feat: continuous verification job #219

aphansal123 · 2025-08-04T18:15:31Z

Breaking Changes

None - This is a purely additive feature that:

Extends existing database interfaces with new methods
Adds new verification endpoints without modifying existing ones
Maintains backward compatibility with existing server registration flows
Uses feature flags and configuration to enable/disable the background job system

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update

Checklist

I have read the MCP Documentation
My code follows the repository's style guidelines
New and existing tests pass locally
I have added appropriate error handling
I have added or updated documentation as needed

Additional context

Key Features Implemented

Background Verification Job System
- Cron-based scheduling (configurable, default: daily at 2 AM)
- Configurable concurrent processing (default: 10 parallel verifications)
- Graceful lifecycle management with proper cleanup
- Real-time status monitoring and health checks
Dual Verification Methods
- HTTP-01 Challenge: Verifies via /.well-known/mcp-challenge/{token} endpoint
- DNS TXT Record: Verifies via _mcp-challenge.{domain} TXT records
- Fallback logic with intelligent retry patterns
- Security hardening: TLS 1.2+ enforcement, certificate validation
Advanced Error Handling & Retry Logic
- Exponential backoff with configurable limits
- Error classification (retryable vs. permanent failures)
- Context-aware timeouts with proper cancellation
- Modern Go patterns using errors.Is() and errors.As()
Comprehensive Database Layer
- Domain verification lifecycle tracking
- Consecutive failure counting with threshold-based actions
- Automated cleanup of old verification records
- Complete implementations for both MongoDB and in-memory storage
Notification & Alerting System
- Configurable failure thresholds (default: 3 consecutive failures)
- Cooldown periods to prevent notification spam (default: 24 hours)
- Extensible notification interface for different alert channels
- Structured logging for debugging and monitoring

Configuration Options

type BackgroundJobConfig struct {
    CronSchedule               string        // Default: "0 0 2 * * *" (daily at 2 AM)
    MaxConcurrentVerifications int           // Default: 10
    VerificationTimeout        time.Duration // Default: 30s
    FailureThreshold           int           // Default: 3
    RetryDelay                 time.Duration // Default: 1s
    NotificationCooldown       time.Duration // Default: 24h
    CleanupInterval            time.Duration // Default: 7 days
}

… domain verification

…en_test.go

Co-authored-by: Copilot <[email protected]>

…protocol/registry into thomas-sickert/token-storage # Conflicts: # internal/verification/README.md # internal/verification/token.go # internal/verification/token_test.go

Closes [#22190](github/copilot#22190)  ## Motivation and Context This PR implements DNS record verification functionality for the MCP Registry's server name verification system. This feature enables domain owners to prove ownership of their domains by adding specific TXT records to their DNS, which is required for publishing MCP servers under domain-scoped namespaces (e.g., com.example/my-server). This prevents domain impersonation and ensures only legitimate domain owners can publish under their domains. The implementation follows industry best practices used by certificate authorities and cloud services for domain ownership verification, providing a secure and reliable method for continuous domain validation. ## How Has This Been Tested? - Comprehensive unit tests: Added extensive test coverage for all DNS verification functions including success cases, failure scenarios, timeout handling, and retry logic - Mock DNS resolver: Implemented a complete mock DNS resolver system for reliable testing without external dependencies - Token generation and validation: Added tests for cryptographically secure token generation and format validation Error handling: Tested various error conditions including DNS failures, timeouts, and invalid inputs - Integration scenarios: Tested with both mock and real DNS configurations - Performance benchmarks: Added benchmark tests for token generation and validation functions - Example CLI tool: Created a dns-verify example application for manual testing and demonstration ## Breaking Changes  ## Types of changes  - [ ] Bug fix (non-breaking change which fixes an issue) - [X] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist  - [X] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [X] My code follows the repository's style guidelines - [X] New and existing tests pass locally - [X] I have added appropriate error handling - [X] I have added or updated documentation as needed ## Additional context - Cryptographically secure tokens: 128-bit random tokens using crypto/rand with base64url encoding - Robust DNS resolution: Configurable DNS resolvers with support for secure resolvers (8.8.8.8, 1.1.1.1) - Retry logic: Exponential backoff for transient DNS failures with configurable timeouts and retry limits - Comprehensive error handling: Detailed error types with proper error wrapping and retry logic - Security considerations: Uses secure DNS resolvers, validates token formats, and implements proper timeout handling - Extensive documentation: Added detailed README with usage examples, security considerations, and integration guides --------- Co-authored-by: Copilot <[email protected]> Co-authored-by: Trent Jones <[email protected]>

… domain verification and 3-strike failure policy

… implementation

…erification-job

…per error handling, and shared utilities

…se fields and methods

aphansal123 · 2025-08-04T21:36:56Z

I'll update the well-known namespace format based on our thread earlier - .well-known/mcp/verify

…vironment settings

…on-job

Co-authored-by: Copilot <[email protected]>

…on-job

…te test naming from BG to BackgroundJob

Copilot

Pull Request Overview

This PR implements a comprehensive continuous verification job system for the MCP Registry to maintain domain ownership validation. The system provides automatic background verification of registered domains using both DNS TXT records and HTTP challenges, with robust error handling, retry logic, and notification systems.

Key changes include:

Background verification job with cron-based scheduling and concurrent processing
Enhanced database layer supporting domain verification lifecycle tracking
Configuration system for background job behavior and thresholds
Comprehensive test coverage for all verification components

Reviewed Changes

Copilot reviewed 18 out of 20 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`internal/verification/background_job.go`	Core background verification job implementation with cron scheduling
`internal/verification/http.go`	HTTP-01 challenge verification with security hardening
`internal/verification/dns.go`	DNS TXT record verification with context support
`internal/verification/validation.go`	Common input validation logic for both verification methods
`internal/verification/wait.go`	Context-aware waiting utility
`internal/model/model.go`	Enhanced domain verification data models
`internal/database/*.go`	Database interface extensions for verification tracking
`internal/config/config.go`	Configuration options for background job system
`cmd/registry/main.go`	Integration of background job into main application

Copilot · 2025-08-05T21:52:53Z

internal/verification/dns_resolver.go

@@ -22,7 +22,7 @@ func (d *DefaultDNSResolver) LookupTXT(ctx context.Context, name string) ([]stri

 // NewDefaultDNSResolver creates a DNS resolver with the given configuration
 //
-//nolint:ireturn // Factory function returning interface is acceptable for dependency injection
+//nolint:ireturn // Factory function intentionally returns interface for dependency injection


The comment has been corrected from 'Factory function returning interface is acceptable for dependency injection' to 'Factory function intentionally returns interface for dependency injection', which is clearer and more grammatically correct.

Copilot · 2025-08-05T21:52:53Z

internal/config/config.go

@@ -1,7 +1,7 @@
 package config

 import (
-	env "github.com/caarlos0/env/v11"
+	"github.com/caarlos0/env/v11"


The import alias has been removed (changed from env \"github.com/caarlos0/env/v11\" to just the standard import). This is good practice as the package name env is already clear and the alias was unnecessary.

Copilot · 2025-08-05T21:52:53Z

internal/verification/dns.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"log"
 	"net"
-	"strings"
 	"time"


The unused import \"strings\" has been removed from line 9, which improves code cleanliness. The string manipulation functionality has been moved to the shared validation module.

aphansal123 and others added 15 commits July 29, 2025 15:27

feat: implement 128-bit cryptographically secure token generation for…

72a1967

… domain verification

Merge branch 'main' into feature/domain-verification-token-generation

ffbed48

Fix package references and eliminate duplicate string literals in tok…

f375640

…en_test.go

Update internal/verification/README.md

f7a85fa

Co-authored-by: Copilot <[email protected]>

Update internal/verification/token_test.go

36579a1

Co-authored-by: Copilot <[email protected]>

Capitalize MaxDNSRecordLength variable name for consistency

382925e

Add comprehensive DNS TXT record RFC compliance validation tests

a9afe32

Fix gci linter error by removing trailing whitespace

bc4d621

Initial implementation of the metadata collection

71b6a9f

Merge branch 'remote-verification' of https://github.com/modelcontext…

c3cd6f7

…protocol/registry into thomas-sickert/token-storage # Conflicts: # internal/verification/README.md # internal/verification/token.go # internal/verification/token_test.go

Update to account for the verification without server case

3daef44

Implement continuous verification background job system with DNS/HTTP…

5daa853

… domain verification and 3-strike failure policy

Fix database interface methods and refine background verification job…

b48197b

… implementation

Merge branch 'remote-verification' into thomas-sickert/token-storage

57fe1ad

aphansal123 self-assigned this Aug 4, 2025

aphansal123 added 2 commits August 4, 2025 14:16

Merge branch 'thomas-sickert/token-storage' into feature/continuous-v…

8b04448

…erification-job

Fix linting errors and modernize verification code with TLS 1.2+, pro…

92b8406

…per error handling, and shared utilities

aphansal123 changed the title ~~Feature/continuous verification job~~ feat: continuous verification job Aug 4, 2025

aphansal123 changed the base branch from thomas-sickert/token-storage to main August 4, 2025 19:51

aphansal123 changed the base branch from main to thomas-sickert/token-storage August 4, 2025 19:52

aphansal123 requested a review from Copilot August 4, 2025 19:52

This comment was marked as outdated.

Sign in to view

Fix build errors and duplicate struct definitions, add missing databa…

40865cd

…se fields and methods

aphansal123 added 2 commits August 4, 2025 17:49

fix: update cron schedule comment and remove unused variable assignment

60999f9

feat: integrate background verification job into main application

b981b95

Base automatically changed from thomas-sickert/token-storage to remote-verification August 5, 2025 14:06

aphansal123 added 2 commits August 5, 2025 10:17

fix: resolve golangci-lint import formatting issues

1981eb8

Add production-ready background verification job with configurable en…

a348eef

…vironment settings

Merge branch 'remote-verification' into feature/continuous-verificati…

39efcf9

…on-job

aphansal123 requested a review from Copilot August 5, 2025 16:08

This comment was marked as outdated.

Sign in to view

aphansal123 and others added 3 commits August 5, 2025 12:17

update temporary network error to clarify that it is non-retryable

426428b

Co-authored-by: Copilot <[email protected]>

Fix negative timeout bug in background verification job

680e739

Upgrade env package from v10 to v11 and fix golangci-lint errors

b479a75

aphansal123 requested a review from Copilot August 5, 2025 17:16

This comment was marked as outdated.

Sign in to view

aphansal123 added 2 commits August 5, 2025 13:35

Merge branch 'remote-verification' into feature/continuous-verificati…

75312ec

…on-job

Fix notification logic to alert on all threshold exceedances and upda…

af1627e

…te test naming from BG to BackgroundJob

aphansal123 requested review from thomas-sickert and trent-j and removed request for trent-j and thomas-sickert August 5, 2025 21:22

Fix background job to use stored tokens instead of generating new ones

6d0d5d6

aphansal123 requested a review from Copilot August 5, 2025 21:52

Copilot AI reviewed Aug 5, 2025

View reviewed changes

aphansal123 requested review from trent-j and thomas-sickert August 5, 2025 22:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: continuous verification job #219

feat: continuous verification job #219

Uh oh!

aphansal123 commented Aug 4, 2025 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

aphansal123 commented Aug 4, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Aug 5, 2025

Uh oh!

Copilot AI Aug 5, 2025

Uh oh!

Copilot AI Aug 5, 2025

Uh oh!

Uh oh!

feat: continuous verification job #219

Are you sure you want to change the base?

feat: continuous verification job #219

Uh oh!

Conversation

aphansal123 commented Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Breaking Changes

Types of changes

Checklist

Additional context

Key Features Implemented

Configuration Options

Uh oh!

This comment was marked as outdated.

Uh oh!

aphansal123 commented Aug 4, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Aug 5, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 5, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

aphansal123 commented Aug 4, 2025 •

edited

Loading