v0

package

Go to main page

Versions in this module

v1

v1.8.0

Jul 12, 2026

v1.7.9

May 12, 2026

v1.7.8

May 5, 2026 GO-2026-5008

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

v1.7.7

May 4, 2026 GO-2026-5008

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

v1.7.6

Apr 30, 2026 GO-2026-5008 +2 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

v1.7.5

Apr 29, 2026 GO-2026-5008 +3 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

v1.7.4

Apr 29, 2026 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.7.3

Apr 28, 2026 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.7.2

Apr 27, 2026 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.7.1

Apr 27, 2026 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.7.0

Apr 25, 2026 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.6.0

Apr 15, 2026 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.5.0

Mar 6, 2026 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.4.1

Feb 10, 2026 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.4.0

Dec 13, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.10

Nov 18, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.9

Nov 17, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.8

Nov 3, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.7

Oct 29, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.6

Oct 29, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.5

Oct 24, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.4

Oct 24, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.3

Oct 16, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.2

Oct 16, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.1

Oct 15, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.0

Oct 14, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

Changes in this version

type ServerJSON

+ Icons []model.Icon

+ Title string

v1.2.3

Sep 30, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.2.2

Sep 30, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.2.1

Sep 30, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.2.0

Sep 29, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

Changes in this version

type RegistryExtensions

+ Status model.Status

+ type ResponseMeta struct

+ Official *RegistryExtensions

+ type ServerResponse struct

+ Meta ResponseMeta

+ Server ServerJSON

v1.1.0

Sep 23, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

Changes in this version

type RegistryExtensions

+ ServerID string

+ VersionID string

type ServerJSON

+ WebsiteURL string

+ func (s *ServerJSON) GetServerID() string

+ func (s *ServerJSON) GetVersionID() string

v1.0.0

Sep 8, 2025 GO-2026-5008 +3 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

Changes in this version

type ServerJSON

+ Version string

v0

v0.0.3

Sep 8, 2025 GO-2026-5008 +3 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

v0.0.2

Sep 8, 2025 GO-2026-5008 +3 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

v0.0.1

Sep 8, 2025 GO-2026-5008 +3 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

Changes in this version

+ type Metadata struct

+ Count int

+ NextCursor string

+ Total int

+ type RegistryExtensions struct

+ ID string

+ IsLatest bool

+ PublishedAt time.Time

+ ReleaseDate string

+ UpdatedAt time.Time

+ type ServerJSON struct

+ Description string

+ Meta *ServerMeta

+ Name string

+ Packages []model.Package

+ Remotes []model.Transport

+ Repository model.Repository

+ Schema string

+ Status model.Status

+ VersionDetail model.VersionDetail

+ type ServerListResponse struct

+ Metadata *Metadata

+ Servers []ServerJSON

+ type ServerMeta struct

+ Official *RegistryExtensions

+ PublisherProvided map[string]interface{}

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL