Publish under the agntk scope with a bare-npx server launch

.github/workflows/release.yml

@@ -311,11 +311,11 @@ jobs:
           VERSION: ${{ steps.metadata.outputs.version }}
         run: |
           for attempt in 1 2 3 4 5 6; do
-            if [[ "$(npm view "@codegraph/mcp@$VERSION" version --json 2>/dev/null)" == "\"$VERSION\"" ]]; then
+            if [[ "$(npm view "@agntk/codegraph-mcp@$VERSION" version --json 2>/dev/null)" == "\"$VERSION\"" ]]; then
               exit 0
             fi
             if [[ "$attempt" == "6" ]]; then
-              echo "@codegraph/mcp@$VERSION did not become visible after six attempts" >&2
+              echo "@agntk/codegraph-mcp@$VERSION did not become visible after six attempts" >&2
               exit 1
             fi
             sleep 10
@@ -327,9 +327,9 @@ jobs:
           VERSION: ${{ steps.metadata.outputs.version }}
         run: |
           mkdir -p tmp/registry
-          npm pack "@codegraph/mcp@$VERSION" --pack-destination tmp/registry
+          npm pack "@agntk/codegraph-mcp@$VERSION" --pack-destination tmp/registry
           node scripts/release/smoke-package.mjs \
-            --tarball "tmp/registry/codegraph-mcp-$VERSION.tgz" \
+            --tarball "tmp/registry/agntk-codegraph-mcp-$VERSION.tgz" \
             --version "$VERSION"
 
       - name: Create package checksum
@@ -394,14 +394,14 @@ jobs:
           VERSION: ${{ steps.metadata.outputs.version }}
         run: |
           mkdir -p tmp/registry
-          npm pack "@codegraph/mcp@$VERSION" --pack-destination tmp/registry
+          npm pack "@agntk/codegraph-mcp@$VERSION" --pack-destination tmp/registry
           if ! cmp -s "tmp/release/$FILENAME" "tmp/registry/$FILENAME"; then
             echo "Registry tarball does not match the artifact built from bootstrap_commit" >&2
             sha256sum "tmp/release/$FILENAME" "tmp/registry/$FILENAME" >&2
             exit 1
           fi
           node scripts/release/smoke-package.mjs \
-            --tarball "tmp/registry/codegraph-mcp-$VERSION.tgz" \
+            --tarball "tmp/registry/agntk-codegraph-mcp-$VERSION.tgz" \
             --version "$VERSION"
 
       - name: Create package checksum

README.md

@@ -17,7 +17,7 @@ CodeGraph turns source code and project knowledge into a searchable graph for AI
 - [Security policy](SECURITY.md)
 - [MIT license](LICENSE)
 
-The public npm package is named `@codegraph/mcp`. Its npm link, version badge, and weekly-download badge will be added after the one-time `0.1.0` bootstrap publish is verified against the registry.
+The public npm package is named `@agntk/codegraph-mcp`. Its npm link, version badge, and weekly-download badge will be added after the one-time `0.1.0` bootstrap publish is verified against the registry.
 
 ## What it does
 
@@ -31,7 +31,7 @@ The public npm package is named `@codegraph/mcp`. Its npm link, version badge, a
 
 ## Choose how to start
 
-CodeGraph requires Node.js 20 or newer. The npm commands below apply after `@codegraph/mcp` is visible in the npm registry.
+CodeGraph requires Node.js 20 or newer. The npm commands below apply after `@agntk/codegraph-mcp` is visible in the npm registry.
 
 ### Agent-first with MCP
 
@@ -42,7 +42,7 @@ Add this server configuration to an MCP client:
   "mcpServers": {
     "codegraph": {
       "command": "npx",
-      "args": ["-y", "-p", "@codegraph/mcp", "codegraph-mcp"]
+      "args": ["-y", "@agntk/codegraph-mcp"]
     }
   }
 }
@@ -71,7 +71,7 @@ Configuration saves the project but does not index it. The full reindex parses s
 Start the dashboard directly from the package:
 
 ```bash
-npx -y -p @codegraph/mcp codegraph-dashboard
+npx -y -p @agntk/codegraph-mcp codegraph-dashboard
 ```
 
 Open the URL printed by the process. A fresh database opens on the setup flow. Confirm storage and embeddings, choose Browse to select a folder, then select Index project. The page shows model download and indexing progress, finishes remaining embeddings automatically, and reports file, symbol, edge, and embedding counts before opening the graph explorer.
@@ -171,7 +171,7 @@ pnpm release:check
 
 The basic installed-tarball smoke proves the package installs in a clean consumer, both binaries start, all five MCP tools are present, a fresh database is setup-safe, Browse and indexing work, data survives restarts, the dashboard and MCP process share one embedded server, and the exact tarball hash is reported. The release CI runs that installed artifact with embedded storage on Linux x64 and Apple silicon, and checks external FalkorDB guidance on Windows x64. An opt-in local-provider lane proves cold model download progress and a usable 768-dimension vector index.
 
-A local tarball cannot prove npm registry resolution. Verify `npx -y -p @codegraph/mcp codegraph-mcp` and `npx -y -p @codegraph/mcp codegraph-dashboard` only after publication.
+A clean-consumer local tarball proof verifies that bare `npx -y @agntk/codegraph-mcp` selects the `codegraph-mcp` bin and that `npx -y -p @agntk/codegraph-mcp codegraph-dashboard` selects the dashboard bin. Repeat both commands against the package name after publication to verify npm registry resolution.
 
 ## Development
 
@@ -201,7 +201,7 @@ FalkorDBLite's Linux x64 and Apple silicon macOS binaries are installed with the
 | [`@codegraph/plugin-nlp`](packages/plugin-nlp/) | Embeddings, reranking, entity resolution, and document ingestion |
 | [`@codegraph/mcp-server`](packages/mcp-server/) | MCP transport and the five public tool groups |
 | [`@codegraph/cli`](packages/cli/) | Source-checkout command-line tools |
-| [`@codegraph/mcp`](packages/npm-package/) | Public npm distribution staging and entry point |
+| [`@agntk/codegraph-mcp`](packages/npm-package/) | Public npm distribution staging and entry point |
 | [`@codegraph/mcpb`](packages/mcpb/) | Platform-local MCPB desktop extension build |
 | [`@codegraph/api`](packages/api/) | REST API consumed by the dashboard |
 | [`@codegraph/dashboard`](packages/dashboard/) | Static dashboard UI served by the API |

SECURITY.md

@@ -19,7 +19,7 @@ The maintainer will aim to acknowledge a report within 72 hours, provide status
 
 ## Known advisories in the package dependency tree
 
-`npm audit` reports findings against `@codegraph/mcp` that we cannot resolve from this
+`npm audit` reports findings against `@agntk/codegraph-mcp` that we cannot resolve from this
 repository. They are listed here rather than suppressed, and the release pipeline enforces
 the list: `pnpm audit:consumer` resolves the dependency tree an end user actually installs
 and fails on any unacknowledged advisory at high severity or above. An acknowledgement that
@@ -28,7 +28,7 @@ stops matching a real advisory also fails the build, so this list cannot go stal
 ### sharp (GHSA-f88m-g3jw-g9cj), high
 
 `sharp` versions below 0.35.0 inherit libvips vulnerabilities CVE-2026-33327, CVE-2026-33328,
-CVE-2026-35590 and CVE-2026-35591. `@codegraph/mcp` does not depend on `sharp` directly. It
+CVE-2026-35590 and CVE-2026-35591. `@agntk/codegraph-mcp` does not depend on `sharp` directly. It
 arrives through `@huggingface/transformers`, which declares `sharp ^0.34.x` in every
 published release from 3.8.1 through 4.2.0, so no upstream version of that package resolves
 to a patched `sharp`.

apps/web/components/landing/hero-section.tsx

@@ -76,7 +76,7 @@ export function HeroSection() {
             className="mx-auto mt-5 max-w-2xl rounded-lg border border-amber-400/30 bg-amber-400/10 px-4 py-3 text-left text-xs leading-5 text-amber-100 sm:text-sm"
             aria-label="Package publication status"
           >
-            <strong>Not yet published to npm.</strong> The package is <code>@codegraph/mcp@0.1.0</code>. The <code>npx -y -p @codegraph/mcp codegraph-dashboard</code> and <code>npx -y -p @codegraph/mcp codegraph-mcp</code> commands activate at publication; use the source setup today.
+            <strong>Not yet published to npm.</strong> The package is <code>@agntk/codegraph-mcp@0.1.0</code>. The <code>npx -y @agntk/codegraph-mcp</code> and <code>npx -y -p @agntk/codegraph-mcp codegraph-dashboard</code> commands activate at publication; use the source setup today.
           </motion.aside>
         </div>
 

apps/web/components/landing/release-section.tsx

@@ -58,7 +58,7 @@ export function ReleaseSection() {
         </div>
 
         <div className="mt-6 rounded-xl border border-amber-400/30 bg-amber-400/10 p-5 text-sm leading-6 text-amber-100">
-          <strong>Publication gate:</strong> <code>@codegraph/mcp@0.1.0</code> is not in the npm registry yet. The package defines both <code>codegraph-mcp</code> and <code>codegraph-dashboard</code> bins, but registry-based install copy becomes active only after publication is verified.
+          <strong>Publication gate:</strong> <code>@agntk/codegraph-mcp@0.1.0</code> is not in the npm registry yet. The package defines both <code>codegraph-mcp</code> and <code>codegraph-dashboard</code> bins, but registry-based install copy becomes active only after publication is verified.
         </div>
       </div>
     </section>

apps/web/scripts/audit-landing.mjs

@@ -41,14 +41,15 @@ const requiredClaims = [
   'Load next',
   '59% smaller',
   '25 installed-package assertions',
-  '@codegraph/mcp@0.1.0',
-  'npx -y -p @codegraph/mcp codegraph-mcp',
-  'npx -y -p @codegraph/mcp codegraph-dashboard',
+  '@agntk/codegraph-mcp@0.1.0',
+  'npx -y @agntk/codegraph-mcp',
+  'npx -y -p @agntk/codegraph-mcp codegraph-dashboard',
 ]
 
 const forbiddenClaims = [
   /Jina/i,
-  /npx(?:\s+-y)?\s+(?!-p\s+@codegraph\/mcp\s+)codegraph-(?:mcp|dashboard)/,
+  /@codegraph\/mcp/,
+  /npx(?:\s+-y)?\s+(?!@agntk\/codegraph-mcp(?:\s|<)|-p\s+@agntk\/codegraph-mcp\s+codegraph-dashboard(?:\s|<))codegraph-(?:mcp|dashboard)/,
   /CODEGRAPH_DRIVER[^\n]*embedded/i,
   /0\.969/,
   /4 persona tools/i,

docker-compose.yml

@@ -37,7 +37,7 @@ services:
   # The API and the dashboard now run as one process from a single binary:
   #
   #   pnpm dashboard            # from a checkout
-  #   npx -y -p @codegraph/mcp codegraph-dashboard   # from the published package
+  #   npx -y -p @agntk/codegraph-mcp codegraph-dashboard   # from the published package
   #
   # Both serve the UI and the REST API on http://localhost:3001. Point them at
   # this database with FALKORDB_HOST=localhost FALKORDB_PORT=6379, or omit those

docs/DISTRIBUTION-SETUP.md

@@ -1,6 +1,6 @@
 # Distribution and Release Setup
 
-This is the operator guide for the public `@codegraph/mcp` npm package and the platform-local MCPB desktop extension. The canonical source is [Phoenixrr2113/codebase-graph](https://github.com/Phoenixrr2113/codebase-graph).
+This is the operator guide for the public `@agntk/codegraph-mcp` npm package and the platform-local MCPB desktop extension. The canonical source is [Phoenixrr2113/codebase-graph](https://github.com/Phoenixrr2113/codebase-graph).
 
 ## Release model
 
@@ -29,7 +29,7 @@ Use a clean checkout of the reviewed commit. Confirm authentication without disp
 git status --short
 git rev-parse HEAD
 npm whoami
-npm view @codegraph/mcp version --json
+npm view @agntk/codegraph-mcp version --json
 ```
 
 The status output must be empty. Save the full 40-character commit SHA as `BOOTSTRAP_COMMIT`; it identifies the reviewed source used to build the registry package. An npm `E404` response is expected before the first publication. Then run the full local gate:
@@ -51,7 +51,7 @@ pnpm release:check
 Publish only the exact tarball created and verified by `pnpm release:check`:
 
 ```bash
-npm publish tmp/release/codegraph-mcp-0.1.0.tgz --access public
+npm publish tmp/release/agntk-codegraph-mcp-0.1.0.tgz --access public
 ```
 
 The authenticated bootstrap cannot use trusted-publishing provenance because the npm package does not exist yet. Later releases use the trusted publisher and receive automatic provenance from npm.
@@ -73,25 +73,25 @@ Installed runtime defaults are part of the package contract. `API_PORT` defaults
 From the repository root:
 
 ```bash
-npm view @codegraph/mcp@0.1.0 name version license repository bin dist --json
+npm view @agntk/codegraph-mcp@0.1.0 name version license repository bin dist --json
 mkdir -p tmp/registry
-npm pack @codegraph/mcp@0.1.0 --pack-destination tmp/registry
+npm pack @agntk/codegraph-mcp@0.1.0 --pack-destination tmp/registry
 node scripts/release/smoke-package.mjs \
-  --tarball tmp/registry/codegraph-mcp-0.1.0.tgz \
+  --tarball tmp/registry/agntk-codegraph-mcp-0.1.0.tgz \
   --version 0.1.0
 ```
 
 The basic smoke creates a temporary consumer and installs the exact tarball without lifecycle scripts. Its 25 runtime assertions cover the matching CLI version, dashboard health and built assets, empty projects and embedding coverage, setup status, Browse roots, MCP initialization, the exact five-tool surface (`analyze`, `codebase`, `knowledge`, `query`, and `search`), project configuration, indexing, graph queries, restart persistence, concurrent MCP and dashboard access through one embedded server, shutdown order, persisted data, and the tarball SHA-256.
 
-Release CI runs this installed artifact with embedded FalkorDBLite on Linux x64 and Apple silicon macOS. The macOS job first runs `brew install libomp openssl@3`. The Windows x64 job verifies the exact external FalkorDB guidance without attempting embedded startup. A local tarball does not prove npm registry resolution for the documented `npx` entry paths; check those only after publication.
+Release CI runs this installed artifact with embedded FalkorDBLite on Linux x64 and Apple silicon macOS. The macOS job first runs `brew install libomp openssl@3`. The Windows x64 job verifies the exact external FalkorDB guidance without attempting embedded startup. A clean-consumer local tarball proof verifies the documented invocation shapes: bare `npx -y @agntk/codegraph-mcp` selects the MCP bin, while `npx -y -p @agntk/codegraph-mcp codegraph-dashboard` selects the dashboard bin. Repeat both commands against the package name after publication to verify npm registry resolution.
 
 After the registry smoke passes, create the GitHub `npm` environment for later tag releases. In GitHub Actions, open the Release workflow, choose **Run workflow** from `main`, enter `0.1.0` as `bootstrap_version`, and enter the saved full SHA as `bootstrap_commit`. This one-time path accepts only the `0.1.0` package version, checks out that exact commit, requires it to be reachable from `main`, reruns the full release gate, confirms that the exact version already exists on npm, requires the registry tarball to be byte-for-byte identical to the artifact rebuilt from `bootstrap_commit`, creates the annotated `v0.1.0` tag on that commit, and publishes the tarball plus checksum as a GitHub release. It does not use the `npm` environment, request an OIDC token, or call `npm publish` again.
 
 Do not push `v0.1.0` yourself after the manual npm publication. A normal tag-triggered release correctly requires its version to be unpublished; the bootstrap workflow dispatch owns the initial tag and avoids a duplicate publication attempt.
 
 ## Configure trusted publishing
 
-After `@codegraph/mcp` exists on npm, open its package settings and add a GitHub Actions trusted publisher with:
+After `@agntk/codegraph-mcp` exists on npm, open its package settings and add a GitHub Actions trusted publisher with:
 
 | Field | Value |
 | --- | --- |

mcp.json.example

@@ -8,12 +8,12 @@
   }
 }
 
-// Post-publication, after @codegraph/mcp is verified in the npm registry
+// Post-publication, after @agntk/codegraph-mcp is verified in the npm registry
 {
   "mcpServers": {
     "codegraph": {
       "command": "npx",
-      "args": ["-y", "-p", "@codegraph/mcp", "codegraph-mcp"]
+      "args": ["-y", "@agntk/codegraph-mcp"]
     }
   }
 }

packages/dashboard/src/components/dashboard/setup-flow.tsx

@@ -436,7 +436,7 @@ export function SetupFlow({ apiUrl, status, onStatusRefresh, onProjectParsed, on
               <div className="mt-5 flex flex-wrap gap-2">
                 <Button onClick={onExplore}>Explore graph</Button>
                 <Button variant="outline" onClick={() => {
-                  void navigator.clipboard.writeText('npx -y -p @codegraph/mcp codegraph-mcp setup').catch((error: unknown) => {
+                  void navigator.clipboard.writeText('npx -y @agntk/codegraph-mcp setup').catch((error: unknown) => {
                     console.warn('Unable to copy the MCP setup command', error)
                   })
                 }}>Copy MCP setup command</Button>

packages/mcp-server/README.md

@@ -1,6 +1,6 @@
 # @codegraph/mcp-server
 
-Private workspace implementation of the CodeGraph Model Context Protocol server. The public `@codegraph/mcp` package stages this server with its runtime dependencies and dashboard.
+Private workspace implementation of the CodeGraph Model Context Protocol server. The public `@agntk/codegraph-mcp` package stages this server with its runtime dependencies and dashboard.
 
 ## Grouped tools
 

packages/npm-package/__tests__/cli.test.ts

@@ -25,7 +25,7 @@ describe('codegraph-mcp CLI', () => {
     );
     writeFileSync(
       join(fixtureDirectory, 'package.json'),
-      JSON.stringify({ name: '@codegraph/mcp', version: '9.8.7', type: 'module' }),
+      JSON.stringify({ name: '@agntk/codegraph-mcp', version: '9.8.7', type: 'module' }),
     );
 
     const result = spawnSync(
@@ -50,7 +50,7 @@ describe('codegraph-mcp CLI', () => {
     );
     writeFileSync(
       join(fixtureDirectory, 'package.json'),
-      JSON.stringify({ name: '@codegraph/mcp', version: '9.8.7', type: 'module' }),
+      JSON.stringify({ name: '@agntk/codegraph-mcp', version: '9.8.7', type: 'module' }),
     );
     writeFileSync(
       join(fixtureDirectory, 'server', 'index.mjs'),

packages/npm-package/__tests__/package-metadata.test.ts

@@ -3,7 +3,7 @@ import { createPublishedManifest } from '../lib/package-metadata.mjs';
 import { canonicalPackCommand, rejectSourcePackagePack } from '../guard-pack.mjs';
 
 const packageManifest = {
-  name: '@codegraph/mcp',
+  name: '@agntk/codegraph-mcp',
   version: '0.1.0',
   description: 'CodeGraph MCP Server',
   type: 'module',
@@ -71,7 +71,7 @@ describe('createPublishedManifest', () => {
     const manifest = createPublishedManifest({ packageManifest, dependencyManifests });
 
     expect(manifest).toMatchObject({
-      name: '@codegraph/mcp',
+      name: '@agntk/codegraph-mcp',
       version: '0.1.0',
       description: 'CodeGraph MCP Server',
       license: 'MIT',

packages/npm-package/bin/codegraph-dashboard.mjs

@@ -31,7 +31,7 @@ function readPackageVersion() {
   if (
     typeof manifest !== 'object' ||
     manifest === null ||
-    manifest.name !== '@codegraph/mcp' ||
+    manifest.name !== '@agntk/codegraph-mcp' ||
     typeof manifest.version !== 'string'
   ) {
     throw new Error('invalid package manifest');

packages/npm-package/bin/codegraph-mcp.mjs

@@ -4,7 +4,7 @@
  *
  * Usage:
  *   codegraph-mcp                          # start MCP server (stdio transport)
- *   npx -y -p @codegraph/mcp codegraph-mcp # run without global install
+ *   npx -y @agntk/codegraph-mcp            # run without global install
  *
  * Environment:
  *   CODEGRAPH_EMBEDDING_PROVIDER  Embedding provider or "none" for offline mode
@@ -26,7 +26,7 @@ function readPackageVersion() {
   if (
     typeof manifest !== 'object' ||
     manifest === null ||
-    manifest.name !== '@codegraph/mcp' ||
+    manifest.name !== '@agntk/codegraph-mcp' ||
     typeof manifest.version !== 'string'
   ) {
     throw new Error('invalid package manifest');

packages/npm-package/build.mjs

@@ -141,7 +141,7 @@ Add this configuration to an MCP client after the package is visible in the npm
   "mcpServers": {
     "codegraph": {
       "command": "npx",
-      "args": ["-y", "-p", "@codegraph/mcp", "codegraph-mcp"]
+      "args": ["-y", "@agntk/codegraph-mcp"]
     }
   }
 }
@@ -164,7 +164,7 @@ Configuration saves the project. Reindexing parses structure and finishes embedd
 Start the dashboard directly from this package:
 
 \`\`\`bash
-npx -y -p @codegraph/mcp codegraph-dashboard
+npx -y -p @agntk/codegraph-mcp codegraph-dashboard
 \`\`\`
 
 Open the URL printed by the process. A fresh database opens on setup. Confirm storage and embeddings, use Browse to choose a folder, then select Index project. The page shows download and indexing progress before opening the explorer.
@@ -225,5 +225,5 @@ MIT
 );
 
 const bundleBytes = readFileSync(resolve(outputDirectory, 'server/index.mjs')).byteLength;
-console.log(`Built @codegraph/mcp staging directory (${(bundleBytes / 1024 / 1024).toFixed(1)} MB bundle).`);
+console.log(`Built @agntk/codegraph-mcp staging directory (${(bundleBytes / 1024 / 1024).toFixed(1)} MB bundle).`);
 console.log('Canonical package command: pnpm pack:npm');