Skip to content

Publish MCP Registry entry via GitHub OIDC (v1.1.0, docs link fix) - #494

Merged
dodeja merged 3 commits into
mainfrom
cursor/mcp-registry-oidc-publish-c69c
Oct 30, 2026
Merged

dodeja merged 3 commits into
mainfrom
cursor/mcp-registry-oidc-publish-c69c

Conversation

@dodeja

@dodeja dodeja commented Oct 30, 2026 •

Copy link
Copy Markdown
Member

Summary

Updates the official MCP Registry metadata for io.github.Terminal49/terminal49 and publishes it from GitHub Actions on future server.json changes.

  • server.json stays at v1.1.0 (the live registry only has v1.0.0) and sets websiteUrl to https://terminal49.com/docs/mcp/home. That URL returns HTTP 200 with no redirect. mcp-publisher v1.8.1 validate accepts the file, and it matches the schema in $schema.
  • .github/workflows/publish-mcp.yml publishes the root server.json with mcp-publisher login github-oidc and mcp-publisher publish. Permissions are id-token: write and contents: read. It runs on workflow_dispatch and on a push to main that changes server.json. The publisher download is pinned to v1.8.1 and verified with cosign the way the registry GitHub Actions guide pins it. Action SHAs are immutable so tools/security/workflows.test.mjs passes. The job runs only when github.ref is refs/heads/main.
  • packages/mcp/llms-install.md is the Cline marketplace install guide. MCP server runtime code and tools are unchanged.

After merge

Merging this PR pushes server.json to main, which starts Publish to MCP Registry automatically. No registry secret is required: the io.github.Terminal49 namespace is authorized by GitHub OIDC from this organization repository.

  1. Confirm that workflow run succeeds.
  2. If it does not start or it fails, open Actions → Publish to MCP Registry → Run workflow and select main.
  3. Confirm the registry entry is v1.1.0 with websiteUrl https://terminal49.com/docs/mcp/home: https://registry.modelcontextprotocol.io/v0.1/servers/io.github.Terminal49%2Fterminal49/versions

Later metadata edits need a new version in server.json before merge. The registry rejects a second publish of the same version.

Tests

  • mcp-publisher validate server.json (v1.8.1) against registry.modelcontextprotocol.io
  • JSON Schema draft-07 validation of server.json, including URI formats
  • node --test tools/security/workflows.test.mjs (7 passed)

This PR does not run the publish.

Open in Web Open in Cursor 

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need.

RetriggerView in GreptileConfidence Score: 5/5

The PR appears safe to merge; no actionable defects were established.

Summary

Adds automatic publication of the MCP Registry entry and a Cline installation guide.

  • MCP Registry publishing follows metadata changes on main.
  • Cline users can follow a guide to connect to the hosted MCP server.

No actionable issues were established. No workflow or runtime tests were run during this review.

Acknowledgment: dodeja explicitly noted that the registry rejects duplicate versions and documented the need to bump version. Keeping version 1.1.0 is intentional according to the PR description.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A["Push changes to server.json on main"] --> C{"Run is on main?"}
  B["Manual workflow run"] --> C
  C -->|No| D["Skip publication"]
  C -->|Yes| E["Check out repository"]
  E --> F["Download pinned publisher"]
  F --> G["Verify signature with cosign"]
  G --> H["Sign in with GitHub OIDC"]
  H --> I["Publish root server.json"]
Loading

Reviews (1) · Last reviewed commit: "docs: add the Cline install guide and re..." · Reviewed by Greptile

cursoragent and others added 3 commits October 30, 2026 19:35
Point server.json at https://terminal49.com/docs/mcp/home and keep version 1.1.0.

Co-authored-by: Akshay Dodeja <[email protected]>
Add a workflow that verifies mcp-publisher v1.8.1 and publishes server.json on main.

Co-authored-by: Akshay Dodeja <[email protected]>
Record packages/mcp/llms-install.md and point the MCP README at the OIDC workflow.

Co-authored-by: Akshay Dodeja <[email protected]>
@vercel

vercel Bot commented Oct 30, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
api Ready Ready Preview Oct 30, 2026 7:36pm UTC

Request Review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 30, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-30T19:38:43.040594Z ac89af0 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@github-actions github-actions Bot added risk-shadow:high Shadow-only risk signal: high risk:unknown Advisory evidence unavailable or changed; no merge permission labels Oct 30, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Shadow risk calibration

Signal Result Authority
Path classifier risk:high Deterministic advisory policy
heuristic fallback risk-shadow:high Shadow only

Calibration result: agreement.

Shadow risk never blocks or enables merge. Keep it in observation mode until roughly 50 pull requests have human-reviewed labels, then calibrate before considering any policy use.

@github-actions github-actions Bot added risk:high Advisory path risk; current-head human review needed and removed risk:unknown Advisory evidence unavailable or changed; no merge permission labels Oct 30, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ac89af055c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +18 to +20
2. Add this entry under `mcpServers` in Cline's MCP settings file
(`cline_mcp_settings.json`; in the IDE: MCP Servers → Configure →
Configure MCP Servers; CLI: `~/.cline/data/settings/cline_mcp_settings.json`).

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Document Cline's platform-specific config paths

For users or agents editing settings directly—especially on Windows—this step names the file but provides only the Unix-style CLI path and no macOS, Windows, or Linux IDE-extension locations. That leaves the direct-edit installation path incomplete outside the UI, despite the repository's MCP documentation standard requiring all three platform paths; add those locations or make this an explicitly UI-only workflow.

AGENTS.md reference: AGENTS.md:L60-L62

Useful? React with 👍 / 👎.

@@ -0,0 +1,61 @@
name: Publish to MCP Registry

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Split the tooling and documentation changes into separate commits

This commit adds the registry publishing workflow while also changing MCP documentation and registry metadata, so tooling and documentation can no longer be reviewed or reverted independently. Split these changes as required by the repository's commit policy.

AGENTS.md reference: AGENTS.md:L83-L87

Useful? React with 👍 / 👎.

@dodeja
dodeja merged commit b8f9ed6 into main Oct 30, 2026
34 checks passed
@dodeja
dodeja deleted the cursor/mcp-registry-oidc-publish-c69c branch October 30, 2026 21:45

This branch was successfully deployed

1 active deployment
Preview — ac89af05 Deployed Oct 30, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

risk:high Advisory path risk; current-head human review needed risk-shadow:high Shadow-only risk signal: high

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants