Request: set `io.github.dokdosolutions-us/lucky` & `/jam` to `deleted` — original publisher locked out after GitHub account rename

[dokdosolutions-us]

Summary

I'm the original publisher of two servers under the io.github.dokdosolutions-us namespace. That GitHub account has since been renamed dokdosolutions-us → Ahreum-us (company rebrand, Dokdo Solutions → Ahreum LLC). I want to retire both entries (set status: deleted), but I can no longer self-service with mcp-publisher status, because the namespace is keyed on the GitHub login string and my account no longer presents the dokdosolutions-us login.

Request: please set both server names, all versions, to deleted — or restore edit access on that namespace so I can do it myself.

Affected entries (all currently status: active, verified 2026-06-22)

Server name	Versions	repository.url	npm package
io.github.dokdosolutions-us/lucky	1.0.3, 1.0.4 (latest)	github.com/dokdosolutions-us/clover-mcp-server	@dokdosolutions/clover-mcp (deprecated)
io.github.dokdosolutions-us/jam	0.4.0, 0.5.0 (latest)	github.com/dokdosolutions-us/toast-mcp	toast-mcp (deprecated)

Why I can't self-service

• The account was renamed dokdosolutions-us → Ahreum-us. The registry grants io.github.<login>/* from the current GitHub login (per the OAuth/OIDC auth handlers), so a fresh mcp-publisher login github now grants only io.github.ahreum-us/* — never io.github.dokdosolutions-us/*.
• The only credentials that ever granted the old namespace were short-lived registry JWTs that expired 2026-06-07.

Proof of ownership

• The lucky entry's repository.url 301-redirects to github.com/Ahreum-us/clover-mcp-server, the account I currently control (publicly verifiable: curl -sI https://github.com/dokdosolutions-us/clover-mcp-server).
• The jam entry points to github.com/dokdosolutions-us/toast-mcp, which is currently private and intentionally staying private. I can prove ownership of it via the deprecated npm package toast-mcp that this entry references, and via my control of the Ahreum-us account that published both servers — happy to verify however you prefer.
• I control the (now-deprecated) npm packages @dokdosolutions/clover-mcp and toast-mcp referenced by these entries.
• I can authenticate to the registry as Ahreum-us to confirm I control the repos these entries reference. Happy to provide any further verification you need.

Security consideration

The registry keys namespace ownership on the GitHub login string, not the immutable numeric user ID. The freed dokdosolutions-us username is now unclaimed — anyone who registers that GitHub handle would be granted io.github.dokdosolutions-us/* publish rights and could push new versions over these orphaned entries. Setting them to deleted closes that exposure. (Flagging in case you'd also like to track the underlying login-string-vs-numeric-ID ownership gap separately.)

References

• Request: Rename server io.github.amit755/4fetch to com.4fetch/fetch #1020 — a maintainer advised the publisher of a near-identical namespace rename to "mark it as deleted using mcp-publisher or api"; that self-service path is exactly what the account rename blocks for me here.
• Mechanism I'd use with access: mcp-publisher status --status deleted --all-versions … → PATCH /v0.1/servers/{serverName}/status.

Thanks!

[pree-dew]

@Ahreum-us Registry doesn't handle the cases where github account is renamed as it doesn't have way to verify the right authority. In order to mark previous servers as deleted the work around will be to briefly change the name back to dokdosolutions-us, create a token and mark it as deleted using the status command and then rename back to Ahreum-us.

[dokdosolutions-us]

@pree-dew Thank you and that makes sense — I understand the registry can't verify authority once the login string changes, so there's no server-side path for you to action this directly.

I'll use the rename-back workaround (temporarily rename the account to dokdosolutions-us, mint a token, run mcp-publisher status --status deleted --all-versions on both entries, then rename back) during a maintenance window when I can do it cleanly.

One thing worth flagging for the project itself: because ownership is keyed on the mutable GitHub login string rather than the immutable numeric user ID, any publisher who renames their account hits this same dead end — and the freed handle becomes claimable by anyone, who would then inherit publish rights over the orphaned namespace. The rename-back dance works as a workaround, but it might be worth tracking the underlying string-vs-numeric-ID ownership model as a separate issue, since this will recur. Happy to open that as its own issue if useful.

Thanks again for the quick response!

[dokdosolutions-us]

@pree-dew Maintenance ended up happening sooner than later!
With that said, I am following up here, with an update on what I've tried since filing this.

Request (unchanged): please set both of these to status: deleted, all versions:

• io.github.dokdosolutions-us/lucky (repo clover-mcp-server)
• io.github.dokdosolutions-us/jam (repo toast-mcp)

I've reclaimed the publishing identity to do this the self-service way. These were published from the GitHub account dokdosolutions-us, which I'd since renamed. Because the registry keys namespace authority on the GitHub login string (io.github.<login>/*), I renamed that account back to dokdosolutions-us specifically so I'd again hold the required authority and could run mcp-publisher status myself. So this is no longer an ownership problem — I control the namespace again.

The remaining blocker is the mcp-publisher CLI login, not authorization. I can't get through the GitHub device-flow login in mcp-publisher v1.7.9, so I can never mint a registry JWT to run the status command:

$ mcp-publisher login github
<paste your actual terminal output here — the slow_down / incorrect_device_code sequence>

$ mcp-publisher status --status deleted --all-versions \
    --message "Retired; backing repo + npm package deprecated" \
    io.github.dokdosolutions-us/lucky
Error: not logged in

The login cycles through slow_down and then fails with incorrect_device_code, and never completes. (Happy to file this as a separate mcp-publisher bug if it's not already tracked — let me know.)

So I'm asking for either:

1. A working login path — if there's a known fix/workaround for the v1.7.9 device-flow issue, or a supported way to exchange a GitHub token directly for a registry JWT, point me to it and I'll do the deletions myself; or
2. A direct maintainer action setting both names (all versions) to status: deleted — same handling as Delete orphaned entry: press.respira/respira-wordpress (lost signing key) #1124, since I hold the original handle and can demonstrate ownership.

Verification: I'm the original publisher and currently control dokdosolutions-us — happy to prove it however is easiest (a gist, a commit to either repo, a TXT record, etc.). The backing repos and npm packages are already deprecated.

Again, thanks for your time on this! It is greatly appreciated!

[dokdosolutions-us]

@pree-dew Oops sorry I fat fingered and meant to hit 'Comment' instead of 'Close'