# H/M MCP Registry Release Gate

Human interface: <https://hogarmas.net/mcp-registry-release-gate/>

Machine contract: <https://hogarmas.net/api/mcp-registry-release-gate>

Receipt schema: <https://hogarmas.net/mcp-registry-release-gate/schema.json>

Official source: <https://registry.modelcontextprotocol.io>

## Purpose

Compare two published `server.json` versions from the official MCP Registry and produce a deterministic, checksum-bound ledger of observable declaration changes.

The gate reviews:

- Registry server identity
- Package registry and package identity
- Remote origin, path and transport
- Repository identity and source
- Package transport, runtime hints and redacted argument fingerprints
- Required secret and environment-variable declaration shape
- Schema, website, status and extension drift
- Informational title, description, icon and package-version changes

## API

Read the contract without fetching Registry history:

```http
GET /api/mcp-registry-release-gate
```

Read one public server's version index:

```http
GET /api/mcp-registry-release-gate?name=net.hogarmas%2Fagent-surface
```

Compare two exact versions:

```http
GET /api/mcp-registry-release-gate?name=net.hogarmas%2Fagent-surface&from=1.5.0&to=1.6.0
```

Only `registry.modelcontextprotocol.io` is queried. Arbitrary URLs are not accepted.

## MCP tool

Focused endpoint: `https://agents.hogarmas.net/mcp/agent-surface`

Free tool: `compare_mcp_registry_releases`

Required input: `serverName`. Optional `fromVersion` and `toVersion` must be supplied together; omit both to compare the latest two official versions. The tool returns the same structured comparison, unsigned SHA-256 receipt and browser review link. No authentication or payment is required.

The MCP call stores only the fixed tool name in aggregate metrics. Server names, selected versions and comparison fields are not persisted. QA calls are excluded from the public funnel.

## Decisions

- `review-required`: at least one critical or high-impact declared field changed.
- `change-observed`: only medium or informational declared fields changed.
- `no-observable-change`: normalized fields covered by the gate are equal.

These decisions are review-routing labels. They are not security, maliciousness, compatibility, provenance or legal verdicts.

## Receipt

Schema: `hm.mcp-registry-release-gate.v1`

The SHA-256 checksum covers the normalized server identity, selected release edge, decision, summary, version fingerprints and complete change ledger. It is not cryptographically signed and does not authenticate H/M as an issuer.

## Privacy

- Registry names and versions are public inputs returned to the requesting browser.
- H/M does not persist the query or comparison response.
- Aggregate metrics contain only fixed page and action identifiers plus aggregate dwell time.
- Metrics do not contain Registry names, versions, URLs, change fields, checksums or secret declarations.
- Secret `value` and `default` contents are never returned. Only declaration shape such as `isSecret`, `isRequired`, `hasValue` and `hasDefault` is compared.

## Limitations

- The official MCP Registry is currently in preview.
- Registry namespace and package verification performed at publication is not re-performed by H/M.
- Package artifacts are not downloaded, validated or executed.
- Runtime behavior, implementation quality and operator intent are not observed.
- A missing change does not prove that a release is safe or compatible.
- Continuous monitoring is not active in the free one-shot gate.

## Commercial pilot boundary

The public page can create a local monitoring brief for a possible recurring release-watch pilot. Copying that brief or opening the email link records only a fixed aggregate action code. It does not activate monitoring, create an account or commit either party to a service.