chore(release): publish the MCP Registry listing with every release

[jfrench9]

Summary

server.json pins an exact xbrlkit version, and clients that install from the Official MCP Registry run exactly that version. The listing was published by hand and had fallen behind: the registry lists 0.16.4 while 0.16.5 is on PyPI. Registry installs were therefore missing the latest fixes, tool changes and the /view link.

The listing now moves with the package. Cutting a release bumps server.json alongside pyproject.toml. The gated publish job validates the listing before the PyPI upload and lists it on the registry right after.

Changes

• create-release.yml: the version-bump step rewrites the two version fields in server.json and commits it with pyproject.toml. The rewrite is byte-for-byte apart from those two fields.
• publish.yml, inside the existing production-gated job:
  • Before anything irreversible, it checks that server.json names this release and that the README carries the mcp-name ownership token.
  • It runs mcp-publisher validate, which needs no login, so a listing the registry would reject stops the job before a PyPI version number is used up.
  • After the upload, it waits for PyPI to serve the version, logs in by DNS for the ai.robosystems namespace, and publishes.
  • It skips a version that is already listed, and fails with a clear error if the secret is missing.
• mcp-publisher: pinned to v1.8.1 by the sha256 in that release's checksum file, and installed under $RUNNER_TEMP so the build can't sweep the binary into the sdist.
• tests/test_server_json.py:
  • server.json and pyproject.toml must name the same version.
  • The package identifier and the README token must match.
  • The description must fit the registry's 100 characters.
  • A tool count in the description ("18 tools") must equal the MCP server's real tool list. Adding or removing a tool now fails CI until the description is updated.
• server.json: bumped to 0.16.5, the current release.

Output Impact

INTERNAL. No package code or serialization changes. The published listing changes version on every release from now on.

Testing

• Gate. just test-all passes: ruff, format, basedpyright, and pytest with 534 passed and 2 skipped.
• Drift checks. Setting server.json's package version back to 0.16.4 and the description to "19 tools" fails exactly the version and tool-count tests.
• Release rewrite. The version-bump snippet, extracted from create-release.yml and run on a copy of server.json, changed only the two version lines.
• Publish step with no key.
  • For 0.16.4, which is listed, the script prints "already listed" and exits 0.
  • For 0.16.5, which isn't, it fails with the missing-secret error before calling the publisher.
• Registry check. mcp-publisher validate server.json passes against the live registry with an empty home directory, so it needs no saved login.
• Lint. actionlint reports the same notes on both workflows as on main, so there are none new.

Not exercised: the real login and publish in Actions. That first runs on the next release.

Before the next release

The publish job needs the registry key as a production environment secret named MCP_REGISTRY_PRIVATE_KEY, holding the hex Ed25519 seed for the robosystems.ai DNS record. Without it, the release still publishes to PyPI and the job then fails at the registry step with that error.

🤖 Generated with Claude Code