Stop fighting with npm tokens just to list a Model Context Protocol server. The official MCP registry supports multiple package types, and one of them, MCPB, requires nothing more than a GitHub release. This approach bypasses the need for an npm account, a token, or a publish step, allowing developers to ship server.json metadata directly from their repo.

The MCPB Path to Registry Listing

The registry stores metadata, not code. Each entry in server.json points to a package hosted elsewhere, supporting npm, PyPI, NuGet, Docker/OCI, Cargo, and MCPB. For MCPB specifically, the rules are strict but simple: the file must exist on a GitHub or GitLab release, the URL must contain the string 'mcp', and server.json must include the file's SHA-256 hash in the fileSha256 field. Authentication is equally streamlined for GitHub users. By using the server name format io.github./, you can leverage OIDC within GitHub Actions. This means the registry login requires no stored secrets, significantly reducing the setup friction for new projects or those avoiding npm infrastructure entirely.

Bundling and Hashing Gotchas

An MCP Bundle is a zip archive containing the server and a manifest.json. Using the @anthropic-ai/mcpb tool at version 2.1.2, developers can validate and pack their servers. However, a critical pitfall exists: rebuilding the bundle creates a new file with different entry timestamps, resulting in a different SHA-256 hash even if the contents are identical. The hash in server.json must match the exact file uploaded to the release, not a rebuilt version. To avoid this, the workflow should download the existing release asset and verify its hash against server.json before publishing. The mcp-publisher tool validates the server.json against the live registry, ensuring the metadata is correct before any changes go live. This step prevents registry mismatches that could break client installations.

Automating the Release and Publish

The recommended workflow triggers on a mcp-v* tag. It runs tests, downloads the release asset, and checks the hash before proceeding. With id-token: write permissions enabled in GitHub Actions, the workflow can log in via OIDC and publish using mcp-publisher. A successful run takes seconds, ending with a 'Successfully published' message. Verification should always happen via the registry API, not just the action logs. A simple curl request to the registry endpoint confirms the server's status as 'active' and 'isLatest'. While this method skips npx installation paths, it provides a robust, secret-free distribution channel for MCP servers.

Key Takeaways

  • MCPB files allow registry listing without npm tokens or accounts.
  • The SHA-256 hash in server.json must match the exact uploaded file, not a rebuild.
  • GitHub OIDC authentication eliminates the need for stored registry secrets.
  • Verify publication by querying the registry API directly, not just checking CI logs.

The Bottom Line

For developers who want to avoid npm dependency hell, MCPB via GitHub releases is the cleanest path to the official registry. Just remember that the hash is immutable: pack it once, upload it once, and never rebuild it after generating the hash.