diff --git a/.gitignore b/.gitignore
index 7a5a785..490e243 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,6 @@ local-test-results.json
 # not code and shouldn't live in git. Track deliberately-saved research
 # output under a different name.
 research-*.json
+# MCP registry publisher credentials (mcp-publisher writes these into
+# packages/create-webclaw/). They are OAuth/API tokens — never commit them.
+.mcpregistry_*_token
diff --git a/.mcp.json b/.mcp.json
index fabcd4f..a1eca74 100644
--- a/.mcp.json
+++ b/.mcp.json
@@ -1,7 +1,8 @@
 {
   "mcpServers": {
     "webclaw": {
-      "command": "~/.webclaw/webclaw-mcp"
+      "command": "npx",
+      "args": ["-y", "@webclaw/mcp"]
     }
   }
 }