Files

T

retoor 251c3dc2ba research: mcp-client-support subject (106 sources, 3 conclusions)

- wire spec: lifecycle, stdio + Streamable HTTP transports, tools,
  utilities, legacy SSE, versioning, changelog (14 Tier 1)
- client ecosystem: Claude Code/VS Code/Cursor/Codex configs,
  mcp-remote, Smithery, registries, Glama (12 Tier 1)
- security/ops: authorization draft, trust model, poisoning,
  rug pulls, production hardening (12 Tier 1) + 68 Tier 2 cards
- conclusions: minimal stdlib client on 2025-11-25, normalizer +
  resolver agent for pasted configs/GitHub URLs, untrusted-until-
  consent trust model; nothing built yet
- audit PASS (14 subjects, 797 sources, 32 conclusions)

2026-10-18 19:23:02 +02:00

3.4 KiB

Raw Blame History

Official MCP Registry quickstart

Metadata

Field	Value
Institute	Molodetz Institute - Research and Retrieval Division
Subject	mcp-client-support
Document type	Source Dossier
Tier	1
Source title	Official MCP Registry quickstart
Source URL	https://modelcontextprotocol.io/registry/quickstart.md
Source publisher / author	MCP maintainers (Anthropic-led)
Source type	documentation
Source date (published)	Unknown, not stated (marked "currently in preview. Breaking changes or data resets may occur.")
Date researched	2026-10-18
Researched by	tai (agent), model: Claude Sonnet 5, on behalf of retoor
Research method	gather-subagent direct page fetch, parent synthesis from evidence pack
Confidence	High
Status	Active

Summary

The official MCP Registry quickstart: a metadata-only registry (never artifacts) where npm linkage runs through an mcpName field in package.json matched by server.json, publishing runs through the mcp-publisher CLI, and the server.json schema (packages, transports, environment variables) forms a machine-readable run contract queryable over a discovery API.

Key findings

"The MCP Registry only hosts metadata, not artifacts. Before publishing... we will publish the MCP server's package to npm": a registry entry points at a real npm/PyPI/etc. package.
npm linkage: add "mcpName": "io.github.my-username/weather" to package.json; "The name property in server.json must match the mcpName property"; GitHub auth forces the io.github.<user>/ namespace.
mcp-publisher CLI: init (generates server.json), login (GitHub device flow shown), publish; install via release tarball or brew install mcp-publisher.
server.json schema includes $schema, name, repository.url, version, packages[] with registryType/identifier/version/transport: {type: stdio} and environmentVariables[] (description, isRequired, isSecret, name): a machine-readable run contract.
Verification/discovery API: curl "https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.my-username/weather" returns {"servers":[...]}; follow-ups cover other package types, remote servers, DNS auth for custom namespaces.

Pros / strengths

The registry entry is a machine-readable run contract (package id, transport, required and secret env vars), which is exactly what a resolver needs without README scraping.
The mcpName/server.json linkage rule is stated as a MUST, so namespace-to-package mapping is mechanical.
Discovery API gives a keyed search endpoint for verification and lookup.

Cons / limitations / caveats

Explicitly "currently in preview. Breaking changes or data resets may occur": anything tai builds on the registry schema or API must tolerate resets.
No publish date; preview status means the quickstart itself can change shape.
Companion pages (package types, remote servers, authentication) were cited but not opened, so non-npm and remote-server entries are not covered by this dossier.

Relevance to tai

First lookup for a GitHub URL: server.json/mcpName to registry metadata gives package id, transport, and required env vars without scraping READMEs. The preview caveat constrains how hard tai may depend on the API.

Changelog

Date	Change
2026-10-18	Initial dossier created.

3.4 KiB Raw Blame History