Protocol v2.0.0
STANDARD RFC-0001 · CANONICAL SPEC v2.0.0 · v2.1 DRAFT

MSR JSON

Open Metadata Protocol for Software, APIs, AI Agents and MCP Servers

Machine-readable. Verifiable. Vendor-neutral.
Publish Metadata Once. Enable Intelligence Everywhere.

Read Specification Validator GitHub Support Protocol
https://example.org/.well-known/msr.json 
{
  "$schema": "https://msr-standard.org/schemas/msr-2.0.json",
  "protocol": {
    "name": "MSR JSON",
    "version": "2.0.0",
    "canonical_url": "https://example.org/.well-known/msr.json"
  },
  "entity": {
    "name": "Lanternly Agent",
    "slug": "lanternly-agent",
    "domain": "example.org",
    "type": "mcp-server"
  },
  "capabilities": {
    "deployment": ["cloud", "docker"],
    "interfaces": {
      "mcp": { "transport": "sse", "tools_count": 8 }
    }
  },
  "releases": {
    "latest": { "version": "2.4.0", "release_type": "minor" }
  }
}
End-to-End Pipeline

Protocol Architecture

How self-hosted root metadata transforms decentralized software into verified intelligence graphs.

Standard
MSR JSON

Authoritative root manifest at /.well-known/msr.json

↓
Payload
Software Metadata

Identity, interfaces, releases & pricing in minor units

↓
Cryptographic
Trust

DNS-TXT challenge & Ed25519 signature proof

↓
Index
Discovery

Automated crawler sync without proprietary APIs

↓
Semantic
Knowledge Graphs

Interoperable graph linking tools, agents & packages

↓
Execution
Software Intelligence

Autonomous tool invocation and runtime routing

Design Rationale

Why MSR JSON: Problems Solved

Traditional software distribution relies on fragmented proprietary vendor portals or 25-year-old unmaintained XML formats. MSR JSON addresses critical infrastructure gaps:

01

Manual Vendor Forms

Eliminates submitting repetitive web forms across dozens of registries and catalogs. Software vendors maintain one root manifest; aggregators sync automatically.

02

Duplicated Metadata

Stops stale descriptions and mismatched version strings. The publisher's own domain is the single source of truth for changelogs, binaries, and license terms.

03

Software Fragmentation

Unifies desktop software, SaaS platforms, OpenAPI backends, CLI binaries, and AI tools under one deterministic JSON Schema specification.

04

AI Discovery

Provides autonomous LLM agents with machine-parsable tool capabilities, OpenAPI endpoints, and functional boundaries to discover software automatically.

05

MCP Discovery

First-class descriptors for Model Context Protocol (MCP) servers, declaring SSE and stdio endpoints, tool counts, and schemas for direct agent integration.

06

Trust Verification

Prevents impersonation through root domain HTTP challenges, DNS-TXT records, SHA-256 download checksums, and Ed25519 cryptographic signatures.

07

Software Intelligence

Enables global indexing networks, developer dependency graphs, and automated package managers to reason about software compatibility and reliability in real time.

Anatomy of a Manifest

Six Core Architectural Blocks

Every valid MSR JSON manifest is organized into six deterministic, modular top-level objects designed for predictable validation and backwards compatibility.

1. "protocol": { ... }
Required

Provenance & Standard Licensing

Declares adherence to the specification, SemVer protocol versioning, standard attribution, and the canonical URI where this document is hosted.

  • name: Must be "MSR JSON"
  • version: Specification SemVer string (e.g., "2.0.0")
  • author: Protocol author or governing working group
  • specification_license: SPDX ID (CC-BY-4.0)
  • canonical_url: Authoritative HTTPS URI of the manifest
"protocol": {
  "name": "MSR JSON",
  "version": "2.0.0",
  "author": "Antonio Santos",
  "specification_license": "CC-BY-4.0",
  "reference_implementation_license": "MIT",
  "canonical_url": "https://example.org/.well-known/msr.json"
}
2. "entity": { ... }
Required

Product, Agent, or Tool Identity

Uniquely identifies the entity using machine-readable identifiers, publisher details, domain association, and localized BCP 47 human descriptions.

  • name: Official title (max 120 characters)
  • slug: Lowercase kebab-case identifier (^[a-z0-9]+(-[a-z0-9]+)*$)
  • domain: Primary authoritative FQDN
  • type: Archetype (saas, ai-agent, mcp-server, api, desktop, etc.)
  • descriptions: Map keyed by BCP 47 language tags with summary (max 256 chars) and optional tagline
"entity": {
  "name": "Lanternly Observability Agent",
  "slug": "lanternly-agent",
  "domain": "lanternly.dev",
  "type": "mcp-server",
  "descriptions": {
    "en": {
      "tagline": "Root-cause MCP server for microservices.",
      "summary": "Standardized MCP tool bindings allowing AI coding agents to diagnose microservice failures."
    }
  }
}
3. "capabilities": { ... }
Required

Functional Interfaces & Pricing

Exposes interfaces (MCP, OpenAPI, gRPC), runtime targets, currency-safe pricing in integer minor units, and third-party integrations.

  • deployment: Array of targets (cloud, self-hosted, docker, desktop)
  • interfaces.mcp: Model Context Protocol transport, tool counts, and schema URIs
  • interfaces.openapi: Version & specification URL
  • pricing: Model (free, subscription, usage) & integer cents (e.g. 1999)
"capabilities": {
  "deployment": ["cloud", "docker"],
  "interfaces": {
    "mcp": {
      "version": "2024-11-05",
      "transport": "sse",
      "endpoint": "https://api.lanternly.dev/mcp/sse",
      "tools_count": 8
    }
  },
  "pricing": {
    "model": "usage",
    "starting_price_cents": 0,
    "currency": "USD"
  }
}
4. "releases": { ... }
Required

Artifact Distribution & Checksums

Provides authoritative information on current and past releases, changelog links, distribution binaries, and SHA-256 integrity digests.

  • latest.version: SemVer release version
  • latest.published_at: ISO 8601 UTC timestamp
  • latest.release_type: major, minor, patch, security
  • latest.artifacts: Array of platform binaries, URIs, and 64-character hex SHA-256 hashes 
"releases": {
  "latest": {
    "version": "2.4.0",
    "published_at": "2026-09-15T14:30:00Z",
    "release_type": "minor",
    "artifacts": [
      {
        "platform": "docker",
        "uri": "docker.io/lanternly/agent:2.4.0",
        "sha256": "8f4e2c918a7b6d5e4c3b2a109f8e7d6c5b4a392817263544abcdef0123456789"
      }
    ]
  }
}
5. "trust": { ... }
Optional

Cryptographic Attestation & Verification

Allows publishers to prove root-domain ownership, publish public keys, and bind cryptographic signatures to the manifest payload.

  • domain_verification.method: dns-txt, well-known-http, or tls-alpn
  • signatures.algorithm: ed25519, ecdsa-p256, or rsa-pss-4096
  • signatures.public_key: Base64-encoded public key
  • audit_receipt: Security audit validation references
"trust": {
  "domain_verification": {
    "method": "dns-txt",
    "status": "verified",
    "verified_at": "2026-09-01T10:00:00Z"
  },
  "signatures": {
    "algorithm": "ed25519",
    "public_key": "MCowBQYDK2VwAyEA47DEQpj8...",
    "manifest_signature": "25f54316a30c51b7596b63..."
  }
}
6. "telemetry": { ... }
Optional

Status & Event Webhooks

Provides public availability endpoints and HMAC-SHA256 push webhook registrations for immediate registry synchronization.

  • status_page: Public uptime monitoring URL
  • webhook.url: HTTPS endpoint on vendor domain
  • webhook.events: Array of subscribed event types (e.g. release.published)
"telemetry": {
  "status_page": "https://status.lanternly.dev",
  "webhook": {
    "url": "https://lanternly.dev/hooks/msr",
    "events": ["release.published", "status.incident"]
  }
}

Implement MSR JSON in Minutes

Validate your existing metadata or author an MSR manifest for your API, MCP tool, or software application.

Open Online Validator Browse Reference Examples Install CLI Tool