The MCP Registry

The Brutor MCP Registry is a standalone registry server for Model Context Protocol servers — the answer to “which MCP servers exist, which are ours, and which are actually governed?” It implements the official MCP Registry specification (server.json 2025-12-11, served under the /v0.1 API), so any spec-compliant MCP client or tool can consume it directly.

It plays a different role from the gateway: the gateway enforces what a governed client may call; the registry is the catalog — discovery, publication and inventory. Together they close the loop: find a server in the registry, register it in the gateway, and its record flips to governed.

A governed enterprise subregistry

Three things distinguish it from pointing your tooling at the public registry:

• Federation. A scheduled aggregator scrapes upstream registries — the official MCP Registry and any others you connect — and serves their records alongside your own, incrementally and with opaque-cursor pagination. Your organization gets one registry endpoint that covers both the world’s servers and the internal ones that must never be published outside.
• Publication. Teams publish internal MCP servers with namespace verification (GitHub-org or DNS based), JWT-authenticated publishing, and automatic validation — spec compliance plus a reachability check on the declared transport.
• Governance posture. Every served record carries an ai.brutor.registry _meta block with registry-native analytics and the server’s gateway-governance posture: governed (registered and fronted by the gateway), ungoverned (known to exist, not under enforcement) or unknown. A developer browsing for a tool sees at a glance whether using it is sanctioned.

The registry always serves

Governance enrichment is fail-open by design: if the control plane is unreachable or the integration is disabled, records are served with governanceStatus: "unknown" rather than the registry going down. A catalog that fails closed is a catalog people stop using.

What’s in the box

Piece	What it is
Registry server	Python/FastAPI, PostgreSQL storage, on-boot migrations, port 5001
API	/v0.1 per the official spec — browse, search by keyword/namespace/verification, updated_since incremental consumption
Aggregator	Scheduled upstream scraping (AGGREGATOR_INTERVAL_SECONDS, default hourly)
Auth	GitHub OAuth for human publishers; gateway-issued service tokens for automation
Admin UI	Connection management, registry browsing, monitoring and configuration
CLI	List, show, remove, stats, JSON import

How it fits the platform

• The Asset Register inventories the AI estate inside your gateway; the MCP Registry catalogs MCP servers for it — including ones not yet under governance.
• Registering an MCP server in the gateway is what makes it governed: access-controlled, policy-checked and audited. The registry reflects that status; it does not grant it.
• Shadow AI Discovery finds MCP servers nobody registered — the registry is where the sanctioned alternative is published.

Next steps

Register your own MCP serverBring a server under gateway governance — access control, policies, audit.

Use MCP tools through the gatewayPoint Claude Desktop, Goose or your agent at one governed MCP endpoint.

Shadow AI DiscoveryFind the MCP servers and agents nobody registered.