MCP and agent distribution status
Last verified: 2026-08-02
The step-by-step registry procedure lives in mcp-registry-publication.md; this page tracks status only.
This is the tracked truth for first-party discovery, package publishing, the official MCP Registry, external directories, and crawler access. A checked-in manifest is not the same as a published listing, and a browser consent approval is not the same as a completed OAuth token exchange.
Codex owns its localhost callback and the final authorization-code exchange. Sleeper Hit therefore keeps the existing standards-compliant redirect intact. The client-neutral /oauth/connected page is an optional server-side verification handoff: it shows success only when the signed-in user has a recent, unexpired access token, but it cannot replace a client's callback without client cooperation.
Current status
| Item | Status | Owner | Evidence or dependency | Verification |
|---|---|---|---|---|
Production authenticated remote MCP (/mcp) | Complete | Sleeper Hit platform | Production and stage both return the RFC 9728 OAuth challenge; a Codex OAuth session successfully called whoami, get_agent_guidance, and get_credits on stage. | POST an MCP initialize request without credentials and confirm 401 plus WWW-Authenticate; connect Codex and call the three read-only tools. |
Production public discovery MCP (/api/mcp) | Complete | Sleeper Hit platform | Production and stage return the public descriptor without authentication; public tools are read-only. | GET the endpoint, then call initialize and tools/list; confirm only public discovery tools and readOnlyHint: true. |
| Official MCP Registry: public discovery | Listed; metadata revision pending | Sleeper Hit release owner | studio.sleeperhit/public-discovery version 0.3.0 is active in the official registry. Root server.json is now 0.4.0: it drops the repository link (the repository is private, so the published 0.3.0 link 404s for every visitor) and adds an icon. Registry versions are immutable, so the correction only lands on publish. | Query https://registry.modelcontextprotocol.io/v0.1/servers?search=sleeperhit&limit=100. |
| Official MCP Registry: authenticated creation | Ready to publish; deferred | Sleeper Hit release owner | registry/authenticated-creation.server.json validates against the current official schema and points to the verified production /mcp endpoint. Publishing creates a new immutable registry identity/version and requires the existing domain signing credential plus an explicit release decision. | Publish the manifest as studio.sleeperhit/creation-production, then query the registry and perform a fresh OAuth connection from the listing URL. |
@sleeperhit/cli npm package | Intentionally deferred | Sleeper Hit release owner | The package is not present on npm. Before publishing, choose a public license, confirm the @sleeperhit npm scope owner, package the workspace dependency, and run package provenance/release checks. Repository metadata now points at SleeperHitStudio/sleeperhit-studio. | npm view @sleeperhit/cli name version repository.url --json, then install into a clean temporary project and run sleeperhit --help. |
@sleeperhit/mcp-server npm package | Intentionally deferred | Sleeper Hit release owner | The package is not present on npm. Remote OAuth is the preferred modern path and does not depend on this package. Local stdio remains buildable from the repo. Public publishing has the same license, scope ownership, workspace-package, and provenance dependencies as the CLI. | npm view @sleeperhit/mcp-server name version repository.url --json, then install into a clean temporary project and complete an API-key stdio smoke test. |
| External MCP/community directories | Deferred | Sleeper Hit growth/release owner | Wait for the authenticated creation registry entry so directory copy can point at the primary product path instead of only public discovery. Do not claim a listing until its public URL is recorded here. | Record each directory listing URL, open it logged out, and connect through the listed production endpoint. |
| OpenAPI/API directories | Deferred | Sleeper Hit growth/release owner | The stable OpenAPI document is live; external submission requires an owner account and directory-specific review. | Record each public listing URL and compare its fetched spec URL with https://sleeperhit.studio/api/v1/openapi.json. |
| Crawler transport access | Complete | Sleeper Hit platform | Production robots.txt explicitly allows major search/answer-engine crawlers and links the docs sitemap. The sitemap includes human docs, machine indexes, llms.txt, and llms-full.txt. | Fetch https://sleeperhit.studio/robots.txt and https://docs.sleeperhit.studio/sitemap.xml; require HTTP 200 and the expected entries. |
| Search/answer-engine indexing | Externally deferred | Sleeper Hit growth owner | A repository deploy can expose crawlable documents but cannot guarantee third-party indexing. Requires owner access to the relevant webmaster or directory consoles. | Use each provider's inspection console or documented search query and record the indexed canonical URL/date. |
Registry manifests
server.json— public discovery listing (studio.sleeperhit/public-discovery); live at0.3.0, checked in at0.4.0and awaiting publish.registry/authenticated-creation.server.json— prepared full OAuth creation/production listing (studio.sleeperhit/creation-production, version0.1.0), never published.
Registry versions are immutable and servers cannot be deleted or unpublished. Change the version before publishing any semantic manifest change; never reuse a published name/version pair. Each manifest's version is held equal to the version its server returns from initialize, and tests/unit/mcp-registry-manifests.test.ts fails if a manifest drifts from that or from the published server.json schema.
Adding, renaming, or removing MCP tools does not require a registry republish — server.json has no tool field, and clients read the catalog from the live server.
Authenticated registry release checklist
Owner: Sleeper Hit release owner. The full procedure — prerequisites, commands, and post-publish verification — is in mcp-registry-publication.md. Two decisions must be settled before the first publish, because both become permanent:
- Confirm that
studio.sleeperhit/creation-productionis the durable registry name. Servers cannot be deleted or renamed once published. - Confirm that version
0.1.0is the intended first immutable release.
The studio.sleeperhit namespace is already proven by the deployed /.well-known/mcp-registry-auth file; publishing needs the release owner's matching private key, which is not in this repository.