Naming Conventions
Every package on mpak has a scoped name in the format @scope/name. The scope is derived from your GitHub identity, and the registry enforces ownership cryptographically.
The Format
Section titled “The Format”@scope/name| Part | Source | Example |
|---|---|---|
@scope |
Your GitHub org or username (lowercased) | @nimblebraininc |
name |
The package identifier you choose | postgres-mcp |
| Full name | Combined | @nimblebraininc/postgres-mcp |
Scope Rules
Section titled “Scope Rules”Your scope is automatically derived from the GitHub OIDC token at publish time. You cannot choose a different scope.
| GitHub Owner | Package Scope |
|---|---|
NimbleBrainInc (org) |
@nimblebraininc/... |
johndoe (user) |
@johndoe/... |
My-Org (org) |
@my-org/... |
Scopes are always lowercase. GitHub owner names are lowercased automatically.
This means:
- You can only publish packages under your own scope
- No one else can publish to your scope
- Scope ownership is verified cryptographically via OIDC (no API keys, no manual approval)
Name Rules
Section titled “Name Rules”Package names (the part after the scope) must follow these rules:
| Rule | Example |
|---|---|
| Lowercase letters, numbers, hyphens | postgres-mcp |
| Must start with a letter | my-server (not 1-server) |
| No consecutive hyphens | my-server (not my--server) |
| No leading or trailing hyphens | server (not -server-) |
Naming Best Practices
Section titled “Naming Best Practices”Be descriptive. The name should tell users what the server connects to or does.
| Good | Bad | Why |
|---|---|---|
postgres-mcp |
my-server |
Tells users what it connects to |
github-issues |
tool |
Specific about what it does |
slack-notifications |
notifications |
Names the integration |
code-review |
helper |
Describes the capability |
Include the service or protocol name when wrapping an API: stripe-mcp, jira-mcp, openai-mcp.
Avoid generic names like utils, tools, helper, core. These don’t help users discover your package.
Don’t include your org name in the package name. The scope already identifies you: @yourorg/postgres-mcp, not @yourorg/yourorg-postgres-mcp.
Namespace Governance
Section titled “Namespace Governance”The mpak Trust Framework includes RG-02 namespace governance controls to prevent squatting and name confusion:
- Slopsquatting prevention: Names that are confusingly similar to popular packages may be flagged
- Trademark enforcement: Package names impersonating well-known brands may be removed
Renaming and Transfers
Section titled “Renaming and Transfers”Package names are immutable once published. To “rename” a package:
- Publish a new package under the desired name
- Deprecate the old package (point users to the new one)
- The old name remains reserved to prevent confusion