Requested by Can · project thread

#What this changes

Serves /.well-known/mcp-registry-auth, the proof record the official MCP registry (registry.modelcontextprotocol.io) fetches to let a domain's owner publish servers under that domain. With it, diffinery.com can publish its MCP server as com.diffinery/diffinery.

• diffinery.com's record (an Ed25519 public key) is built in and served only when PUBLIC_URL is diffinery.com, so a self-hosted copy never serves the project's key for its own domain.
• Other instances set MCP_REGISTRY_AUTH under vars. Anything that isn't one well-formed v=MCPv1; k=ed25519|ecdsap384; p=... record is a 404, like an unset one.
• Docs: a "List your instance in the MCP registry" section on /docs/agents/mcp, the new variable in /docs/self-hosting/configuration, and the route in the REST reference.

#How it was tested

• New unit tests (test/unit/mcp-registry-auth.test.ts): own record, malformed records, the built-in record only on diffinery.com (not on lookalike hosts or localhost).
• pnpm -r --if-present build, pnpm run typecheck, and the docs and site unit tests pass locally.
• mcp-publisher validate accepts the server.json that will be published once this is live.

#Checklist

• pnpm -r typecheck and pnpm -r test pass
• User- or admin-visible changes update the docs in apps/diffinery/docs
• New D1 migrations use the next free number in apps/diffinery/migrations (none)

🤖 Generated with Claude Code

https://claude.ai/code/session_0156222tQpRPtP1Em3kEeZnK