Orphaned records after a GitHub account rename cannot be deprecated by their owner #1662

A GitHub account rename silently orphans every registry record published under the old login, and there is no documented way for the owner to deprecate them afterwards. We have hit this and cannot fix our own stale record.

The record

name     io.github.traffiycom-ui/paidsync
version  1.0.0
status   active
isLatest true
updated  2026-04-08
repo     github.com/traffiycom-ui/paidsync-mcp-server
remote   type "sse", url https://mcp.paidsync.ai/sse

https://mcp.paidsync.ai/sse has returned HTTP 404 since we retired SSE. The description also advertises "200+ tools" across three platforms, against an actual 530+ across fourteen.

Our current record is io.github.PaidSync/paidsync v2.3.0, isLatest: true, repository github.com/PaidSync/paidsync-mcp, remote streamable-http at https://mcp.paidsync.ai/mcp. That one is accurate and we maintain it normally.

Why we cannot deprecate the old one

The GitHub account traffiycom-ui was renamed. github.com/traffiycom-ui now returns 404, and the old repository path 301s to its current home.

internal/api/handlers/v0/auth/github_at.go derives the permitted namespace from the login string:

ResourcePattern: fmt.Sprintf("io.github.%s/*", username)

with username coming from user.Login on the GitHub API response. Since GitHub now returns the new login for the same account and token, there is no longer any credential that resolves to io.github.traffiycom-ui. The namespace is unreachable by its actual owner.

docs/administration/admin-operations.md states that status changes require an "Admin account with @modelcontextprotocol.io email", and documents no route for a publisher who has lost namespace access.

Ask

Could an admin mark io.github.traffiycom-ui/paidsync deprecated, or set its status so it stops being served as latest? Happy to demonstrate ownership of the account and the domain in whatever form is easiest.

Two things this surfaces beyond our case

1. Renames orphan records silently. GitHub renames are common and the old login is never reclaimed by the same person. Any publisher who renames loses the ability to correct or retire everything they published beforehand, with no self-service path.

2. isLatest is per namespace, so a stale record can still present as latest. Both records above currently report isLatest: true. An aggregator that resolves a server by searching rather than by exact namespace can pick the abandoned one. At least one downstream directory currently shows our server as inactive because it is health-checking the dead sse URL from the old record rather than the streamable-http URL from the current one.

Resolving ownership against the numeric GitHub account id rather than the mutable login string would close (1). For (2), a way to flag a namespace as superseded by another would help, though that has its own abuse considerations.

Happy to open a separate issue for either if you would rather keep this one scoped to the takedown.