@motiblog/mcp 0.1.2 → 0.1.3

package/README.md

@@ -147,6 +147,79 @@ node -e "console.log(Object.keys(require('@motiblog/mcp')))"
 MOTIBLOG_HTTP_PORT=3098 node_modules/.bin/motiblog-mcp-http
 ```
 
+## Listing in the official MCP Registry
+
+`server.json` in this directory is the listing, validated against schema
+`2025-12-11`. The registry is the canonical directory since 2026 and downstream
+directories and newsletters ingest it, so **one publish propagates** — do this
+before filling in any individual directory form.
+
+### The namespace
+
+`server.json` claims `ai.motiblog/mcp` — the reverse-DNS namespace for a domain
+we own, which is the identity a product should have rather than a personal
+GitHub handle. Claiming it means proving control of `motiblog.ai`.
+
+**The keypair is already generated and the proof is already deployed.** The
+public half is served from the web app at
+[`/.well-known/mcp-registry-auth`](../web/src/app/.well-known/mcp-registry-auth/route.ts);
+the private half is at `~/.motiblog/mcp-registry-key` (mode 600, never in the
+repo, same convention as the agent API key).
+
+HTTP verification was chosen over the DNS TXT record deliberately: it lives in
+this repository, so the proof is reviewable, versioned and deploys with the app
+instead of depending on a registrar dashboard nobody remembers the login for.
+The registry accepts either, with the same key — if you ever prefer DNS, the
+record is:
+
+```
+motiblog.ai.  IN  TXT  "v=MCPv1; k=ed25519; p=<the same public key>"
+```
+
+### Publishing
+
+`mcp-publisher` is a Go binary from
+[github.com/modelcontextprotocol/registry releases](https://github.com/modelcontextprotocol/registry/releases)
+(v1.8.1 at time of writing) — it is not on npm.
+
+```bash
+cd apps/mcp
+mcp-publisher login http \
+  --domain motiblog.ai \
+  --private-key "$(cat ~/.motiblog/mcp-registry-key)"
+mcp-publisher publish
+```
+
+The web app must be deployed with the well-known route before the login will
+verify — the registry fetches `https://motiblog.ai/.well-known/mcp-registry-auth`
+and checks the signature against it. Confirm it is live first:
+
+```bash
+curl https://motiblog.ai/.well-known/mcp-registry-auth
+# v=MCPv1; k=ed25519; p=...
+```
+
+**If you rotate the key**, the constant in the route and the DNS record (if one
+exists) must change together. A mismatch fails with a signature error that does
+not explain itself.
+
+Validate before publishing — the registry rejects on schema, and the limits
+are tighter than they look (`description` caps at **100 characters**, which
+the first draft of ours blew past):
+
+```bash
+python3 - <<'PY'
+import json, urllib.request, jsonschema
+s = json.load(urllib.request.urlopen(json.load(open('server.json'))['$schema']))
+jsonschema.validate(json.load(open('server.json')), s)
+print('valid')
+PY
+```
+
+**Updating a listing needs a new version.** Bump `version` in both
+`package.json` and `server.json` whenever the copy or the package changes, or
+the publish is a no-op.
+
 ## Entry points
 
 | File | Shape | Use |

package/package.json

@@ -1,6 +1,8 @@
 {
   "name": "@motiblog/mcp",
-  "version": "0.1.2",
+  "version": "0.1.3",
+  "//mcpName": "Links this npm package to its official MCP Registry entry. The registry refuses to publish a listing that names an npm package which does not point back at it — that pairing is how it proves the same owner controls both. Must equal `name` in server.json.",
+  "mcpName": "ai.motiblog/mcp",
   "description": "MotiBlog MCP server — run a whole blog from an agent: propose topics, generate, fact-check, approve through a governed gate, publish, or export to your own codebase",
   "license": "UNLICENSED",
   "homepage": "https://motiblog.ai/mcp",