Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

DNS auth 401 "no MCP public key found" despite correct, globally-propagated base64 TXT record

Abierto
  • ¿Algo no está bien?
#1,694 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
48/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
go
Área
authentication, networking

Línea de trabajo

Start with the registry's DNS authentication path, using the mcp-publisher login dns flow and the reported 401 as the reproduction. Compare the TXT lookup result used by the registry with the public and authoritative resolver results listed here, and investigate whether stale negative caching is involved. Done means the registry recognizes the published base64 proof and DNS login succeeds, or the resolver/cache behavior is identified.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

DNS authentication (mcp-publisher login dns) fails with 401 no MCP public key found in DNS TXT records, even though the required MCP proof TXT record is correctly published, well-formed, and globally propagated. The registry's resolver appears to be serving/caching a stale negative result: every public resolver and the authoritative nameserver return the correct base64 Ed25519 key, but the registry still cannot see it after ~3 hours.

Environment
  • mcp-publisher version: 1.8.1
  • Domain: solides.com.br (apex TXT record, authoritative = AWS Route 53, TTL 60s)
  • Auth method: login dns
What the publisher expects (from login dns output)
Expected proof record:
v=MCPv1; k=ed25519; p=SKhuBvoz+KAh+PdxO6WHDunygJ03s6ahwSbR6FR3wtw=
What is actually published (and globally propagated)

The TXT record on the solides.com.br apex is identical to the expected proof, is a single value (no 255-char chunking, no duplicate v=MCPv1), with TTL 60s. Verified just now against 5 resolvers plus the authoritative NS:

Resolver Returns
8.8.8.8 (Google) v=MCPv1; k=ed25519; p=SKhuBvoz+KAh+PdxO6WHDunygJ03s6ahwSbR6FR3wtw=
1.1.1.1 (Cloudflare) identical
9.9.9.9 (Quad9) identical
208.67.222.222 (OpenDNS) identical
ns-1666.awsdns-16.co.uk (authoritative Route 53) identical

Reproduce:

dig +short TXT solides.com.br @8.8.8.8 | grep MCPv1
Actual error
Error: failed to get token: failed to exchange dns signature: token exchange failed with status 401:
{"title":"Unauthorized","status":401,"detail":"DNS authentication failed",
 "errors":[{"message":"no MCP public key found in DNS TXT records"}]}
Likely cause

The record was previously published for a few days in hex encoding (p=48a8..., 64 chars) before being corrected to the spec-required base64 encoding. We suspect the registry's internal DNS resolver has a stale cache / negative-cache entry for solides.com.br TXT that is outliving the record's 60s TTL (3h+ and counting), so it never re-fetches the corrected base64 key. The public internet has fully converged on the correct value.

Ask

Could you confirm which resolver the registry backend uses for DNS auth, and whether its cache for solides.com.br TXT can be flushed / its TTL honored? Happy to provide any further diagnostics.

(Note: the p= value above is an Ed25519 public key — safe to share for reproduction.)

Lenguaje dominante
Go
Estrellas
7.4k
Forks
1k
Merge medio
3 d 14 h
PR fusionados (30 d)
12

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de modelcontextprotocol/registry

Todos los issues de modelcontextprotocol/registry

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.