The remote server has never been in the official registry. What is listed
under this namespace is chart-color-audit - a different package, an npm
stdio CLI - so the four-tool HTTP server at chart-color-mcp.vercel.app is
discoverable only by a human reading mcp-docs.html.

Publishing it by hand needs a GitHub device-code login, which means it
happens once and then never again when the endpoint changes. This does it
the way release-lib.yml already publishes to npm: OIDC, no stored token,
nothing to expire. The registry trusts the workflow because it runs in
this repo and the namespace it claims is owned by this account.

Release is `git tag mcp-v0.1.1 && git push origin mcp-v0.1.1`. mcp-v*
rather than v* so it cannot collide with the lib-v* npm train.

The version comes from the tag, so server.json and the registry entry
cannot disagree. The card is tested before anything is published, because
api/well-known.js imports that same file and a malformed one 500s the
live endpoint. And the job polls the registry afterwards rather than
trusting the publish command's exit code - a release that reports success
without landing is the failure nobody notices.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>