# MCP Registry: what publishing needs (prepared, NOT run)

Nothing here has been deployed or published. Every step below is public and needs approval.

## Drafts
- `docs/server.json`: name `com.wayreceipt/wayreceipt`, remote `https://wayreceipt.com/mcp`. Needs the domain wayreceipt.com (not owned; buying it costs money).
- `docs/server.pages-dev.json`: name `dev.pages.wayreceipt/wayreceipt`, remote `https://wayreceipt.pages.dev/mcp`. Free, but assumes the Pages project name `wayreceipt` is available. If Cloudflare assigns another name, rebuild with:
  `SITE_ORIGIN=https://<project>.pages.dev MCP_NAME=dev.pages.<project>/wayreceipt SERVER_JSON_OUT=server.pages-dev.json PAGES_BUILD=1 node scripts/build-site.js`
- Both use description from `config/copy.json` `registry_description`. Registry metadata for a version is immutable once published (only status can change), so check wording first.

## Hosting note
The project runs as a Worker with static assets (`wrangler.jsonc`). For a pages.dev host, `PAGES_BUILD=1` also writes `dist-pages/` = the static site plus `_worker.js` (the same Worker bundled for Pages "advanced mode"). This bundle was built but never run on Pages. The D1 binding `DB` must be added to the Pages project. A `*.workers.dev` host would instead give a namespace of the form `dev.workers.<subdomain>.wayreceipt/...` (not prepared).

## HTTP ownership proof
1. `scripts/registry-auth-key.sh` makes an Ed25519 key in `.registry-key/` (mode 600, git-ignored, never served) and `build-site.js` writes `site/.well-known/mcp-registry-auth` as `v=MCPv1; k=ed25519; p=<base64 public key>`. Done locally; served by wrangler dev.
2. After an approved deploy, check: `curl https://<host>/.well-known/mcp-registry-auth`.
3. Install mcp-publisher (GitHub release binary of modelcontextprotocol/registry), then:
   `mcp-publisher login http --domain <host> --private-key <64-hex Ed25519 seed>` (the seed is the 32 bytes shown by `openssl pkey -in .registry-key/key.pem -noout -text`; do not paste it into chat or logs).
4. STOP here unless publishing is approved. Publishing would be `mcp-publisher publish docs/server.pages-dev.json` (rename to server.json in the working dir).

Open question from the Scout's code read: whether the registry accepts `dev.pages.<project>` namespaces from HTTP auth (only github.io was found blocked). Only a real `login http` run will confirm it; it has not been run.

## Status 2026-10-23 (pages.dev, after the Pages deploy)
- `https://wayreceipt.pages.dev/.well-known/mcp-registry-auth` is live (`text/plain`) and its key matches `.registry-key/`.
- `mcp-publisher` 1.8.3 is at `/workspace/venture/tools/bin/mcp-publisher`. `mcp-publisher validate` on `docs/server.pages-dev.json` (copied to `server.json`): valid.
- `mcp-publisher login http --domain wayreceipt.pages.dev` succeeded. The registry token granted `publish` on `dev.pages.wayreceipt/*`, which answers the open question above: HTTP auth on a pages.dev subdomain is accepted. The token lasts about 5 minutes, so it was logged out again. Run login again right before publishing.
- NOT published. The registry has no `wayreceipt` entry. Held until Wednesday per Chief Of Staff (publish once, under wayreceipt.com if bought by then, otherwise under pages.dev).
- Publish (when approved): from a directory holding `server.json` = `docs/server.pages-dev.json`, run login as in step 3, then `mcp-publisher publish server.json`.