Skip to content

Add marketplace listing assets and fix execute destructive hint #815

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cursor merged 2 commits into from
Jul 20, 2026
Merged

Add marketplace listing assets and fix execute destructive hint #815

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9daaa02
Add marketplace listing assets and fix execute destructive hint
cursoragent Jul 20, 2026
4d7ba1a
Remove one-off marketplace form artifacts from the repo
cursoragent Jul 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions .github/workflows/publish-mcp-registry.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
name: Publish MCP Registry

on:
workflow_dispatch:
push:
branches:
- main
paths:
- server.json
- .github/workflows/publish-mcp-registry.yml

permissions:
contents: read
id-token: write

concurrency:
group: publish-mcp-registry
cancel-in-progress: false

jobs:
publish:
runs-on: ubuntu-latest
name: Publish server.json to MCP Registry
timeout-minutes: 10
steps:
- name: Checkout
uses: actions/checkout@v6.0.2
Comment on lines +26 to +27

@coderabbitai coderabbitai Bot Jul 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Check the latest release version of actions/checkout
gh api repos/actions/checkout/releases/latest --jq .tag_name

Repository: kentcdodds/kody

Length of output: 160

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow =="
git ls-files .github/workflows/publish-mcp-registry.yml
echo
cat -n .github/workflows/publish-mcp-registry.yml | sed -n '1,220p'

echo
echo "== checkout release tag existence =="
gh api repos/actions/checkout/releases/tags/v6.0.2 --jq '{tag_name, name, draft, prerelease, published_at}'

echo
echo "== checkout tag ref =="
gh api repos/actions/checkout/git/refs/tags/v6.0.2 --jq '{ref, object_type: .object.type, object_sha: .object.sha}'

Repository: kentcdodds/kody

Length of output: 1742

Prevent credential persistence in the checkout step.

actions/checkout stores the GitHub token in local git config by default. Set persist-credentials: false here since this workflow doesn’t need git auth later.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 26-27: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish-mcp-registry.yml around lines 26 - 27, Update the
actions/checkout step in the Checkout workflow action to set persist-credentials
to false, preventing the GitHub token from being stored in local git
configuration while leaving the existing checkout behavior unchanged.

Source: Linters/SAST tools


- name: Install mcp-publisher
run: |
set -euo pipefail
curl -fsSL \
"https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" \
| tar xz mcp-publisher

- name: Authenticate with GitHub OIDC
run: ./mcp-publisher login github-oidc

- name: Publish
run: ./mcp-publisher publish
4 changes: 3 additions & 1 deletion packages/worker/src/mcp/tools/execute.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,9 @@ More context: https://github.com/kentcdodds/kody/blob/main/docs/use/execute.md
`.trim(),
annotations: {
readOnlyHint: false,
destructiveHint: false,
// Execute can delete, overwrite, send, revoke, or otherwise make
// irreversible changes depending on the module and capabilities called.
destructiveHint: true,
idempotentHint: false,
openWorldHint: true,
} satisfies ToolAnnotations,
Expand Down
18 changes: 18 additions & 0 deletions server.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
{
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"name": "io.github.kentcdodds/kody",
"title": "Kody",
"description": "Personal assistant MCP server with search, execute, packages, jobs, secrets, and integrations.",
"version": "1.0.0",
"websiteUrl": "https://heykody.dev",
"repository": {
"url": "https://github.com/kentcdodds/kody",
"source": "github"
},
"remotes": [
{
"type": "streamable-http",
"url": "https://heykody.dev/mcp"
}
]
}
Loading