feat: verify job for mcp server publish

Author: KunalSin9h

.github/workflows/publish-mcp.yml

@@ -1,7 +1,9 @@
 name: Publish to MCP Registry
 
-on:
-  workflow_dispatch: # Manually publishing, since we have to update hardcoded version in server.json (mcp registry)
+on: # Every new version release of `vet`
+  push:
+    tags:
+      - 'v*'
 
 jobs:
   publish:
@@ -11,11 +13,19 @@ jobs:
       contents: read
 
     steps:
+      - name: Ensure jq is installed
+        run: sudo apt-get update && sudo apt-get install -y jq
+
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+
+      - name: Get version from tag
+        run: echo "VET_VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV
 
-      ### Publish MCP server:
+      - name: fill version in server.json 
+        run: sed -i "s/VERSION_FROM_ENV/$VET_VERSION/g" server.json
 
+      # publish mcp server
       - name: Install mcp-publisher
         run: |
           curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
@@ -26,3 +36,56 @@ jobs:
       - name: Publish server to MCP Registry
         run: ./mcp-publisher publish
 
+  verify-publish:
+    runs-on: ubuntu-latest
+    needs: publish
+
+    steps:
+      - name: Ensure jq is installed
+        run: sudo apt-get update && sudo apt-get install -y jq
+
+      - name: Get version from tag
+        run: echo "VET_VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV
+
+      - name: Query MCP Registry and verify server is published
+        env:
+          SERVER_NAME: "io.github.safedep/vet-mcp"
+          EXPECTED_VERSION: $VET_VERSION
+          REGISTRY_URL: "https://registry.modelcontextprotocol.io/v0.1/servers"
+        run: |
+          echo "Checking MCP Registry for $SERVER_NAME"
+
+          # Query registry
+          url="${REGISTRY_URL}?search=${SERVER_NAME}"
+          echo "Requesting: $url"
+          http_status=$(curl -s -o response.json -w "%{http_code}" "$url")
+          if [ "$http_status" -ne 200 ]; then
+            echo "Registry query failed with HTTP status $http_status"
+            cat response.json || true
+            exit 1
+          fi
+
+          # Pretty print the response for debugging
+          echo "Registry response (truncated):"
+          jq 'if .servers then {servers: (.servers | length)} else . end' response.json
+
+          # Verify server name exists in servers array
+          if [ -z "$EXPECTED_VERSION" ]; then
+            # Only check for presence by name
+            jq -e --arg name "$SERVER_NAME" '.servers[]? | select(.name == $name)' response.json >/dev/null || {
+              echo "ERROR: Server $SERVER_NAME not found in registry response"
+              echo "Full response:"
+              cat response.json
+              exit 1
+            }
+            echo "Found server $SERVER_NAME"
+          else
+            # Check for both name and version match
+            jq -e --arg name "$SERVER_NAME" --arg ver "$EXPECTED_VERSION" '.servers[]? | select(.name == $name and (.version == $ver or (.packages[]? | select(.version==$ver) // empty)))' response.json >/dev/null || {
+              echo "ERROR: Server $SERVER_NAME with version $EXPECTED_VERSION not found"
+              echo "Full response:"
+              cat response.json
+              exit 1
+            }
+            echo "Found server $SERVER_NAME with version $EXPECTED_VERSION"
+          fi

server.json

@@ -3,7 +3,7 @@
   "name": "io.github.safedep/vet-mcp",
   "title": "SafeDep Vet MCP",
   "description": "The Vet MCP server helps in vetting open source packages before they are used in a project through AI generated code. Vet MCP server can protect against Slopsquatting attacks, malicious packages, vulnerabilities and other security risks.",
-  "version": "1.12.8", 
+  "version": "VERSION_FROM_ENV",
   "websiteUrl": "https://safedep.io",
   "icons": [
     {
@@ -28,8 +28,8 @@
   "packages": [
     {
       "registryType": "oci",
-      "identifier": "ghcr.io/safedep/vet:v1.12.8",
-      "version": "v1.12.8",
+      "identifier": "ghcr.io/safedep/vet:VERSION_FROM_ENV",
+      "version": "VERSION_FROM_ENV",
       "runtimeHint": "docker",
       "runtimeArguments": [
         {