MCP Registry
Central control plane for MCP server registration, tool discovery, allow-lists, health monitoring, and audit — for ADK-Rust Enterprise.
Why
Without a registry, MCP servers are ad hoc per-agent connectors with no visibility, governance, or control. The MCP Registry ensures every server, tool, credential binding, and exposure decision is centrally managed and auditable.
Tools (10)
Example Workflow
> register_mcp_server(name: "github-tools", transport: "stdio", command: "npx -y @modelcontextprotocol/server-github", ...)
{ "server_id": "mcp_github_tools_sta", "version": 1, "status": "registered" }
> test_mcp_server(server_id: "mcp_github_tools_sta")
{ "connectivity": true, "schema_valid": true, "latency_ms": 45, "result": "passed" }
> discover_mcp_tools(server_id: "mcp_github_tools_sta", tools: [...])
{ "snapshot_id": "disc_abc123", "tools_count": 13, "diff": { "added_tools": ["search_repositories", ...] } }
> set_tool_allowlist(server_id: "mcp_github_tools_sta", tool_names: ["search_repositories", "get_file_contents"], ...)
{ "entries": 2, "status": "active" }
> list_mcp_servers()
[{ "id": "mcp_github_tools_sta", "name": "github-tools", "status": "active", "tools_discovered": 13, "tools_allowed": 2 }]
> disable_mcp_server(server_id: "mcp_github_tools_sta")
{ "status": "disabled", "message": "Server removed from active routing. History preserved." }
Key Concepts
- Discovery ≠ Exposure — discovering tools does not expose them to agents. Explicit allow-listing is required.
- Versioned definitions — every update creates a new immutable version for rollback.
- Credential indirection — servers reference vault credentials, never raw secrets.
- Audit trail — all mutations emit audit events with actor, action, and timestamp.
- Environment isolation — servers are scoped to dev/staging/production.
Installation
cargo install mcp-registry
Or build from source:
git clone https://github.com/zavora-ai/mcp-registry
cd mcp-registry
cargo build --release
MCP Client Config
{
"mcpServers": {
"registry": {
"command": "/path/to/mcp-registry"
}
}
}
Documentation
Governance
- Production allow-list changes require policy simulation
- Write-capable tool exposure requires Platform Admin approval
- All mutations are audit-logged
- Credential bindings reference vault entries only
Implementation Phases
License
Apache-2.0
Part of the ADK-Rust Enterprise MCP server ecosystem.
Registry Compliance
This server implements the ADK MCP SDK contract:
- HealthCheck — async health probe for registry monitoring
- mcp-server.toml — manifest declaring tools, risk classes, and credentials
- Structured tracing —
RUST_LOGenv-filter for observability
rmcp and MCP compatibility
This server is built with rmcp 3.1.2 and requires Rust 1.94.1 or newer. The rmcp 3 rollout retains legacy MCP initialization compatibility and targets MCP protocol revisions 2025-11-25 and 2026-07-28.
MCP 2026-07-28 rollout (P4 workflow/business)
This server uses rmcp 3.1.2 and adk-mcp-sdk 0.2 with a minimum supported
Rust version of 1.94.1. It accepts stateless MCP 2026 requests with
per-request protocol, client identity, and capability metadata while retaining
the legacy MCP 2025-11-25 initialize flow for ordinary tools.
- Tasks:
discover_mcp_tools,export_mcp_inventory - MRTR approvals: None; this server exposes no manifest-classified protected operations.
- Discovery and routing: rmcp serves on-demand discovery and validates the
per-request protocol envelope; HTTP deployments can route with
Mcp-MethodandMcp-Name. The packaged binary currently uses stdio. - Caching:
tools/listreturns a publicttlMsof 60,000 for MCP 2026; rmcp omits the cache fields for legacy clients. - Deprecated extensions: this server does not add new Roots, Sampling, or dynamic client-registration dependencies.
Protected tools require MCP_REQUEST_STATE_KEY with at least 32 high-entropy
bytes. All replicas must share that key so sealed approval state can resume on
another instance. Approval state is bound to the client identity, tool, and
arguments and expires after two minutes. Missing identity, invalid state,
rejection, or legacy protocol use fails closed. Task records are process-local
for the current stdio runtime; use a durable task store before deploying the
server behind scale-to-zero HTTP infrastructure.