Repository navigation
ci(cli): publish with no stored secret, and to the MCP Registry - #288
Merged
Merged
Conversation
… the MCP Registry The MCP Registry does not host servers, it describes them: cli/server.json tells a client which npm package to install, over which transport, with which argument (mcp) and which variables (CRUX_API_KEY, optional and secret), so the client builds the command without a hand-written configuration. Ownership is proven twice: only a login as nucliweb on GitHub publishes io.github.nucliweb/* names, and the npm package carries that name in mcpName, which the registry reads from npm. publish-cli.yml publishes to npm through trusted publishing: npm takes the OIDC token of the run instead of NPM_TOKEN, and adds the provenance of the package. The same token logs mcp-publisher in to the registry, after npm, and the step retries while npm lists the new version. check-tag-version.js also checks that the version of cli/server.json, the version of its npm package and its name match cli/package.json.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
4 of 5 tasks
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Chapter 7b of the MCP server, and phase 2a of the plan: the CLI publishes to npm with no token, and its MCP server goes to the MCP Registry as
io.github.nucliweb/webperf-snippets.cli/server.jsondescribes the server for the registry: npm packagewebperf-snippets, stdio, argumentmcp, andCRUX_API_KEYas an optional secret.cli/package.jsoncarries the same name inmcpName, which the registry checks on npm.publish-cli.yml:id-token: write, Node 24 and npm 11.5.1 or later, and noNODE_AUTH_TOKEN; npm publishes through trusted publishing and adds the provenance. Thenmcp-publisher1.8.1 logs in withgithub-oidcand publishescli/server.json, retrying for three minutes while npm lists the version.check-tag-version.jschecks thatcli/server.json, its npm package and its name matchcli/package.json.docs/RELEASING.mddescribes the publication and what to do if npm publishes and the registry step fails.Before the next
cli-v*tag, the trusted publisher on npmjs.com has to name this repository,publish-cli.ymland thenpm-publishenvironment. After the first publication with it, theNPM_TOKENsecret can go.Test plan
mcp-publisher validate cli/server.json(1.8.1) against the registry: valid, locallycheck-tag-version.test.js: the version ofserver.json, of its package and the name; failed before the change, locallynpm run test:ci22/22 and lint, locally