diff --git a/.github/workflows/release-binaries.yml b/.github/workflows/release-binaries.yml
index c56a1048..08854061 100644
--- a/.github/workflows/release-binaries.yml
+++ b/.github/workflows/release-binaries.yml
@@ -11,6 +11,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   build-and-publish:
@@ -82,6 +83,4 @@ jobs:
           registry-url: "https://registry.npmjs.org"
 
       - name: Publish platform package
-        run: npm publish ./packages/${{ matrix.artifact }} --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish ./packages/${{ matrix.artifact }} --access public --provenance
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4e07f2e1..43d0bc85 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -134,7 +134,8 @@ jobs:
           workflow: release
           github-token: ${{ steps.generate_token.outputs.token }}
           branch: release
-          npm-token: ${{ secrets.NPM_TOKEN }}
+        env:
+          NPM_CONFIG_PROVENANCE: "true"
       - name: Save Bun Cache
         uses: actions/cache/save@v4
         if: steps.validate.outcome == 'success' && steps.restore-bun-cache.outputs.cache-hit != 'true'
diff --git a/.gitignore b/.gitignore
index b75e8253..07aa9d0c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,6 +20,9 @@ coverage
 # OS files
 .DS_Store
 
+# Local MCP config
+.mcp.json
+
 # Proto / Moon
 .moon/cache
 .moon/docker