diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 5461a336b..6eb3a7284 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -23,12 +23,17 @@ jobs:
       - uses: actions/checkout@v4
 
       # The unified `hanzo` front door (hanzo-js/hanzo) ships beside @hanzo/cli:
-      # it depends on it, so the two go out together. A plain `git clone` on the
-      # runner prompts for credentials even for a public repo; checkout does not.
-      - uses: actions/checkout@v4
-        with:
-          repository: hanzo-js/hanzo
-          path: .hanzo-pkg
+      # it depends on it, so the two go out together. Fetched as a public
+      # tarball: this run's token is scoped to hanzoai/cli and answers 404 for
+      # another org's repo (checkout), and a bare `git clone` on the runner
+      # prompts for credentials. codeload needs neither.
+      - name: The hanzo package source
+        run: |
+          set -euo pipefail
+          mkdir -p .hanzo-pkg
+          curl -fsSL https://codeload.github.com/hanzo-js/hanzo/tar.gz/refs/heads/main \
+            | tar -xz -C .hanzo-pkg --strip-components=1
+          node -p 'const p=require("./.hanzo-pkg/package.json"); p.name+"@"+p.version'
 
       - uses: actions/setup-node@v4
         with:
diff --git a/npm/bin/hanzo.js b/npm/bin/hanzo.js
index 8a2b7828f..d188fef52 100755
--- a/npm/bin/hanzo.js
+++ b/npm/bin/hanzo.js
@@ -112,6 +112,10 @@ if (rawName === "hanzo-dev" || rawName === "dev") {
 
 // The binary this launcher execs must be HERE (it is run by absolute path);
 // companions only need to be findable on PATH, which starts here.
+// `@hanzo/mcp` taught `… mcp serve`; the native server serves stdio bare, so a
+// leading `serve` is the same request and must not die as an unknown command.
+if (targetTool === "mcp" && argv[0] === "serve") argv = argv.slice(1);
+
 const missing = required.filter((t) => (t === targetTool ? !hasLocal(t) : !hasTool(t)));
 if (missing.length > 0 && existsSync(installScript) && env.HANZO_NO_LAZY_INSTALL !== "1") {
   spawnSync(process.execPath, [installScript, ...missing], {
diff --git a/npm/package.json b/npm/package.json
index d607aa906..0caf3d3b4 100644
--- a/npm/package.json
+++ b/npm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/cli",
-  "version": "8.5.909",
+  "version": "8.5.910",
   "description": "Hanzo CLI — unified CLI, coding agent (dev), MCP server, local inference engine, and node",
   "license": "MIT",
   "repository": {