[Aymericr]

What does this PR do?

Adds .github/workflows/mcp-registry-deprecate-legacy.yml, which can only be run manually (workflow_dispatch). It installs mcp-publisher v1.8.1, checks its SHA-256 against the release's published registry_1.8.1_checksums.txt (the same pin mcp-registry.yml uses), and logs in with github-oidc. It then runs:

mcp-publisher status --status <input> --message "Superseded by app.pascal/editor" --all-versions --yes io.github.pascalorg/editor

The goal is to free the remote URL https://editor.pascal.app/api/mcp so that app.pascal/editor can be published. The status input can be deleted (the default) or deprecated. Upstream's duplicate-remote-URL check (validateNoDuplicateRemoteURLs with status != 'deleted' in internal/database/postgres.go) only skips deleted entries, so only deleted frees the URL. The command uses --all-versions instead of pinning 0.6.1, and --yes because bulk updates prompt for confirmation.

How to test

1. After merge, run the workflow from the Actions tab with status: deleted.
2. Check that https://registry.modelcontextprotocol.io/v0/servers?search=io.github.pascalorg/editor no longer lists the entry, and that publishing app.pascal/editor with the same remote URL succeeds.

Screenshots / screen recording

N/A — non-visual change

Checklist

• I've tested this locally with bun dev
• My code follows the existing code style (run bun check to verify)
• I've updated relevant documentation (if applicable)
• This PR targets the main branch

  

---

Note

Low Risk
Adds an opt-in Actions workflow with no runtime app changes; risk is limited to incorrect manual registry status updates.

^{Reviewed by Cursor Bugbot for commit e335e67. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T21:48:10.531326Z	d10cdd1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Aymericr]

Triage review. The workflow itself looks clean (manual-only trigger, minimal id-token: write + contents: read, flags before the server name), but as written it won't achieve the goal of freeing https://editor.pascal.app/api/mcp.

I checked upstream modelcontextprotocol/registry on main: validateNoDuplicateRemoteURLs (internal/service/registry_service.go) calls ListServers with a RemoteURL filter and rejects the publish if any returned server has a different name. ListServers (internal/database/postgres.go) only excludes rows where status = 'deleted'. So a deprecated io.github.pascalorg/editor will still block publishing app.pascal/editor. The caveat in the description is right, it's not just a probability.

Suggested changes before merge:

1. Use --status deleted (the publisher accepts active|deprecated|deleted, and a deleted entry can be restored via the status endpoint), or make status a workflow_dispatch input with deleted as the default so it's a deliberate choice at run time. Deleting drops the deprecation message for anyone still resolving the old name, so this is a maintainer call.
2. Pin mcp-publisher to a specific release (and ideally verify its checksum) instead of releases/latest, since this job mints an OIDC token that can change our registry entry.

Non-visual change, so no screenshots needed. Holding the merge until CI finishes and the status question is settled.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d10cdd1d2d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Delete the legacy entry to release its remote URL

When this workflow is run to unblock publishing app.pascal/editor, deprecated will not release https://editor.pascal.app/api/mcp: the registry's remote-URL lookup excludes only entries whose status is deleted (buildFilterConditions adds status != 'deleted'), so the subsequent publish will still find the legacy entry and reject the duplicate URL. Use --status deleted for all versions rather than requiring the migration to fail first. Upstream registry implementation

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Pin and verify the privileged publisher binary

When this manually dispatched workflow runs, the mutable latest archive is executed with id-token: write and then obtains registry edit authority, so an upstream compromise or incompatible release can alter Pascal's registry entries without any reviewed repository change. Pin a known publisher version and verify its SHA-256 before extraction, as .github/workflows/mcp-registry.yml already does.

Useful? React with 👍 / 👎.

[Aymericr]

Re-reviewed. Both asks are addressed. The status is now a choice that defaults to deleted, which is the status that frees the remote URL, and mcp-publisher is pinned to v1.8.1 with a SHA-256 check. Permissions are minimal (id-token: write, contents: read) and the workflow only runs on manual dispatch. LGTM. It needs a second maintainer's approval or an admin merge, since it was opened under this account.