modelcontextprotocol / modelcontextprotocol/registry
Entry Criteria
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 7.3k
- Forks
- 994
- Avg merge
- 4d 12h
- Merged PRs (30d)
- 19
Description
I believe we should have entry criteria to what makes its way onto the registry. I've spoken about this previously but I feel we have the opportunity to not just shift security left, but to start left.
Instead of making it the wild-west of what can make its way onto the registry, we should have some entry criteria that all MCP servers have to meet in order to get represented.
Some of the criteria should include:
- Is the server maintained?
- Is there any attestations that provide information about server signing or build proof?
- Security risk (taking into account CVEs) so that users can see how vulnerable a server is before they pull it
Happy to work with people on this.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing Discussion #11 and the current registry behavior described by the issue. Define the entry criteria for maintenance, signing or build attestations, and CVE-related risk, then document how those criteria would be applied to MCP servers.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100