MCP Registry Supply Chain: Admission, Drift, and Rollback
A registry entry tells you what a publisher declared. Production admission proves what you fetched, what you observed, what you approved, and what you can safely restore. Separate Registry publication, package provenance, runtime discovery, and local approval. Verify an MCP server namespace without trusting the name inside its own record. Pin immutable publication, execution-source, provenance, and live descriptor evidence. Detect registry status changes and runtime drift after admission. Roll back routing to a previously admitted version without rewriting history. Maintain a tamper-evident admission ledger that explains every decision. You find com.example/inventory in a registry. Its description looks right. Its package exists. The server answers server/discover. That is not one fact. It is a chain of facts from different authorities: A publisher authenticated for a namespace submitted a record. A package registry served an artifact with a specific identity and digest. A running endpoint reported a protocol version, capabilities, tools, and diagnostic server information. Your organization decided that this exact combination was allowed. Collapsing those facts into “it is in the registry, so trust it” creates a supply chain blind spot. A valid publication can still be deprecated. A package tag can point at an unexpected artifact if you do not pin its digest. A server can add a destructive tool after review. A rollback can silently choose a version that…
MCP Registry Supply Chain: Admission, Drift, and Rollback: A registry entry tells you what a publisher declared. Production admission proves what you fetched,…
This free lesson is part of the AI Engineering from Scratch curriculum. Read the full explanation, run the lesson code, and verify the result in the interactive reader or from the repository source.
Browse the complete course catalog or open this lesson on GitHub.