Publish Store

Publishing to the Store

Overview

MCP apps publish to the deco studio registry via HTTP POST to a publish-request endpoint. After submitting, the deco team reviews the request and notifies the requester by email whether it was approved, rejected, or needs adjustments.

Two publishing modes:

Getting the Publish URL and API Token from Studio

Finding the Publish URL

1. Go to your org's registry settings in Studio: https://studio.decocms.com/{org-slug}/settings/store/registry (replace {org-slug} with your organization slug, e.g. https://studio.decocms.com/deco/settings/store/registry)
2. Find the Publish Requests card
3. The card shows a toggle to enable/disable external publish requests
4. When enabled, the publish URL is displayed in the card — copy it
   • Example: https://studio.decocms.com/org/deco/registry/publish-request
5. If the toggle is disabled, external publishing is not available for that org

Getting an API Token (if required)

1. In the same Publish Requests card, check if Require API Token is enabled
2. If enabled, requests without a valid token will be rejected
3. To generate a token:
   • The API Keys section appears below the Require API Token toggle
   • Enter a key name (e.g. "CI/CD Pipeline")
   • Click + Generate
   • Copy the key immediately — it is shown only once and cannot be retrieved later
   • If you lose it, generate a new one
4. If Require API Token is disabled, no token is needed

Rate Limiting

The Rate Limit section in the same card controls how many publish requests are allowed per time window:

• Max requests: default 100
• Window: Per hour or per minute

Config File: deco.json / app.json

The publish workflow reads deco.json (preferred) or falls back to app.json. They are the same file with different names — always prefer deco.json.

Full Schema

{
  "scopeName": "my-org",
  "name": "my-mcp",
  "friendlyName": "My MCP App",
  "description": "Short description of what this MCP does (1-2 sentences).",
  "icon": "https://example.com/icon.png",
  "unlisted": false,
  "official": false,
  "connection": {
    "type": "HTTP",
    "url": "https://my-mcp.decocache.com/api/mcp",
    "configSchema": {}
  },
  "requester": {
    "name": "Your Name or Organization",
    "email": "contact@example.com",
    "repository": "https://github.com/org/repo"
  },
  "metadata": {
    "categories": ["Developer Tools"],
    "tags": ["automation", "api"],
    "short_description": "One-line description (max 160 chars).",
    "mesh_description": "Longer description for AI agents (2-3 paragraphs)."
  },
  "tools": [
    { "name": "tool_name", "description": "What the tool does" }
  ]
}

Field Reference

Requester Info

Every publish request includes requester information so the deco team can:

1. Know who submitted the app
2. Send email notifications (approved / rejected / adjustments needed)
3. Reference the source code during review

Priority for requester fields:

1. requester object in deco.json / app.json (preferred)
2. Git committer name + email (automatic fallback)

Always fill in the requester fields in your config file for reliable communication.

How Publishing Works

1. Submit a Publish Request

The GitHub Actions workflow (or manual curl) sends a POST request with the app metadata. This creates a pending publish request.

2. Review by Deco Team

The deco team reviews the submission:

• Checks the app metadata, description, and tools
• May request adjustments via email

3. Notification

The requester receives an email at the address provided:

• Approved: App appears in the store (unless unlisted: true)
• Rejected: Email explains why
• Adjustments needed: Email details what to change, resubmit after fixing

4. Visibility After Approval

• unlisted: false (default) — App is listed in store search and browse
• unlisted: true — App is NOT listed but still accessible by direct ID

Publish Payload

The workflow builds a payload from your config. Here's how fields map:

GitHub Actions Workflow

The template includes .github/workflows/publish-registry.yml that automates publishing.

Triggers

• Push to main: When deco.json, app.json, or README.md changes
• Manual dispatch: With optional dry_run flag

Setup

For the public deco store (default)

No secrets needed. Just push to main.

For a private org store

1. Get the publish URL from Studio (see "Getting the Publish URL" above)
2. Go to your GitHub repo Settings > Secrets and variables > Actions
3. Add secret PUBLISH_URL with the URL you copied from Studio
4. If the org has Require API Token enabled:
   • Generate a token in Studio (see "Getting an API Token" above)
   • Add secret PUBLISH_API_KEY with the generated token

Manual Publish

1. Go to Actions > Publish to Registry
2. Click Run workflow
3. Optionally check Dry run to preview the payload without publishing

Manual curl

# Public deco store (no token needed)
curl -X POST https://studio.decocms.com/org/deco/registry/publish-request \
  -H "Content-Type: application/json" \
  -d @payload.json

# Private org store (with token)
curl -X POST <publish-url-from-studio> \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <api-key>" \
  -d @payload.json

Response Codes

Troubleshooting

Quick Checklist

1. Rename app.json to deco.json (or keep app.json — both work)
2. Fill in required fields: scopeName, name
3. Fill in recommended fields: friendlyName, description, icon
4. Add requester with name, email, and repository
5. Set connection.url to your production MCP server URL
6. Add metadata with categories, tags, short_description
7. Write a good README.md (used as the store readme, max 50,000 chars)
8. Set unlisted: false if you want the app visible in store search
9. For private org stores: get the publish URL and optional API token from Studio
10. Push to main — the workflow publishes automatically
11. Wait for email from deco team with approval/rejection/adjustments