I'm publishing an MCP server. How do I name it so users don't confuse it with someone else's server and scanners don't flag it as a lookalike?

What should I check, step by step?

1. If you have a domain, use the reverse-DNS namespace (com.yourcompany/server-name) and prove it with a DNS TXT record or the /.well-known/mcp-registry-auth file. Users can match that to your website, which an io.github namespace can't offer them.

2. Use one name everywhere: the registry name's server part, the npm or PyPI package name, the repository name, the serverInfo.name your server returns from initialize, and the name in your docs. When these don't match, honest servers look like impersonators.
3. Normalize your candidate the way lookalike checks do (lowercase, turn every hyphen, underscore, space and dot into one separator, then drop the separators) and compare it with existing names. An equal result, or one name being a prefix of the other, means users can confuse the two.
4. Search before you publish: the official registry's API accepts /v0/servers?search=<name>; also search npm or PyPI and GitHub for the normalized form, and check Rightshold's public record with name_collision_check.
5. Leave other vendors' brands out of the name (no slack-, github- or notion- prefix unless you're that vendor). Write "for Slack" in the description and title instead, so the name doesn't suggest the vendor published it.
6. Don't publish your server several times under variant names to reserve them. The MCP Registry's moderation policy lists "the same server being submitted multiple times under different names" as spam. On npm, publish under a scope you own, which can't be imitated with punctuation.
7. Keep the display title in one script. Registry names allow only ASCII letters, digits, dots, hyphens and underscores, but a title or client label can mix scripts, and Unicode's security report gives "paypal" written with a Cyrillic а as its example of a mixed-script confusable.
8. Link the registry listing from your website and README, and link your website from the listing, so a user can confirm the server from either end.

How do lookalike and typosquat checks compare MCP server names?

Many checks reduce each name to a canonical form, a skeleton, and compare skeletons, so changes in case or punctuation don't make a name look new. Rightshold's name-collision check is one example and publishes its rules: names are trimmed, lowercased, have a leading @ removed and have every run of hyphens, underscores, spaces and dots folded into one hyphen. Two names then collide if they are equal (exact_normalized), equal once the separators are removed (separator_variant), or if one separator-free name is a prefix of the other and the shorter one has at least four characters (prefix_variant).

• Other checks go further, with edit distance, keyboard typos, or the Unicode confusables data from UTS #39, where two strings are confusable if their skeletons match. You can't predict every scanner, so choose a name that is clearly distinct and not just distinct enough to pass one rule set.
• A warning is a fact about names, not an accusation. If your name collides with an existing one by accident, rename before you publish. Once users have installed a server, renaming it costs much more.

What do the MCP Registry and npm enforce about server and package names?

The official MCP Registry enforces the name's format: a namespace and a name part, starting and ending with a letter or digit, with dots and hyphens (and underscores in the name part) in between. Namespace authentication stops anyone else publishing under your GitHub account or domain. The moderation policy says the registry won't remove servers that do the same thing as other servers, so a similar name under someone else's namespace can stay listed.

• npm says it can detect typosquat attacks and block those packages from being published, and its naming guidelines ask that an unscoped name not be spelled like another package's or confuse others about authorship. Being blocked there doesn't protect your registry listing or your title, so check those yourself.

How do I check my MCP server name for lookalikes before publishing?

name_collision_check takes a candidate name and returns every public name on Rightshold's record that it reads like (agent handles, display names, verified claimed registry names, and registered servers' names and slugs), the rule each one matched, and the normalized form and skeleton it used, so you can recompute the result. It needs no key and registers nothing.

• When you later register your server on Rightshold with register_external_server, the same warnings come back with the registration. They never block it.