Skip to content

Commit bb84ea6

Browse files
authored
Publisher-managed "deleted" support (#893)
(Updated auto-generated PR description from @tadasant / Claude on Feb 22, 2026) ## Motivation and Context Fixes #637 Server lifecycle management (deprecation and yanking) is a standard requirement for package registries. Use cases like rebranding, security vulnerabilities, and end-of-life servers demand the ability to mark servers as deprecated or deleted, with optional messaging to guide consumers toward alternatives. ## Changes ### New API endpoints - **`PATCH /v0/servers/{serverName}/versions/{version}/status`** — Update the lifecycle status of a single server version - **`PATCH /v0/servers/{serverName}/status`** — Update the lifecycle status of all versions of a server in a single transaction Both endpoints accept: ```json { "status": "active|deprecated|deleted", "statusMessage": "Optional message (max 500 chars) explaining the change" } ``` ### New CLI command - **`mcp-publisher status <serverName> [version]`** — Update server lifecycle status from the command line - `--status` (required): `active`, `deprecated`, or `deleted` - `--message`: Optional status message - `--all-versions`: Apply to all versions of the server (replaces the `<version>` argument) ### API response changes `RegistryExtensions` now includes two new fields: - `statusChangedAt` — Timestamp of the last status change - `statusMessage` — Optional free-form message (e.g., deprecation reason, migration guidance) ### List endpoint changes - New `include_deleted` query parameter on `GET /v0/servers` — defaults to `false`, hiding deleted servers from listings - When `updated_since` is provided, `include_deleted` is automatically set to `true` for incremental sync ### Database - Migration `013_add_status_fields.sql`: Adds `status_changed_at` (NOT NULL, initialized from `published_at`) and `status_message` columns to the `servers` table ### Design decisions (from review discussion) - **Dedicated status endpoints** rather than overloading the existing edit endpoint - **Bidirectional status transitions** — all transitions between `active`, `deprecated`, and `deleted` are allowed - **`statusMessage` as free-form text** — no structured `nextName` or `alternativeUrl` fields (per maintainer feedback, to avoid complexity around chaining, trust transfer, etc.) - **Publish permission** grants status change access (not limited to admin/edit) - **Status message auto-cleared** when transitioning back to `active` Good, now I have the full picture. Here's the addendum: ### Consumer-facing API changes The new status fields live inside `_meta["io.modelcontextprotocol.registry/official"]` on every `ServerResponse`. This is the existing `RegistryExtensions` object — two new fields are added alongside the existing ones: **Before:** ```json { "server": { "name": "com.example/my-server", "...": "..." }, "_meta": { "io.modelcontextprotocol.registry/official": { "status": "active", "publishedAt": "2025-06-01T00:00:00Z", "updatedAt": "2025-06-15T00:00:00Z", "isLatest": true } } } ``` **After:** ```json { "server": { "name": "com.example/my-server", "...": "..." }, "_meta": { "io.modelcontextprotocol.registry/official": { "status": "deprecated", "statusChangedAt": "2026-02-01T12:00:00Z", "statusMessage": "Deprecated in favor of com.example/my-server-v2", "publishedAt": "2025-06-01T00:00:00Z", "updatedAt": "2026-02-01T12:00:00Z", "isLatest": true } } } ``` | New field | Type | Present when | |-----------|------|-------------| | `statusChangedAt` | `string` (RFC3339) | Always — initialized to `publishedAt` for existing records | | `statusMessage` | `string` (max 500 chars) | Only when set — `null`/omitted for active servers (auto-cleared on transition to active) | These fields appear on **every endpoint that returns a `ServerResponse`**: `GET /v0/servers`, `GET /v0/servers/{name}`, `GET /v0/servers/{name}/versions/{version}`, and the new PATCH status endpoints. ### List endpoint filtering `GET /v0/servers` gains an `include_deleted` query parameter: | Scenario | Behavior | |----------|----------| | No `include_deleted` param | Deleted servers hidden (default `false`) | | `include_deleted=true` | Deleted servers included in results | | `updated_since` provided | `include_deleted` forced to `true` for incremental sync | ## How Has This Been Tested? - Unit tests for status handler (`status_test.go`) covering status transitions, permission checks, validation errors, and the all-versions endpoint - Unit tests for the CLI command (`status_test.go`) - Integration with existing server/edit handler tests - Database layer tests for the new status update and query methods - Tested locally with `make dev-compose` ## Types of changes - [x] New feature (non-breaking change which adds functionality) ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Open items from review - [ ] `include_deleted` silent override: When `updated_since` is provided and `include_deleted=false` is explicitly passed, should return a 400 error rather than silently overriding ([thread](#893 (comment))) — agreed upon but may not yet be implemented
1 parent 01e4e2b commit bb84ea6

26 files changed

Lines changed: 4153 additions & 474 deletions

cmd/publisher/README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,9 @@ make dev-compose # Start local registry
2121

2222
### Commands
2323
- **`init`** - Generate server.json templates with auto-detection
24-
- **`login`** - Handle authentication (github, dns, http, none)
24+
- **`login`** - Handle authentication (github, dns, http, none)
2525
- **`publish`** - Validate and upload servers to registry
26+
- **`status`** - Update server lifecycle status (active, deprecated, deleted)
2627
- **`logout`** - Clear stored credentials
2728

2829
### Authentication Providers

cmd/publisher/commands/status.go

Lines changed: 375 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,375 @@
1+
package commands
2+
3+
import (
4+
"bufio"
5+
"bytes"
6+
"context"
7+
"encoding/json"
8+
"errors"
9+
"flag"
10+
"fmt"
11+
"io"
12+
"net/http"
13+
"net/url"
14+
"os"
15+
"path/filepath"
16+
"strings"
17+
)
18+
19+
// StatusUpdateRequest represents the request body for status update endpoints
20+
type StatusUpdateRequest struct {
21+
Status string `json:"status"`
22+
StatusMessage *string `json:"statusMessage,omitempty"`
23+
}
24+
25+
// AllVersionsStatusResponse represents the response from the all-versions status endpoint
26+
type AllVersionsStatusResponse struct {
27+
UpdatedCount int `json:"updatedCount"`
28+
}
29+
30+
// VersionInfo holds version and status for display
31+
type VersionInfo struct {
32+
Version string
33+
Status string
34+
}
35+
36+
// ServerResponseMeta represents the _meta field in API responses
37+
type ServerResponseMeta struct {
38+
Official *struct {
39+
Status string `json:"status"`
40+
} `json:"io.modelcontextprotocol.registry/official,omitempty"`
41+
}
42+
43+
// SingleServerResponse represents the response from a single server version endpoint
44+
type SingleServerResponse struct {
45+
Server struct {
46+
Version string `json:"version"`
47+
} `json:"server"`
48+
Meta ServerResponseMeta `json:"_meta"`
49+
}
50+
51+
// ServerListResponse represents the response from the versions list endpoint
52+
type ServerListResponse struct {
53+
Servers []SingleServerResponse `json:"servers"`
54+
}
55+
56+
func StatusCommand(args []string) error {
57+
// Parse command flags
58+
fs := flag.NewFlagSet("status", flag.ExitOnError)
59+
status := fs.String("status", "", "New status: active, deprecated, or deleted (required)")
60+
message := fs.String("message", "", "Optional status message explaining the change")
61+
allVersions := fs.Bool("all-versions", false, "Apply status change to all versions of the server")
62+
yes := fs.Bool("yes", false, "Skip confirmation prompt for bulk operations")
63+
fs.BoolVar(yes, "y", false, "Skip confirmation prompt for bulk operations (shorthand)")
64+
65+
if err := fs.Parse(args); err != nil {
66+
return err
67+
}
68+
69+
// Validate required arguments
70+
if *status == "" {
71+
return errors.New("--status flag is required (active, deprecated, or deleted)")
72+
}
73+
74+
// Validate status value
75+
validStatuses := map[string]bool{"active": true, "deprecated": true, "deleted": true}
76+
if !validStatuses[*status] {
77+
return fmt.Errorf("invalid status '%s'. Must be one of: active, deprecated, deleted", *status)
78+
}
79+
80+
// Get server name from positional args
81+
remainingArgs := fs.Args()
82+
if len(remainingArgs) < 1 {
83+
return errors.New("server name is required\n\nUsage: mcp-publisher status --status <active|deprecated|deleted> [flags] <server-name> [version]")
84+
}
85+
86+
serverName := remainingArgs[0]
87+
var version string
88+
89+
// Get version if provided (required unless --all-versions is set)
90+
if !*allVersions {
91+
if len(remainingArgs) < 2 {
92+
return errors.New("version is required unless --all-versions flag is set\n\nUsage: mcp-publisher status --status <active|deprecated|deleted> [flags] <server-name> <version>")
93+
}
94+
version = remainingArgs[1]
95+
}
96+
97+
// Load saved token
98+
homeDir, err := os.UserHomeDir()
99+
if err != nil {
100+
return fmt.Errorf("failed to get home directory: %w", err)
101+
}
102+
103+
tokenPath := filepath.Join(homeDir, TokenFileName)
104+
tokenData, err := os.ReadFile(tokenPath)
105+
if err != nil {
106+
if os.IsNotExist(err) {
107+
return errors.New("not authenticated. Run 'mcp-publisher login <method>' first")
108+
}
109+
return fmt.Errorf("failed to read token: %w", err)
110+
}
111+
112+
var tokenInfo map[string]string
113+
if err := json.Unmarshal(tokenData, &tokenInfo); err != nil {
114+
return fmt.Errorf("invalid token data: %w", err)
115+
}
116+
117+
token := tokenInfo["token"]
118+
registryURL := tokenInfo["registry"]
119+
if registryURL == "" {
120+
registryURL = DefaultRegistryURL
121+
}
122+
123+
// Update status
124+
if *allVersions {
125+
return updateAllVersionsStatus(registryURL, serverName, *status, *message, token, *yes)
126+
}
127+
return updateVersionStatus(registryURL, serverName, version, *status, *message, token)
128+
}
129+
130+
func updateVersionStatus(registryURL, serverName, version, status, statusMessage, token string) error {
131+
// Fetch current status to show "from → to"
132+
currentStatus, err := fetchVersionStatus(registryURL, serverName, version, token)
133+
if err != nil {
134+
return fmt.Errorf("failed to fetch current status: %w", err)
135+
}
136+
137+
_, _ = fmt.Fprintf(os.Stdout, "Updating %s version %s: %s → %s\n", serverName, version, currentStatus, status)
138+
139+
if err := updateServerStatus(registryURL, serverName, version, status, statusMessage, token); err != nil {
140+
return fmt.Errorf("failed to update status: %w", err)
141+
}
142+
143+
_, _ = fmt.Fprintln(os.Stdout, "✓ Successfully updated status")
144+
return nil
145+
}
146+
147+
func updateAllVersionsStatus(registryURL, serverName, status, statusMessage, token string, skipConfirm bool) error {
148+
if !strings.HasSuffix(registryURL, "/") {
149+
registryURL += "/"
150+
}
151+
152+
// Fetch all versions to show current statuses and get count for confirmation
153+
versions, err := fetchAllVersionsStatus(registryURL, serverName, token)
154+
if err != nil {
155+
return fmt.Errorf("failed to fetch current versions: %w", err)
156+
}
157+
158+
if len(versions) == 0 {
159+
return errors.New("no versions found for this server")
160+
}
161+
162+
// Show what will be updated
163+
_, _ = fmt.Fprintf(os.Stdout, "This will update %d version(s) of %s:\n", len(versions), serverName)
164+
for _, v := range versions {
165+
_, _ = fmt.Fprintf(os.Stdout, " %s: %s → %s\n", v.Version, v.Status, status)
166+
}
167+
168+
// Prompt for confirmation unless -y/--yes was provided
169+
if !skipConfirm {
170+
_, _ = fmt.Fprint(os.Stdout, "Continue? [y/N] ")
171+
reader := bufio.NewReader(os.Stdin)
172+
response, err := reader.ReadString('\n')
173+
if err != nil {
174+
return fmt.Errorf("failed to read response: %w", err)
175+
}
176+
response = strings.TrimSpace(strings.ToLower(response))
177+
if response != "y" && response != "yes" {
178+
return errors.New("operation cancelled")
179+
}
180+
}
181+
182+
// Build the request body
183+
requestBody := StatusUpdateRequest{
184+
Status: status,
185+
}
186+
if statusMessage != "" {
187+
requestBody.StatusMessage = &statusMessage
188+
}
189+
190+
jsonData, err := json.Marshal(requestBody)
191+
if err != nil {
192+
return fmt.Errorf("error serializing request: %w", err)
193+
}
194+
195+
// URL encode the server name
196+
encodedServerName := url.PathEscape(serverName)
197+
statusURL := registryURL + "v0/servers/" + encodedServerName + "/status"
198+
199+
req, err := http.NewRequestWithContext(context.Background(), http.MethodPatch, statusURL, bytes.NewBuffer(jsonData))
200+
if err != nil {
201+
return fmt.Errorf("error creating request: %w", err)
202+
}
203+
req.Header.Set("Content-Type", "application/json")
204+
req.Header.Set("Authorization", "Bearer "+token)
205+
206+
client := &http.Client{}
207+
resp, err := client.Do(req)
208+
if err != nil {
209+
return fmt.Errorf("error sending request: %w", err)
210+
}
211+
defer resp.Body.Close()
212+
213+
body, err := io.ReadAll(resp.Body)
214+
if err != nil {
215+
return fmt.Errorf("error reading response: %w", err)
216+
}
217+
218+
if resp.StatusCode != http.StatusOK {
219+
return fmt.Errorf("server returned status %d: %s", resp.StatusCode, body)
220+
}
221+
222+
// Parse response to get updated count
223+
var response AllVersionsStatusResponse
224+
if err := json.Unmarshal(body, &response); err != nil {
225+
// If we can't parse the response, just report success
226+
_, _ = fmt.Fprintln(os.Stdout, "✓ Successfully updated all versions")
227+
return nil
228+
}
229+
230+
_, _ = fmt.Fprintf(os.Stdout, "✓ Successfully updated %d version(s)\n", response.UpdatedCount)
231+
return nil
232+
}
233+
234+
func updateServerStatus(registryURL, serverName, version, status, statusMessage, token string) error {
235+
if !strings.HasSuffix(registryURL, "/") {
236+
registryURL += "/"
237+
}
238+
239+
// Build the request body
240+
requestBody := StatusUpdateRequest{
241+
Status: status,
242+
}
243+
if statusMessage != "" {
244+
requestBody.StatusMessage = &statusMessage
245+
}
246+
247+
jsonData, err := json.Marshal(requestBody)
248+
if err != nil {
249+
return fmt.Errorf("error serializing request: %w", err)
250+
}
251+
252+
// URL encode the server name and version
253+
encodedServerName := url.PathEscape(serverName)
254+
encodedVersion := url.PathEscape(version)
255+
statusURL := registryURL + "v0/servers/" + encodedServerName + "/versions/" + encodedVersion + "/status"
256+
257+
req, err := http.NewRequestWithContext(context.Background(), http.MethodPatch, statusURL, bytes.NewBuffer(jsonData))
258+
if err != nil {
259+
return fmt.Errorf("error creating request: %w", err)
260+
}
261+
req.Header.Set("Content-Type", "application/json")
262+
req.Header.Set("Authorization", "Bearer "+token)
263+
264+
client := &http.Client{}
265+
resp, err := client.Do(req)
266+
if err != nil {
267+
return fmt.Errorf("error sending request: %w", err)
268+
}
269+
defer resp.Body.Close()
270+
271+
body, err := io.ReadAll(resp.Body)
272+
if err != nil {
273+
return fmt.Errorf("error reading response: %w", err)
274+
}
275+
276+
if resp.StatusCode != http.StatusOK {
277+
return fmt.Errorf("server returned status %d: %s", resp.StatusCode, body)
278+
}
279+
280+
return nil
281+
}
282+
283+
func fetchVersionStatus(registryURL, serverName, version, token string) (string, error) {
284+
if !strings.HasSuffix(registryURL, "/") {
285+
registryURL += "/"
286+
}
287+
288+
encodedServerName := url.PathEscape(serverName)
289+
encodedVersion := url.PathEscape(version)
290+
fetchURL := registryURL + "v0/servers/" + encodedServerName + "/versions/" + encodedVersion + "?include_deleted=true"
291+
292+
req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, fetchURL, nil)
293+
if err != nil {
294+
return "", fmt.Errorf("error creating request: %w", err)
295+
}
296+
req.Header.Set("Authorization", "Bearer "+token)
297+
298+
client := &http.Client{}
299+
resp, err := client.Do(req)
300+
if err != nil {
301+
return "", fmt.Errorf("error sending request: %w", err)
302+
}
303+
defer resp.Body.Close()
304+
305+
body, err := io.ReadAll(resp.Body)
306+
if err != nil {
307+
return "", fmt.Errorf("error reading response: %w", err)
308+
}
309+
310+
if resp.StatusCode != http.StatusOK {
311+
return "", fmt.Errorf("server returned status %d: %s", resp.StatusCode, body)
312+
}
313+
314+
// Parse the response to extract status
315+
var response SingleServerResponse
316+
if err := json.Unmarshal(body, &response); err != nil {
317+
return "", fmt.Errorf("error parsing response: %w", err)
318+
}
319+
320+
if response.Meta.Official == nil {
321+
return "", errors.New("server response missing status information")
322+
}
323+
324+
return response.Meta.Official.Status, nil
325+
}
326+
327+
func fetchAllVersionsStatus(registryURL, serverName, token string) ([]VersionInfo, error) {
328+
if !strings.HasSuffix(registryURL, "/") {
329+
registryURL += "/"
330+
}
331+
332+
encodedServerName := url.PathEscape(serverName)
333+
fetchURL := registryURL + "v0/servers/" + encodedServerName + "/versions?include_deleted=true"
334+
335+
req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, fetchURL, nil)
336+
if err != nil {
337+
return nil, fmt.Errorf("error creating request: %w", err)
338+
}
339+
req.Header.Set("Authorization", "Bearer "+token)
340+
341+
client := &http.Client{}
342+
resp, err := client.Do(req)
343+
if err != nil {
344+
return nil, fmt.Errorf("error sending request: %w", err)
345+
}
346+
defer resp.Body.Close()
347+
348+
body, err := io.ReadAll(resp.Body)
349+
if err != nil {
350+
return nil, fmt.Errorf("error reading response: %w", err)
351+
}
352+
353+
if resp.StatusCode != http.StatusOK {
354+
return nil, fmt.Errorf("server returned status %d: %s", resp.StatusCode, body)
355+
}
356+
357+
var response ServerListResponse
358+
if err := json.Unmarshal(body, &response); err != nil {
359+
return nil, fmt.Errorf("error parsing response: %w", err)
360+
}
361+
362+
var versions []VersionInfo
363+
for _, s := range response.Servers {
364+
status := "unknown"
365+
if s.Meta.Official != nil {
366+
status = s.Meta.Official.Status
367+
}
368+
versions = append(versions, VersionInfo{
369+
Version: s.Server.Version,
370+
Status: status,
371+
})
372+
}
373+
374+
return versions, nil
375+
}

0 commit comments

Comments
 (0)