Publish MCP with GitHub Actions

The official Registry docs recommend GitHub OIDC where possible because it avoids storing a dedicated Registry authentication secret.

name: Publish MCP Registry
on:
  push:
    tags: ["v*"]
permissions:
  contents: read
  id-token: write

# after tests/build/package publishing:
# ./mcp-publisher login github-oidc
# ./mcp-publisher publish

Release order matters

For package-based servers, publish the package first, then publish Registry metadata that points to the verified version.

Protect the pipeline

Require tests before tag/release, restrict who can create release tags, pin important Actions, and use environment protections for publishing credentials.

Reference

Official GitHub Actions publishing guide