1 name: MCP Registry Release
2
3 on:
4 workflow_dispatch:
5 inputs:
6 version:
7 description: "Override the version in server.json (e.g. 0.2.0); leave blank to publish as-is"
8 required: false
9
10 # A remote server proves namespace ownership through domain (DNS) verification,
11 # not GitHub OIDC: the registry checks a v=MCPv1 TXT record on sigit.si against
12 # a request signed with the matching Ed25519 private key. See the MCP Registry
13 # doc in the sigit-si repo for the one-time key/DNS setup.
14 permissions:
15 contents: read
16
17 jobs:
18 publish:
19 name: Publish server.json to the MCP Registry
20 runs-on: ubuntu-latest
21 steps:
22 - name: Checkout
23 uses: actions/checkout@v6
24
25 - name: Optionally override the version in server.json
26 shell: bash
27 run: |
28 version="${{ github.event.inputs.version }}"
29 if [ -n "${version}" ]; then
30 jq --arg v "${version}" '.version = $v' server.json > server.tmp
31 mv server.tmp server.json
32 fi
33 cat server.json
34
35 - name: Check the remote URL matches the namespace domain
36 shell: bash
37 run: |
38 # The registry rejects a remote server whose URL isn't under the
39 # namespace's domain. si.sigit -> sigit.si, so every listed remote
40 # must live on sigit.si (or a subdomain).
41 server_name="$(jq -r '.name' server.json)"
42 domain="$(echo "${server_name%%/*}" | awk -F. '{ for (i=NF; i>=1; i--) printf "%s%s", $i, (i>1 ? "." : "") }')"
43 echo "Server: ${server_name} Domain: ${domain}"
44
45 bad="$(jq -r --arg d "${domain}" '
46 .remotes // []
47 | map(.url | sub("^[a-z]+://"; "") | sub("/.*$"; ""))
48 | map(select(. != $d and (endswith("." + $d) | not)))
49 | .[]' server.json)"
50 if [ -n "${bad}" ]; then
51 echo "Remote URL host(s) not under ${domain}: ${bad}" >&2
52 exit 1
53 fi
54
55 - name: Install mcp-publisher
56 shell: bash
57 run: |
58 curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
59
60 - name: Authenticate to the MCP Registry
61 shell: bash
62 env:
63 MCP_REGISTRY_DNS_PRIVATE_KEY: ${{ secrets.MCP_REGISTRY_DNS_PRIVATE_KEY }}
64 run: |
65 if [ -z "${MCP_REGISTRY_DNS_PRIVATE_KEY}" ]; then
66 echo "MCP_REGISTRY_DNS_PRIVATE_KEY secret is not set. See the MCP Registry doc in the sigit-si repo." >&2
67 exit 1
68 fi
69 ./mcp-publisher login dns --domain=sigit.si --private-key="${MCP_REGISTRY_DNS_PRIVATE_KEY}"
70
71 - name: Publish
72 shell: bash
73 run: ./mcp-publisher publish
74
75 - name: Verify the server is listed
76 shell: bash
77 run: |
78 server_name="$(jq -r '.name' server.json)"
79 curl -fsSL "https://registry.modelcontextprotocol.io/v0.1/servers?search=${server_name}" | jq .