MCP-REG-002

Namespace ownership is verifiable (GitHub or DNS TXT)

“Publishers must verify ownership of their namespace through GitHub, DNS, or HTTP challenges, preventing arbitrary spam submissions.” — spec anchor

How to fix this

Verify ownership of your server's namespace — through GitHub, DNS, or an HTTP challenge — before publishing. This namespace authentication is what stops someone else from publishing under a name tied to your GitHub account or domain.

Example: failing and passing

example.com serves no MCPv1 proof at /.well-known/mcp-registry-auth (and, in this example, has no DNS TXT proof either), so its claim to com.example/weather cannot be verified.

Violates MCP-REG-002 · HTTP

GET /.well-known/mcp-registry-auth HTTP/1.1
Host: example.com

HTTP/1.1 404 Not Found

example.com serves the MCPv1 public-key proof that the registry checks, with a signature from the matching private key, before allowing publishes under com.example/*.

Complies with MCP-REG-002 · HTTP

GET /.well-known/mcp-registry-auth HTTP/1.1
Host: example.com

HTTP/1.1 200 OK
Content-Type: text/plain

v=MCPv1; k=ed25519; p=<base64 Ed25519 public key>

How the validator checks this

This rule is catalogued from the specification but is not yet checked automatically. No probe emits a finding for it, so it never appears in a report as pass, warn or fail. It is documented here because it is a real requirement of the specification — it is simply not one this validator can confirm for you yet.

Check your own server against MCP-REG-002

The validator does not check MCP-REG-002 automatically yet, so confirm it by hand against the examples above. It does check 73 of the 79 rules — validate a server to see those.

Background on this topic: how to publish to the official registry.