Back to Home
modelcontextprotocol icon

registry

Verified Safe

by modelcontextprotocol

Overview

The MCP registry provides MCP clients with a list of MCP servers, acting as an app store for MCP servers by cataloging their metadata.

Installation

Run Command
make dev-compose

Environment Variables

  • MCP_REGISTRY_DATABASE_URL
  • MCP_REGISTRY_ENVIRONMENT
  • MCP_REGISTRY_GITHUB_CLIENT_ID
  • MCP_REGISTRY_GITHUB_CLIENT_SECRET
  • MCP_REGISTRY_JWT_PRIVATE_KEY
  • MCP_REGISTRY_ENABLE_ANONYMOUS_AUTH
  • MCP_REGISTRY_SEED_FROM
  • MCP_REGISTRY_OIDC_ENABLED
  • MCP_REGISTRY_OIDC_ISSUER
  • MCP_REGISTRY_OIDC_CLIENT_ID
  • MCP_REGISTRY_OIDC_EXTRA_CLAIMS
  • MCP_REGISTRY_OIDC_EDIT_PERMISSIONS
  • MCP_REGISTRY_OIDC_PUBLISH_PERMISSIONS
  • MCP_REGISTRY_ENABLE_REGISTRY_VALIDATION
  • GF_AUTH_GOOGLE_CLIENT_SECRET

Security Notes

The project demonstrates strong security awareness. Hardcoded secrets are explicitly confined to local development configurations (docker-compose.yml defaults), with production deployments leveraging Pulumi's secure secret management (e.g., secure: v1:...). Authentication relies on robust methods like GitHub OAuth/OIDC and cryptographically verified DNS/HTTP challenges, with cloud KMS/Key Vault integration available for key signing. The `mcp-publisher` CLI includes explicit warnings about potential command injection risks if users are not careful with input, showing good transparency. Network communications for external API calls are standard. The server's API itself is a metadata registry, reducing direct execution risks, and includes input validation and size limits for publisher-provided data.

Similar Servers

Stats

Interest Score100
Security Score9
Cost ClassLow
Stars5990
Forks514
Last Update2025-12-05

Tags

KubernetesGoAPIRegistryPostgreSQL