[robertjamesprior]

publish-mcp.yml has never successfully published. It ran ten times on 2025-09-10, failed every time, and its push trigger was commented out with the note "Paused before we have a remote mcp server and already published it". Both halves of that note are now false, and the live registry entry has been stale since 2025-09-09.

Why every run failed

The live entry was published 2025-09-09 18:04, out of band. Every one of the ten runs the next day was triggered by a push to main with server.json still at version 1.0.0, and the registry rejects that:

return fmt.Errorf("%w: %s@%s already exists", database.ErrInvalidVersion, serverJSON.Name, serverJSON.Version)

So the publish step could not have succeeded regardless of what the login step did. Run logs are expired, so I cannot confirm whether login was also failing, which is why this change hardens both.

Changes

• Skip when the version is already live. Queries the registry for the published version and compares it to server.json. This is what makes re-enabling the push trigger safe: a merge that does not touch version is a no-op rather than a red build. The trigger is also pathed to server.json.
• Install the released binary (v1.8.1) instead of cloning the registry and running make publisher. Removes the Go toolchain, a full clone, and an unpinned dependency on that repo's main.
• Derive the signing seed from the DER tail rather than parsing openssl pkey -text output with awk. For Ed25519 the 48-byte PKCS#8 DER ends with the 32-byte seed, which is exactly the 64 hex characters login dns wants.
• Check the secret against DNS before login. Reconstructs the public key from the seed and compares it to the v=MCPv1 record at the onkernel.com apex. A mismatch now fails with a message naming both keys instead of an opaque 401.
• Drop the Node setup and id-token: write. Neither is used. DNS auth signs in process, and github-oidc would only authenticate an io.github.* namespace, not com.onkernel/*.

Testing

Requires MCP_PRIVATE_KEY, so login and publish are unverified end to end. Everything either side of them is verified:

• Seed derivation and public-key reconstruction round-trip against a throwaway Ed25519 key, matching openssl pkey -pubout byte for byte.
• The DNS lookup returns the live published key, rmb4S9RJozgGFvf91MZakyUlRNTIKjzXB6c8tAOiI9M=.
• The mismatch branch fires correctly when given a key that is not the published one.
• The version check against the live registry reports 1.0.0 -> 1.1.0, so the next run will publish rather than skip.
• mcp-publisher_linux_amd64.tar.gz contains mcp-publisher at the archive root and --version exits 0.

whoever dispatches this first should confirm MCP_PRIVATE_KEY still holds the base64 body of the PKCS#8 key whose public half is in DNS. If it does, the DNS pre-check passes and publishing should work. If it does not, the pre-check will say so in one line.

---

Note

Medium Risk
Touches external registry publishing and DNS-authenticated signing secrets in CI; misconfiguration could block publishes or expose key-handling issues, though duplicate publishes are guarded and keys are masked.

Overview
Re-enables automated MCP registry publishing when server.json changes on main, after the workflow had been paused and was failing on duplicate-version publishes.

The workflow now queries the live registry and skips install/login/publish when the version in server.json already matches what is published, so routine merges do not fail. It installs the pinned mcp-publisher release (v1.8.1) instead of building from the registry repo, derives the Ed25519 DNS login seed from the PKCS#8 secret, and validates that secret against the apex v=MCPv1 TXT record before login. Unused Node.js setup and id-token permissions are removed.

^{Reviewed by Cursor Bugbot for commit a8c2a20. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Oct 19, 2026 3:34pm UTC

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 925df1c. Configure here.}