[M3gA-Mind]

Summary

RegistryServerSummary.official is documented as "never trusted from the wire". But the Smithery adapter decodes its rows straight from Smithery's JSON, and tag_source cleared only website_url and auth_kind. So with a Smithery key configured, a row arriving with "official": true kept the badge on every uncurated search. That covers RegistrySearch and the guided SetupSearch, both of which answer through McpRegistry::registry_search. Only RegistrySearchCurated with tag_official re-tagged it.

• tag_source clears official, like the other trust signals.
• registry_search clears it on every row from every source, so only registry_search_curated can set it, from the module's own list.

The field still deserializes. Hosts decode the badge the module sets in its replies (OpenHuman shows it from RegistrySearchCurated), and #[serde(skip_deserializing)] would strip it there.

Related issue

None filed. Found by reading the curation path.

API or behavior changes

No row from RegistrySearch or SetupSearch is badged official. RegistrySearchCurated with tag_official badges exactly the curated servers, as before. No contract change.

Validation

On our Linux CI runner (toolchain 1.99.1), on this branch from main e098e53:

• cargo fmt --all -- --check: clean
• cargo clippy --locked --all-targets --all-features -- -D warnings: 0 errors (main: 0)
• cargo build --locked --all-targets --all-features: ok
• The new tests (plain, curated, Smithery adapter, and the bus members) pass. -p tinymcp registry::: 723 passed, 0 failed.
• cargo test --locked --all-features --workspace: 1575 passed, 7 failed. All 7 are timing flakes in tinybus_module::directories and registry::boot that fail the same way on main in full-suite runs and pass alone; none touches the badge.
• Red control (both clearing lines removed, i.e. main's behaviour):
  • the plain-search test fails (!lookalike(&page).official);
  • the adapter test fails (!tagged[0].official);
  • the curated test fails for tag_official: false;
  • the bus test fails naming RegistrySearch ["notion",1,20].

Tests

• no_search_member_badges_a_row_that_claims_official_on_the_wire drives RegistrySearch, SetupSearch, and RegistrySearchCurated with tagging off and on, through the module service. It runs against loopback stand-ins for the official catalog and for Smithery, whose one row claims the badge.
• McpRegistry-level tests cover plain search and curated search.
• a_row_claiming_the_official_badge_arrives_without_it covers the Smithery adapter's tag_source.
• Red control: with both clearing lines removed (main's behaviour), the plain-search, adapter and bus tests fail.
• Two test-only seams (Registries::with_smithery_base, McpRegistry::with_registries, McpService::with_dynamic_registry) point the module at the stand-ins.

Documentation

Code comments at both clearing sites.

Checklist

• The change is focused on one logical change
• No new #[allow(...)], #[ignore], or relaxed lints
• No secrets, tokens, or .env contents in the diff or the description

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 40b4cef4-e41f-446a-8d80-54566fee040f

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[tinysweeper]

Tiny Sweeper review

Reviewed head: 911ad7802ba1cdbfaf2de49dc9db5363e19e8fe7

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 7 of 7 files.
Pull request purpose (title): Never take the offic…

Diagnostics and supporting details

Full summary

Pull request purpose (title): Never take the official badge from an upstream registry row. The change stops the `official` badge from being taken from an upstream registry row: the Smithery adapter's `tag_source` clears `official` alongside the other untrusted fields, and `McpRegistry::registry_search` clears it on every row from every source, so only `registry_search_curated` can set the badge from the module's own curated list. The tests lane now reports no defect: it found the diff carries tests that would fail if either guard were removed, including the loopback Smithery tests in `ops/mod_tests.rs` and `tinybus_module/mod_tests.rs`. The latest-push delta is unavailable, so no push-delta comparison is presented.

Review snapshot

Change surface	Files	Review signal	Count
Production	4	Active findings	0
Tests	3	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: Test coverage is assessed from changed tests and lane evidence; execution is not claimed without trusted check data.

What changed

`tag_source` in the Smithery adapter now clears `official` like the other trust signals, and `McpRegistry::registry_search` clears `official` on every row returned by every source, so `RegistrySearch` and `SetupSearch` can no longer surface an upstream-claimed badge while `registry_search_curated` keeps badging exactly the curated servers. The field still deserializes so hosts can decode the badge the module sets in its replies. Test-only seams (`Registries::with_smithery_base`, `McpRegistry::with_registries`, `McpService::with_dynamic_registry`) point the module at loopback stand-ins.

Features

• Modified — Smithery adapter clears the official badge on decoded rows: Rows arriving from Smithery with `official: true` no longer keep the badge, matching the documented rule that the field is never trusted from the wire. (crates/tinymcp/src/registry/sources/smithery/mod.rs pub(super) fn tag_source(mut servers: Vec<RegistryServerSummary>) -> Vec<Registr, crates/tinymcp/src/registry/sources/smithery/mod.rs impl SmitheryRegistry {)
• Modified — Uncurated registry search clears the official badge on every row: `RegistrySearch` and `SetupSearch` can no longer surface an upstream-claimed official badge; only `registry_search_curated` sets it, from the module's own list. (crates/tinymcp/src/registry/ops/types.rs impl McpRegistry {)
• Internal refactor — Test-only seams for pointing the registry and service at stand-in upstreams: Enables tests to substitute loopback servers for the official catalog and Smithery without changing production behavior; the seams are `#[cfg(test)]` only. (crates/tinymcp/src/registry/ops/types.rs impl McpRegistry {, crates/tinymcp/src/registry/sources/types.rs impl Registries {, crates/tinymcp/src/tinybus_module/service.rs impl McpService {)

Tests

• unit — A Smithery row claiming the official badge arrives from `tag_source` without it.: Behavioural adapter-level test; the tests lane reported it fails if the `tag_source` clearing is reverted. (crates/tinymcp/src/registry/sources/smithery/mod_tests.rs fn a_row_that_already_names_its_source_keeps_it() {)
• integration — A row claiming official on the wire is not badged by a plain `registry_search` or by `registry_search_curated` with tagging off or on.: Behavioural registry-level tests driving a loopback Smithery listing a row with `"official": true`; the tests lane reported they would fail if either guard were removed. (crates/tinymcp/src/registry/ops/mod_tests.rs async fn a_supervisor_from_the_registry_steps_over_its_store() {)
• integration — No search member (`RegistrySearch`, `SetupSearch`, `RegistrySearchCurated` with tagging off and on) badges a row that claims official on the wire.: Behavioural bus-member test driving the same loopback stand-ins through the module service; the tests lane found no defect. (crates/tinymcp/src/tinybus_module/mod_tests.rs async fn configured_tool_call_uses_the_services_sandbox_not_an_empty_launcher_se)

Findings

No active actionable findings.

Before merge

None.

How this fits together

flowchart LR
  n0["...or_from_the_registry_steps_over_its_store<br/>changed"]:::changed
  n1["McpRegistry<br/>changed"]:::changed
  n2["SmitheryRegistry<br/>changed"]:::changed
  n3["a_row_that_already_names_its_source_keeps_it<br/>changed"]:::changed
  n4["Registries<br/>changed"]:::changed
  n5["bare_summary"]:::impacted
  n6["registry"]:::impacted
  n7["clone"]:::impacted
  n8["registry_over_catalog"]:::impacted
  n9["registry_with"]:::impacted
  n0 -->|calls| n6
  n0 -->|uses| n6
  n0 -->|tests| n6
  n3 -->|calls| n5
  n3 -->|tests| n5
  n4 -->|uses| n2
  n6 -->|uses| n1
  n8 -->|uses| n1
  n8 -->|calls| n7
  n9 -->|uses| n1
  n9 -->|calls| n6
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Loading

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The critique lane reported 0 findings.
• Lane summary: Reviewed 3 files; 0 findings.

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The security lane reported 0 findings.
• Lane summary: Reviewed 3 files; 0 findings.

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The tests lane found the diff carries behavioural tests that would fail if either guard were removed, driving a loopback Smithery row with `"official": true` and asserting it comes back unbadged.
• Positive: The tests lane noted the `#[cfg(test)]` constructors are test-only seams.
• Lane summary: The change adds a real behavioural guard (clearing `official` in `tag_source` and in the uncurated `registry_search` merge) and the diff carries tests that would fail if either guard were removed: the unit test in `smithery/mod_tests.rs` and the end-to-end tests in `ops/mod_tests.rs` and `tinybus_module/mod_tests.rs` that drive a loopback Smithery listing a row with `"official": true` and assert the row comes back unbadged. The `#[cfg(test)]` constructors are test-only seams. I found no defect worth reporting.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The commits lane reported no sensitive content in committed files.
• Lane summary: No sensitive content in committed files.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The description lane found the new commits' test-only seams and tests match the description, with claims lining up with the diff.
• Lane summary: The new commits add test-only seams and tests that match the description: `with_registries`, `with_smithery_base` and `with_dynamic_registry` are `#[cfg(test)]` helpers, and the new tests exercise the badge-clearing behaviour the PR describes. The description's claims line up with the diff; no reportable defect found.

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.002851
• Tokens: 214366 input · 3381 output · 65536 cached · 511 embedding
• Updated: 2026-11-11T15:29:44Z

Head	State	Pass summary
0c51c79b1729	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-11-11T10:57:59Z)
12aabe95fd9f	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-11-11T12:56:23Z)
911ad7802ba1	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-11-11T15:29:44Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0070

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0029