Allowed localhosts for remote url when testing

Dockerfile

@@ -0,0 +1,42 @@
+# Multi-stage Dockerfile for MCP Registry with localhost support
+FROM golang:1.24-alpine AS builder
+
+# Install build dependencies
+RUN apk add --no-cache git make
+
+# Set working directory
+WORKDIR /build
+
+# Copy go mod files first for better caching
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Copy source code
+COPY . .
+
+# Build the registry with version info
+RUN CGO_ENABLED=0 GOOS=linux go build \
+    -ldflags="-X main.Version=$(git describe --tags --always --dirty) -X main.GitCommit=$(git rev-parse HEAD) -X main.BuildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+    -a -installsuffix cgo \
+    -o /registry \
+    ./cmd/registry
+
+# Final stage
+FROM alpine:latest
+
+# Install ca-certificates for HTTPS
+RUN apk --no-cache add ca-certificates
+
+WORKDIR /app
+
+# Copy binary from builder
+COPY --from=builder /registry /app/registry
+
+# Copy seed data
+COPY --from=builder /build/data ./data
+
+# Expose port
+EXPOSE 8080
+
+# Run the registry
+ENTRYPOINT ["/app/registry"]

internal/validators/utils.go

@@ -2,6 +2,7 @@ package validators
 
 import (
 	"net/url"
+	"os"
 	"regexp"
 	"strings"
 )
@@ -133,6 +134,11 @@ func IsValidSubfolderPath(path string) bool {
 
 // IsValidRemoteURL checks if a URL is valid for remotes (stricter than packages - no localhost allowed)
 func IsValidRemoteURL(rawURL string) bool {
+	const (
+		httpScheme  = "http"
+		httpsScheme = "https"
+	)
+
 	// First check basic URL structure
 	if !IsValidURL(rawURL) {
 		return false
@@ -148,12 +154,26 @@ func IsValidRemoteURL(rawURL string) bool {
 	}
 
 	// Reject localhost URLs for remotes (security/production concerns)
+	// Allow localhost if MCP_REGISTRY_ALLOW_LOCALHOST is explicitly enabled (for local development)
 	hostname := u.Hostname()
-	if hostname == "localhost" || hostname == "127.0.0.1" || strings.HasSuffix(hostname, ".localhost") {
-		return false
+	isLocalhost := hostname == "localhost" || hostname == "127.0.0.1" || strings.HasSuffix(hostname, ".localhost")
+
+	allowLocalhostEnv := os.Getenv("MCP_REGISTRY_ALLOW_LOCALHOST")
+	allowLocalhost := allowLocalhostEnv == "true" || allowLocalhostEnv == "1"
+
+	if isLocalhost {
+		// Check if localhost URLs are allowed via environment variable
+		if !allowLocalhost {
+			return false
+		}
+		// If explicitly enabled, allow localhost URLs (http or https)
 	}
 
-	if u.Scheme != "https" {
+	// Require HTTPS for non-localhost URLs, but allow HTTP for localhost (when enabled)
+	if u.Scheme != httpsScheme && u.Scheme != httpScheme {
+		return false
+	}
+	if u.Scheme == httpScheme && !allowLocalhost {
 		return false
 	}