feat(registries): MCP-866 trust/provenance model foundation (config + merge)

Foundation layer for user-added registries. CLI add-source, server-add-time
stamping/enforcement, REST/MCP surface, and docs follow in subsequent commits.

- Add registry provenance trust tags (official/trusted vs custom/unverified) to
  both config and registries RegistryEntry, with IsTrusted() helpers.
- DefaultRegistries are tagged official/trusted.
- SetRegistriesFromConfig recomputes provenance AUTHORITATIVELY by ID: a
  shipped-default ID is always official; anything user-added is
  custom/unverified — a user cannot self-assert trust via config.
- ServerConfig gains SourceRegistryID + SourceRegistryProvenance so a server's
  origin is recorded for the approval/quarantine view.
- Config validation rejects skip_quarantine for servers sourced from a
  custom/unverified registry (quarantine-always; no user allowlist).
- RegistriesLocked enterprise stub knob (doc + add-source rejection only).
- Tests: provenance JSON round-trip, authoritative merge recompute (incl.
  rejecting self-asserted trust), skip_quarantine rejection/allowance. config +
  registries suites green with -race; golangci-lint 0 issues.

Refs MCP-866.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Author: Dumbris

internal/config/config.go

@@ -101,6 +101,13 @@ type Config struct {
 	// Registries configuration for MCP server discovery
 	Registries []RegistryEntry `json:"registries,omitempty" mapstructure:"registries"`
 
+	// RegistriesLocked is an enterprise stub knob (MCP-866): when true, runtime
+	// additions of custom registries (e.g. `registry add-source`, the REST/MCP
+	// add-source surface) are rejected so an administrator can pin the discovery
+	// sources. Built-in defaults are unaffected. Documented but otherwise inert
+	// beyond the add-source rejection.
+	RegistriesLocked bool `json:"registries_locked,omitempty" mapstructure:"registries-locked"`
+
 	// Deprecated: Features flags are unused and have no runtime effect. Kept for backward compatibility.
 	Features *FeatureFlags `json:"features,omitempty" mapstructure:"features"`
 
@@ -251,6 +258,16 @@ type ServerConfig struct {
 	LauncherWaitTimeout Duration `json:"launcher_wait_timeout,omitempty" mapstructure:"launcher_wait_timeout" swaggertype:"string"`
 	EnabledTools        []string `json:"enabled_tools,omitempty" mapstructure:"enabled_tools"`   // Allowlist: only these tools are exposed; mutually exclusive with disabled_tools
 	DisabledTools       []string `json:"disabled_tools,omitempty" mapstructure:"disabled_tools"` // Denylist: these tools are hidden; mutually exclusive with enabled_tools
+
+	// SourceRegistryID records which registry this server was added from (empty
+	// for manually-configured servers). MCP-866: surfaced in the approval /
+	// quarantine view so a reviewer can see a server's origin.
+	SourceRegistryID string `json:"source_registry_id,omitempty" mapstructure:"source_registry_id"`
+	// SourceRegistryProvenance is the trust tag of the source registry at add
+	// time (RegistryProvenanceOfficial / RegistryProvenanceCustom). When it is
+	// RegistryProvenanceCustom, skip_quarantine is forbidden — a custom,
+	// unverified registry can never opt its servers out of quarantine.
+	SourceRegistryProvenance string `json:"source_registry_provenance,omitempty" mapstructure:"source_registry_provenance"`
 }
 
 // OAuthConfig represents OAuth configuration for a server
@@ -632,6 +649,18 @@ func (c *OutputSanitisationConfig) WouldMutate(trust string) bool {
 	return trust == "untrusted" && (c.IsStripEnabled() || c.IsSpotlightEnabled())
 }
 
+// Registry provenance tags (MCP-866). Trust is derived, not user-asserted: a
+// registry is "trusted" only when it is one of the shipped built-in defaults.
+// Anything a user adds at runtime (e.g. via `registry add-source`) is
+// "custom/unverified" and can NEVER skip quarantine — there is no allowlist a
+// user can append themselves into.
+const (
+	// RegistryProvenanceOfficial marks a built-in, shipped-by-default registry.
+	RegistryProvenanceOfficial = "official/trusted"
+	// RegistryProvenanceCustom marks a user-added registry of unknown trust.
+	RegistryProvenanceCustom = "custom/unverified"
+)
+
 // RegistryEntry represents a registry in the configuration
 type RegistryEntry struct {
 	ID          string      `json:"id"`
@@ -646,6 +675,19 @@ type RegistryEntry struct {
 	// true and no key is configured, the registry is skipped/marked unavailable
 	// rather than failing the whole search (FR-008).
 	RequiresKey bool `json:"requires_key,omitempty"`
+	// Provenance is the trust tag for this registry (MCP-866):
+	// RegistryProvenanceOfficial for built-in defaults, RegistryProvenanceCustom
+	// for user-added registries. It is authoritatively (re)computed by the
+	// registries merge from whether the ID is a shipped default — a user cannot
+	// claim "official/trusted" by writing it into their config.
+	Provenance string `json:"provenance,omitempty" mapstructure:"provenance"`
+}
+
+// IsTrusted reports whether the registry is an official, shipped-by-default
+// source. Trust is never granted by omission — an absent provenance tag is
+// untrusted.
+func (r *RegistryEntry) IsTrusted() bool {
+	return r != nil && r.Provenance == RegistryProvenanceOfficial
 }
 
 // CursorMCPConfig represents the structure for Cursor IDE MCP configuration
@@ -847,6 +889,7 @@ func DefaultRegistries() []RegistryEntry {
 			ServersURL:  "https://registry.modelcontextprotocol.io/v0.1/servers",
 			Tags:        []string{"verified", "official"},
 			Protocol:    "modelcontextprotocol/registry",
+			Provenance:  RegistryProvenanceOfficial,
 		},
 		{
 			ID:          "reference",
@@ -856,6 +899,7 @@ func DefaultRegistries() []RegistryEntry {
 			ServersURL:  "builtin://reference",
 			Tags:        []string{"verified", "official", "reference"},
 			Protocol:    "builtin/reference",
+			Provenance:  RegistryProvenanceOfficial,
 		},
 		{
 			ID:          "docker-mcp-catalog",
@@ -865,6 +909,7 @@ func DefaultRegistries() []RegistryEntry {
 			ServersURL:  "https://hub.docker.com/v2/repositories/mcp/",
 			Tags:        []string{"verified"},
 			Protocol:    "custom/docker",
+			Provenance:  RegistryProvenanceOfficial,
 		},
 		{
 			ID:          "pulse",
@@ -875,6 +920,7 @@ func DefaultRegistries() []RegistryEntry {
 			Tags:        []string{"verified"},
 			Protocol:    "custom/pulse",
 			RequiresKey: true,
+			Provenance:  RegistryProvenanceOfficial,
 		},
 		{
 			ID:          "smithery",
@@ -885,6 +931,7 @@ func DefaultRegistries() []RegistryEntry {
 			Tags:        []string{"verified"},
 			Protocol:    "modelcontextprotocol/registry",
 			RequiresKey: true,
+			Provenance:  RegistryProvenanceOfficial,
 		},
 	}
 }
@@ -1247,6 +1294,16 @@ func (c *Config) ValidateDetailed() []ValidationError {
 				Message: "enabled_tools and disabled_tools are mutually exclusive; use one or the other",
 			})
 		}
+
+		// MCP-866: a server sourced from a custom/unverified registry can NEVER
+		// skip quarantine. There is no allowlist a user can add themselves into,
+		// so an unverified third-party source must always be reviewed.
+		if server.SkipQuarantine && server.SourceRegistryProvenance == RegistryProvenanceCustom {
+			errors = append(errors, ValidationError{
+				Field:   fieldPrefix + ".skip_quarantine",
+				Message: "skip_quarantine is not allowed for a server added from a custom/unverified registry",
+			})
+		}
 	}
 
 	// Validate DataDir exists (if specified and not empty).

internal/config/registry_provenance_test.go

@@ -0,0 +1,69 @@
+package config
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// MCP-866: provenance/trust model for registries.
+
+func TestDefaultRegistries_AreOfficialTrusted(t *testing.T) {
+	for _, r := range DefaultRegistries() {
+		assert.Equalf(t, RegistryProvenanceOfficial, r.Provenance,
+			"built-in default %q must be tagged official/trusted", r.ID)
+		assert.Truef(t, r.IsTrusted(), "built-in default %q must report IsTrusted", r.ID)
+	}
+}
+
+func TestRegistryEntry_IsTrusted(t *testing.T) {
+	assert.True(t, (&RegistryEntry{Provenance: RegistryProvenanceOfficial}).IsTrusted())
+	assert.False(t, (&RegistryEntry{Provenance: RegistryProvenanceCustom}).IsTrusted())
+	// Absent provenance is NOT trusted — never grant trust by omission.
+	assert.False(t, (&RegistryEntry{}).IsTrusted())
+}
+
+func TestRegistryEntry_ProvenanceJSONRoundTrip(t *testing.T) {
+	in := RegistryEntry{ID: "acme", Name: "Acme", URL: "https://acme.example/", Provenance: RegistryProvenanceCustom}
+	b, err := json.Marshal(in)
+	require.NoError(t, err)
+	assert.Contains(t, string(b), `"provenance":"custom/unverified"`)
+
+	var out RegistryEntry
+	require.NoError(t, json.Unmarshal(b, &out))
+	assert.Equal(t, RegistryProvenanceCustom, out.Provenance)
+}
+
+// A server added from a custom/unverified registry must never carry
+// skip_quarantine=true; config validation rejects it (FR: quarantine-always).
+func TestValidate_RejectsSkipQuarantineForCustomOriginServer(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.Servers = []*ServerConfig{
+		{
+			Name:                     "evil",
+			Protocol:                 "stdio",
+			Command:                  "npx",
+			Enabled:                  true,
+			SkipQuarantine:           true,
+			SourceRegistryID:         "acme",
+			SourceRegistryProvenance: RegistryProvenanceCustom,
+		},
+	}
+	err := cfg.Validate()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "skip_quarantine")
+}
+
+// skip_quarantine remains allowed for trusted/official-origin servers and for
+// servers with no registry origin (manually-added), to avoid breaking existing
+// configs.
+func TestValidate_AllowsSkipQuarantineForTrustedOrigin(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.Servers = []*ServerConfig{
+		{Name: "ok-trusted", Protocol: "stdio", Command: "npx", Enabled: true, SkipQuarantine: true, SourceRegistryProvenance: RegistryProvenanceOfficial},
+		{Name: "ok-manual", Protocol: "stdio", Command: "npx", Enabled: true, SkipQuarantine: true},
+	}
+	assert.NoError(t, cfg.Validate())
+}

internal/registries/provenance_test.go

@@ -0,0 +1,46 @@
+package registries
+
+import (
+	"testing"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// MCP-866: provenance is computed authoritatively at merge time. A built-in
+// default is official/trusted; any user-added registry is custom/unverified,
+// and a user CANNOT claim trust by writing "official/trusted" into their config.
+func TestSetRegistriesFromConfig_ComputesProvenance(t *testing.T) {
+	cfg := config.DefaultConfig()
+	cfg.Registries = []config.RegistryEntry{
+		{
+			ID:         "acme",
+			Name:       "Acme Registry",
+			URL:        "https://acme.example/",
+			ServersURL: "https://acme.example/v0.1/servers",
+			Protocol:   "modelcontextprotocol/registry",
+			// Malicious attempt to self-assert trust — must be ignored.
+			Provenance: config.RegistryProvenanceOfficial,
+		},
+	}
+
+	SetRegistriesFromConfig(cfg)
+
+	acme := FindRegistry("acme")
+	require.NotNil(t, acme)
+	assert.Equal(t, config.RegistryProvenanceCustom, acme.Provenance,
+		"user-added registry must be custom/unverified regardless of self-asserted provenance")
+	assert.False(t, acme.IsTrusted())
+
+	official := FindRegistry("official")
+	require.NotNil(t, official)
+	assert.Equal(t, config.RegistryProvenanceOfficial, official.Provenance)
+	assert.True(t, official.IsTrusted())
+}
+
+func TestRegistryEntry_IsTrusted(t *testing.T) {
+	assert.True(t, (&RegistryEntry{Provenance: config.RegistryProvenanceOfficial}).IsTrusted())
+	assert.False(t, (&RegistryEntry{Provenance: config.RegistryProvenanceCustom}).IsTrusted())
+	assert.False(t, (&RegistryEntry{}).IsTrusted())
+}

internal/registries/registry_data.go

@@ -16,7 +16,22 @@ func SetRegistriesFromConfig(cfg *config.Config) {
 	index := make(map[string]int) // ID -> position in merged
 	merged := make([]RegistryEntry, 0, len(config.DefaultRegistries()))
 
+	// Trust is derived from membership in the shipped default set (MCP-866), not
+	// from any provenance a user wrote into their config — so a custom registry
+	// can never claim "official/trusted", and an override of a default ID keeps
+	// its trusted status (e.g. attaching an API key to a built-in registry).
+	defaults := config.DefaultRegistries()
+	defaultIDs := make(map[string]bool, len(defaults))
+	for i := range defaults {
+		defaultIDs[defaults[i].ID] = true
+	}
+
 	upsert := func(r RegistryEntry) {
+		if defaultIDs[r.ID] {
+			r.Provenance = config.RegistryProvenanceOfficial
+		} else {
+			r.Provenance = config.RegistryProvenanceCustom
+		}
 		if pos, ok := index[r.ID]; ok {
 			merged[pos] = r
 			return
@@ -25,7 +40,6 @@ func SetRegistriesFromConfig(cfg *config.Config) {
 		merged = append(merged, r)
 	}
 
-	defaults := config.DefaultRegistries()
 	for i := range defaults {
 		upsert(fromConfigEntry(&defaults[i]))
 	}
@@ -38,6 +52,12 @@ func SetRegistriesFromConfig(cfg *config.Config) {
 	registryList = merged
 }
 
+// IsTrusted reports whether this is an official, shipped-by-default registry.
+// Trust is never granted by omission — an absent provenance tag is untrusted.
+func (r *RegistryEntry) IsTrusted() bool {
+	return r != nil && r.Provenance == config.RegistryProvenanceOfficial
+}
+
 // fromConfigEntry converts a config.RegistryEntry to a registries.RegistryEntry.
 func fromConfigEntry(r *config.RegistryEntry) RegistryEntry {
 	return RegistryEntry{

internal/registries/types.go

@@ -17,6 +17,11 @@ type RegistryEntry struct {
 	// ErrRegistryKeyMissing so the calling surface can mark it unavailable
 	// instead of failing the whole search (FR-008).
 	RequiresKey bool `json:"requires_key,omitempty"`
+	// Provenance is the trust tag (MCP-866): config.RegistryProvenanceOfficial
+	// for built-in defaults, config.RegistryProvenanceCustom for user-added
+	// registries. Computed authoritatively by SetRegistriesFromConfig — never
+	// trusted by self-assertion.
+	Provenance string `json:"provenance,omitempty"`
 }
 
 // ServerEntry represents an MCP server discovered via a registry

oas/docs.go

@@ -109,6 +109,14 @@ components:
             $ref: '#/components/schemas/config.RegistryEntry'
           type: array
           uniqueItems: false
+        registries_locked:
+          description: |-
+            RegistriesLocked is an enterprise stub knob (MCP-866): when true, runtime
+            additions of custom registries (e.g. `registry add-source`, the REST/MCP
+            add-source surface) are rejected so an administrator can pin the discovery
+            sources. Built-in defaults are unaffected. Documented but otherwise inert
+            beyond the add-source rejection.
+          type: boolean
         require_mcp_auth:
           description: 'Require authentication on /mcp endpoint (default: false)'
           type: boolean
@@ -461,6 +469,14 @@ components:
           type: string
         protocol:
           type: string
+        provenance:
+          description: |-
+            Provenance is the trust tag for this registry (MCP-866):
+            RegistryProvenanceOfficial for built-in defaults, RegistryProvenanceCustom
+            for user-added registries. It is authoritatively (re)computed by the
+            registries merge from whether the ID is a shipped default — a user cannot
+            claim "official/trusted" by writing it into their config.
+          type: string
         requires_key:
           description: |-
             RequiresKey marks a registry that needs an API key to be queried. When
@@ -616,6 +632,19 @@ components:
         skip_quarantine:
           description: Skip tool-level quarantine for this server
           type: boolean
+        source_registry_id:
+          description: |-
+            SourceRegistryID records which registry this server was added from (empty
+            for manually-configured servers). MCP-866: surfaced in the approval /
+            quarantine view so a reviewer can see a server's origin.
+          type: string
+        source_registry_provenance:
+          description: |-
+            SourceRegistryProvenance is the trust tag of the source registry at add
+            time (RegistryProvenanceOfficial / RegistryProvenanceCustom). When it is
+            RegistryProvenanceCustom, skip_quarantine is forbidden — a custom,
+            unverified registry can never opt its servers out of quarantine.
+          type: string
         updated:
           type: string
         url: