Documentation
¶
Overview ¶
Package registries holds the per-registry validators that confirm a package exists in its upstream registry and carries an ownership annotation matching the resource's expected server name. Each validator (OCI, NPM, PyPI) is a standalone function consumed by Dispatcher via the v1alpha1.RegistryValidatorFunc type.
Index ¶
- Constants
- Variables
- func Dispatcher(ctx context.Context, origin v1alpha1.MCPPackageOrigin, objectName string) error
- func ValidateNPM(ctx context.Context, origin v1alpha1.MCPPackageOrigin, serverName string) error
- func ValidateOCI(ctx context.Context, origin v1alpha1.MCPPackageOrigin, serverName string) error
- func ValidatePyPI(ctx context.Context, origin v1alpha1.MCPPackageOrigin, serverName string) error
- type NPMPackageResponse
- type PyPIPackageResponse
Constants ¶
const ( DefaultURLNPM = "https://registry.npmjs.org" DefaultURLPyPI = "https://pypi.org" )
Canonical public registry base URLs the validators fall back to when MCPPackageOriginNPM.Mirror / MCPPackageOriginPyPI.Mirror is empty. These are validator-side concerns: the API types in pkg/api/v1alpha1 don't reference them. Operators retargeting the validators at a private mirror (Verdaccio for npm, devpi for PyPI) only touch this file. An explicit Mirror on a package is honored as-is and used to drive the upstream HTTP probe; non-empty values are treated as overrides, not violations.
Variables ¶
var ( ErrMissingIdentifierForNPM = errors.New("package identifier is required for NPM packages") ErrMissingVersionForNPM = errors.New("package version is required for NPM packages") )
var ( ErrMissingIdentifierForOCI = errors.New("package identifier is required for OCI packages") ErrUnsupportedRegistry = errors.New("unsupported OCI registry") )
var ( ErrMissingIdentifierForPyPI = errors.New("package identifier is required for PyPI packages") ErrMissingVersionForPyPi = errors.New("package version is required for PyPI packages") )
var ErrRateLimited = errors.New("rate limited by registry")
ErrRateLimited is returned when a registry rate limits our requests
Functions ¶
func Dispatcher ¶
Dispatcher is the v1alpha1-native RegistryValidatorFunc. It fans (ctx, origin, objectName) out to the appropriate per-registry validator based on which Origin sub-struct is non-nil. An origin with no sub-struct set — or with the wrong sub-struct for its Type — returns a 400-style error.
Use it directly as the v argument to obj.ValidateRegistries:
err := v1alpha1.ValidateObjectRegistries(ctx, obj, registries.Dispatcher)
Callers that want to disable a subset of registries (e.g. unit tests, offline imports, air-gapped deployments) can wrap this with their own RegistryValidatorFunc that filters on origin.Type before delegating.
func ValidateNPM ¶
ValidateNPM validates that an NPM package contains the correct MCP server name.
func ValidateOCI ¶
ValidateOCI validates that an OCI image contains the correct MCP server name annotation.
Supported reference forms (Identifier must include an explicit tag or digest):
- registry/namespace/image:tag
- registry/namespace/image@sha256:digest
- registry/namespace/image:tag@sha256:digest
- namespace/image:tag (defaults to docker.io)
Supported registries:
- Docker Hub (docker.io)
- GitHub Container Registry (ghcr.io)
- Google Artifact Registry (*.pkg.dev)
func ValidatePyPI ¶
ValidatePyPI validates that a PyPI package contains the correct MCP server name.
Types ¶
type NPMPackageResponse ¶
type NPMPackageResponse struct {
MCPName string `json:"mcpName"`
}
NPMPackageResponse represents the structure returned by the NPM registry API
type PyPIPackageResponse ¶
type PyPIPackageResponse struct {
Info struct {
Description string `json:"description"`
} `json:"info"`
}
PyPIPackageResponse represents the structure returned by the PyPI JSON API
Source Files
Directories