Home Docs Model Context Protocol 20 Oct 2026

One change · mcp

How to Authenticate When Publishing to the Official MCP Registry changedregistry/authentication

Nearest release: v2.1.305, published under an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Upstream edited this page at 20 Oct 2026 20:02 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 20 Oct 2026 20:07 UTC.

Upstream edited 20 Oct 2026 20:02 UTC

Recorded here 20 Oct 2026 20:07 UTC

Lines+213added

Lines−221removed

From line 1 where the diff opens

First seen 14 Aug 2026 this site's first read of the page

Recorded edits3to this page, all time

The whole hunk

from line 1, old and new numbered

lines

from line 1

11# How to Authenticate When Publishing to the Official MCP Registry

3<Note>

4 The MCP Registry is currently in preview. Breaking changes or data resets may occur before general availability. If you encounter any issues, please report them on [GitHub](https://github.com/modelcontextprotocol/registry/issues).

5</Note>

3> [!NOTE]

5> The MCP Registry is currently in preview. Breaking changes or data resets may occur before general availability. If you encounter any issues, please report them on [GitHub](https://github.com/modelcontextprotocol/registry/issues).

77You must authenticate before publishing to the official MCP Registry. The MCP Registry supports different authentication methods. Which authentication method you choose determines the namespace of your server's name.

from line 50

5050

5151To perform DNS authentication using the `mcp-publisher` CLI tool, run the following commands in your server project directory to generate a TXT record based on a public/private key pair:

5252

53<CodeGroup>

54 ```bash Ed25519 theme={null}

55 MY_DOMAIN="example.com"

53```bash Ed25519 theme={null}

54MY_DOMAIN="example.com"

5655

57 # Generate public/private key pair using Ed25519

58 openssl genpkey -algorithm Ed25519 -out key.pem

56# Generate public/private key pair using Ed25519

57openssl genpkey -algorithm Ed25519 -out key.pem

5958

60 # Generate TXT record

61 PUBLIC_KEY="$(openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64)"

62 echo "${MY_DOMAIN}. IN TXT \"v=MCPv1; k=ed25519; p=${PUBLIC_KEY}\""

63 ```

59# Generate TXT record

60PUBLIC_KEY="$(openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64)"

61echo "${MY_DOMAIN}. IN TXT \"v=MCPv1; k=ed25519; p=${PUBLIC_KEY}\""

62```

6463

65 ```bash ECDSA P-384 theme={null}

66 MY_DOMAIN="example.com"

64```bash ECDSA P-384 theme={null}

65MY_DOMAIN="example.com"

6766

68 # Generate public/private key pair using ECDSA P-384

69 openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -out key.pem

67# Generate public/private key pair using ECDSA P-384

68openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -out key.pem

7069

71 # Generate TXT record

73 echo "${MY_DOMAIN}. IN TXT \"v=MCPv1; k=ecdsap384; p=${PUBLIC_KEY}\""

74 ```

70# Generate TXT record

72echo "${MY_DOMAIN}. IN TXT \"v=MCPv1; k=ecdsap384; p=${PUBLIC_KEY}\""

73```

7574

76 ```bash Google KMS theme={null}

77 MY_DOMAIN="example.com"

78 MY_PROJECT="myproject"

79 MY_KEYRING="mykeyring"

80 MY_KEY_NAME="mykey"

75```bash Google KMS theme={null}

76MY_DOMAIN="example.com"

77MY_PROJECT="myproject"

78MY_KEYRING="mykeyring"

79MY_KEY_NAME="mykey"

8180

82 # Log in using gcloud CLI (https://cloud.google.com/sdk/docs/install)

83 gcloud auth login

81# Log in using gcloud CLI (https://cloud.google.com/sdk/docs/install)

82gcloud auth login

8483

85 # Set default project

86 gcloud config set project "${MY_PROJECT}"

84# Set default project

85gcloud config set project "${MY_PROJECT}"

8786

88 # Create a keyring in your project

89 gcloud kms keyrings create "${MY_KEYRING}" --location global

87# Create a keyring in your project

88gcloud kms keyrings create "${MY_KEYRING}" --location global

9089

91 # Create an Ed25519 signing key

92 gcloud kms keys create "${MY_KEY_NAME}" --default-algorithm=ec-sign-ed25519 --purpose=asymmetric-signing --keyring="${MY_KEYRING}" --location=global

90# Create an Ed25519 signing key

91gcloud kms keys create "${MY_KEY_NAME}" --default-algorithm=ec-sign-ed25519 --purpose=asymmetric-signing --keyring="${MY_KEYRING}" --location=global

9392

94 # Enable Application Default Credentials (ADC) so the publisher tool can sign

95 gcloud auth application-default login

93# Enable Application Default Credentials (ADC) so the publisher tool can sign

94gcloud auth application-default login

9695

97 # Attempt login to show the public key

98 mcp-publisher login dns google-kms --domain="${MY_DOMAIN}" --resource="projects/${MY_PROJECT}/locations/global/keyRings/${MY_KEYRING}/cryptoKeys/${MY_KEY_NAME}/cryptoKeyVersions/1"

96# Attempt login to show the public key

97mcp-publisher login dns google-kms --domain="${MY_DOMAIN}" --resource="projects/${MY_PROJECT}/locations/global/keyRings/${MY_KEYRING}/cryptoKeys/${MY_KEY_NAME}/cryptoKeyVersions/1"

9998

100 # Copy the "Expected proof record":

101 # ${MY_DOMAIN}. IN TXT "v=MCPv1; k=ed25519; p=${PUBLIC_KEY}"

102 ```

99# Copy the "Expected proof record":

100# ${MY_DOMAIN}. IN TXT "v=MCPv1; k=ed25519; p=${PUBLIC_KEY}"

101```

103102

104 ```bash Azure Key Vault theme={null}

105 MY_DOMAIN="example.com"

106 MY_SUBSCRIPTION="subscription name or ID"

107 MY_RESOURCE_GROUP="MyResourceGroup"

108 MY_KEY_VAULT="MyKeyVault"

109 MY_KEY_NAME="MyKey"

103```bash Azure Key Vault theme={null}

104MY_DOMAIN="example.com"

105MY_SUBSCRIPTION="subscription name or ID"

106MY_RESOURCE_GROUP="MyResourceGroup"

107MY_KEY_VAULT="MyKeyVault"

108MY_KEY_NAME="MyKey"

110109

111 # Log in using Azure CLI (https://learn.microsoft.com/en-us/cli/azure/install-azure-cli)

112 az login

110# Log in using Azure CLI (https://learn.microsoft.com/en-us/cli/azure/install-azure-cli)

111az login

113112

114 # Set default subscription

115 az account set --subscription "${MY_SUBSCRIPTION}"

113# Set default subscription

114az account set --subscription "${MY_SUBSCRIPTION}"

116115

117 # Create a resource group

118 az group create --location westus --resource-group "${MY_RESOURCE_GROUP}"

116# Create a resource group

117az group create --location westus --resource-group "${MY_RESOURCE_GROUP}"

119118

120 # Create a key vault

121 az keyvault create --name "${MY_KEY_VAULT}" --location westus --resource-group "${MY_RESOURCE_GROUP}"

119# Create a key vault

120az keyvault create --name "${MY_KEY_VAULT}" --location westus --resource-group "${MY_RESOURCE_GROUP}"

122121

123 # Create an ECDSA P-384 signing key

124 az keyvault key create --name "${MY_KEY_NAME}" --vault-name "${MY_KEY_VAULT}" --curve P-384

122# Create an ECDSA P-384 signing key

123az keyvault key create --name "${MY_KEY_NAME}" --vault-name "${MY_KEY_VAULT}" --curve P-384

125124

126 # Attempt login to show the public key

127 mcp-publisher login dns azure-key-vault --domain="${MY_DOMAIN}" --vault "${MY_KEY_VAULT}" --key "${MY_KEY_NAME}"

125# Attempt login to show the public key

126mcp-publisher login dns azure-key-vault --domain="${MY_DOMAIN}" --vault "${MY_KEY_VAULT}" --key "${MY_KEY_NAME}"

128127

129 # Copy the "Expected proof record":

130 # ${MY_DOMAIN}. IN TXT "v=MCPv1; k=ecdsap384; p=${PUBLIC_KEY}"

131 ```

132</CodeGroup>

128# Copy the "Expected proof record":

129# ${MY_DOMAIN}. IN TXT "v=MCPv1; k=ecdsap384; p=${PUBLIC_KEY}"

130```

133131

134132Then add the TXT record using your DNS provider's control panel. It may take several minutes for the TXT record to propagate. After the TXT record has propagated, log in using the `mcp-publisher login` command:

135133

136<CodeGroup>

137 ```bash Ed25519 theme={null}

138 MY_DOMAIN="example.com"

134```bash Ed25519 theme={null}

135MY_DOMAIN="example.com"

139136

140 PRIVATE_KEY="$(openssl pkey -in key.pem -noout -text | grep -A3 "priv:" | tail -n +2 | tr -d ' :\n')"

141 mcp-publisher login dns --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}"

142 ```

137PRIVATE_KEY="$(openssl pkey -in key.pem -noout -text | grep -A3 "priv:" | tail -n +2 | tr -d ' :\n')"

138mcp-publisher login dns --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}"

139```

143140

144 ```bash ECDSA P-384 theme={null}

145 MY_DOMAIN="example.com"

141```bash ECDSA P-384 theme={null}

142MY_DOMAIN="example.com"

146143

147 PRIVATE_KEY="$(openssl ec -in key.pem -noout -text | grep -A4 "priv:" | tail -n +2 | tr -d ' :\n')"

148 mcp-publisher login dns --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}"

149 ```

144PRIVATE_KEY="$(openssl ec -in key.pem -noout -text | grep -A4 "priv:" | tail -n +2 | tr -d ' :\n')"

145mcp-publisher login dns --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}"

146```

150147

151 ```bash Google KMS theme={null}

152 MY_DOMAIN="example.com"

153 MY_PROJECT="myproject"

154 MY_KEYRING="mykeyring"

155 MY_KEY_NAME="mykey"

148```bash Google KMS theme={null}

149MY_DOMAIN="example.com"

150MY_PROJECT="myproject"

151MY_KEYRING="mykeyring"

152MY_KEY_NAME="mykey"

156153

157 mcp-publisher login dns google-kms --domain="${MY_DOMAIN}" --resource="projects/${MY_PROJECT}/locations/global/keyRings/${MY_KEYRING}/cryptoKeys/${MY_KEY_NAME}/cryptoKeyVersions/1"

158 ```

154mcp-publisher login dns google-kms --domain="${MY_DOMAIN}" --resource="projects/${MY_PROJECT}/locations/global/keyRings/${MY_KEYRING}/cryptoKeys/${MY_KEY_NAME}/cryptoKeyVersions/1"

155```

159156

160 ```bash Azure Key Vault theme={null}

161 MY_DOMAIN="example.com"

162 MY_KEY_VAULT="MyKeyVault"

163 MY_KEY_NAME="MyKey"

157```bash Azure Key Vault theme={null}

158MY_DOMAIN="example.com"

159MY_KEY_VAULT="MyKeyVault"

160MY_KEY_NAME="MyKey"

164161

165 mcp-publisher login dns azure-key-vault --domain="${MY_DOMAIN}" --vault "${MY_KEY_VAULT}" --key "${MY_KEY_NAME}"

166 ```

167</CodeGroup>

162mcp-publisher login dns azure-key-vault --domain="${MY_DOMAIN}" --vault "${MY_KEY_VAULT}" --key "${MY_KEY_NAME}"

163```

168164

169165## HTTP Authentication

170166

from line 168

172168

173169To perform HTTP authentication using the `mcp-publisher` CLI tool, run the following commands in your server project directory to generate an `mcp-registry-auth` file based on a public/private key pair:

174170

175<CodeGroup>

176 ```bash Ed25519 theme={null}

177 # Generate public/private key pair using Ed25519

178 openssl genpkey -algorithm Ed25519 -out key.pem

171```bash Ed25519 theme={null}

172# Generate public/private key pair using Ed25519

173openssl genpkey -algorithm Ed25519 -out key.pem

179174

180 # Generate mcp-registry-auth file

181 PUBLIC_KEY="$(openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64)"

182 echo "v=MCPv1; k=ed25519; p=${PUBLIC_KEY}" > mcp-registry-auth

183 ```

175# Generate mcp-registry-auth file

176PUBLIC_KEY="$(openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64)"

177echo "v=MCPv1; k=ed25519; p=${PUBLIC_KEY}" > mcp-registry-auth

178```

184179

185 ```bash ECDSA P-384 theme={null}

186 # Generate public/private key pair using ECDSA P-384

187 openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -out key.pem

180```bash ECDSA P-384 theme={null}

181# Generate public/private key pair using ECDSA P-384

182openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -out key.pem

188183

189 # Generate mcp-registry-auth file

191 echo "v=MCPv1; k=ecdsap384; p=${PUBLIC_KEY}" > mcp-registry-auth

192 ```

184# Generate mcp-registry-auth file

186echo "v=MCPv1; k=ecdsap384; p=${PUBLIC_KEY}" > mcp-registry-auth

187```

193188

194 ```bash Google KMS theme={null}

195 MY_DOMAIN="example.com"

196 MY_PROJECT="myproject"

197 MY_KEYRING="mykeyring"

198 MY_KEY_NAME="mykey"

189```bash Google KMS theme={null}

190MY_DOMAIN="example.com"

191MY_PROJECT="myproject"

192MY_KEYRING="mykeyring"

193MY_KEY_NAME="mykey"

199194

200 # Log in using gcloud CLI (https://cloud.google.com/sdk/docs/install)

201 gcloud auth login

195# Log in using gcloud CLI (https://cloud.google.com/sdk/docs/install)

196gcloud auth login

202197

203 # Set default project

204 gcloud config set project "${MY_PROJECT}"

198# Set default project

199gcloud config set project "${MY_PROJECT}"

205200

206 # Create a keyring in your project

207 gcloud kms keyrings create "${MY_KEYRING}" --location global

201# Create a keyring in your project

202gcloud kms keyrings create "${MY_KEYRING}" --location global

208203

209 # Create an Ed25519 signing key

210 gcloud kms keys create "${MY_KEY_NAME}" --default-algorithm=ec-sign-ed25519 --purpose=asymmetric-signing --keyring="${MY_KEYRING}" --location=global

204# Create an Ed25519 signing key

205gcloud kms keys create "${MY_KEY_NAME}" --default-algorithm=ec-sign-ed25519 --purpose=asymmetric-signing --keyring="${MY_KEYRING}" --location=global

211206

212 # Enable Application Default Credentials (ADC) so the publisher tool can sign

213 gcloud auth application-default login

207# Enable Application Default Credentials (ADC) so the publisher tool can sign

208gcloud auth application-default login

214209

215 # Attempt login to show the public key

216 mcp-publisher login http google-kms --domain="${MY_DOMAIN}" --resource="projects/${MY_PROJECT}/locations/global/keyRings/${MY_KEYRING}/cryptoKeys/${MY_KEY_NAME}/cryptoKeyVersions/1"

210# Attempt login to show the public key

211mcp-publisher login http google-kms --domain="${MY_DOMAIN}" --resource="projects/${MY_PROJECT}/locations/global/keyRings/${MY_KEYRING}/cryptoKeys/${MY_KEY_NAME}/cryptoKeyVersions/1"

217212

218 # Copy the "Expected proof record" to `./mcp-registry-auth`:

219 # v=MCPv1; k=ed25519; p=${PUBLIC_KEY}

220 ```

213# Copy the "Expected proof record" to `./mcp-registry-auth`:

214# v=MCPv1; k=ed25519; p=${PUBLIC_KEY}

215```

221216

222 ```bash Azure Key Vault theme={null}

223 MY_DOMAIN="example.com"

224 MY_SUBSCRIPTION="subscription name or ID"

225 MY_RESOURCE_GROUP="MyResourceGroup"

226 MY_KEY_VAULT="MyKeyVault"

227 MY_KEY_NAME="MyKey"

217```bash Azure Key Vault theme={null}

218MY_DOMAIN="example.com"

219MY_SUBSCRIPTION="subscription name or ID"

220MY_RESOURCE_GROUP="MyResourceGroup"

221MY_KEY_VAULT="MyKeyVault"

222MY_KEY_NAME="MyKey"

228223

229 # Log in using Azure CLI (https://learn.microsoft.com/en-us/cli/azure/install-azure-cli)

230 az login

224# Log in using Azure CLI (https://learn.microsoft.com/en-us/cli/azure/install-azure-cli)

225az login

231226

232 # Set default subscription

233 az account set --subscription "${MY_SUBSCRIPTION}"

227# Set default subscription

228az account set --subscription "${MY_SUBSCRIPTION}"

234229

235 # Create a resource group

236 az group create --location westus --resource-group "${MY_RESOURCE_GROUP}"

230# Create a resource group

231az group create --location westus --resource-group "${MY_RESOURCE_GROUP}"

237232

238 # Create a key vault

239 az keyvault create --name "${MY_KEY_VAULT}" --location westus --resource-group "${MY_RESOURCE_GROUP}"

233# Create a key vault

234az keyvault create --name "${MY_KEY_VAULT}" --location westus --resource-group "${MY_RESOURCE_GROUP}"

240235

241 # Create an ECDSA P-384 signing key

242 az keyvault key create --name "${MY_KEY_NAME}" --vault-name "${MY_KEY_VAULT}" --curve P-384

236# Create an ECDSA P-384 signing key

237az keyvault key create --name "${MY_KEY_NAME}" --vault-name "${MY_KEY_VAULT}" --curve P-384

243238

244 # Attempt login to show the public key

245 mcp-publisher login http azure-key-vault --domain="${MY_DOMAIN}" --vault "${MY_KEY_VAULT}" --key "${MY_KEY_NAME}"

239# Attempt login to show the public key

240mcp-publisher login http azure-key-vault --domain="${MY_DOMAIN}" --vault "${MY_KEY_VAULT}" --key "${MY_KEY_NAME}"

246241

247 # Copy the "Expected proof record" to `./mcp-registry-auth`:

248 # v=MCPv1; k=ecdsap384; p=${PUBLIC_KEY}

249 ```

250</CodeGroup>

242# Copy the "Expected proof record" to `./mcp-registry-auth`:

243# v=MCPv1; k=ecdsap384; p=${PUBLIC_KEY}

244```

251245

252246Then host the `mcp-registry-auth` file at `/.well-known/mcp-registry-auth` on your domain. After the file is hosted, log in using the `mcp-publisher login` command:

253247

254<CodeGroup>

255 ```bash Ed25519 theme={null}

256 MY_DOMAIN="example.com"

257 PRIVATE_KEY="$(openssl pkey -in key.pem -noout -text | grep -A3 "priv:" | tail -n +2 | tr -d ' :\n')"

258 mcp-publisher login http --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}"

259 ```

248```bash Ed25519 theme={null}

249MY_DOMAIN="example.com"

250PRIVATE_KEY="$(openssl pkey -in key.pem -noout -text | grep -A3 "priv:" | tail -n +2 | tr -d ' :\n')"

251mcp-publisher login http --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}"

252```

260253

261 ```bash ECDSA P-384 theme={null}

262 MY_DOMAIN="example.com"

263 PRIVATE_KEY="$(openssl ec -in key.pem -noout -text | grep -A4 "priv:" | tail -n +2 | tr -d ' :\n')"

264 mcp-publisher login http --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}"

265 ```

254```bash ECDSA P-384 theme={null}

255MY_DOMAIN="example.com"

256PRIVATE_KEY="$(openssl ec -in key.pem -noout -text | grep -A4 "priv:" | tail -n +2 | tr -d ' :\n')"

257mcp-publisher login http --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}"

258```

266259

267 ```bash Google KMS theme={null}

268 MY_DOMAIN="example.com"

269 MY_PROJECT="myproject"

270 MY_KEYRING="mykeyring"

271 MY_KEY_NAME="mykey"

260```bash Google KMS theme={null}

261MY_DOMAIN="example.com"

262MY_PROJECT="myproject"

263MY_KEYRING="mykeyring"

264MY_KEY_NAME="mykey"

272265

273 mcp-publisher login http google-kms --domain="${MY_DOMAIN}" --resource="projects/${MY_PROJECT}/locations/global/keyRings/${MY_KEYRING}/cryptoKeys/${MY_KEY_NAME}/cryptoKeyVersions/1"

274 ```

266mcp-publisher login http google-kms --domain="${MY_DOMAIN}" --resource="projects/${MY_PROJECT}/locations/global/keyRings/${MY_KEYRING}/cryptoKeys/${MY_KEY_NAME}/cryptoKeyVersions/1"

267```

275268

276 ```bash Azure Key Vault theme={null}

277 MY_DOMAIN="example.com"

278 MY_KEY_VAULT="MyKeyVault"

279 MY_KEY_NAME="MyKey"

269```bash Azure Key Vault theme={null}

270MY_DOMAIN="example.com"

271MY_KEY_VAULT="MyKeyVault"

272MY_KEY_NAME="MyKey"

280273

281 mcp-publisher login http azure-key-vault --domain="${MY_DOMAIN}" --vault "${MY_KEY_VAULT}" --key "${MY_KEY_NAME}"

282 ```

283</CodeGroup>

274mcp-publisher login http azure-key-vault --domain="${MY_DOMAIN}" --vault "${MY_KEY_VAULT}" --key "${MY_KEY_NAME}"

275```

284276

This page’s history 3 edits

20 Oct 2026 +213 −221 · this one
28 Sep 2026 +4 −4
14 Aug 2026 +283 −0

The page’s own history →

Where it came from

The capturemcp
Upstream pagemodelcontextprotocol.io

Around it

Every changethe ledger
That day20 Oct 2026