chore(053): server.json description — local-first + security scanning (#516)

* chore(053): server.json description — surface local-first + security scanning

Updates the registry description to reflect current positioning: local-first
operation and built-in security scanning (sensitive-data detection) alongside
the existing BM25 discovery, quarantine, and token-savings messaging.
Version already matches the latest release (0.33.1). Schema-validated (98/100 chars).

* chore(053): drop invalid localhost remote from server.json

The registry's semantic validation rejects http://localhost:8080/mcp
(invalid-remote-url) — remotes[] must be publicly reachable. mcpproxy is
local-first with no public remote and no supported package type yet, so the
entry is discovery-only (name + description + repo link). Updated the publish
guide's schema notes to match. Validated clean with 'mcp-publisher validate'.

Author: Dumbris

docs/mcp-registry-publishing.md

@@ -97,8 +97,8 @@ mcp-publisher status --status deleted \
 
 - `version` must be a plain semantic version string (`0.33.1`) — no `v` prefix, no ranges.
 - `packages[]` is empty because none of the supported `registryType` values (`npm`, `pypi`, `oci`, `nuget`, `mcpb`) match MCPProxy's distribution channels (Homebrew tap, GitHub release tarballs, `.deb`/`.rpm`, `go install`). The Docker server-edition image at `ghcr.io/smart-mcp-proxy/mcpproxy-server` is not yet published to releases (gated behind `if: false` in the release workflow).
-- `remotes[]` describes the actual MCP transport: a locally-run `mcpproxy serve` instance that exposes a Streamable HTTP endpoint at `http://localhost:8080/mcp`. MCP clients that support HTTP transport connect directly to this address.
-- If a Docker image for the server edition is published in a future release, add an `oci` entry to `packages[]` pointing at `ghcr.io/smart-mcp-proxy/mcpproxy-server:{version}` with `"transport": {"type": "stdio"}` and the appropriate `runtimeArguments` for `docker run`.
+- `remotes[]` is intentionally **omitted**. mcpproxy runs locally (`mcpproxy serve` exposes Streamable HTTP at `http://localhost:8080/mcp`), but the registry's semantic validation **rejects localhost/private remote URLs** (`invalid-remote-url`) — `remotes[]` is reserved for publicly reachable hosted endpoints. With no public remote and no installable package type, the entry is **discovery-only**: it lists the server, description, and repository link so clients can find it and follow the repo's install instructions.
+- If a Docker image for the server edition is published in a future release, add an `oci` entry to `packages[]` pointing at `ghcr.io/smart-mcp-proxy/mcpproxy-server:{version}` with `"transport": {"type": "stdio"}` and the appropriate `runtimeArguments` for `docker run`. That would upgrade the entry from discovery-only to one-click installable.
 
 ## References
 

server.json

@@ -2,18 +2,12 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.smart-mcp-proxy/mcpproxy-go",
   "title": "MCPProxy",
-  "description": "Smart MCP proxy with BM25 tool discovery, quarantine security, and ~99% token savings",
+  "description": "Local-first MCP proxy with BM25 tool discovery, security scanning, quarantine & ~99% token savings",
   "websiteUrl": "https://mcpproxy.app",
   "repository": {
     "url": "https://github.com/smart-mcp-proxy/mcpproxy-go",
     "source": "github"
   },
   "version": "0.33.1",
-  "packages": [],
-  "remotes": [
-    {
-      "type": "streamable-http",
-      "url": "http://localhost:8080/mcp"
-    }
-  ]
+  "packages": []
 }