What Is an MCP Registry? Discovering & Governing MCP Servers

An MCP registry is a centralized directory that catalogs Model Context Protocol servers, providing AI clients with metadata to find and connect to external tools. Maxim AI's open-source AI gateway Bifrost pairs with registry discovery to provide runtime governance, authorization, and traffic controls that registries intentionally leave out, addressing the operational hurdle of finding reliable servers across fragmented ecosystems.

TL;DR server.json manifests, but they do not proxy, inspect, or govern runtime execution.An MCP registry is a centralized directory that catalogs Model Context Protocol servers, providing AI clients with the metadata required to find and connect to external tools. As autonomous agents and coding assistants shift from static prompt completion to dynamic tool execution, finding reliable servers across fragmented ecosystems has become an operational hurdle. Bifrost https://www.getmaxim.ai/bifrost , an open-source AI gateway https://github.com/maximhq/bifrost built in Go by Maxim AI, pairs with registry discovery to provide the runtime governance, authorization, and traffic controls that registries intentionally leave out. Understanding the role of an MCP registry requires distinguishing between discovering a tool and safely governing its execution in production. An MCP registry is an authoritative index that catalogs Model Context Protocol servers, mapping unique server identifiers to their hosting packages, supported transports, and capability manifests. It functions as an informational directory for AI agents, similar to how npm or PyPI indexes software libraries, but with a specific focus on agentic tools, resource providers, and prompt templates. Under the Model Context Protocol specification https://modelcontextprotocol.io , AI systems communicate with external tools via standardized JSON-RPC 2.0 messages. While the protocol standardizes message formatting across standard input/output STDIO , Server-Sent Events SSE , and streamable HTTP, it does not dictate how an agent discovers which servers exist in an organization or across the broader open-source ecosystem. An MCP registry fills this void by storing standardized descriptors. Crucially, a registry hosts metadata about tools , not the executable tool code itself. The actual runtime binaries or container images reside on package managers such as npm, PyPI, GitHub Packages, or Docker Hub. The registry simply records who built the server, where the code lives, how to authenticate with the publisher, and what arguments are required to spin it up. The official MCP Registry project, coordinated by the Model Context Protocol working group, established a vendor-neutral standard for listing public and private servers. By querying a registry, an agent or an engineering team can evaluate an MCP server before integrating it into a workflow, replacing ad-hoc configuration with programmatic lookup. { "$schema": "https://static.modelcontextprotocol.io/schemas/server.json", "name": "com.example.database/postgres-inspector", "title": "PostgreSQL Schema & Query Inspector", "description": "Enables read-only schema inspection and query analysis for PostgreSQL instances.", "version": "1.2.0", "packages": { "registry": "npm", "identifier": "@example/mcp-postgres", "version": "1.2.0", "transport": "stdio" } , "capabilities": { "tools": true, "resources": true, "prompts": false } } MCP server discovery relies on a distributed architecture that connects publishers, metadata repositories, aggregators, and consuming AI clients. Rather than relying on manual file edits in tools like Claude Desktop or Cursor, automated discovery allows clients to query an endpoint, retrieve server capabilities, and prepare connections dynamically. Discovery begins with publishing. When a developer creates an MCP server, they publish the build artifacts to a standard package registry. Next, they submit a server.json manifest to an MCP registry. The registry validates the publisher's namespace, records the manifest, and exposes the metadata through an unauthenticated, read-only REST API. Namespace validation ensures authenticity. The official registry enforces reverse-DNS naming conventions such as com.example/server or io.github.username/server . Domain-backed namespaces require DNS TXT record verification, while GitHub-backed namespaces require OAuth proof of repository control. This mechanism stops malicious actors from typosquatting popular tool names or impersonating verified infrastructure providers. Emerging standards are expanding discovery beyond centralized web registries. For instance, the Internet Engineering Task Force draft on MCP DNS Discovery https://datatracker.ietf.org/doc/draft-morrison-mcp-dns-discovery/ defines mechanisms for advertising MCP server endpoints directly through DNS TXT records. Using records like mcp.domain.com , client infrastructure can discover agent tool interfaces dynamically across corporate networks without relying on third-party web catalogs. Once metadata is indexed, client-side tools and developer environments pull updates from the registry. Downstream aggregators can ingest this catalog, build search indexes, and surface approved servers inside corporate developer portals. When an agent requests a capability, the client queries the registry index, retrieves the installation schema, and establishes the transport layer. While an MCP registry answers the question of what servers exist, it does not answer whether an agent should be permitted to execute them. Registries are passive catalogs, not active checkpoints. Once a client downloads a server configuration from a registry, all execution occurs directly between the client and the tool backend. This architectural separation creates severe enterprise risks: Enterprise security teams cannot rely solely on a registry to protect infrastructure. A registry provides discovery, but production environments require runtime governance to control which tools execute, who invokes them, and what parameters pass through the wire. Securing the Model Context Protocol requires dividing responsibilities across the architecture. A registry catalogs metadata, a gateway manages runtime network traffic, and an endpoint agent oversees developer machines. The following table summarizes how these layers operate: | Capability | MCP Registry | MCP Gateway e.g., Bifrost | Endpoint Governance Bifrost Edge | |---|---|---|---| Primary Function | Catalog and discover server metadata | Route, authenticate, and govern tool calls | Discover and enforce policies on local machines | Operational Plane | Discovery Plane Metadata | Control Plane & Runtime Data Plane | Endpoint Enforcement Plane | Network Position | External or internal web service | Inline reverse proxy between agent and servers | Background agent on host operating system | Traffic Inspection | None does not handle traffic | Full payload inspection and validation | Machine-level interception of local AI apps | Authentication | Namespace ownership validation | Centralized OAuth 2.0, PKCE, virtual keys | SSO-based machine link and identity binding | Access Control | None public or catalog-level visibility | Tool-level RBAC, user budgets, rate limits | Fleet-wide allow/deny lists for apps and MCPs | Token Optimization | None | Schema pruning, Code Mode orchestration | None delegated to gateway control plane | Audit Logging | Registry access and download metrics | Immutable logs of every tool call and argument | Inventory of installed MCPs and running processes | Relying on a registry without a gateway leaves runtime traffic unguarded. Conversely, deploying a gateway without endpoint visibility leaves developer workstations exposed to shadow MCP connections. Comprehensive governance demands all three layers working in unison. A production MCP gateway https://www.getmaxim.ai/bifrost/resources/mcp-gateway sits between the AI model and downstream tool servers, acting as the centralized security enforcement point. Bifrost treats Model Context Protocol traffic as a first-class citizen alongside LLM routing, unifying access control, traffic filtering, and cost optimization under one architecture. Using Bifrost as an MCP gateway https://docs.getbifrost.ai/mcp/gateway , organizations register upstream MCP servers once within the gateway control plane. AI agents and coding tools connect directly to Bifrost rather than connecting to each individual server. When an agent requests a tool call, Bifrost intercepts the request, evaluates policy constraints, and manages execution. +-------------+ JSON-RPC +--------------------+ | AI Agent | ------------------------ | Bifrost Gateway | | Claude, | | - Virtual Keys | | Cursor | <------------------------ | - Tool Filtering | +-------------+ Response | - Guardrails & RBAC| +--------------------+ | Forward Tool Call | HTTP / SSE / STDIO v +--------------------+ | Downstream Servers | | DBs, APIs, Tools | +--------------------+ Instead of exposing entire tool suites to every model, Bifrost uses virtual keys https://docs.getbifrost.ai/features/governance/virtual-keys to enforce fine-grained access control. A virtual key defines the exact permissions, budgets, and rate limits allocated to a user, agent, or service. Through MCP tool filtering https://docs.getbifrost.ai/features/governance/mcp-tools , administrators select which specific tools are exposed under each virtual key. For example, a customer support agent can be granted access to read tickets while write and delete operations remain blocked. At the enterprise tier, MCP tool groups https://docs.getbifrost.ai/enterprise/mcp-tool-groups allow platform teams to bundle tools into logical profiles, making it simple to provision consistent policies across hundreds of developers. Traditional MCP setups execute commands automatically upon model invocation. Bifrost introduces robust controls over tool execution https://docs.getbifrost.ai/mcp/tool-execution . Teams can require explicit human-in-the-loop approvals for sensitive calls, or enable Agent Mode with auto-approval thresholds for read-only operations. Furthermore, Bifrost applies runtime guardrails https://docs.getbifrost.ai/enterprise/guardrails to intercept prompts and tool arguments before they reach external systems. Integrated secrets detection catches credentials, API keys, and private tokens, preventing data leaks caused by malicious prompt injection. Connecting dozens of MCP servers introduces massive context window overhead. Loading raw tool definitions into prompts can consume tens of thousands of tokens per query. Bifrost solves this through Code Mode https://docs.getbifrost.ai/mcp/code-mode . Instead of passing every tool schema to the LLM, Bifrost exposes four meta-tools that allow the model to search schemas on demand and generate Python code to orchestrate tools within a secure sandbox. In sustained production benchmarks, this approach reduces token consumption by more than 90% and cuts query latency significantly, allowing engineering teams to attach hundreds of tools without bloating context windows. Every interaction passing through the gateway generates structured audit logs https://docs.getbifrost.ai/enterprise/audit-logs . These immutable logs record caller identities, tool names, parameters, execution latency, and return codes, satisfying enterprise compliance standards including SOC 2, HIPAA, and ISO 27001. While server-side agents run inside governed cloud environments, developer workflows introduce a major governance blind spot: local developer workstations. Software engineers frequently integrate local MCP servers into desktop applications like Cursor, Claude Desktop, and terminal coding agents. Because these tools run locally on developer laptops, traffic bypasses traditional network gateways, creating an unmonitored layer of shadow AI. Bifrost Edge https://www.getmaxim.ai/bifrost/edge directly resolves this problem by bringing gateway governance to company endpoints. Operating as an alpha capability, Bifrost Edge runs natively in the background on macOS, Windows, and Linux devices. The architecture uses a combined model: the Bifrost AI gateway serves as the central control plane and policy engine, while Bifrost Edge https://www.getmaxim.ai/bifrost/edge extends those exact policies to employee workstations. Beyond routing, Bifrost applies governance https://www.getmaxim.ai/bifrost/resources/governance and security controls centrally, and Bifrost Edge extends that same governance and security to AI traffic on employee machines, with endpoint enforcement https://docs.getbifrost.ai/edge/security on each device. Through MCP governance at the endpoint https://docs.getbifrost.ai/edge/mcp-governance , Bifrost Edge continuously inspects local developer tools to discover configured MCP servers. It builds an aggregated inventory of all active tools across the organization, enabling security teams to see which servers are running across the entire fleet. Administrators can then enforce allow and deny lists directly on the device. If an engineer attempts to connect an unapproved or insecure community MCP server, Bifrost Edge halts execution locally before any corporate data leaves the laptop. The agent requires zero per-application configuration; it hooks into supported applications https://docs.getbifrost.ai/edge/supported-applications automatically and can be rolled out across the entire device fleet via standard MDM deployment https://docs.getbifrost.ai/edge/deployment-mdm tools like Jamf, Microsoft Intune, and Kandji. Platform engineering teams building an enterprise MCP adoption plan should adopt a structured lifecycle approach. Governance should facilitate developer productivity while establishing firm security guardrails. +-------------------------------------------------------------+ | Enterprise MCP Governance Plan | +-------------------------------------------------------------+ | 1. Curate Internal Registry | | Index approved tools using standardized manifests | +-------------------------------------------------------------+ | v +-------------------------------------------------------------+ | 2. Intercept via Central Gateway | | Route all agent execution through Bifrost control plane | +-------------------------------------------------------------+ | v +-------------------------------------------------------------+ | 3. Enforce Least Privilege RBAC | | Assign virtual keys, tool filters, and budget limits | +-------------------------------------------------------------+ | v +-------------------------------------------------------------+ | 4. Secure Developer Endpoints | | Deploy Bifrost Edge via MDM to eliminate shadow MCPs | +-------------------------------------------------------------+ | v +-------------------------------------------------------------+ | 5. Continuously Monitor & Audit | | Inspect execution logs for anomalies and prompt attacks | +-------------------------------------------------------------+ Do not allow client applications to pull directly from public unvetted indexes. Establish an internal catalog that mirrors approved public servers and hosts internal company tools. Require all published servers to supply complete server.json manifests detailing precise capabilities, expected environment variables, and code repository links. Direct client-to-server connections prevent consistent auditing. Route all application and agent traffic through an MCP gateway like Bifrost. Centralizing connections ensures that changes to tool locations, version upgrades, and credential rotations happen behind the gateway without disrupting client applications. Map tools to specific user and agent responsibilities. Use virtual keys to partition permissions, ensuring that automated background agents possess only read access while human-triggered workflows obtain scoped execution capabilities. Group sensitive tools under strict approval rules to prevent accidental data modifications. Roll out Bifrost Edge across developer workstations using your mobile device management system. This provides immediate visibility into local tool configurations inside IDEs and terminal environments, stopping unapproved third-party servers from accessing internal repositories or proprietary source code. Continuously evaluate centralized governance https://www.getmaxim.ai/bifrost/resources/governance metrics. Track error frequencies, latency trends, and unexpected tool calls. Ingest gateway audit logs into your organization's security information and event management SIEM systems to detect prompt injection attempts, anomalous data exfiltration patterns, and abusive usage. An MCP registry is a metadata catalog that stores information about available MCP servers, their schemas, and where to download them. An MCP gateway is a runtime network proxy that sits between AI models and servers to handle authentication, enforce tool access controls, capture audit logs, and execute calls safely. No, an MCP registry only hosts metadata documents describing the server, such as its name, description, parameters, and author. The actual executable code, binaries, and dependencies remain hosted on package managers like npm, PyPI, or Docker container registries. Yes, unmanaged MCP servers can pose significant security risks. If an agent connects to an unauthenticated server or falls victim to prompt injection, the server can execute arbitrary commands, leak internal database records, or exfiltrate private credentials stored on the host machine. The server.json file is a standardized manifest format defined by the Model Context Protocol working group. It details the server identifier, publisher information, installation package requirements, transport configurations, and high-level capabilities, allowing registries and aggregators to index tools consistently. Reverse-DNS naming ties an MCP server to a verified external domain or GitHub account, such as com.company/tool . Before publishing to the official registry, owners must prove domain control via DNS TXT records or GitHub authentication, preventing unauthorized publishers from impersonating trusted providers. Bifrost uses a feature called Code Mode, which replaces dozens of raw tool definitions in the model prompt with a small set of meta-tools. The AI model dynamically searches schemas and executes sandboxed Python code to call tools on demand, reducing token consumption by over 90% in dense tool environments. Shadow MCP occurs when developers connect local AI assistants, like Cursor or Claude Desktop, to unapproved local MCP servers without security team oversight. Enterprises can eliminate shadow MCP by deploying Bifrost Edge to discover local server configurations and enforce allowlists directly on endpoints. As the Model Context Protocol ecosystem expands, balancing rapid tool discovery with enterprise security is essential for production deployments. While an MCP registry provides the metadata needed to find external capabilities, runtime governance requires dedicated infrastructure. Engineering teams looking to secure their tool infrastructure can request a Bifrost demo https://getmaxim.ai/bifrost/book-a-demo to explore enterprise governance controls or evaluate the open-source Bifrost repository https://github.com/maximhq/bifrost to run a high-performance gateway locally.