Add Taisly remote MCP server

[taisly]

Closes #1402.

Adds the official Taisly hosted MCP server as a Streamable HTTP catalog entry.

• Source: https://github.com/taisly/agent
• Endpoint: https://app.taisly.com/mcp
• Authentication: OAuth
• Version: 0.2.8
• License: MIT

The endpoint is live and returns the expected OAuth protected-resource challenge for unauthenticated MCP initialization requests. The entry includes the current 13-tool surface and distinguishes remote public-video-URL publishing from the local npm transport.

[taisly]

Gentle follow-up: this catalog entry is mergeable, and the linked submission issue (#1402) contains the endpoint, OAuth, source, version, and license details. The fork workflows are currently waiting for maintainer approval. When convenient, could a maintainer approve CI and review the entry? Happy to adjust any ToolHive metadata.

[amirejaz]

MCP Server Review — Taisly Social Media Posting

Type: Remote (streamable-http) · Repository: https://github.com/taisly/agent · Verdict: REQUEST_CHANGES

Two blocking items, both small and mechanical. Everything else below is a note.

---

Verified working

• POST https://app.taisly.com/mcp returns a correct RFC 9728 WWW-Authenticate challenge; /.well-known/oauth-protected-resource/mcp and /.well-known/oauth-authorization-server advertise PKCE S256, dynamic client registration, and mcp:read / mcp:write. Satisfies Security requirements → Authentication and authorization and Encryption in transit.
• All 13 declared tools match src/mcp.js exactly.
• MIT licensed with a public repository.
• Semver tags; 0.2.8 matches the latest release; releases carry written notes, satisfying Release process → Maintained changelog.
• Issue #2 received a maintainer response, so Community health → Responsiveness is met.
• tier: "Official" is correct — Taisly is the platform owner of the integrated service (Tiered classifications). The Proprietary service references exemption also means the closed hosted backend is not itself a blocker, since the entry is genuinely first-party.
• task catalog:validate passes.

---

Blocking

Both are documented in docs/adding-entries-llm.md and hold across all 110 catalog entries without exception:

1. Namespace. name is io.github.taisly/agent; this catalog requires io.github.stacklok/<server-name> (line 388) — here, io.github.stacklok/taisly. The current value is correct for your entry in the official MCP Registry; this registry normalizes everything under its own publisher namespace.

2. Icon. The entry points at an external PNG (https://app.taisly.com/logo512.png, mimeType: image/png). The required form (lines 301–307) is a repo-hosted SVG with sizes: ["any"]:

"icons": [{
  "src": "https://raw.githubusercontent.com/stacklok/toolhive-registry/main/registries/toolhive/servers/taisly/icon.svg",
  "mimeType": "image/svg+xml",
  "sizes": ["any"]
}]

The PR also adds only server.json — line 46 requires icon.svg to be committed to registries/toolhive/servers/taisly/ alongside it.

Note that task catalog:validate passes despite both; it checks the JSON schema, not these conventions.

---

Notes, not blockers

• GitHub Actions are not pinned to SHAs. check.yml and publish-mcp-registry.yml use actions/checkout@v4 and actions/setup-node@v4. Required severity at server-criteria.md:106.
• No software provenance. npm @taisly/agent@0.2.8 reports attestations: null. Expected severity. Your publish workflow already requests id-token: write, so npm publish --provenance would close this cheaply.
• No automated dependency updates — no Dependabot or Renovate config.
• No automated tests. CI's npm run check is node --check on five files, which is syntax parsing rather than a test suite or linter.
• SECURITY.md absent (Recommended, line 115).
• oauth_config (line 450) is optional here and not required for approval.

---

Summary

Fix the namespace and the icon and the spec side is clean. Everything under Notes is optional for this PR, though the SHA pinning and provenance items are worth picking up upstream.

[rdimitrov]

Hi @taisly, thanks for the submission, and the endpoint does check out. That said, this doesn't meet our community health criteria: 264 stars against 4 watchers, 2 forks, and a single contributor points to inflated rather than organic traction. We'd be glad to take another look once there's genuine adoption. Cheers!