Catch nested server.json publish PRs and clarify publishing guidance

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
     - name: Run lint
       uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a
       with:
-        version: v2.13.1
+        version: v2.14.0
 
     - name: Validate schemas and examples
       run: make validate

.github/workflows/close-invalid-publish-prs.yml

@@ -34,7 +34,7 @@ jobs:
       COMMENT_BODY: |
         Hi @__AUTHOR__ 👋 — thanks for your interest in the MCP Registry!
 
-        It looks like this PR is trying to publish an MCP server by adding or editing server files in this repository (under `servers/`, `data/servers/`, or in `data/seed.json`). That isn't how servers get published, so I'm closing this PR automatically.
+        It looks like this PR is trying to publish an MCP server by adding or editing server files in this repository (such as `server.json` at any location, files under `servers/` or `data/servers/`, or entries in `data/seed.json`). That isn't how servers get published, so I'm closing this PR automatically.
 
         **Servers are published with the [`mcp-publisher`](https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/quickstart.mdx) CLI**, not by opening a pull request against this repo. The CLI verifies that you own your namespace and submits your `server.json` directly to the live registry API.
 
@@ -131,6 +131,7 @@ jobs:
                || "$f" =~ ^data/[^/]*server\.json$ \
                || "$f" == "data/seed.json" \
                || "$f" == "server.json" \
+               || "$f" == **/server.json \
                || "$f" == "servers.json" ]]; then
               publish_attempt=1
             else

.github/workflows/detect-invalid-publish-prs.yml

@@ -51,10 +51,9 @@ jobs:
                 # and nothing else, so that legit PRs touching seed data
                 # alongside real code are left alone.
                 #
-                # Keep this list in sync with the copy in stage 2. It stays an
-                # explicit list rather than a broad `**/server.json` glob:
-                # because we require *every* file to match, an over-broad
-                # pattern would auto-close a legitimate single-file PR.
+                # Keep this list in sync with the copy in stage 2.
+                # Match server.json at any depth, including namespace paths
+                # like io.quickbrew/mcp-server/server.json from #1698.
                 # data/servers/** is here because #1524 put its server.json
                 # there - a natural guess next to data/seed.json - and slipped
                 # through the original servers/**-only list.
@@ -67,6 +66,7 @@ jobs:
                      || "$f" =~ ^data/[^/]*server\.json$ \
                      || "$f" == "data/seed.json" \
                      || "$f" == "server.json" \
+                     || "$f" == **/server.json \
                      || "$f" == "servers.json" ]]; then
                     publish_attempt=1
                   else

AGENTS.md

@@ -0,0 +1 @@
+CLAUDE.md

CLAUDE.md

@@ -5,6 +5,8 @@ Import @README.md
 
 ## Important: Publishing MCP servers
 
+Publishing an MCP server does NOT happen through a pull request to this repository. Do NOT create a PR that adds a `server.json` or a server directory anywhere in this repository to publish or list a server, including under a namespace such as `io.example/my-server/server.json`. Even merging such a PR would not publish the server.
+
 The `data/seed.json` file is seed data for local development only. Do NOT create pull requests or commits that add server entries to `data/seed.json` as a way to publish a server to the registry.
 
-To publish an MCP server, use the `mcp-publisher` CLI tool. See `docs/modelcontextprotocol-io/quickstart.mdx` for instructions.
+To publish an MCP server, use the `mcp-publisher` CLI tool from the server's own project. See `docs/modelcontextprotocol-io/quickstart.mdx` for instructions. Pull requests here are for changes to the registry's code, documentation, and development fixtures.

README.md

@@ -79,6 +79,8 @@ docker run -p 8080:8080 ghcr.io/modelcontextprotocol/registry:main-20250906-abc1
 
 #### Publishing a server
 
+Publishing an MCP server does **not** happen through a pull request to this repository. Adding a `server.json`, a server directory, or an entry in `data/seed.json` will not publish or list your server, even if the PR is merged. Use the `mcp-publisher` CLI from your server's own project instead.
+
 To publish a server, we've built a simple CLI. You can use it with:
 
 ```bash

go.mod

@@ -71,7 +71,7 @@ require (
 	go.opentelemetry.io/otel/trace v1.47.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/crypto v0.57.0 // indirect
-	golang.org/x/net v0.59.0 // indirect
+	golang.org/x/net v0.60.0 // indirect
 	golang.org/x/oauth2 v0.37.0 // indirect
 	golang.org/x/sync v0.23.0 // indirect
 	golang.org/x/sys v0.48.0 // indirect

go.sum

@@ -168,8 +168,8 @@ golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
 golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
 golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
-golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
-golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
 golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
 golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=