內部 API 不應放在公開 MCP registry

Quick answer: A public MCP registry is a great home for a general-purpose tool you want strangers to discover, but it is the wrong place to expose an internal API that carries production data, service credentials, and unreleased behavior. Internal MCP servers should be private and reachable only through your own identity and network boundaries, even though the tooling around MCP defaults toward publishing and discovery. The reason is not secrecy alone: a public entry turns an internal integration into a durable, indexed surface that outlives the permissions you meant to scope it with, and it invites assumptions about stability that an internal endpoint cannot promise. If your MCP server wraps an internal microservice, treat it as infrastructure and keep it off the registry; use a registry only for tools you would genuinely defend as a public product.

The MCP ecosystem is modeled on package and plugin registries, where discoverability is the point. That model carries an implicit assumption that the server is meant for external consumers, which is exactly the opposite of an internal integration built to let an agent reach your own systems. Publishing such a server is rarely a dramatic "data breach" moment; it is more often a quiet misconfiguration where a server with access to staging or customer data becomes reachable through a shared catalog, and the access controls that should have been private are retrofitted after the fact.

Public registry versus private MCP

The two deployment models serve different trust boundaries and should not be treated as interchangeable distribution options.

The versioning row deserves emphasis: a public entry is treated as a commitment, while an internal endpoint moves as fast as the service behind it. Hosting the latter as a public entry creates external expectations your team cannot meet without slowing internal development.

Bind the server to your identity boundary

An internal MCP server should authenticate through the same IAM and network controls as the API it wraps, rather than introducing a separate shared secret. The server is a thin adapter, not a new trust zone.

Because the server reuses the existing issuer and scopes, revoking a developer or a service principal cuts off both direct API access and MCP access in one place, which is the behavior you want when someone leaves or a credential rotates.

Keep the schema separate from the data

One common reason teams reach for a registry is to share the tool definitions so agents know what is available. You can solve that without exposing the server: distribute the schema or generated client through internal channels while keeping the executable endpoint private.

This preserves the discoverability benefit—agents and developers can see the available tools—while the running server and its data stay inside the trust boundary. The artifact that gets shared is the description, not the access.

Generate the server from the internal contract

A spec-driven workflow keeps the private MCP server honest: the tool list, input schemas, and error shapes derive from the same OpenAPI contract the service already publishes internally, so the adapter cannot drift into exposing undocumented operations. When the internal API changes, the MCP server is regenerated and redeployed through the same private pipeline, with no registry entry to update or revoke.

The decision rule is simple. Ask whether you would be comfortable with an unknown external user calling every tool the server exposes, now and in six months after the underlying service changes. If the answer is no, the server belongs in a private, IAM-bound deployment with an internally distributed schema. Registries are for public products; internal APIs are infrastructure, and confusing the two is how an internal tool quietly becomes a public surface.

Frequently asked questions

Can I just publish an internal MCP server with strong auth?

Auth helps, but publishing still creates a durable, indexed entry and external expectations. The server's very existence and metadata become public, and one misconfigured scope can expose internal data. Keep it private unless it is genuinely a public product.

How do agents discover internal tools without a registry?

Distribute the generated tool schema or client through internal docs and allowlist the private host. Agents get the tool descriptions while the executable endpoint stays behind your network and IAM.

What identity should the private server use?

Reuse the same IAM/SSO issuer and scopes as the underlying API, so access, rotation, and revocation are managed in one place rather than through a separate shared secret.

Is it safe to expose staging data through a public MCP entry?

No. Staging data often mirrors real records and is still sensitive. A public entry should only ever expose data explicitly classified as public-safe.

How do we keep the MCP server in sync with the internal API?

Generate it from the internal OpenAPI contract and redeploy through a private pipeline, so tool definitions and input schemas track the service without manual registry updates.

This is part of the Powerduck vs Smithery comparison — start there for the full picture of choosing where MCP servers belong.