Pull requests

• feat(schema): add package executable to select an npm bin

  #1672·zero-abd opened Sep 26, 2026·

  ·

• docs(auth): document HTTP verification requirements and pin them with tests

  #1640·ump45nose opened Sep 14, 2026·

  ·

• docs: pin and verify mcp-publisher in the GitHub Actions publishing workflow

  #1624·UgaTheDev opened Sep 6, 2026·

  ·
  1

  1

• feat(ui): display server icons in the registry web client

  #1586·tounsils opened Aug 27, 2026·

  ·
  1

  2

• fix(validators): reject invalid argument types and empty positional arguments

  #1583·JosephDoUrden opened Aug 27, 2026Contributor·

  ·
  1

• fix(auth): reject gitlab.io domains in DNS/HTTP token exchange

  #1574·latent-9 opened Aug 26, 2026Contributor·

  ·

• fix(ui): prefer human-readable server title in registry cards

  #1573·RuyaaCapital-admin opened Aug 25, 2026·

  ·

• fix(publisher): record repository.id at init so renames stay resolvable

  #1570·UgaTheDev opened Aug 25, 2026·

  ·
  5

• feat(search): match server descriptions as well as names

  #1565·csitte opened Aug 22, 2026·

  ·
  1

  1

• fix(publish): validate registries outside the transaction and time the pool wait

  #1562·rdimitrov opened Aug 21, 2026Member·

  ·
  3

• fix(validators): reject incomplete repository metadata

  #1555·samrusani opened Aug 20, 2026·

  ·
  1

  1

• fix(validators): name the package version in ownership-failure errors

  #1544·sronix opened Aug 18, 2026Contributor·

  ·
  1

• docs(api): document the raw publish flow for non-CLI publishers

  #1541·fieldproofhq opened Aug 16, 2026·

  ·

• docs: add mcp-server-audit to Community Projects

  #1529·Yveshby27 opened Aug 12, 2026·1 task done·

  ·

• fix(publisher): accept UTF-8 BOM in server.json

  #1528·beeswaxpat opened Aug 11, 2026·

  ·

• docs: state field length limits in the publishing quickstart

  #1526·beeswaxpat opened Aug 11, 2026·

  ·

• docs(security): pin and verify mcp-publisher installer

  #1523·sys-ops-node opened Aug 11, 2026·7 of 9 tasks·

  ·
  1

• fix(api): normalize server $schema to current version on read

  #1515·ousamabenyounes opened Aug 10, 2026·

  ·
  1

• fix(publish): correct misleading org-namespace guidance in 403 and docs

  #1483·rdimitrov opened Jul 27, 2026Member·

  ·
  2

• feat(search): match server description as well as name

  #1471·amitvijapur opened Jul 21, 2026·

  ·
  1

  2

• fix(validators): reject loopback/private/link-local hosts in IsValidRemoteURL

  #1470·amitvijapur opened Jul 21, 2026·

  ·
  1

  6

• fix(publisher): pad ECDSA P-384 signature to fixed width

  #1457·JosephDoUrden opened Jul 16, 2026Contributor·

  ·
  5

• feat(validators): expose config-free validators as an importable pkg/validators library

  #1451·itguruhaseeb opened Jul 16, 2026·

  ·

• fix(schema): upgrade server.json dialect to JSON Schema 2020-12

  #1446·piyushbag opened Jul 15, 2026·2 tasks done·

  ·
  1

• Add optional security-scan receipt _meta extension (v1) — resolves #1273

  #1404·eeee2345 opened Jun 29, 2026·

  ·
  22