On September 8, 2025, the Model Context Protocol project launched the MCP Registry in preview at registry.modelcontextprotocol.io. The registry is an open catalog and API for discovering publicly available MCP servers, built so that clients, marketplaces and enterprises can share one source of truth about which servers exist, where their packages live and who published them. For developers who ship MCP servers, including .NET teams publishing to NuGet, it created a standard way to be found.

Key Facts#

  • Launch: September 8, 2025, announced on the official MCP blog, with the service hosted at registry.modelcontextprotocol.io.
  • What it is: An open catalog and API for publicly available MCP servers. The project README calls it "an app store for MCP servers."
  • Status: Preview. The announcement warned that the preview offered no data durability guarantees and that breaking changes could occur before general availability.
  • Open source: The registry service and its OpenAPI specification are open source, so compatible alternative implementations can exist.
  • Contributors: The launch credited 16 individuals from at least nine companies, including people from Anthropic, GitHub, Block, PulseMCP, Stacklok, Microsoft, VS Code and NuGet.
  • Subregistries: The design supports public subregistries, such as client-specific marketplaces, and private registries that enterprises run on top of the central catalog.
  • Growth: By November 25, 2025, the MCP project reported nearly 2,000 registry entries, a 407% increase since launch.

What Happened#

Before the registry, MCP servers were scattered across GitHub lists, vendor directories and blog posts. Every client that wanted to offer a server marketplace had to crawl and curate that landscape itself, and users had little way to tell an official server from a copy with a similar name.

The registry addresses that with a small, deliberate scope. It stores metadata about servers, not the server code itself. Each entry is described by a server.json document that names the server, points to its source repository and lists the packages that contain it, such as an npm package, a PyPI package, a NuGet package or a container image. Clients read that metadata through the registry API and decide how to install and run the server.

Publishing goes through a command-line tool called mcp-publisher, with init, login and publish commands. The registry ties each server name to a verified namespace. According to the project README, publishers can prove ownership through GitHub OAuth, GitHub OIDC from Actions workflows, DNS verification or HTTP verification for a domain. A server named io.github.your-name/weather, for example, can only be published by that GitHub account.

The launch post framed the central registry as a base layer rather than a final storefront. Public subregistries can add their own curation, ratings or client-specific filtering, and organizations can run private registries that start from the public data and apply internal security rules.

Background#

MCP grew quickly after Anthropic introduced it in November 2024, and OpenAI, Google and Microsoft all adopted it during 2025. That success created a distribution problem: thousands of servers, many unofficial, with no shared way to find, trust or update them. Community-run directories had emerged to fill the gap, and the registry was built in the open by contributors from several companies rather than as one more competing catalog.

The work also reflected MCP's broader shift toward formal governance. The project had announced a governance model at the end of July 2025, and the registry was developed in the open with contributors from multiple companies rather than by a single vendor.

Why It Matters for Developers#

For .NET developers, the most concrete detail is that NuGet is a first-class package type. The official registry accepts packages only from trusted public sources, and for NuGet that means https://api.nuget.org/v3/index.json. Ownership is verified with an mcp-name: marker in the package README, for example mcp-name: io.github.contoso/inventory. The registry's reference documentation includes a NuGet example that sets a runtimeHint of dnx, the single-shot tool runner that ships with the .NET 10 SDK, much like npx for npm. A minimal entry for a NuGet-packaged server looks like this:

JSON
{
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "name": "io.github.contoso/inventory",
  "description": "Query stock levels in the Contoso inventory system.",
  "repository": {
    "url": "https://github.com/contoso/inventory-mcp",
    "source": "github"
  },
  "version": "1.2.0",
  "packages": [
    {
      "registryType": "nuget",
      "registryBaseUrl": "https://api.nuget.org/v3/index.json",
      "identifier": "Contoso.Inventory.McpServer",
      "version": "1.2.0",
      "runtimeHint": "dnx",
      "transport": { "type": "stdio" }
    }
  ]
}

Several practical consequences follow:

  • Package your server like any other tool. A stdio MCP server built with the C# SDK can ship as a NuGet package and be launched with dnx. Our MCP in C# guide covers building one, and the NuGet packaging guide covers versioning and metadata.
  • Automate publishing from CI. GitHub OIDC support means a release workflow can publish registry metadata without long-lived secrets. See the CI/CD with GitHub Actions guide.
  • Treat registry entries as supply-chain inputs. Namespace and package verification reduce impersonation, but they do not prove a server is safe. Review what a server can access before you allow it, as discussed in our supply chain security interview guide.

Enterprises that already run internal NuGet feeds should also note the subregistry model. A private registry can mirror approved entries from the public catalog and add internal servers, which gives security teams one allowlist to manage.

What's Next#

At launch, the registry was explicitly a preview with general availability planned later. The project README records an API freeze for version 0.1 starting October 24, 2025, with a commitment to avoid breaking changes during that period. By the protocol's first anniversary in November 2025, the registry had grown to nearly 2,000 entries.

The open questions are about trust and curation rather than plumbing. The central registry verifies who published a server, not whether the server behaves well, so ratings, security scanning and allowlisting are left to subregistries and to organizations themselves. How those layers mature will shape whether developers can safely install MCP servers with the same confidence they bring to mainstream package managers.

Sources#