Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

DNS auth 401 "no MCP public key found" despite correct, globally-propagated base64 TXT record

未关闭
  • 哪里不对？
#1,694 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
48/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
go
领域
authentication, networking

调研方向

Start with the registry's DNS authentication path, using the mcp-publisher login dns flow and the reported 401 as the reproduction. Compare the TXT lookup result used by the registry with the public and authoritative resolver results listed here, and investigate whether stale negative caching is involved. Done means the registry recognizes the published base64 proof and DNS login succeeds, or the resolver/cache behavior is identified.

由索引模型根据 Issue 内容生成。

描述

Summary

DNS authentication (mcp-publisher login dns) fails with 401 no MCP public key found in DNS TXT records, even though the required MCP proof TXT record is correctly published, well-formed, and globally propagated. The registry's resolver appears to be serving/caching a stale negative result: every public resolver and the authoritative nameserver return the correct base64 Ed25519 key, but the registry still cannot see it after ~3 hours.

Environment
  • mcp-publisher version: 1.8.1
  • Domain: solides.com.br (apex TXT record, authoritative = AWS Route 53, TTL 60s)
  • Auth method: login dns
What the publisher expects (from login dns output)
Expected proof record:
v=MCPv1; k=ed25519; p=SKhuBvoz+KAh+PdxO6WHDunygJ03s6ahwSbR6FR3wtw=
What is actually published (and globally propagated)

The TXT record on the solides.com.br apex is identical to the expected proof, is a single value (no 255-char chunking, no duplicate v=MCPv1), with TTL 60s. Verified just now against 5 resolvers plus the authoritative NS:

Resolver Returns
8.8.8.8 (Google) v=MCPv1; k=ed25519; p=SKhuBvoz+KAh+PdxO6WHDunygJ03s6ahwSbR6FR3wtw=
1.1.1.1 (Cloudflare) identical
9.9.9.9 (Quad9) identical
208.67.222.222 (OpenDNS) identical
ns-1666.awsdns-16.co.uk (authoritative Route 53) identical

Reproduce:

dig +short TXT solides.com.br @8.8.8.8 | grep MCPv1
Actual error
Error: failed to get token: failed to exchange dns signature: token exchange failed with status 401:
{"title":"Unauthorized","status":401,"detail":"DNS authentication failed",
 "errors":[{"message":"no MCP public key found in DNS TXT records"}]}
Likely cause

The record was previously published for a few days in hex encoding (p=48a8..., 64 chars) before being corrected to the spec-required base64 encoding. We suspect the registry's internal DNS resolver has a stale cache / negative-cache entry for solides.com.br TXT that is outliving the record's 60s TTL (3h+ and counting), so it never re-fetches the corrected base64 key. The public internet has fully converged on the correct value.

Ask

Could you confirm which resolver the registry backend uses for DNS auth, and whether its cache for solides.com.br TXT can be flushed / its TTL honored? Happy to provide any further diagnostics.

(Note: the p= value above is an Ed25519 public key — safe to share for reproduction.)

主要语言
Go
星标
7.4k
派生
1k
平均合并
1 天 19 小时
30 天内合并 PR
22

环境准备

  • 提供 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

modelcontextprotocol/registry 的其他 Issue

查看 modelcontextprotocol/registry 的全部 Issue

相似的 Issue

更多 Go Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。