leadbay · milstan · May 20, 2026 · May 20, 2026
diff --git a/.claude-plugin/plugins/leadbay/.claude-plugin/plugin.json b/.claude-plugin/plugins/leadbay/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "leadbay",
-  "version": "0.6.3",
+  "version": "0.10.1",
   "description": "AI lead discovery, qualification, and outreach prep on your Leadbay account.",
   "author": {
     "name": "Leadbay",
@@ -15,7 +15,7 @@
   "mcpServers": {
     "leadbay": {
       "command": "npx",
-      "args": ["-y", "@leadbay/mcp@0.6"],
+      "args": ["-y", "@leadbay/mcp@0.10"],
       "env": {
         "LEADBAY_TOKEN": "${user_config.leadbay_token}",
         "LEADBAY_REGION": "${user_config.leadbay_region}",
@@ -27,7 +27,7 @@
     "leadbay_token": {
       "type": "string",
       "title": "Leadbay bearer token",
-      "description": "Mint with: npx -y @leadbay/mcp@0.6 login --email <you> --region <us|fr>",
+      "description": "Mint with: npx -y @leadbay/mcp@0.10 login --email <you> --region <us|fr>",
       "sensitive": true,
       "required": true
     },

diff --git a/README.md b/README.md
@@ -35,7 +35,7 @@ Start a conversation — the agent will ask for your Leadbay email and password
 ### Via MCP (Claude Desktop, Cursor, Cowork, any MCP client)
 
 ```bash
-npx -y @leadbay/mcp@0.7 install --email you@yourcompany.com --region us
+npx -y @leadbay/mcp@0.10 install --email you@yourcompany.com --region us
 ```
 
 The installer auto-detects which MCP clients you have (Claude Desktop, Cursor, Claude Code), prompts you per-target, and writes the token into each client's config. Add `--no-write` to disable the composite write tools. Full per-client setup, env vars, troubleshooting, and a tour of the MCP primitives is in [`packages/mcp/README.md`](packages/mcp/README.md).

diff --git a/packages/dxt/manifest.template.json b/packages/dxt/manifest.template.json
@@ -43,7 +43,7 @@
     "leadbay_token": {
       "type": "string",
       "title": "Leadbay bearer token",
-      "description": "Mint one with: npx -y @leadbay/mcp@0.9 login --email <you> --region <us|fr> (then copy LEADBAY_TOKEN from the credentials file the command writes — path is shown on stderr)",
+      "description": "Mint one with: npx -y @leadbay/mcp@0.10 login --email <you> --region <us|fr> (then copy LEADBAY_TOKEN from the credentials file the command writes — path is shown on stderr)",
       "sensitive": true,
       "required": true
     },

diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog — @leadbay/mcp
 
+## 0.10.1 — 2026-05-20
+
+Documentation + version-pin sweep paired with hardening the release pipeline. No functional changes to the published binary.
+
+- **Pin bumps**: every `npx -y @leadbay/mcp@<old>` reference in `bin.ts` (install command output, error hints, doctor instructions, generated client configs), `README.md`, `server.json` (MCP Registry manifest), `packages/dxt/manifest.template.json`, and `.claude-plugin/plugins/leadbay/.claude-plugin/plugin.json` is now `@0.10`. New installs land on the latest minor.
+- **Release pipeline migrated to npm Trusted Publishers OIDC** (`.github/workflows/release.yml`): npm revoked Classic tokens on Dec 9 2025 and Granular tokens with the "Bypass 2FA" flag still hit known publish-rejection bugs ([npm/cli#9268](https://github.com/npm/cli/issues/9268)). The publish step now uses OIDC via the [Trusted Publishers binding](https://docs.npmjs.com/trusted-publishers) configured per-package on npmjs.com. Runtime bumped to Node 24 in publish jobs for the bundled npm ≥ 11.5 that speaks the OIDC handshake (Node 22's npm 10 can't, and self-upgrade via `npm install -g npm@latest` consistently breaks on the runner image).
+- **Auto-release** (existing `.github/workflows/auto-tag.yml` — unchanged in this release, documented here): merges to `main` that bump `packages/mcp/package.json#version` automatically push `mcp-v<ver>` and dispatch `release.yml` on the tag, which publishes to npm + MCP Registry + uploads the .dxt to a GitHub Release. No manual tagging needed.
+
 ## 0.10.0 — 2026-05-19
 
 First stable cut of the 0.10 line. Consolidates everything since 0.9.1: host-native widget rendering, structured routing schema, the top-up flow, like/dislike write tools, the `research_lead` split, and PostHog + Sentry telemetry. See dev-iteration commits for granular per-PR history; this is the npm-shipped consolidation.

diff --git a/packages/mcp/README.md b/packages/mcp/README.md
@@ -24,7 +24,7 @@ A Model Context Protocol server that lets Claude Desktop, Cursor, Claude Code, a
 ## 1. Install (one command)
 
 ```bash
-npx -y @leadbay/mcp@0.6 install --email you@yourcompany.com --region us
+npx -y @leadbay/mcp@0.10 install --email you@yourcompany.com --region us
 # (you'll be prompted for your password — it's not echoed)
 ```
 
@@ -67,14 +67,14 @@ Claude Desktop 2026 ships the DXT (Desktop Extension) system — the legacy `cla
 
 If you installed Node from the official [nodejs.org](https://nodejs.org) `.pkg`, `/usr/local/lib/node_modules` is root-owned. Any of these works:
 
-- **Use `npx` (recommended, no global install):** all examples above use `npx -y @leadbay/mcp@0.6 ...` — no global install needed.
+- **Use `npx` (recommended, no global install):** all examples above use `npx -y @leadbay/mcp@0.10 ...` — no global install needed.
 - **`sudo npm install -g @leadbay/mcp`** (enter your macOS password).
 - **Use a Node version manager** — [nvm](https://github.com/nvm-sh/nvm), [volta](https://volta.sh), [fnm](https://github.com/Schniz/fnm). They install Node under your home directory, so `npm install -g` works without sudo.
 
 ### If you'd rather mint a token without auto-install
 
 ```bash
-npx -y @leadbay/mcp@0.6 login \
+npx -y @leadbay/mcp@0.10 login \
   --email you@yourcompany.com \
   --region us
 ```
@@ -92,7 +92,7 @@ Edit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) o
   "mcpServers": {
     "leadbay": {
       "command": "npx",
-      "args": ["-y", "@leadbay/mcp@0.6"],
+      "args": ["-y", "@leadbay/mcp@0.10"],
       "env": {
         "LEADBAY_TOKEN": "<paste-token-from-step-1>",
         "LEADBAY_REGION": "us"
@@ -113,7 +113,7 @@ In Cursor settings, add the MCP server:
   "mcp.servers": {
     "leadbay": {
       "command": "npx",
-      "args": ["-y", "@leadbay/mcp@0.6"],
+      "args": ["-y", "@leadbay/mcp@0.10"],
       "env": { "LEADBAY_TOKEN": "<paste-token>", "LEADBAY_REGION": "us" }
     }
   }
@@ -126,7 +126,7 @@ In Cursor settings, add the MCP server:
 claude mcp add leadbay --scope user \
   --env LEADBAY_TOKEN=<paste-token> \
   --env LEADBAY_REGION=us \
-  -- npx -y @leadbay/mcp@0.6
+  -- npx -y @leadbay/mcp@0.10
 ```
 
 > **`--scope user`** registers Leadbay globally for your account (visible from any project). Without it, `claude mcp add` defaults to project-local scope and the server only appears in conversations opened from the directory where you ran the command.
@@ -138,7 +138,7 @@ claude mcp add leadbay --scope user \
 Before starting Claude, run:
 
 ```bash
-LEADBAY_TOKEN=<paste-token> npx -y @leadbay/mcp@0.6 doctor
+LEADBAY_TOKEN=<paste-token> npx -y @leadbay/mcp@0.10 doctor
 ```
 
 Expected output:
@@ -366,14 +366,14 @@ The user's literal text replaces `verification.ref` in the outreach record, and
 | `No enrichment credits remaining` | Out of quota | Contact Leadbay support to extend quota |
 | Claude Desktop "loading forever" on first use | `npx` cold-start fetching the package | First run takes ~10s. Prefer `npm install -g @leadbay/mcp` for faster startup. |
 | Claude Desktop doesn't show Leadbay tools | Server crashed at startup | Check `~/Library/Logs/Claude/mcp*.log` (macOS) or `%APPDATA%\Claude\logs\mcp*.log` (Windows). |
-| Claude Code can't find Leadbay in a new conversation | MCP server installed at project scope (default before 0.3.0) | Re-run with `--scope user`: `claude mcp remove leadbay && claude mcp add leadbay --scope user --env LEADBAY_TOKEN=… --env LEADBAY_REGION=us -- npx -y @leadbay/mcp@0.6` |
+| Claude Code can't find Leadbay in a new conversation | MCP server installed at project scope (default before 0.3.0) | Re-run with `--scope user`: `claude mcp remove leadbay && claude mcp add leadbay --scope user --env LEADBAY_TOKEN=… --env LEADBAY_REGION=us -- npx -y @leadbay/mcp@0.10` |
 | Agent reports "tool not found" for `refine_prompt` / `adjust_audience` etc. | Pre-0.3.0 install with `LEADBAY_MCP_WRITE` unset (writes were off) | Either re-run `npx @leadbay/mcp install` or remove `LEADBAY_MCP_WRITE=0` from your client config (writes are on by default in 0.3.0+) |
 
 ## 5. Upgrade & rotation
 
-**Upgrade**: change the pinned minor in your config, e.g. `"@leadbay/mcp@0.2"` → `"@leadbay/mcp@0.6"`, then restart the client. **0.3.0 enables composite write tools by default** — see [MIGRATION.md](./MIGRATION.md). See also the [changelog](https://github.com/leadbay/leadclaw/releases).
+**Upgrade**: change the pinned minor in your config, e.g. `"@leadbay/mcp@0.2"` → `"@leadbay/mcp@0.10"`, then restart the client. **0.3.0 enables composite write tools by default** — see [MIGRATION.md](./MIGRATION.md). See also the [changelog](https://github.com/leadbay/leadclaw/releases).
 
-**Rotate token**: re-run `npx -y @leadbay/mcp@0.6 install --email you@yourcompany.com --region us` (or `login`) — the new session token replaces the old one in your MCP client config, and logging in again invalidates the prior session on most session backends.
+**Rotate token**: re-run `npx -y @leadbay/mcp@0.10 install --email you@yourcompany.com --region us` (or `login`) — the new session token replaces the old one in your MCP client config, and logging in again invalidates the prior session on most session backends.
 
 ## 6. Advanced
 

diff --git a/packages/mcp/package.json b/packages/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@leadbay/mcp",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "mcpName": "io.github.leadbay/leadbay-mcp",
   "description": "Model Context Protocol (MCP) server for Leadbay — AI lead discovery, qualification, and enrichment for Claude Desktop, Cursor, and Claude Code.",
   "type": "module",

diff --git a/packages/mcp/server.json b/packages/mcp/server.json
@@ -3,7 +3,7 @@
   "name": "io.github.leadbay/leadbay-mcp",
   "title": "Leadbay",
   "description": "AI lead discovery, qualification, and outreach prep on your Leadbay account.",
-  "version": "0.9.1",
+  "version": "0.10.1",
   "repository": {
     "url": "https://github.com/leadbay/leadclaw",
     "source": "github",
@@ -15,7 +15,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@leadbay/mcp",
-      "version": "0.9.1",
+      "version": "0.10.1",
       "transport": {
         "type": "stdio"
       },
@@ -27,13 +27,13 @@
         },
         {
           "type": "positional",
-          "value": "@leadbay/mcp@0.9"
+          "value": "@leadbay/mcp@0.10"
         }
       ],
       "environmentVariables": [
         {
           "name": "LEADBAY_TOKEN",
-          "description": "Bearer token; mint with `npx -y @leadbay/mcp@0.9 login --email <you> --region <us|fr>`.",
+          "description": "Bearer token; mint with `npx -y @leadbay/mcp@0.10 login --email <you> --region <us|fr>`.",
           "isRequired": true,
           "isSecret": true
         },

diff --git a/packages/mcp/src/bin.ts b/packages/mcp/src/bin.ts
@@ -67,7 +67,7 @@ EXAMPLE Claude Desktop config (~/Library/Application Support/Claude/claude_deskt
     "mcpServers": {
       "leadbay": {
         "command": "npx",
-        "args": ["-y", "@leadbay/mcp@0.3"],
+        "args": ["-y", "@leadbay/mcp@0.10"],
         "env": {
           "LEADBAY_TOKEN": "lb_...",
           "LEADBAY_REGION": "us",
@@ -421,7 +421,7 @@ async function runLogin(args: string[]): Promise<number> {
     mcpServers: {
       leadbay: {
         command: "npx",
-        args: ["-y", "@leadbay/mcp@0.3"],
+        args: ["-y", "@leadbay/mcp@0.10"],
         env: {
           LEADBAY_TOKEN: result.token,
           LEADBAY_REGION: result.region,
@@ -458,7 +458,7 @@ async function runLogin(args: string[]): Promise<number> {
         `  claude mcp add leadbay --scope user \\\n` +
         `    --env LEADBAY_TOKEN=${result.token} \\\n` +
         `    --env LEADBAY_REGION=${result.region} \\\n` +
-        `    -- npx -y @leadbay/mcp@0.3\n\n` +
+        `    -- npx -y @leadbay/mcp@0.10\n\n` +
         `Restart your MCP client to pick up the new server.\n`
     );
     return 0;
@@ -575,7 +575,7 @@ async function runLogin(args: string[]): Promise<number> {
         `  claude mcp add leadbay --scope user \\\n` +
         `    --env LEADBAY_TOKEN=$(jq -r .mcpServers.leadbay.env.LEADBAY_TOKEN ${quotedPath}) \\\n` +
         `    --env LEADBAY_REGION=${result.region} \\\n` +
-        `    -- npx -y @leadbay/mcp@0.3\n`
+        `    -- npx -y @leadbay/mcp@0.10\n`
     );
   }
   process.stderr.write(
@@ -823,7 +823,7 @@ export function buildClaudeCodeAddArgs(
     `LEADBAY_TELEMETRY_ENABLED=${telemetryEnabled ? "true" : "false"}`,
   ];
   if (!includeWrite) args.push("--env", `LEADBAY_MCP_WRITE=0`);
-  args.push("--", "npx", "-y", "@leadbay/mcp@0.3");
+  args.push("--", "npx", "-y", "@leadbay/mcp@0.10");
   return args;
 }
 
@@ -897,7 +897,7 @@ async function installInJsonConfig(
 
     parsed.mcpServers.leadbay = {
       command: "npx",
-      args: ["-y", "@leadbay/mcp@0.3"],
+      args: ["-y", "@leadbay/mcp@0.10"],
       env,
     };
 
@@ -1129,7 +1129,7 @@ async function runInstall(args: string[]): Promise<number> {
   }
   process.stderr.write(
     `\nThe token was written into client config files but never printed to your terminal.\n` +
-      `Verify with: LEADBAY_TOKEN=$(...) npx -y @leadbay/mcp@0.3 doctor\n` +
+      `Verify with: LEADBAY_TOKEN=$(...) npx -y @leadbay/mcp@0.10 doctor\n` +
       `Restart your MCP client(s) to pick up the new server.\n` +
       `If you ever leak the token, run \`leadbay-mcp login --email <you> --region <us|fr>\` to mint a fresh one (which invalidates the prior session).\n`
   );

diff --git a/packages/mcp/test/unit/install-flags.test.ts b/packages/mcp/test/unit/install-flags.test.ts
@@ -46,11 +46,11 @@ describe("buildClaudeCodeAddArgs — Claude Code registration argv", () => {
     expect(args).toContain("LEADBAY_MCP_WRITE=0");
   });
 
-  it("pins the @leadbay/mcp@0.3 npx target", () => {
+  it("pins the @leadbay/mcp@0.10 npx target", () => {
     const args = buildClaudeCodeAddArgs("tok", "us", true, true);
     const sep = args.indexOf("--");
     expect(sep).toBeGreaterThan(0);
-    expect(args.slice(sep + 1)).toEqual(["npx", "-y", "@leadbay/mcp@0.3"]);
+    expect(args.slice(sep + 1)).toEqual(["npx", "-y", "@leadbay/mcp@0.10"]);
   });
 
   it("token and region are NOT placed after the `--` separator (would be passed to npx, not claude)", () => {

diff --git a/packages/mcp/test/unit/login-collision.test.ts b/packages/mcp/test/unit/login-collision.test.ts
@@ -15,7 +15,7 @@ const CFG = (email: string, region: "us" | "fr", token = "u.tok") => ({
   mcpServers: {
     leadbay: {
       command: "npx",
-      args: ["-y", "@leadbay/mcp@0.3"],
+      args: ["-y", "@leadbay/mcp@0.10"],
       env: { LEADBAY_TOKEN: token, LEADBAY_REGION: region },
     },
   },