# How to submit an MCP server to ToolHive registry

By [Jonah Ease](https://manycp.com/about) Published 1 Oct 2026 Last checked 1 Oct 2026

This is the most selective of the GitHub-hosted lists. It publishes a written bar, scores entries against it, and has a core team member review every pull request[1] [2]. So the work is not mainly the file. It is deciding, honestly, whether your project clears the bar before you write the file.

## What the registry requires

| Requirement | Level |
| --- | --- |
| Open source, with public source code | Required |
| A permissive licence: Apache-2.0, MIT, BSD | Required |
| Pinned dependencies and GitHub Actions pinned to SHAs | Required |
| Secure auth, TLS in transit, secrets handled and marked, no known unpatched critical or high CVEs | Required |
| Sigstore or GitHub Attestations provenance; security scanning in CI | Expected |
| SLSA assessment, a published SBOM, a SECURITY.md | Recommended |

Copyleft licences such as AGPL-3.0, GPL and LGPL are excluded. Entries are either Official, meaning maintained by the ToolHive team, the MCP specification authors or the platform owners, or Community, which is where yours would sit[3] [2].

## The file

An entry is a `server.json` in the upstream MCP format, in its own folder under `registries/toolhive/servers/`. It is either container-based, with a `packages` list, or remote, with `remotes` [4]. ToolHive's own fields go in `_meta`.

A remote server (example names)

```
{
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "name": "io.github.stacklok/my-remote-server",
  "description": "What your server does in one sentence",
  "repository": { "url": "https://github.com/myorg/my-server", "source": "github" },
  "version": "1.0.0",
  "remotes": [{ "type": "streamable-http", "url": "https://api.example.com/mcp" }],
  "_meta": {
    "io.modelcontextprotocol.registry/publisher-provided": {
      "io.github.stacklok": {
        "https://api.example.com/mcp": { "tier": "Community", "status": "Active", "tools": ["tool_name_1"] }
      }
    }
  }
}
```

- The key inside `_meta` must match the package identifier for a container, or the remote URL for a remote server[4].
- Folder names use lowercase letters and hyphens[4].

## From fork to merge

1. Open an issue outlining what you are adding, then fork the repository[1].
2. Sign off every commit with a `Signed-off-by` trailer, which is the Developer Certificate of Origin[1].
3. Run `task catalog:validate` [2].
4. Open the pull request. CI must pass, a core team member reviews it, and commits are squashed into one with your pull request title[1].

## Why a submission is declined

### What the criteria rule out

- A thin client or a repository with only packaging files, for a third-party server. The implementation itself must be open source. An official vendor's own server may sit on a proprietary backend[2].
- A copyleft licence, or a missing one. If the licence is unclear, they ask you to clarify[2].
- Actions pinned to a tag and not a commit SHA, or unpinned dependencies[3].

### What counts against you

The criteria weigh organic signals and list patterns of manufactured traction: stars that do not match watchers or forks, one account with many near-empty repositories created in a short window, and a history of mostly automated or marketing commits. A cluster of those, with a single maintainer and no real adoption, is grounds to decline until the project shows sustained community health[2]. A repository only days or weeks old with little adoption is a yellow flag, as is no release in six months[2].

## By hand

Read both criteria documents against your repository first, fix what they flag, and then do the four steps above. Expect a human reading your project and not only a validator.

## Current status, 1 Oct 2026

On 2 Oct 2026 the repository had [30 open pull requests](https://github.com/stacklok/toolhive-catalog/pulls?q=is%3Apr+is%3Aopen) and 6 open issues[5]. The criteria documents and the README quoted here were the current versions on `main` [2] [4].

## How long merges took

No outside pull requests merged in the 90 days to 2 Oct 2026: too few for a median. [The merged pull requests](https://github.com/stacklok/toolhive-catalog/pulls?q=is%3Apr+is%3Amerged) are on GitHub.

## Sources

1. [toolhive-catalog: CONTRIBUTING.md](https://github.com/stacklok/toolhive-catalog/blob/main/CONTRIBUTING.md) · checked 1 Oct 2026
2. [toolhive-catalog: Registry Inclusion Criteria](https://github.com/stacklok/toolhive-catalog/blob/main/docs/registry-criteria.md) · checked 1 Oct 2026
3. [toolhive-catalog: MCP Server Inclusion Criteria](https://github.com/stacklok/toolhive-catalog/blob/main/docs/server-criteria.md) · checked 1 Oct 2026
4. [toolhive-catalog: README (how to add a server)](https://github.com/stacklok/toolhive-catalog/blob/main/README.md) · checked 1 Oct 2026
5. [toolhive-catalog: open pull requests](https://github.com/stacklok/toolhive-catalog/pulls?q=is%3Apr+is%3Aopen) · checked 1 Oct 2026

ManyCP is not affiliated with, endorsed by or sponsored by any directory, Docker, OpenAI, Anthropic or GitHub named here. Names are used to say which service a fact is about.

---

Source: [ManyCP](https://manycp.com/directories/toolhive-catalog)