Starstruk Logo MarkStarstruk

v1.4.1

modelcontextprotocol/registryv1.4.1Feb 10, 2026by rdimitrov

AI Summary

Patch release with security fixes, enhanced validation, and UI improvements. Includes vulnerability resolution by upgrading Go to 1.24.13 and adds a new /validate endpoint for server.json validation.

Key Highlights

  • Security fix: reject requests with NUL bytes in URL (including URL-encoded %00)
  • Added /validate endpoint for centralized validation
  • Enhanced server.json validation (phase 1)
  • Default to local registry in the UI
  • Allow template variables in transport URL field

New Features

  • Added /validate endpoint for centralized validation
  • Template variables support in transport URL field
  • Enhanced server.json validation (phase 1)
  • Local registry as default in UI

Full Release Notes

## What's Changed
* Revert "Restrict @claude bot to mcp org only, fix fork behavior" by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/851
* Promote prod to 1.4.0 by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/852
* Ensure no downtime during rollouts by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/854
* Default to the local registry in the UI by @filmor in https://github.com/modelcontextprotocol/registry/pull/799
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.212.0 to 3.213.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/856
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.213.0 to 3.214.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/872
* build(deps): bump anchore/sbom-action from 0.20.11 to 0.21.0 in the actions group by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/860
* build(deps): bump github.com/jackc/pgx/v5 from 5.7.6 to 5.8.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/864
* fix(api): reject requests with NUL bytes in URL by @majiayu000 in https://github.com/modelcontextprotocol/registry/pull/869
* fix(publisher): add --help support for subcommands by @majiayu000 in https://github.com/modelcontextprotocol/registry/pull/867
* chore: update licensing to Apache 2.0 for new contributions by @domdomegg in https://github.com/modelcontextprotocol/registry/pull/887
* build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/888
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.214.0 to 3.215.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/880
* build(deps): bump golang.org/x/mod from 0.31.0 to 0.32.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/883
* Handle URL-encoded NUL bytes (%00) in URL path and query by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/877
* docs: Add MCP registry browser to the `community-projects.md` page by @vemonet in https://github.com/modelcontextprotocol/registry/pull/889
* Enhanced server.json validation (phase 1) by @BobDickinson in https://github.com/modelcontextprotocol/registry/pull/636
* build(deps): bump github.com/danielgtaylor/huma/v2 from 2.34.1 to 2.35.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/905
* build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.24.1 to 4.25.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/899
* build(deps): bump cloud.google.com/go/kms from 1.23.2 to 1.24.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/891
* build(deps): bump actions/checkout from 4 to 6 in the actions group by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/892
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.215.0 to 3.216.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/898
* docs: Fix errors and typos in public documentation by @jonathanhefner in https://github.com/modelcontextprotocol/registry/pull/909
* build(deps): bump anchore/sbom-action from 0.21.1 to 0.22.0 in the actions group by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/911
* docs: Add preview disclaimer note to public documentation by @jonathanhefner in https://github.com/modelcontextprotocol/registry/pull/908
* build(deps): bump cloud.google.com/go/kms from 1.24.0 to 1.25.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/913
* build(deps): bump anchore/sbom-action from 0.22.0 to 0.22.1 in the actions group by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/920
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.216.0 to 3.217.1 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/919
* Added /validate endpoint and modified mcp-publish so that all validation happens there by @BobDickinson in https://github.com/modelcontextprotocol/registry/pull/896
* Resolve vulnerability warnings by bumping Go to 1.24.12 by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/934
* build(deps): bump go.opentelemetry.io/otel/metric from 1.39.0 to 1.40.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/930
* build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/933
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.217.1 to 3.218.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/924
* build(deps): bump github.com/golang-jwt/jwt/v5 from 5.3.0 to 5.3.1 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/922
* build(deps): bump go.opentelemetry.io/otel from 1.39.0 to 1.40.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/927
* build(deps): bump go.opentelemetry.io/otel/sdk/metric from 1.39.0 to 1.40.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/928
* build(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/929
* build(deps): bump go.opentelemetry.io/otel/exporters/prometheus from 0.61.0 to 0.62.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/939
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.218.0 to 3.219.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/941
* Group otel dependencies in a single dependabot PR by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/935
* Resolve vulnerability warnings by bumping Go to 1.24.13 by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/938
* build(deps): bump go.opentelemetry.io/contrib/instrumentation/runtime from 0.64.0 to 0.65.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/940
* feat(schema): allow template variables in transport URL field by @tadasant in https://github.com/modelcontextprotocol/registry/pull/910
* build(deps): bump golang.org/x/mod from 0.32.0 to 0.33.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/951
* build(deps): bump github.com/go-git/go-git/v5 from 5.16.2 to 5.16.5 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/950

## New Contributors
* @filmor made their first contribution in https://github.com/modelcontextprotocol/registry/pull/799
* @majiayu000 made their first contribution in https://github.com/modelcontextprotocol/registry/pull/869
* @vemonet made their first contribution in https://github.com/modelcontextprotocol/registry/pull/889

**Full Changelog**: https://github.com/modelcontextprotocol/registry/compare/v1.4.0...v1.4.1