Add MCP Registry publishing support

[davegomez]

The package wasn't discoverable through the MCP Registry. This adds everything needed for automated publishing: server.json metadata with environment variable declarations, mcpName in package.json for registry verification, and OIDC-authenticated publish steps in the release workflow.

The release script (scripts/release.mjs) replaces the direct changelogen call to keep server.json version in sync with
package.json on every release. It forwards CLI args to changelogen so pnpm release -- --major still works. The CI workflow also patches server.json from the git tag as a fallback.

[greptile-apps]

Greptile Overview

Greptile Summary

Adds MCP Registry publishing support with automated version syncing between package.json and server.json. The new scripts/release.mjs orchestrates releases by running changelogen, patching server.json versions, and pushing tags. The CI workflow includes fallback version syncing and OIDC-authenticated publishing to both npm and MCP Registry.

• Added mcpName field to package.json for registry verification
• Created server.json with server metadata and environment variable declarations
• Replaced direct changelogen call with Node script that syncs versions across both config files
• Extended CI workflow to download mcp-publisher and publish to MCP Registry after npm
• Release script forwards CLI args to changelogen (e.g., --major, --minor)

Issues found:

• Curl piped to tar without intermediate verification poses security risk
• Missing validation for packages[0] in release script could cause crash on malformed server.json

Confidence Score: 3/5

• Safe to merge with minor security improvements recommended
• The PR correctly implements MCP Registry publishing with proper OIDC authentication and version syncing. However, the curl pipe pattern in the CI workflow poses a minor security risk, and the release script lacks validation for the server.json structure. Both issues are unlikely to cause problems in practice but should be addressed for production robustness.
• Review .github/workflows/release.yml for curl security pattern and scripts/release.mjs for error handling

[greptile-apps]

_{2 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}