Affected by GO-2026-5008
and 4 other vulnerabilities
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
This directory contains an end-to-end test for publishing to the registry.
What the Test Covers
Publisher Tool: Tests the publisher CLI that publishes metadata to the registry
Registry API: Validates the /v0/publish and /v0/servers/{server_id} endpoints work correctly
Example Validation: Ensures all example JSON in docs/reference/server-json/generic-server-json.md is valid and can be published
Data Consistency: Verifies published data matches what's retrieved from the registry
Test Flow
Build: Build publisher and registry
Start Services: Launch registry and MongoDB using Docker Compose with test configuration
Publish Examples: Extract JSON examples from documentation and run publisher to publish each one
Validate Responses: GET each published server from the registry and compare it to the example JSON
Cleanup: Stop Docker containers and remove temporary files
How to Run
Prerequisites
Docker and Docker Compose
Go 1.24
Make sure you're in the repository root directory
Run the Tests
./tests/integration/run.sh
Note: Integration tests use isolated container names (registry-integration-test, postgres-integration-test) to prevent conflicts with development containers from make dev-compose.