Show each MCP server's logo, from sources the publisher declared

[lbesecker195]

Closes #71.

Every listing drew a two-letter monogram. Most can now show a real logo, taken only from things the publisher already put on the public record.

Where logos come from, in order

Source	Why it ranks here	Coverage
icons in server.json	the logo they chose for this server	~14% of upstream entries
GitHub avatar of an io.github.* owner	the official registry verified that identity before allowing the namespace	24,328 / 37,015 (66%)
GitHub avatar of the repository owner	the repo URL is the publisher's own claim, so it goes last	5,714 more
monogram	—	the remaining ~19%

Nothing is inferred from a name or scraped from a website. A wrong logo asserts an affiliation that isn't there, which is worse than none.

From a declared icons array: SVG first, then the smallest raster still sharp at 2× (a 512px PNG drawn at 48px is a big download for nothing), and dark-theme icons are passed over when there's another. http:// (mixed content), data: and placeholder URLs are dropped in the manifest, so an unusable icon never invalidates the listing's import.

Rendering

The <img> is stacked over the existing monogram and carries onerror="this.remove()". If a publisher moves their icon or a host dies, the reader sees the monogram, never a broken-image glyph, and the tile's size is fixed up front, so there's no layout shift either way. referrerpolicy="no-referrer" keeps the page a visitor was reading out of third-party logs. Declared icons get padding on a light tile (most are transparent marks drawn for white); avatars are opaque and fill the tile. The tile colour is a new --logo-tile token, off-white in dark mode.

Backfill

The sync rightly skips upstream entries whose updatedAt hasn't moved, which also means a newly read field like icons would never reach existing listings. OfficialRegistry.sync(reapply: true) pushes everything through the mapping once more, writes only rows whose mapped fields actually differ, and announces nothing — otherwise all 37,000 listings would have been pushed to IndexNow, which already answers 429 at normal volume.

Tests: 185 passing on three seeds.

---

Pages affected:

• MCP Harbor -- registry home, featured and newest MCP servers.
• MCP server directory -- every card in the search grid gets a logo.
• Have I Been Pwned MCP -- logo from a verified GitHub owner.

🤖 Generated with Claude Code