feat: rename @agentkey/mcp → @agentkey/cli in install scripts and docs (#47)

## Summary

Companion change to
[chainbase-labs/AgentKey-Server#32](https://github.com/chainbase-labs/AgentKey-Server/pull/32).
The npm package has been renamed; this PR updates everything users
actually see.

**User-facing**
- \`scripts/install.{sh,ps1}\`: \`MCP_PACKAGE\` / \`$McpPackage\` →
\`CLI_PACKAGE\` / \`$CliPackage\`
- \`scripts/uninstall.{sh,ps1}\`: sweep BOTH \`@agentkey/cli\` and
\`@agentkey/mcp\` so users upgrading from v0.x get a clean uninstall
- \`skills/agentkey/SKILL.md\`: setup command + manual-config JSON
example
- \`README.md\` + \`docs/README_zh.md\`: every \`npx @agentkey/mcp\`
command + the manual-config JSON examples (switched from stale stdio
shape to the remote-HTTP shape that \`--auth-login\` actually writes in
v1.0)

**Internal / protocol docs**
- \`SECURITY.md\`: file/network audit tables
- \`protocol/skill-meta-v1.md\`, \`docs/SERVER-IMPLEMENTATION.md\`:
clarify the protocol partner is AgentKey-Server's hosted \`/v1/mcp\`
endpoint, not a standalone npm package — these references were already
misleading before the rename
- \`.claude/CLAUDE.md\`: keep Claude-session guidance in sync

\`CHANGELOG.md\` left untouched (release-please manages history).

## Sequencing

Merge this PR **after** \`@agentkey/cli\` is published to npm —
otherwise the install scripts here will reference a package that doesn't
exist yet. Recommended order:

1. Merge
[AgentKey-Server#32](https://github.com/chainbase-labs/AgentKey-Server/pull/32)
2. \`cd cli && npm publish\` (first \`@agentkey/cli\` release at
\`1.0.0\`)
3. Merge this PR

## Test plan

- [ ] Verify \`npx -y @agentkey/cli --auth-login\` works end-to-end
after npm publish
- [ ] Verify \`scripts/uninstall.sh\` on a machine with
\`@agentkey/mcp\` globally installed cleans it up
- [ ] Spot-check the rendered README on GitHub for any missed references

scripts/install.ps1

@@ -11,7 +11,7 @@
 
     Behavior mirrors install.sh: checks Node >= 18 (installs via winget/scoop/choco),
     auto-detects which AI agents are installed and runs `npx skills add` for them,
-    then `npx @agentkey/mcp --auth-login` for device auth. The auth step opens a
+    then `npx @agentkey/cli --auth-login` for device auth. The auth step opens a
     local browser by default; under SSH / Docker / OpenClaw it switches to a
     QR + URL flow that the user scans on a phone (`--no-browser` server-side flag).
     MCP config is written automatically for Claude Code / Claude Desktop / Cursor.
@@ -35,7 +35,7 @@ param(
 
 $ErrorActionPreference = 'Stop'
 $SkillRepo   = 'chainbase-labs/agentkey'
-$McpPackage  = '@agentkey/mcp'
+$CliPackage  = '@agentkey/cli'
 $NodeMinMajor = 18
 
 # ── Agent markers (mirror of install.sh) ──────────────────────────────────
@@ -378,7 +378,7 @@ if ($SkipMcp) {
     # Telemetry context for install_completed. Opt-out is honored at the
     # SOURCE: when AGENTKEY_TELEMETRY=0, no other context env vars are
     # exported — hostname-derived fingerprint, agent lists, and installer
-    # flags are never computed nor passed to the child `npx @agentkey/mcp`
+    # flags are never computed nor passed to the child `npx @agentkey/cli`
     # process. The server treats AGENTKEY_TELEMETRY=0 as a hard skip.
     if ($NoTelemetry -or (Test-Path -LiteralPath $TelemetryOptOutFile)) {
         $env:AGENTKEY_TELEMETRY = '0'
@@ -403,10 +403,10 @@ if ($SkipMcp) {
         $env:AGENTKEY_DEVICE_FINGERPRINT = $DeviceFingerprint
     }
 
-    & npx -y $McpPackage @authArgs
+    & npx -y $CliPackage @authArgs
     if ($LASTEXITCODE -ne 0) {
         Write-Err 'MCP auth failed.'
-        Write-Muted "Retry manually:  npx -y $McpPackage $($authArgs -join ' ')"
+        Write-Muted "Retry manually:  npx -y $CliPackage $($authArgs -join ' ')"
         exit 1
     }
     Write-Ok 'MCP server registered'

scripts/install.sh

@@ -18,7 +18,7 @@ set -euo pipefail
 
 # ── Constants ─────────────────────────────────────────────────────────────
 SKILL_REPO="chainbase-labs/agentkey"
-MCP_PACKAGE="@agentkey/mcp"
+CLI_PACKAGE="@agentkey/cli"
 NODE_MIN_MAJOR=18
 
 # ── Agent markers ─────────────────────────────────────────────────────────
@@ -517,7 +517,7 @@ main() {
         # the SOURCE: when AGENTKEY_TELEMETRY=0, no other context env vars
         # are exported — hostname-derived fingerprint, agent lists, and
         # installer flags are never computed nor passed to the child
-        # `npx @agentkey/mcp` process. The server treats AGENTKEY_TELEMETRY=0
+        # `npx @agentkey/cli` process. The server treats AGENTKEY_TELEMETRY=0
         # as a hard skip.
         if $NO_TELEMETRY || [ -f "$TELEMETRY_OPT_OUT_FILE" ]; then
             export AGENTKEY_TELEMETRY=0
@@ -534,9 +534,9 @@ main() {
             export AGENTKEY_DEVICE_FINGERPRINT="$(compute_device_fingerprint "$PLATFORM")"
         fi
 
-        if ! npx -y "$MCP_PACKAGE" "${AUTH_ARGS[@]}"; then
+        if ! npx -y "$CLI_PACKAGE" "${AUTH_ARGS[@]}"; then
             ui_error "MCP auth failed."
-            ui_muted "Retry manually:  npx -y $MCP_PACKAGE ${AUTH_ARGS[*]}"
+            ui_muted "Retry manually:  npx -y $CLI_PACKAGE ${AUTH_ARGS[*]}"
             exit 1
         fi
         ui_ok "MCP server registered"

scripts/uninstall.ps1

@@ -260,13 +260,20 @@ Write-Step '6. npm / npx caches'
 
 if (Get-Command npm -ErrorAction SilentlyContinue) {
     $globalList = & npm list -g --depth=0 2>$null
-    if ($globalList -and ($globalList -match '@agentkey/mcp')) {
-        Write-Info 'Uninstalling global @agentkey/mcp ...'
-        & npm uninstall -g '@agentkey/mcp' 2>$null | Out-Null
-        if ($LASTEXITCODE -eq 0) { Write-Ok 'Removed @agentkey/mcp' }
-        else { Write-Warn2 'Could not remove @agentkey/mcp' }
-    } else {
-        Write-Skip 'Global @agentkey/mcp not installed'
+    $removedAny = $false
+    # Sweep both the current package name and the legacy v0.x name so users
+    # who installed before the @agentkey/mcp → @agentkey/cli rename get a
+    # clean uninstall.
+    foreach ($pkg in @('@agentkey/cli', '@agentkey/mcp')) {
+        if ($globalList -and ($globalList -match [regex]::Escape($pkg))) {
+            Write-Info "Uninstalling global $pkg ..."
+            & npm uninstall -g $pkg 2>$null | Out-Null
+            if ($LASTEXITCODE -eq 0) { Write-Ok "Removed $pkg"; $removedAny = $true }
+            else { Write-Warn2 "Could not remove $pkg" }
+        }
+    }
+    if (-not $removedAny) {
+        Write-Skip 'No global @agentkey/cli or @agentkey/mcp installed'
     }
 } else {
     Write-Skip 'npm not on PATH'

scripts/uninstall.sh

@@ -293,15 +293,24 @@ $md_changed || skipped "No removable AgentKey section in CLAUDE.md"
 step "7. npm / npx caches"
 
 if command -v npm >/dev/null 2>&1; then
-    if npm list -g --depth=0 2>/dev/null | grep -q "@agentkey/mcp"; then
-        info "Uninstalling global @agentkey/mcp ..."
-        if npm uninstall -g @agentkey/mcp >/dev/null 2>&1; then
-            ok "Removed @agentkey/mcp"
-        else
-            warn "Could not remove @agentkey/mcp — try: npm uninstall -g @agentkey/mcp"
+    _global_list="$(npm list -g --depth=0 2>/dev/null || true)"
+    _removed_any=false
+    # Sweep both the current package name and the legacy v0.x name so
+    # users who installed before the @agentkey/mcp → @agentkey/cli rename
+    # get a clean uninstall.
+    for _pkg in "@agentkey/cli" "@agentkey/mcp"; do
+        if echo "$_global_list" | grep -q "$_pkg"; then
+            info "Uninstalling global $_pkg ..."
+            if npm uninstall -g "$_pkg" >/dev/null 2>&1; then
+                ok "Removed $_pkg"
+                _removed_any=true
+            else
+                warn "Could not remove $_pkg — try: npm uninstall -g $_pkg"
+            fi
         fi
-    else
-        skipped "Global @agentkey/mcp not installed"
+    done
+    if ! $_removed_any; then
+        skipped "No global @agentkey/cli or @agentkey/mcp installed"
     fi
 else
     skipped "npm not on PATH"