fix: store tokens in ~/.config/mcp-publisher/ instead of cwd#1166
Merged
fix: store tokens in ~/.config/mcp-publisher/ instead of cwd#1166
Conversation
The mcp-publisher CLI wrote intermediate GitHub token files (.mcpregistry_github_token, .mcpregistry_registry_token) to the current working directory, causing users to accidentally commit live credentials to git. At least 2 users have publicly pushed tokens due to this. This commit: - Eliminates intermediate token files entirely by keeping the GitHub token in memory during the login->exchange flow - Moves the unified token from ~/.mcp_publisher_token to ~/.config/mcp-publisher/token.json (0600 perms, 0700 dir) - Clears the GitHub token from memory immediately after exchange - Cleans up all legacy token locations on logout (cwd, $HOME) - Removes dead NeedsLogin() method from Provider interface - Adds auth package tests (11 tests, previously 0) - Isolates test token setup with t.TempDir() instead of real $HOME Breaking change: users must re-login after upgrading. Existing tokens at ~/.mcp_publisher_token will not be auto-migrated. Fixes #663 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…leanup - Add login_test.go: verifies token is written to ~/.config/mcp-publisher/, directory has 0700 perms, file has 0600 perms, no legacy files created - Add logout_test.go: verifies cleanup of new token, legacy token, both simultaneously, cwd .mcpregistry_* files, and $HOME .mcpregistry_* files - Improve "not authenticated" error to print a hint about the token location change for users upgrading - Add .mcpregistry_* cleanup to integration test teardown Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2 tasks
tadasant
approved these changes
Apr 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #663
mcp-publisher loginno longer writes.mcpregistry_github_tokenand.mcpregistry_registry_tokento the current working directory. GitHub tokens are kept in memory during the login→exchange flow and cleared immediately after.~/.mcp_publisher_tokento~/.config/mcp-publisher/token.json(dir 0700, file 0600), following the convention used bygh,docker, andkubectl.NeedsLogin()was on theProviderinterface but never called — removed from interface and all 4 implementations.forceLoginfield also removed.GitHubATProvider(package previously had 0 tests).SetupTestTokennow usest.TempDir()+t.Setenv("HOME", ...)instead of writing to real$HOME.Breaking change
Users must re-login after upgrading (
mcp-publisher login <method>). Existing tokens at~/.mcp_publisher_tokenare not auto-migrated.logoutcleans up both old and new locations.Test plan
make checkpasses (lint, unit tests, integration tests)mcp-publisher login nonestores token at~/.config/mcp-publisher/token.json.mcpregistry_*files created in cwd after login (with--token,MCP_GITHUB_TOKEN, or device flow)mcp-publisher publishreads token from new locationmcp-publisher validatereads registry URL from new locationmcp-publisher logoutcleans up new location, legacy~/.mcp_publisher_token, and cwd.mcpregistry_*filesmcp-publisher logoutwhen not logged in shows "Not logged in"🤖 Generated with Claude Code