{
  "question": "I'm publishing an MCP server. How do I name it so users don't confuse it with someone else's server and scanners don't flag it as a lookalike?",
  "slug": "how-to-name-your-mcp-server-so-it-isnt-mistaken-for-a-lookalike",
  "url": "https://www.rightshold.com/answers/how-to-name-your-mcp-server-so-it-isnt-mistaken-for-a-lookalike",
  "short_answer": "Choose a name that is still distinct once you ignore case and separators, publish it under a namespace users can tie to you, and use the exact same name everywhere. Lookalike checks usually normalize names before comparing them, so data-bot, databot, data_bot and Data Bot all count as the same name. Many also flag a name that is another name plus a suffix, such as databot and databot-pro. Before you publish, search the places your users look (the official MCP Registry, npm or PyPI, GitHub) for your candidate's normalized form and its prefixes. If you own a domain, publish as com.yourdomain/… rather than io.github.you/…, because the registry ties that namespace to DNS or HTTP proof that users can match to your website. Don't put another company's product name at the front of yours unless you are that company; say what you integrate with in the description instead. npm's naming guidelines ask for names that don't use someone else's trademark or confuse people about authorship. Don't publish extra variants of your name to reserve them in the MCP Registry, either: its moderation policy treats the same server submitted under different names as spam.",
  "checklist": [
    "If you have a domain, use the reverse-DNS namespace (com.yourcompany/server-name) and prove it with a DNS TXT record or the /.well-known/mcp-registry-auth file. Users can match that to your website, which an io.github namespace can't offer them.",
    "Use one name everywhere: the registry name's server part, the npm or PyPI package name, the repository name, the serverInfo.name your server returns from initialize, and the name in your docs. When these don't match, honest servers look like impersonators.",
    "Normalize your candidate the way lookalike checks do (lowercase, turn every hyphen, underscore, space and dot into one separator, then drop the separators) and compare it with existing names. An equal result, or one name being a prefix of the other, means users can confuse the two.",
    "Search before you publish: the official registry's API accepts /v0/servers?search=<name>; also search npm or PyPI and GitHub for the normalized form, and check Rightshold's public record with name_collision_check.",
    "Leave other vendors' brands out of the name (no slack-, github- or notion- prefix unless you're that vendor). Write \"for Slack\" in the description and title instead, so the name doesn't suggest the vendor published it.",
    "Don't publish your server several times under variant names to reserve them. The MCP Registry's moderation policy lists \"the same server being submitted multiple times under different names\" as spam. On npm, publish under a scope you own, which can't be imitated with punctuation.",
    "Keep the display title in one script. Registry names allow only ASCII letters, digits, dots, hyphens and underscores, but a title or client label can mix scripts, and Unicode's security report gives \"paypal\" written with a Cyrillic а as its example of a mixed-script confusable.",
    "Link the registry listing from your website and README, and link your website from the listing, so a user can confirm the server from either end."
  ],
  "sections": [
    {
      "heading": "How lookalike checks compare names",
      "points": [
        "Many checks reduce each name to a canonical form, a skeleton, and compare skeletons, so changes in case or punctuation don't make a name look new. Rightshold's name-collision check is one example and publishes its rules: names are trimmed, lowercased, have a leading @ removed and have every run of hyphens, underscores, spaces and dots folded into one hyphen. Two names then collide if they are equal (exact_normalized), equal once the separators are removed (separator_variant), or if one separator-free name is a prefix of the other and the shorter one has at least four characters (prefix_variant).",
        "Other checks go further, with edit distance, keyboard typos, or the Unicode confusables data from UTS #39, where two strings are confusable if their skeletons match. You can't predict every scanner, so choose a name that is clearly distinct and not just distinct enough to pass one rule set.",
        "A warning is a fact about names, not an accusation. If your name collides with an existing one by accident, rename before you publish. Once users have installed a server, renaming it costs much more."
      ]
    },
    {
      "heading": "What registries enforce, and what they leave to you",
      "points": [
        "The official MCP Registry enforces the name's format: a namespace and a name part, starting and ending with a letter or digit, with dots and hyphens (and underscores in the name part) in between. Namespace authentication stops anyone else publishing under your GitHub account or domain. The moderation policy says the registry won't remove servers that do the same thing as other servers, so a similar name under someone else's namespace can stay listed.",
        "npm says it can detect typosquat attacks and block those packages from being published, and its naming guidelines ask that an unscoped name not be spelled like another package's or confuse others about authorship. Being blocked there doesn't protect your registry listing or your title, so check those yourself."
      ]
    },
    {
      "heading": "Running the check before you publish",
      "points": [
        "name_collision_check takes a candidate name and returns every public name on Rightshold's record that it reads like (agent handles, display names, verified claimed registry names, and registered servers' names and slugs), the rule each one matched, and the normalized form and skeleton it used, so you can recompute the result. It needs no key and registers nothing.",
        "When you later register your server on Rightshold with register_external_server, the same warnings come back with the registration. They never block it."
      ]
    }
  ],
  "checks": [],
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "I'm about to publish an MCP server under this name. Does it read like any agent or server name already on Rightshold's public record, under which rule, and what normalized form and skeleton were compared?",
    "mcp_call": {
      "tool": "name_collision_check",
      "arguments": {
        "name": "<your candidate server name>"
      }
    },
    "also": [
      "Free, no key, read-only: checking a name registers nothing.",
      "It compares with Rightshold's public record only. Search the official MCP Registry (/v0/servers?search=), npm or PyPI and GitHub separately.",
      "precall_check reports, for a live server URL, tool-name collisions with other registered servers, the tool-level version of the same confusion."
    ],
    "scope": "name_collision_check applies three published rules (exact after normalization, separator variant, prefix variant) to names on Rightshold's public record. It computes no edit distance or Unicode confusables, doesn't search the MCP Registry, npm, PyPI or GitHub, and gives no trademark advice."
  },
  "sources": [
    {
      "title": "MCP Registry: How to authenticate when publishing (namespace formats)",
      "url": "https://modelcontextprotocol.io/registry/authentication"
    },
    {
      "title": "MCP Registry: Moderation policy (same server under different names is spam; duplicates not removed)",
      "url": "https://modelcontextprotocol.io/registry/moderation-policy"
    },
    {
      "title": "modelcontextprotocol/registry: internal/validators/validators.go (server name format, checked Nov 9, 2026)",
      "url": "https://github.com/modelcontextprotocol/registry/blob/main/internal/validators/validators.go"
    },
    {
      "title": "npm Docs: Package name guidelines",
      "url": "https://docs.npmjs.com/package-name-guidelines"
    },
    {
      "title": "npm Docs: Threats and mitigations (typosquatting)",
      "url": "https://docs.npmjs.com/threats-and-mitigations"
    },
    {
      "title": "Unicode Technical Standard #39: Unicode Security Mechanisms (confusable detection, mixed-script confusables)",
      "url": "https://www.unicode.org/reports/tr39/"
    },
    {
      "title": "Rightshold agent-safety formats: name collisions (section 10)",
      "url": "https://www.rightshold.com/security/spec"
    }
  ],
  "related": [
    {
      "title": "What a verified namespace in the official MCP Registry proves (and what it doesn't)",
      "url": "https://www.rightshold.com/answers/what-does-a-verified-namespace-in-the-official-mcp-registry-prove"
    },
    {
      "title": "How to prevent MCP tool shadowing between servers",
      "url": "https://www.rightshold.com/answers/how-to-prevent-mcp-tool-shadowing-between-servers"
    },
    {
      "title": "How to write MCP tool descriptions so agents pick the right tool",
      "url": "https://www.rightshold.com/answers/how-to-write-mcp-tool-descriptions-so-agents-pick-the-right-tool"
    },
    {
      "title": "Changing your MCP server's tool definitions without tripping rug-pull alarms",
      "url": "https://www.rightshold.com/answers/how-to-change-your-mcp-servers-tool-definitions-without-tripping-rug-pull-alarms"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-11-09"
}