diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3cc78d1..e47260c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,18 +10,27 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
+    env:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 20
           cache: npm
+          registry-url: https://registry.npmjs.org
       - run: npm ci
       - run: npm run check
       - run: npm run build
       - run: npm test
       - run: npm run smoke
       - run: npm pack
+      - name: Publish to npm
+        if: env.NPM_TOKEN != ''
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
diff --git a/README.md b/README.md
index 64a0ad1..609df9e 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@
 
 Turn an OpenAPI 3.x spec into an MCP server. Each operation becomes an MCP tool; tool calls are validated, proxied to the upstream REST API, and the response is validated against the spec's response schemas.
 
-> **Install from GitHub.** The `mcp-openapi` package on the npm registry is an unrelated third-party project. This project is installed as `github:evalops/mcp-openapi`.
+> **Package name: `@evalops/mcp-openapi`.** The unscoped `mcp-openapi` package on the npm registry is an unrelated third-party project. Install this project from GitHub (`npm install github:evalops/mcp-openapi`) or from npm under the scoped name once a tagged release has been published.
 
 ## Quickstart
 
@@ -151,7 +151,7 @@ export default function transform({ operation, response }) {
 ## Library usage
 
 ```ts
-import { parseSpec, generateToolsWithTags } from "mcp-openapi";
+import { parseSpec, generateToolsWithTags } from "@evalops/mcp-openapi";
 
 const spec = await parseSpec("./openapi.yaml");
 const { tools } = generateToolsWithTags(spec, { prefix: "github" });
diff --git a/package-lock.json b/package-lock.json
index d9b933d..ee5f8dc 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,13 @@
 {
-  "name": "mcp-openapi",
-  "version": "0.4.0",
+  "name": "@evalops/mcp-openapi",
+  "version": "0.5.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "mcp-openapi",
-      "version": "0.4.0",
+      "name": "@evalops/mcp-openapi",
+      "version": "0.5.0",
+      "license": "MIT",
       "dependencies": {
         "@apidevtools/json-schema-ref-parser": "^12.0.1",
         "@hono/node-server": "^2.0.11",
diff --git a/package.json b/package.json
index b9cfd65..c4cabd0 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,28 @@
 {
-  "name": "mcp-openapi",
-  "version": "0.4.0",
+  "name": "@evalops/mcp-openapi",
+  "version": "0.5.0",
   "type": "module",
-  "description": "OpenAPI to MCP server bridge",
+  "description": "OpenAPI 3.x to MCP server bridge with stdio, StreamableHTTP, and SSE transports",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/evalops/mcp-openapi.git"
+  },
+  "homepage": "https://github.com/evalops/mcp-openapi#readme",
+  "bugs": {
+    "url": "https://github.com/evalops/mcp-openapi/issues"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "openapi",
+    "swagger",
+    "llm",
+    "tools"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
diff --git a/src/server.ts b/src/server.ts
index a5b3b75..8962ef1 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -638,8 +638,8 @@ async function scaffoldProject(targetDir: string): Promise<void> {
       check: "tsc -p tsconfig.json --noEmit"
     },
     dependencies: {
-      // The npm package named "mcp-openapi" is an unrelated third-party project; install from GitHub.
-      "mcp-openapi": "github:evalops/mcp-openapi"
+      // The npm package named "mcp-openapi" is an unrelated third-party project; this package is @evalops/mcp-openapi.
+      "@evalops/mcp-openapi": "github:evalops/mcp-openapi"
     },
     devDependencies: {
       "@types/node": "^22.13.4",
@@ -805,7 +805,7 @@ async function generateProjectFromSpec(targetDir: string, specPath: string, oper
           build: "tsc -p tsconfig.json",
           start: "node dist/server.js"
         },
-        dependencies: { "mcp-openapi": "github:evalops/mcp-openapi" },
+        dependencies: { "@evalops/mcp-openapi": "github:evalops/mcp-openapi" },
         devDependencies: { typescript: "^5.7.3", tsx: "^4.20.3", "@types/node": "^22.13.4" }
       },
       null,
diff --git a/test/cli.test.ts b/test/cli.test.ts
index f1b556d..d75b659 100644
--- a/test/cli.test.ts
+++ b/test/cli.test.ts
@@ -97,5 +97,5 @@ test("scaffolds depend on the GitHub source, not the unrelated npm package", asy
   const packageJson = JSON.parse(await readFile(resolve(outDir, "package.json"), "utf8")) as {
     dependencies: Record<string, string>;
   };
-  assert.equal(packageJson.dependencies["mcp-openapi"], "github:evalops/mcp-openapi");
+  assert.equal(packageJson.dependencies["@evalops/mcp-openapi"], "github:evalops/mcp-openapi");
 });