[mohsen1]

Release the initial working MCP package as 0.1.1 after npm bootstrap registration. Staging 0.1.0 reserves that version, so the OIDC workflow cannot publish over it. Rejecting the sole stage removed npm's placeholder package and its trust relationship; retain the bootstrap stage until the first operational version is published.

Only the package version changes. Runtime code and the packed-package test contract are unchanged from #1. CI and the release workflow recheck the versioned artifact before publication. Self-review confirms there is no runtime change.

[mohsen1]

Published @proofline/mcp@0.1.1 from tag v0.1.1 and commit 33ebd871f73d07d61a841f7fcd2db66d007de5a7 through the protected npm environment and GitHub OIDC publisher.

Release: https://github.com/prooflinedev/mcp/actions/runs/40295640439
Package: https://www.npmjs.com/package/@proofline/mcp
Repository and agent configuration: https://github.com/prooflinedev/mcp

Post-publication checks on GCP passed: public registry tarball SHA-512 equals the qualified workflow artifact; npm provenance is present; all nine protocol tests pass against a fresh registry installation. Both pinned and latest npm exec return version 0.1.1. No npm publishing token was stored in GitHub.

The unpublished 0.1.0 bootstrap stage remains reserved; it is not the latest release. Its earlier publish attempt failed because npm reserves staged versions. Version 0.1.1 completed through trusted publishing. The isolated temporary npm login is being revoked after bootstrap.