging such a PR would not publish the server. + The `data/seed.json` file is seed data for local development only. Do NOT create pull requests or commits that add server entries to `data/seed.json` as a way to publish a server to the registry. -To publish an MCP server, use the `mcp-publisher` CLI tool. See `docs/modelcontextprotocol-io/quickstart.mdx` for instructions. +To publish an MCP server, use the `mcp-publisher` CLI tool from the server's own project. See `docs/modelcontextprotocol-io/quickstart.mdx` for instructions. Pull requests here are for changes to the registry's code, documentation, and development fixtures. diff --git a/README.md b/README.md index 817836501..7f6f19674 100644 --- a/README.md +++ b/README.md @@ -79,6 +79,8 @@ docker run -p 8080:8080 ghcr.io/modelcontextprotocol/registry:main-20250906-abc1 #### Publishing a server +Publishing an MCP server does **not** happen through a pull request to this repository. Adding a `server.json`, a server directory, or an entry in `data/seed.json` will not publish or list your server, even if the PR is merged. Use the `mcp-publisher` CLI from your server's own project instead. + To publish a server, we've built a simple CLI. You can use it with: ```bash From af3c8f8d94a52ae6939a04440656c1922fbee911 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sun, 11 Oct 2026 23:07:31 +0300 Subject: [PATCH 2/4] Update golangci-lint for the current Go toolchain --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4e4220739..172cf7339 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,7 +27,7 @@ jobs: - name: Run lint uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a with: - version: v2.13.1 + version: v2.14.0 - name: Validate schemas and examples run: make validate From 1eeb12d2d24226985922c363f7da09402b187aa2 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sun, 11 Oct 2026 23:09:25 +0300 Subject: [PATCH 3/4] Update x/net to resolve CI vulnerability findings --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index e21fa6fca..f14c7e180 100644 --- a/go.mod +++ b/go.mod @@ -71,7 +71,7 @@ require ( go.opentelemetry.io/otel/trace v1.47.0 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect golang.org/x/crypto v0.57.0 // indirect - golang.org/x/net v0.59.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/oauth2 v0.37.0 // indirect golang.org/x/sync v0.23.0 // indirect golang.org/x/sys v0.48.0 // indirect diff --git a/go.sum b/go.sum index 2b8e6d461..b5a54031d 100644 --- a/go.sum +++ b/go.sum @@ -168,8 +168,8 @@ golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98= golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= From 16fa02f6436153c37069d6b67c7b213175915112 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sun, 11 Oct 2026 23:12:27 +0300 Subject: [PATCH 4/4] Alias AGENTS.md to shared Claude guidance --- AGENTS.md | 1 + 1 file changed, 1 insertion(+) create mode 120000 AGENTS.md diff --git a/AGENTS.md b/AGENTS.md new file mode 120000 index 000000000..681311eb9 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1 @@ +CLAUDE.md \ No newline at end of file