Starstruk Logo MarkStarstruk

v1.8.0

modelcontextprotocol/registryv1.8.0Jul 13, 2026by rdimitrov

AI Summary

This release adds support for the Cargo (crates.io) package registry type and includes significant security and validation improvements. It also hardens authentication logic and fixes various API behaviors.

Key Highlights

  • Add cargo (crates.io) as a new package registry type
  • Harden mcp-name matching and distinguish missing packages from missing versions
  • Grant org namespace ownership exclusively to org Owners
  • Allow PATCH in CORS to enable browser access to status endpoints

New Features

  • Add cargo (crates.io) as a package registry type
  • Allow PATCH in CORS for browsers

Full Release Notes

## What's Changed
* deploy: update prod to v1.7.9 by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1282
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.237.0 to 3.238.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1283
* chore(deps): reduce dependabot frequency from daily to weekly by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1284
* build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1292
* build(deps): bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1295
* build(deps): bump github.com/danielgtaylor/huma/v2 from 2.37.3 to 2.38.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1296
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.238.0 to 3.242.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1297
* build(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 in the actions group by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1299
* build(deps): bump golang.org/x/net to v0.55.0 by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1308
* build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.30.0 to 4.31.1 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1298
* docs: update maintainer/collaborator matrix in README by @tadasant in https://github.com/modelcontextprotocol/registry/pull/1324
* build(deps): bump the actions group with 2 updates by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1314
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.242.0 to 3.243.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1313
* build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys from 1.4.0 to 1.5.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1312
* build(deps): bump the opentelemetry group with 5 updates by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1311
* feat: add cargo (crates.io) as a package registry type by @Wolfe-Jam in https://github.com/modelcontextprotocol/registry/pull/1207
* build(deps): bump go.opentelemetry.io/contrib/instrumentation/runtime from 0.68.0 to 0.69.0 in the opentelemetry group by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1332
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.243.0 to 3.244.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1333
* build(deps): bump github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1334
* fix(cargo): harden README fetch, clarify status handling, strengthen tests by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1330
* fix(validators): harden mcp-name matching (PyPI/NuGet anchoring, comment-form safe) + cargo follow-ups by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1331
* fix: client-cancelled GET /v0/servers returns 499 without error log by @advancedresearcharray in https://github.com/modelcontextprotocol/registry/pull/1335
* fix: don't leak internal error detail in GET /v0/servers 500 response by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1338
* build(deps): bump the actions group with 2 updates by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1392
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.244.0 to 3.248.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1391
* build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1375
* build(deps): bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1374
* build(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1373
* Fix broken reference documentation links by @kriptoburak in https://github.com/modelcontextprotocol/registry/pull/1387
* build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.31.1 to 4.32.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1353
* ci: auto-close PRs that try to publish servers via the repo by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1393
* build(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1428
* build(deps): bump github.com/coreos/go-oidc/v3 from 3.19.0 to 3.20.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1429
* build(deps): bump the actions group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1430
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.248.0 to 3.251.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1431
* fix(auth): grant org namespace only to org Owners, not all members by @tadasant in https://github.com/modelcontextprotocol/registry/pull/1383
* build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1433
* docs(auth): document fine-grained PAT permission for org publishing (+ pagination-cap test) by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1435
* docs: add polygraph to community projects by @RubenSousaDinis in https://github.com/modelcontextprotocol/registry/pull/1421
* fix(ci): re-validate author association via REST in close-invalid-publish-prs by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1440
* fix: reject mangled publisher metadata by @he-yufeng in https://github.com/modelcontextprotocol/registry/pull/1310
* fix(api): allow PATCH in CORS so browsers can call the status endpoints by @JosephDoUrden in https://github.com/modelcontextprotocol/registry/pull/1436
* test(api): remove placeholder CORS test superseded by #1436 by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1441
* fix(validators): distinguish a missing package from a missing version on PyPI/NPM by @sronix in https://github.com/modelcontextprotocol/registry/pull/1411

## New Contributors
* @Wolfe-Jam made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1207
* @advancedresearcharray made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1335
* @kriptoburak made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1387
* @RubenSousaDinis made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1421
* @he-yufeng made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1310
* @sronix made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1411

**Full Changelog**: https://github.com/modelcontextprotocol/registry/compare/v1.7.9...v1.8.0