feat: MCP Registry integration — validate upstreams against official registry

[nfvelten]

Migrated from nfvelten/arbitus#119

Summary

The official MCP metaregistry at registry.modelcontextprotocol.io (6.6k stars) catalogs available MCP servers with metadata, capabilities, and trust scores.

Capabilities

• Upstream validation — warn/block connections to unregistered MCP servers
• Auto-discovery — pull upstream capabilities from registry metadata instead of manual config
• Rug Pull detection — monitor registry for tool definition changes on registered upstreams; alert or block if a server's tool schema changes unexpectedly

Config

transport:
  registry:
    enabled: true
    url: "https://registry.modelcontextprotocol.io"
    require_registered: false   # warn only; set true to block unregistered upstreams
    monitor_schema_changes: true

References

• PROPOSAL.md §2.4