Publish under @codegraph/mcp after npm rejected the unscoped name

.github/workflows/release.yml

@@ -311,11 +311,11 @@ jobs:
           VERSION: ${{ steps.metadata.outputs.version }}
         run: |
           for attempt in 1 2 3 4 5 6; do
-            if [[ "$(npm view "codegraph-mcp@$VERSION" version --json 2>/dev/null)" == "\"$VERSION\"" ]]; then
+            if [[ "$(npm view "@codegraph/mcp@$VERSION" version --json 2>/dev/null)" == "\"$VERSION\"" ]]; then
               exit 0
             fi
             if [[ "$attempt" == "6" ]]; then
-              echo "codegraph-mcp@$VERSION did not become visible after six attempts" >&2
+              echo "@codegraph/mcp@$VERSION did not become visible after six attempts" >&2
               exit 1
             fi
             sleep 10
@@ -327,7 +327,7 @@ jobs:
           VERSION: ${{ steps.metadata.outputs.version }}
         run: |
           mkdir -p tmp/registry
-          npm pack "codegraph-mcp@$VERSION" --pack-destination tmp/registry
+          npm pack "@codegraph/mcp@$VERSION" --pack-destination tmp/registry
           node scripts/release/smoke-package.mjs \
             --tarball "tmp/registry/codegraph-mcp-$VERSION.tgz" \
             --version "$VERSION"
@@ -394,7 +394,7 @@ jobs:
           VERSION: ${{ steps.metadata.outputs.version }}
         run: |
           mkdir -p tmp/registry
-          npm pack "codegraph-mcp@$VERSION" --pack-destination tmp/registry
+          npm pack "@codegraph/mcp@$VERSION" --pack-destination tmp/registry
           if ! cmp -s "tmp/release/$FILENAME" "tmp/registry/$FILENAME"; then
             echo "Registry tarball does not match the artifact built from bootstrap_commit" >&2
             sha256sum "tmp/release/$FILENAME" "tmp/registry/$FILENAME" >&2

README.md

@@ -17,7 +17,7 @@ CodeGraph turns source code and project knowledge into a searchable graph for AI
 - [Security policy](SECURITY.md)
 - [MIT license](LICENSE)
 
-The public npm package is named `codegraph-mcp`. Its npm link, version badge, and weekly-download badge will be added after the one-time `0.1.0` bootstrap publish is verified against the registry.
+The public npm package is named `@codegraph/mcp`. Its npm link, version badge, and weekly-download badge will be added after the one-time `0.1.0` bootstrap publish is verified against the registry.
 
 ## What it does
 
@@ -31,7 +31,7 @@ The public npm package is named `codegraph-mcp`. Its npm link, version badge, an
 
 ## Choose how to start
 
-CodeGraph requires Node.js 20 or newer. The npm commands below apply after `codegraph-mcp` is visible in the npm registry.
+CodeGraph requires Node.js 20 or newer. The npm commands below apply after `@codegraph/mcp` is visible in the npm registry.
 
 ### Agent-first with MCP
 
@@ -42,7 +42,7 @@ Add this server configuration to an MCP client:
   "mcpServers": {
     "codegraph": {
       "command": "npx",
-      "args": ["-y", "codegraph-mcp"]
+      "args": ["-y", "-p", "@codegraph/mcp", "codegraph-mcp"]
     }
   }
 }
@@ -71,7 +71,7 @@ Configuration saves the project but does not index it. The full reindex parses s
 Start the dashboard directly from the package:
 
 ```bash
-npx -y --package codegraph-mcp codegraph-dashboard
+npx -y -p @codegraph/mcp codegraph-dashboard
 ```
 
 Open the URL printed by the process. A fresh database opens on the setup flow. Confirm storage and embeddings, choose Browse to select a folder, then select Index project. The page shows model download and indexing progress, finishes remaining embeddings automatically, and reports file, symbol, edge, and embedding counts before opening the graph explorer.
@@ -171,7 +171,7 @@ pnpm release:check
 
 The basic installed-tarball smoke proves the package installs in a clean consumer, both binaries start, all five MCP tools are present, a fresh database is setup-safe, Browse and indexing work, data survives restarts, the dashboard and MCP process share one embedded server, and the exact tarball hash is reported. The release CI runs that installed artifact with embedded storage on Linux x64 and Apple silicon, and checks external FalkorDB guidance on Windows x64. An opt-in local-provider lane proves cold model download progress and a usable 768-dimension vector index.
 
-A local tarball cannot prove npm registry resolution. Verify `npx -y codegraph-mcp` and `npx -y --package codegraph-mcp codegraph-dashboard` only after publication.
+A local tarball cannot prove npm registry resolution. Verify `npx -y -p @codegraph/mcp codegraph-mcp` and `npx -y -p @codegraph/mcp codegraph-dashboard` only after publication.
 
 ## Development
 
@@ -201,7 +201,7 @@ FalkorDBLite's Linux x64 and Apple silicon macOS binaries are installed with the
 | [`@codegraph/plugin-nlp`](packages/plugin-nlp/) | Embeddings, reranking, entity resolution, and document ingestion |
 | [`@codegraph/mcp-server`](packages/mcp-server/) | MCP transport and the five public tool groups |
 | [`@codegraph/cli`](packages/cli/) | Source-checkout command-line tools |
-| [`codegraph-mcp`](packages/npm-package/) | Public npm distribution staging and entry point |
+| [`@codegraph/mcp`](packages/npm-package/) | Public npm distribution staging and entry point |
 | [`@codegraph/mcpb`](packages/mcpb/) | Platform-local MCPB desktop extension build |
 | [`@codegraph/api`](packages/api/) | REST API consumed by the dashboard |
 | [`@codegraph/dashboard`](packages/dashboard/) | Static dashboard UI served by the API |

SECURITY.md

@@ -19,7 +19,7 @@ The maintainer will aim to acknowledge a report within 72 hours, provide status
 
 ## Known advisories in the package dependency tree
 
-`npm audit` reports findings against `codegraph-mcp` that we cannot resolve from this
+`npm audit` reports findings against `@codegraph/mcp` that we cannot resolve from this
 repository. They are listed here rather than suppressed, and the release pipeline enforces
 the list: `pnpm audit:consumer` resolves the dependency tree an end user actually installs
 and fails on any unacknowledged advisory at high severity or above. An acknowledgement that
@@ -28,7 +28,7 @@ stops matching a real advisory also fails the build, so this list cannot go stal
 ### sharp (GHSA-f88m-g3jw-g9cj), high
 
 `sharp` versions below 0.35.0 inherit libvips vulnerabilities CVE-2026-33327, CVE-2026-33328,
-CVE-2026-35590 and CVE-2026-35591. `codegraph-mcp` does not depend on `sharp` directly. It
+CVE-2026-35590 and CVE-2026-35591. `@codegraph/mcp` does not depend on `sharp` directly. It
 arrives through `@huggingface/transformers`, which declares `sharp ^0.34.x` in every
 published release from 3.8.1 through 4.2.0, so no upstream version of that package resolves
 to a patched `sharp`.

apps/web/components/landing/hero-section.tsx

@@ -76,7 +76,7 @@ export function HeroSection() {
             className="mx-auto mt-5 max-w-2xl rounded-lg border border-amber-400/30 bg-amber-400/10 px-4 py-3 text-left text-xs leading-5 text-amber-100 sm:text-sm"
             aria-label="Package publication status"
           >
-            <strong>Not yet published to npm.</strong> The package is <code>codegraph-mcp@0.1.0</code>. The <code>npx codegraph-dashboard</code> and <code>npx codegraph-mcp</code> commands activate at publication; use the source setup today.
+            <strong>Not yet published to npm.</strong> The package is <code>@codegraph/mcp@0.1.0</code>. The <code>npx -y -p @codegraph/mcp codegraph-dashboard</code> and <code>npx -y -p @codegraph/mcp codegraph-mcp</code> commands activate at publication; use the source setup today.
           </motion.aside>
         </div>
 

apps/web/components/landing/release-section.tsx

@@ -58,7 +58,7 @@ export function ReleaseSection() {
         </div>
 
         <div className="mt-6 rounded-xl border border-amber-400/30 bg-amber-400/10 p-5 text-sm leading-6 text-amber-100">
-          <strong>Publication gate:</strong> <code>codegraph-mcp@0.1.0</code> is not in the npm registry yet. The package defines both <code>codegraph-mcp</code> and <code>codegraph-dashboard</code> bins, but registry-based install copy becomes active only after publication is verified.
+          <strong>Publication gate:</strong> <code>@codegraph/mcp@0.1.0</code> is not in the npm registry yet. The package defines both <code>codegraph-mcp</code> and <code>codegraph-dashboard</code> bins, but registry-based install copy becomes active only after publication is verified.
         </div>
       </div>
     </section>

apps/web/scripts/audit-landing.mjs

@@ -41,13 +41,14 @@ const requiredClaims = [
   'Load next',
   '59% smaller',
   '25 installed-package assertions',
-  'codegraph-mcp',
-  'codegraph-dashboard',
+  '@codegraph/mcp@0.1.0',
+  'npx -y -p @codegraph/mcp codegraph-mcp',
+  'npx -y -p @codegraph/mcp codegraph-dashboard',
 ]
 
 const forbiddenClaims = [
   /Jina/i,
-  /@codegraph\/mcp/,
+  /npx(?:\s+-y)?\s+(?!-p\s+@codegraph\/mcp\s+)codegraph-(?:mcp|dashboard)/,
   /CODEGRAPH_DRIVER[^\n]*embedded/i,
   /0\.969/,
   /4 persona tools/i,

docker-compose.yml

@@ -37,7 +37,7 @@ services:
   # The API and the dashboard now run as one process from a single binary:
   #
   #   pnpm dashboard            # from a checkout
-  #   npx codegraph-dashboard   # from the published package
+  #   npx -y -p @codegraph/mcp codegraph-dashboard   # from the published package
   #
   # Both serve the UI and the REST API on http://localhost:3001. Point them at
   # this database with FALKORDB_HOST=localhost FALKORDB_PORT=6379, or omit those

docs/DISTRIBUTION-SETUP.md

@@ -1,6 +1,6 @@
 # Distribution and Release Setup
 
-This is the operator guide for the public `codegraph-mcp` npm package and the platform-local MCPB desktop extension. The canonical source is [Phoenixrr2113/codebase-graph](https://github.com/Phoenixrr2113/codebase-graph).
+This is the operator guide for the public `@codegraph/mcp` npm package and the platform-local MCPB desktop extension. The canonical source is [Phoenixrr2113/codebase-graph](https://github.com/Phoenixrr2113/codebase-graph).
 
 ## Release model
 
@@ -29,7 +29,7 @@ Use a clean checkout of the reviewed commit. Confirm authentication without disp
 git status --short
 git rev-parse HEAD
 npm whoami
-npm view codegraph-mcp version --json
+npm view @codegraph/mcp version --json
 ```
 
 The status output must be empty. Save the full 40-character commit SHA as `BOOTSTRAP_COMMIT`; it identifies the reviewed source used to build the registry package. An npm `E404` response is expected before the first publication. Then run the full local gate:
@@ -73,9 +73,9 @@ Installed runtime defaults are part of the package contract. `API_PORT` defaults
 From the repository root:
 
 ```bash
-npm view codegraph-mcp@0.1.0 name version license repository bin dist --json
+npm view @codegraph/mcp@0.1.0 name version license repository bin dist --json
 mkdir -p tmp/registry
-npm pack codegraph-mcp@0.1.0 --pack-destination tmp/registry
+npm pack @codegraph/mcp@0.1.0 --pack-destination tmp/registry
 node scripts/release/smoke-package.mjs \
   --tarball tmp/registry/codegraph-mcp-0.1.0.tgz \
   --version 0.1.0
@@ -91,7 +91,7 @@ Do not push `v0.1.0` yourself after the manual npm publication. A normal tag-tri
 
 ## Configure trusted publishing
 
-After `codegraph-mcp` exists on npm, open its package settings and add a GitHub Actions trusted publisher with:
+After `@codegraph/mcp` exists on npm, open its package settings and add a GitHub Actions trusted publisher with:
 
 | Field | Value |
 | --- | --- |

mcp.json.example

@@ -8,12 +8,12 @@
   }
 }
 
-// Post-publication, after codegraph-mcp is verified in the npm registry
+// Post-publication, after @codegraph/mcp is verified in the npm registry
 {
   "mcpServers": {
     "codegraph": {
       "command": "npx",
-      "args": ["-y", "codegraph-mcp"]
+      "args": ["-y", "-p", "@codegraph/mcp", "codegraph-mcp"]
     }
   }
 }

packages/dashboard/src/components/dashboard/setup-flow.tsx

@@ -436,7 +436,7 @@ export function SetupFlow({ apiUrl, status, onStatusRefresh, onProjectParsed, on
               <div className="mt-5 flex flex-wrap gap-2">
                 <Button onClick={onExplore}>Explore graph</Button>
                 <Button variant="outline" onClick={() => {
-                  void navigator.clipboard.writeText('npx codegraph-mcp setup').catch((error: unknown) => {
+                  void navigator.clipboard.writeText('npx -y -p @codegraph/mcp codegraph-mcp setup').catch((error: unknown) => {
                     console.warn('Unable to copy the MCP setup command', error)
                   })
                 }}>Copy MCP setup command</Button>

packages/mcp-server/README.md

@@ -1,6 +1,6 @@
 # @codegraph/mcp-server
 
-Private workspace implementation of the CodeGraph Model Context Protocol server. The public `codegraph-mcp` package stages this server with its runtime dependencies and dashboard.
+Private workspace implementation of the CodeGraph Model Context Protocol server. The public `@codegraph/mcp` package stages this server with its runtime dependencies and dashboard.
 
 ## Grouped tools
 

packages/npm-package/__tests__/cli.test.ts

@@ -25,7 +25,7 @@ describe('codegraph-mcp CLI', () => {
     );
     writeFileSync(
       join(fixtureDirectory, 'package.json'),
-      JSON.stringify({ name: 'codegraph-mcp', version: '9.8.7', type: 'module' }),
+      JSON.stringify({ name: '@codegraph/mcp', version: '9.8.7', type: 'module' }),
     );
 
     const result = spawnSync(
@@ -50,7 +50,7 @@ describe('codegraph-mcp CLI', () => {
     );
     writeFileSync(
       join(fixtureDirectory, 'package.json'),
-      JSON.stringify({ name: 'codegraph-mcp', version: '9.8.7', type: 'module' }),
+      JSON.stringify({ name: '@codegraph/mcp', version: '9.8.7', type: 'module' }),
     );
     writeFileSync(
       join(fixtureDirectory, 'server', 'index.mjs'),

packages/npm-package/__tests__/package-metadata.test.ts

@@ -3,7 +3,7 @@ import { createPublishedManifest } from '../lib/package-metadata.mjs';
 import { canonicalPackCommand, rejectSourcePackagePack } from '../guard-pack.mjs';
 
 const packageManifest = {
-  name: 'codegraph-mcp',
+  name: '@codegraph/mcp',
   version: '0.1.0',
   description: 'CodeGraph MCP Server',
   type: 'module',
@@ -71,7 +71,7 @@ describe('createPublishedManifest', () => {
     const manifest = createPublishedManifest({ packageManifest, dependencyManifests });
 
     expect(manifest).toMatchObject({
-      name: 'codegraph-mcp',
+      name: '@codegraph/mcp',
       version: '0.1.0',
       description: 'CodeGraph MCP Server',
       license: 'MIT',

packages/npm-package/bin/codegraph-dashboard.mjs

@@ -31,7 +31,7 @@ function readPackageVersion() {
   if (
     typeof manifest !== 'object' ||
     manifest === null ||
-    manifest.name !== 'codegraph-mcp' ||
+    manifest.name !== '@codegraph/mcp' ||
     typeof manifest.version !== 'string'
   ) {
     throw new Error('invalid package manifest');

packages/npm-package/bin/codegraph-mcp.mjs

@@ -4,7 +4,7 @@
  *
  * Usage:
  *   codegraph-mcp                          # start MCP server (stdio transport)
- *   npx codegraph-mcp                      # run without global install
+ *   npx -y -p @codegraph/mcp codegraph-mcp # run without global install
  *
  * Environment:
  *   CODEGRAPH_EMBEDDING_PROVIDER  Embedding provider or "none" for offline mode
@@ -26,7 +26,7 @@ function readPackageVersion() {
   if (
     typeof manifest !== 'object' ||
     manifest === null ||
-    manifest.name !== 'codegraph-mcp' ||
+    manifest.name !== '@codegraph/mcp' ||
     typeof manifest.version !== 'string'
   ) {
     throw new Error('invalid package manifest');

packages/npm-package/build.mjs

@@ -141,7 +141,7 @@ Add this configuration to an MCP client after the package is visible in the npm
   "mcpServers": {
     "codegraph": {
       "command": "npx",
-      "args": ["-y", "codegraph-mcp"]
+      "args": ["-y", "-p", "@codegraph/mcp", "codegraph-mcp"]
     }
   }
 }
@@ -164,7 +164,7 @@ Configuration saves the project. Reindexing parses structure and finishes embedd
 Start the dashboard directly from this package:
 
 \`\`\`bash
-npx -y --package codegraph-mcp codegraph-dashboard
+npx -y -p @codegraph/mcp codegraph-dashboard
 \`\`\`
 
 Open the URL printed by the process. A fresh database opens on setup. Confirm storage and embeddings, use Browse to choose a folder, then select Index project. The page shows download and indexing progress before opening the explorer.
@@ -225,5 +225,5 @@ MIT
 );
 
 const bundleBytes = readFileSync(resolve(outputDirectory, 'server/index.mjs')).byteLength;
-console.log(`Built codegraph-mcp staging directory (${(bundleBytes / 1024 / 1024).toFixed(1)} MB bundle).`);
+console.log(`Built @codegraph/mcp staging directory (${(bundleBytes / 1024 / 1024).toFixed(1)} MB bundle).`);
 console.log('Canonical package command: pnpm pack:npm');

packages/npm-package/lib/package-metadata.mjs

@@ -93,8 +93,8 @@ export function createPublishedManifest({ packageManifest, dependencyManifests }
   }
 
   const name = requireString(source, 'name', 'packageManifest');
-  if (name !== 'codegraph-mcp') {
-    throw new TypeError('packageManifest.name must be codegraph-mcp');
+  if (name !== '@codegraph/mcp') {
+    throw new TypeError('packageManifest.name must be @codegraph/mcp');
   }
   const publishConfig = cloneRecord(source, 'publishConfig', 'packageManifest');
   if (publishConfig.access !== 'public') {

packages/npm-package/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "codegraph-mcp",
+  "name": "@codegraph/mcp",
   "version": "0.1.0",
   "description": "CodeGraph MCP Server: Index any codebase into a graph database. Search by meaning, trace relationships, and manage project knowledge.",
   "type": "module",

scripts/release/__tests__/smoke-package.test.ts

@@ -188,6 +188,24 @@ describe('smokePackage', () => {
     }));
     expect(String(handshakeOptions.env?.CODEGRAPH_DB_PATH).length).toBeLessThan(90);
   });
+
+  it('boots both installed entry points from the scoped package directory', async () => {
+    const runner = successfulRunner();
+
+    await smokePackage({
+      verifyDashboard: async () => ({ port: 0, asset: '/assets/index-test.js' }),
+      tarballPath: createTarball(),
+      expectedVersion: '0.1.0',
+      runner,
+    });
+
+    expect(runner.run.mock.calls[1][1][0]).toMatch(
+      /node_modules[\\/]@codegraph[\\/]mcp[\\/]bin[\\/]codegraph-mcp\.mjs$/,
+    );
+    expect(runner.run.mock.calls[2][1][2]).toMatch(
+      /node_modules[\\/]@codegraph[\\/]mcp$/,
+    );
+  });
 });
 
 describe('smoke helpers', () => {

scripts/release/__tests__/validate-package.test.ts

@@ -32,7 +32,7 @@ function createValidFixture(): string {
   writeFileSync(join(directory, 'LICENSE'), 'MIT License\n');
   writeFileSync(join(directory, 'README.md'), '# CodeGraph\n');
   writeFileSync(join(directory, 'package.json'), JSON.stringify({
-    name: 'codegraph-mcp',
+    name: '@codegraph/mcp',
     version: '0.1.0',
     license: 'MIT',
     repository: {
@@ -57,7 +57,7 @@ describe('validatePackageDirectory', () => {
     const directory = createValidFixture();
 
     await expect(validatePackageDirectory(pathToFileURL(directory))).resolves.toMatchObject({
-      name: 'codegraph-mcp',
+      name: '@codegraph/mcp',
       version: '0.1.0',
       fileCount: 8,
     });
@@ -137,15 +137,15 @@ describe('validatePackageDirectory', () => {
 describe('validatePackReport', () => {
   it('returns package and size metadata for a valid npm report', () => {
     expect(validatePackReport([{
-      name: 'codegraph-mcp',
+      name: '@codegraph/mcp',
       version: '0.1.0',
       filename: 'codegraph-mcp-0.1.0.tgz',
       size: 1024,
       unpackedSize: 4096,
       entryCount: 5,
       files: [{ path: 'package/bin/codegraph-mcp.mjs', size: 20, mode: 493 }],
     }])).toEqual({
-      name: 'codegraph-mcp',
+      name: '@codegraph/mcp',
       version: '0.1.0',
       filename: 'codegraph-mcp-0.1.0.tgz',
       fileCount: 5,
@@ -156,7 +156,7 @@ describe('validatePackReport', () => {
 
   it('rejects packed artifacts over 15 MB', () => {
     expect(() => validatePackReport([{
-      name: 'codegraph-mcp',
+      name: '@codegraph/mcp',
       version: '0.1.0',
       filename: 'codegraph-mcp-0.1.0.tgz',
       size: (15 * 1024 * 1024) + 1,