MCP Registry Architecture
Version 1.5 · 19 March 2026
This paper proposes a lightweight, deployable architecture for solving the agent discovery problem in Model Context Protocol (MCP) ecosystems. The core proposal is a DNS-based convention — an _mcp TXT record — that points any compliant AI agent to an organisation’s MCP registry. DNS-based discovery is not new: MX, SRV, _dmarc, and WebFinger all use the same pattern. The novelty here is the specific convention for MCP, the design decision to make the registry itself an MCP server (requiring no special client code), and a fully serverless reference implementation.
No novel infrastructure is required. The proposal composes existing, operationally proven technologies into a governance-first discovery layer that any organisation can deploy in a day and run for under $5 per month at typical registry volumes.
What the Paper Covers
- The agent discovery problem and why manual configuration does not scale
- The
_mcpDNS TXT record convention and its field specification - A fully serverless registry architecture: Amazon CloudFront, Lambda@Edge, and DynamoDB Global Tables
- Public and private server access control enforced at the edge
- Security considerations including DNSSEC, JWT authentication, and prompt injection via registry
- A complete implementation guide with deployment steps and cost analysis
- Relationship to the official MCP registry, SEP #1959, NANDA, A2A, and WebFinger
- A live reference implementation at mcp.mariothomas.com
Download
The paper is available in PDF, Markdown, and Word formats from the companion GitHub repository:
github.com/mariothomas/mcp-dns-registry
Versions
| Version | Date | Status | Changes |
|---|---|---|---|
| 1.0 | 25 February 2026 | Published | Initial publication. |
| 1.1 | 27 February 2026 | Published | Added Section 2.3 — What This Proposal Does Not Solve — clarifying that the _mcp DNS record addresses discovery only, and that authentication, authorisation, and tool capability enumeration are explicitly out of scope for the DNS layer. |
| 1.2 | 28 February 2026 | Published | Extended Section 7.4 to address registry-level content filtering as a mitigation for prompt injection attacks, drawing on the DNS reputation services analogy. Added Section 10.6 — Agent Peer Discovery: A Natural Extension — sketching the /.well-known/mcp peer discovery model, referencing WebRTC and data mesh parallels, and positioning direct agent capability advertisement as a complementary layer to the registry architecture. Acknowledgements section added. |
| 1.3 | 2 March 2026 | Published | Extended Section 8.1 to document path-based and subdomain-based registry URL patterns as equally compliant implementation approaches, with trade-offs for each. Updated SPEC.md accordingly. |
| 1.4 | 2 March 2026 | Published | Updated Section 8.1 to reflect that the reference implementation at mcp.mariothomas.com uses path-based routing. Updated Section 8.4 and 8.5 to use correct filename index.js and handler index.handler. Rewrote Section 12 in present tense to reflect live deployment, confirmed GitHub repository URL, and noted path-based routing pattern used in the reference implementation. |
| 1.4.1 | 3 March 2026 | Published | Added copyright notice. No content changes. |
| 1.5 | 19 March 2026 | Published | Expanded Section 2.3 to include the explicit 255-byte DNS TXT record constraint as the hard technical rationale for the pointer-not-container design decision. Added version field to Section 5.4 DynamoDB schema for semantic versioning of registry entries, with accompanying field description distinguishing it from protocol_version. Added Section 5.7 — The Read Path: Audit Trail — making explicit that CloudFront and Lambda@Edge logs provide a queryable record of every agent access. Added Section 7.5 — Context Window Constraints in Large Registries — noting this as a known limitation and recommending aggressive use of capability_filter, concise server entries, and pagination at scale. Acknowledgements updated to reflect feedback from Cole Johnston. |
Reference Implementation
A working implementation is live at mcp.mariothomas.com, including a queryable _mcp DNS record, a fully functional registry, and three MCP servers — public articles, public locations, and private documents with signed-URL retrieval. Source code is available in the GitHub repository.
Feedback and Collaboration
This is a discussion draft. Feedback, critique, and alternative implementations are welcomed — particularly on the DNS convention itself and on non-AWS implementations. Open an issue or discussion in the GitHub repository, or get in touch directly here.
