retoor
251c3dc2ba
- wire spec: lifecycle, stdio + Streamable HTTP transports, tools, utilities, legacy SSE, versioning, changelog (14 Tier 1) - client ecosystem: Claude Code/VS Code/Cursor/Codex configs, mcp-remote, Smithery, registries, Glama (12 Tier 1) - security/ops: authorization draft, trust model, poisoning, rug pulls, production hardening (12 Tier 1) + 68 Tier 2 cards - conclusions: minimal stdlib client on 2025-11-25, normalizer + resolver agent for pasted configs/GitHub URLs, untrusted-until- consent trust model; nothing built yet - audit PASS (14 subjects, 797 sources, 32 conclusions)
55 lines
3.4 KiB
Markdown
55 lines
3.4 KiB
Markdown
# Official MCP Registry quickstart
|
|
|
|
## Metadata
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| Institute | Molodetz Institute - Research and Retrieval Division |
|
|
| Subject | mcp-client-support |
|
|
| Document type | Source Dossier |
|
|
| Tier | 1 |
|
|
| Source title | Official MCP Registry quickstart |
|
|
| Source URL | https://modelcontextprotocol.io/registry/quickstart.md |
|
|
| Source publisher / author | MCP maintainers (Anthropic-led) |
|
|
| Source type | documentation |
|
|
| Source date (published) | Unknown, not stated (marked "currently in preview. Breaking changes or data resets may occur.") |
|
|
| Date researched | 2026-10-18 |
|
|
| Researched by | tai (agent), model: Claude Sonnet 5, on behalf of retoor |
|
|
| Research method | gather-subagent direct page fetch, parent synthesis from evidence pack |
|
|
| Confidence | High |
|
|
| Status | Active |
|
|
|
|
## Summary
|
|
|
|
The official MCP Registry quickstart: a metadata-only registry (never artifacts) where npm linkage runs through an `mcpName` field in `package.json` matched by `server.json`, publishing runs through the `mcp-publisher` CLI, and the `server.json` schema (packages, transports, environment variables) forms a machine-readable run contract queryable over a discovery API.
|
|
|
|
## Key findings
|
|
|
|
- "The MCP Registry only hosts metadata, not artifacts. Before publishing... we will publish the MCP server's package to npm": a registry entry points at a real npm/PyPI/etc. package.
|
|
- npm linkage: add `"mcpName": "io.github.my-username/weather"` to `package.json`; "The `name` property in `server.json` **must** match the `mcpName` property"; GitHub auth forces the `io.github.<user>/` namespace.
|
|
- `mcp-publisher` CLI: `init` (generates `server.json`), `login` (GitHub device flow shown), `publish`; install via release tarball or `brew install mcp-publisher`.
|
|
- `server.json` schema includes `$schema`, `name`, `repository.url`, `version`, `packages[]` with `registryType`/`identifier`/`version`/`transport: {type: stdio}` and `environmentVariables[]` (`description`, `isRequired`, `isSecret`, `name`): a machine-readable run contract.
|
|
- Verification/discovery API: `curl "https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.my-username/weather"` returns `{"servers":[...]}`; follow-ups cover other package types, remote servers, DNS auth for custom namespaces.
|
|
|
|
## Pros / strengths
|
|
|
|
- The registry entry is a machine-readable run contract (package id, transport, required and secret env vars), which is exactly what a resolver needs without README scraping.
|
|
- The `mcpName`/`server.json` linkage rule is stated as a MUST, so namespace-to-package mapping is mechanical.
|
|
- Discovery API gives a keyed search endpoint for verification and lookup.
|
|
|
|
## Cons / limitations / caveats
|
|
|
|
- Explicitly "currently in preview. Breaking changes or data resets may occur": anything tai builds on the registry schema or API must tolerate resets.
|
|
- No publish date; preview status means the quickstart itself can change shape.
|
|
- Companion pages (package types, remote servers, authentication) were cited but not opened, so non-npm and remote-server entries are not covered by this dossier.
|
|
|
|
## Relevance to tai
|
|
|
|
First lookup for a GitHub URL: `server.json`/`mcpName` to registry metadata gives package id, transport, and required env vars without scraping READMEs. The preview caveat constrains how hard tai may depend on the API.
|
|
|
|
## Changelog
|
|
|
|
| Date | Change |
|
|
|---|---|
|
|
| 2026-10-18 | Initial dossier created. |
|