MCP Registry publish 401 after a green validate: the JWT expired

[b-hash88]

MCP Registry publish 401 after a green validate: the JWT expired

The official publisher can validate server.json successfully and still fail the next command with:

Publishing to https://registry.modelcontextprotocol.io...
Error: publish failed: server returned status 401
Invalid or expired Registry JWT token
failed to parse token: token has invalid claims: token is expired

That combination is not contradictory. mcp-publisher validate proves that the manifest satisfies the Registry schema and package checks. It does not prove that the locally cached Registry JWT is fresh, and it does not refresh it. gh auth status is a different credential boundary and cannot repair this token.

One-off recovery

Keep the authentication step adjacent to publication:

mcp-publisher validate
mcp-publisher login github
mcp-publisher publish

Treat the issued JWT as a secret. Do not print it, commit it, copy it into an agent prompt, or persist it as a repository variable.

Recurring GitHub publication

For a GitHub-hosted release workflow, avoid a long-lived Registry credential. Give only the publication job the permissions required for GitHub OIDC:

permissions:
  contents: read
  id-token: write

steps:
  - run: ./mcp-publisher validate
  - run: ./mcp-publisher login github-oidc
  - run: ./mcp-publisher publish

Pin the publisher release and verify its official checksum before execution. Publish a unique server version; Registry versions are immutable, so rerunning the same version is not an update.

Production proof

KnownFix reproduced the expired-token 401 on 2026-08-27 immediately after the same server.json passed validation. We then moved Registry publication to a least-privilege GitHub OIDC job, checksum-pinned mcp-publisher v1.8.1, and published io.github.b-hash88/knownfix version 0.3.15 successfully.

• Successful workflow: https://github.com/b-hash88/knownfix-backend/actions/runs/33091436542
• Public Registry record: https://registry.modelcontextprotocol.io/?q=io.github.b-hash88%2Fknownfix
• Free structured fix: https://b-hash88.github.io/knownfix/fixes/mcp-registry-jwt-expired-401.html

Limits

This report verifies interactive GitHub login and GitHub Actions OIDC publication. It does not test DNS or HTTP namespace authentication. The checksum cited by the implementation is release- and platform-specific; re-resolve it from the official release when changing publisher version or runner architecture.