service

package

Go to main page

Versions in this module

v1

v1.8.7

Oct 30, 2026

v1.8.6

Oct 27, 2026

v1.8.5

Oct 26, 2026

v1.8.4

Oct 23, 2026

v1.8.3

Oct 23, 2026

v1.8.2

Oct 23, 2026

v1.8.1

Aug 6, 2026

v1.8.0

Jul 12, 2026

v1.7.9

May 12, 2026

v1.7.8

May 5, 2026 GO-2026-5008

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

v1.7.7

May 4, 2026 GO-2026-5008

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

v1.7.6

Apr 30, 2026 GO-2026-5008 +2 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

v1.7.5

Apr 29, 2026 GO-2026-5008 +3 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

v1.7.4

Apr 29, 2026 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.7.3

Apr 28, 2026 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.7.2

Apr 27, 2026 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.7.1

Apr 27, 2026 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.7.0

Apr 25, 2026 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.6.0

Apr 15, 2026 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.5.0

Mar 6, 2026 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.4.1

Feb 10, 2026 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.4.0

Dec 13, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.10

Nov 18, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.9

Nov 17, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.8

Nov 3, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.7

Oct 29, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.6

Oct 29, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.5

Oct 24, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.4

Oct 24, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.3

Oct 16, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.2

Oct 16, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.1

Oct 15, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.3.0

Oct 14, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.2.3

Sep 30, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.2.2

Sep 30, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.2.1

Sep 30, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

v1.2.0

Sep 29, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

Changes in this version

type RegistryService

+ CreateServer func(ctx context.Context, req *apiv0.ServerJSON) (*apiv0.ServerResponse, error)

+ GetAllVersionsByServerName func(ctx context.Context, serverName string) ([]*apiv0.ServerResponse, error)

+ GetServerByName func(ctx context.Context, serverName string) (*apiv0.ServerResponse, error)

+ GetServerByNameAndVersion func(ctx context.Context, serverName string, version string) (*apiv0.ServerResponse, error)

+ ListServers func(ctx context.Context, filter *database.ServerFilter, cursor string, limit int) ([]*apiv0.ServerResponse, string, error)

+ UpdateServer func(ctx context.Context, serverName, version string, req *apiv0.ServerJSON, ...) (*apiv0.ServerResponse, error)

v1.1.0

Sep 23, 2025 GO-2026-5008 +4 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

Changes in this version

type RegistryService

+ GetAllVersionsByServerID func(serverID string) ([]apiv0.ServerJSON, error)

+ GetByServerID func(serverID string) (*apiv0.ServerJSON, error)

+ GetByServerIDAndVersion func(serverID string, version string) (*apiv0.ServerJSON, error)

+ GetByVersionID func(versionID string) (*apiv0.ServerJSON, error)

v1.0.0

Sep 8, 2025 GO-2026-5008 +3 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

v0

v0.0.3

Sep 8, 2025 GO-2026-5008 +3 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

v0.0.2

Sep 8, 2025 GO-2026-5008 +3 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

v0.0.1

Sep 8, 2025 GO-2026-5008 +3 more

GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry

Changes in this version

+ func CompareVersions(version1 string, version2 string, timestamp1 time.Time, timestamp2 time.Time) int

+ func IsSemanticVersion(version string) bool

+ type RegistryService interface

+ EditServer func(id string, req apiv0.ServerJSON) (*apiv0.ServerJSON, error)

+ GetByID func(id string) (*apiv0.ServerJSON, error)

+ List func(cursor string, limit int) ([]apiv0.ServerJSON, string, error)

+ Publish func(req apiv0.ServerJSON) (*apiv0.ServerJSON, error)

+ func NewRegistryService(db database.Database, cfg *config.Config) RegistryService

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL