Skip to content

fix(validators): adopt boundary-anchored mcp-name match in PyPI and NuGet (behavior change) #1331

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
rdimitrov wants to merge 1 commit into
base: followup/cargo-hardening
Choose a base branch
from
+8 −9
Draft

fix(validators): adopt boundary-anchored mcp-name match in PyPI and NuGet (behavior change) #1331

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions internal/validators/registries/nuget.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,10 +237,10 @@ func validateReadme(ctx context.Context, serverName, lowerID, lowerVersion strin

readmeContent := string(readmeBytes)

// Check for mcp-name: format (more specific)
mcpNamePattern := "mcp-name: " + serverName
if strings.Contains(readmeContent, mcpNamePattern) {
return ValidReadme, nil // Found as mcp-name: format
// Check for the mcp-name: <server-name> ownership token (boundary-anchored
// to avoid prefix confusion — see containsMCPNameToken).
if containsMCPNameToken(readmeContent, serverName) {
return ValidReadme, nil
}

return InvalidReadme, nil
Expand Down
9 changes: 4 additions & 5 deletions internal/validators/registries/pypi.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@ import (
"fmt"
"net/http"
"net/url"
"strings"
"time"

"github.com/modelcontextprotocol/registry/pkg/model"
Expand Down Expand Up @@ -85,10 +84,10 @@ func ValidatePyPI(ctx context.Context, pkg model.Package, serverName string) err
// Check description (README) content
description := pypiResp.Info.Description

// Check for mcp-name: format (more specific)
mcpNamePattern := "mcp-name: " + serverName
if strings.Contains(description, mcpNamePattern) {
return nil // Found as mcp-name: format
// Check for the mcp-name: <server-name> ownership token (boundary-anchored to
// avoid prefix confusion — see containsMCPNameToken).
if containsMCPNameToken(description, serverName) {
return nil
}

return fmt.Errorf("PyPI package '%s' ownership validation failed. The server name '%s' must appear as 'mcp-name: %s' in the package README", pkg.Identifier, serverName, serverName)
Expand Down