Skip to content

Commit 45bf43f

Browse files
joelverhagenjoelverhagen
authored
Remove namespace match validation for websiteUrl and remote URL (#769)
<!-- Provide a brief summary of your changes --> ## Motivation and Context <!-- Why is this change needed? What problem does it solve? --> Resolve #768 and #494. Require HTTPS for remote URLs. Currently all remote URLs on the MCP Registry are HTTPS. Also fix a test bug when running on Windows (bad temp path). ## How Has This Been Tested? <!-- Have you tested this in a real application? Which scenarios were tested? --> Unit tests. Published a server.json locally with a website URL not matching the server name. ## Breaking Changes <!-- Will users need to update their code or configurations? --> ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply. --> - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [ ] ~I have added or updated documentation as needed~ N/A ## Additional context <!-- Add any other context, implementation notes, or design decisions -->
1 parent d9c2e50 commit 45bf43f

File tree

5 files changed

+30
-118
lines changed

5 files changed

+30
-118
lines changed

‎docs/reference/server-json/generic-server-json.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -280,7 +280,7 @@ This will essentially instruct the MCP client to execute `dnx Knapcode.SampleMcp
280280
"remotes": [
281281
{
282282
"type": "streamable-http",
283-
"url": "http://mcp-fs.anonymous.modelcontextprotocol.io/http"
283+
"url": "https://mcp-fs.anonymous.modelcontextprotocol.io/http"
284284
}
285285
],
286286
"_meta": {

‎internal/importer/importer_test.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66
"net/http"
77
"net/http/httptest"
88
"os"
9+
"path/filepath"
910
"testing"
1011

1112
"github.com/modelcontextprotocol/registry/internal/config"
@@ -20,7 +21,7 @@ import (
2021

2122
func TestImportService_LocalFile(t *testing.T) {
2223
// Create a temporary seed file
23-
tempFile := "/tmp/test_import_seed.json"
24+
tempFile := filepath.Join(os.TempDir(), "test_import_seed.json")
2425
seedData := []*apiv0.ServerJSON{
2526
{
2627
Schema: model.CurrentSchemaURL,

‎internal/validators/utils.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,10 @@ func IsValidRemoteURL(rawURL string) bool {
144144
return false
145145
}
146146

147+
if u.Scheme != "https" {
148+
return false
149+
}
150+
147151
return true
148152
}
149153

‎internal/validators/validators.go‎

Lines changed: 0 additions & 107 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import (
66
"fmt"
77
"net/url"
88
"regexp"
9-
"slices"
109
"strings"
1110

1211
"github.com/modelcontextprotocol/registry/internal/config"
@@ -108,16 +107,6 @@ func ValidateServerJSON(serverJSON *apiv0.ServerJSON) error {
108107
}
109108
}
110109

111-
// Validate reverse-DNS namespace matching for remote URLs
112-
if err := validateRemoteNamespaceMatch(*serverJSON); err != nil {
113-
return err
114-
}
115-
116-
// Validate reverse-DNS namespace matching for website URL
117-
if err := validateWebsiteURLNamespaceMatch(*serverJSON); err != nil {
118-
return err
119-
}
120-
121110
return nil
122111
}
123112

@@ -509,99 +498,3 @@ func parseServerName(serverJSON apiv0.ServerJSON) (string, error) {
509498

510499
return name, nil
511500
}
512-
513-
// validateRemoteNamespaceMatch validates that remote URLs match the reverse-DNS namespace
514-
func validateRemoteNamespaceMatch(serverJSON apiv0.ServerJSON) error {
515-
namespace := serverJSON.Name
516-
517-
for _, remote := range serverJSON.Remotes {
518-
if err := validateRemoteURLMatchesNamespace(remote.URL, namespace); err != nil {
519-
return fmt.Errorf("remote URL %s does not match namespace %s: %w", remote.URL, namespace, err)
520-
}
521-
}
522-
523-
return nil
524-
}
525-
526-
// validateWebsiteURLNamespaceMatch validates that website URL matches the reverse-DNS namespace
527-
func validateWebsiteURLNamespaceMatch(serverJSON apiv0.ServerJSON) error {
528-
// Skip validation if website URL is not provided
529-
if serverJSON.WebsiteURL == "" {
530-
return nil
531-
}
532-
533-
namespace := serverJSON.Name
534-
if err := validateRemoteURLMatchesNamespace(serverJSON.WebsiteURL, namespace); err != nil {
535-
return fmt.Errorf("websiteUrl %s does not match namespace %s: %w", serverJSON.WebsiteURL, namespace, err)
536-
}
537-
538-
return nil
539-
}
540-
541-
// validateRemoteURLMatchesNamespace checks if a remote URL's hostname matches the publisher domain from the namespace
542-
func validateRemoteURLMatchesNamespace(remoteURL, namespace string) error {
543-
// Parse the URL to extract the hostname
544-
parsedURL, err := url.Parse(remoteURL)
545-
if err != nil {
546-
return fmt.Errorf("invalid URL format: %w", err)
547-
}
548-
549-
hostname := parsedURL.Hostname()
550-
if hostname == "" {
551-
return fmt.Errorf("URL must have a valid hostname")
552-
}
553-
554-
// Skip validation for localhost and local development URLs
555-
if hostname == "localhost" || strings.HasSuffix(hostname, ".localhost") || hostname == "127.0.0.1" {
556-
return nil
557-
}
558-
559-
// Extract publisher domain from reverse-DNS namespace
560-
publisherDomain := extractPublisherDomainFromNamespace(namespace)
561-
if publisherDomain == "" {
562-
return fmt.Errorf("invalid namespace format: cannot extract domain from %s", namespace)
563-
}
564-
565-
// Check if the remote URL hostname matches the publisher domain or is a subdomain
566-
if !isValidHostForDomain(hostname, publisherDomain) {
567-
return fmt.Errorf("remote URL host %s does not match publisher domain %s", hostname, publisherDomain)
568-
}
569-
570-
return nil
571-
}
572-
573-
// extractPublisherDomainFromNamespace converts reverse-DNS namespace to normal domain format
574-
// e.g., "com.example" -> "example.com"
575-
func extractPublisherDomainFromNamespace(namespace string) string {
576-
// Extract the namespace part before the first slash
577-
namespacePart := namespace
578-
if slashIdx := strings.Index(namespace, "/"); slashIdx != -1 {
579-
namespacePart = namespace[:slashIdx]
580-
}
581-
582-
// Split into parts and reverse them to get normal domain format
583-
parts := strings.Split(namespacePart, ".")
584-
if len(parts) < 2 {
585-
return ""
586-
}
587-
588-
// Reverse the parts to convert from reverse-DNS to normal domain
589-
slices.Reverse(parts)
590-
591-
return strings.Join(parts, ".")
592-
}
593-
594-
// isValidHostForDomain checks if a hostname is the domain or a subdomain of the publisher domain
595-
func isValidHostForDomain(hostname, publisherDomain string) bool {
596-
// Exact match
597-
if hostname == publisherDomain {
598-
return true
599-
}
600-
601-
// Subdomain match - hostname should end with "." + publisherDomain
602-
if strings.HasSuffix(hostname, "."+publisherDomain) {
603-
return true
604-
}
605-
606-
return false
607-
}

‎internal/validators/validators_test.go‎

Lines changed: 23 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -454,6 +454,21 @@ func TestValidate(t *testing.T) {
454454
},
455455
expectedError: "websiteUrl must use https scheme: ftp://example.com/docs",
456456
},
457+
{
458+
name: "server with invalid websiteUrl - required HTTPS",
459+
serverDetail: apiv0.ServerJSON{
460+
Schema: model.CurrentSchemaURL,
461+
Name: "com.example/test-server",
462+
Description: "A test server",
463+
Repository: &model.Repository{
464+
URL: "https://github.com/owner/repo",
465+
Source: "github",
466+
},
467+
Version: "1.0.0",
468+
WebsiteURL: "http://example.com/docs",
469+
},
470+
expectedError: "websiteUrl must use https scheme: http://example.com/docs",
471+
},
457472
{
458473
name: "server with malformed websiteUrl",
459474
serverDetail: apiv0.ServerJSON{
@@ -512,7 +527,7 @@ func TestValidate(t *testing.T) {
512527
Version: "1.0.0",
513528
WebsiteURL: "https://different.com/docs",
514529
},
515-
expectedError: "websiteUrl https://different.com/docs does not match namespace com.example/test-server",
530+
expectedError: "",
516531
},
517532
{
518533
name: "package with spaces in name",
@@ -797,7 +812,7 @@ func TestValidate_RemoteNamespaceMatch(t *testing.T) {
797812
expectError: false,
798813
},
799814
{
800-
name: "invalid - wrong domain",
815+
name: "valid - different domain",
801816
serverDetail: apiv0.ServerJSON{
802817
Schema: model.CurrentSchemaURL,
803818
Name: "com.example/test-server",
@@ -808,23 +823,22 @@ func TestValidate_RemoteNamespaceMatch(t *testing.T) {
808823
},
809824
},
810825
},
811-
expectError: true,
812-
errorMsg: "remote URL host google.com does not match publisher domain example.com",
826+
expectError: false,
813827
},
814828
{
815-
name: "invalid - different domain entirely",
829+
name: "invalid - not HTTPS",
816830
serverDetail: apiv0.ServerJSON{
817831
Schema: model.CurrentSchemaURL,
818832
Name: "com.microsoft/server",
819833
Remotes: []model.Transport{
820834
{
821835
Type: "streamable-http",
822-
URL: "https://api.github.com/endpoint",
836+
URL: "http://api.github.com/endpoint",
823837
},
824838
},
825839
},
826840
expectError: true,
827-
errorMsg: "remote URL host api.github.com does not match publisher domain microsoft.com",
841+
errorMsg: "invalid remote URL: http://api.github.com/endpoint",
828842
},
829843
{
830844
name: "invalid URL format",
@@ -880,12 +894,12 @@ func TestValidate_RemoteNamespaceMatch(t *testing.T) {
880894
},
881895
{
882896
Type: "streamable-http",
883-
URL: "https://google.com/websocket",
897+
URL: "http://example.com/sse",
884898
},
885899
},
886900
},
887901
expectError: true,
888-
errorMsg: "remote URL host google.com does not match publisher domain example.com",
902+
errorMsg: "invalid remote URL: http://example.com/sse",
889903
},
890904
}
891905

0 commit comments

Comments
 (0)