GitHub org-based publish returns 403 despite confirmed-public org membership, even after full OAuth revoke and re-auth

[mrmclickstream]

Summary

mcp-publisher publish fails with a 403 claiming I have no permission to publish under my GitHub organization's namespace, even though I've verified — through three independent methods, including the exact API endpoint the registry itself uses — that my org membership is public. The failure persists identically across 4 separate attempts, including after a full OAuth revoke and fresh re-authorization.

Error

{"title":"Forbidden","status":403,"detail":"You do not have permission to publish this server. You have permission to publish: io.github.mrmclickstream/*. Attempting to publish: io.github.icedq-tools/mcp-server. If you're trying to publish to a GitHub organization, you may need to make your organization membership public in your GitHub settings: https://docs.github.com/en/account-and-profile/how-tos/organization-membership/publicizing-or-hiding-organization-membership"}

Context

• GitHub account: mrmclickstream
• Organization: icedq-tools (I am an Owner)
• server.json name: io.github.icedq-tools/mcp-server
• Auth method: GitHub OAuth device flow (mcp-publisher login github)

Verification already performed

1. Set org membership visibility to Public via github.com/orgs/icedq-tools/people.
2. Confirmed publicly visible via an incognito browser session at github.com/mrmclickstream — icedq-tools appears under Organizations.
3. Called the exact endpoint documented as the one the registry uses to discover org namespaces, GET https://api.github.com/users/mrmclickstream/orgs, and confirmed icedq-tools is present in the returned array.
4. Fully revoked the app's OAuth grant at github.com/settings/applications, then ran a completely fresh mcp-publisher login github (new device code, new consent screen).
5. Retried mcp-publisher publish — identical 403, unchanged, across 4 attempts spanning roughly 30+ minutes, including both before and after the OAuth revoke.

Expected behavior

Given confirmed-public org membership (verified against the registry's own documented data source), mcp-publisher publish should authorize io.github.icedq-tools/* and allow the publish.

Actual behavior

Consistently 403s, only ever authorizing io.github.mrmclickstream/*, regardless of re-authentication.

Environment

• mcp-publisher version: 1.8.1 (commit: f52dc85, built: 2026-08-06T23:36:13Z)
• OS: Windows