@lpm-registry/mcp-server 0.1.1 → 0.2.0

package/README.md

@@ -98,15 +98,17 @@ For local development, copy `.env.example` to `.env.local` and set your local re
 | `lpm_package_info`        | Get package metadata, install method, access model, and readme  | Optional      |
 | `lpm_api_docs`            | Get structured API docs — functions, classes, types, signatures | Optional      |
 | `lpm_llm_context`         | Get LLM-optimized usage guide — quickStart, patterns, gotchas   | Optional      |
-| `lpm_package_context`     | Get complete package context in one call — metadata, API docs, and usage guide | Optional |
-| `lpm_browse_source`       | Browse package source code — file tree and file contents        | Yes           |
+| `lpm_package_context`     | Get complete package context in one call (pre-install evaluation) | Optional    |
+| `lpm_package_skills`      | Get Agent Skills for building with an installed package         | Optional      |
+| `lpm_docs`                | Search or read LPM documentation (setup, CLI, publishing, etc.) | No           |
+| `lpm_browse_source`       | Browse package source code remotely (last resort)               | Yes           |
 | `lpm_add`                 | Add a package by extracting source files into the project       | Yes           |
-| `lpm_install`             | Install a package as a dependency to node_modules               | Yes           |
-| `lpm_get_install_command` | Get the correct CLI command (`lpm add` vs `lpm install`)        | Optional      |
+| `lpm_install`             | Install a managed dependency (JS → node_modules, Swift → Package.swift) | Yes  |
+| `lpm_audit`               | Security audit — behavioral tags, AI findings, quality scores   | Yes           |
+| `lpm_marketplace_info`    | Marketplace pricing, licensing, and seat management             | Optional      |
 | `lpm_quality_report`      | Get quality score and 28-check breakdown                        | Optional      |
 | `lpm_search_owners`       | Search for users or organizations by name                       | No            |
 | `lpm_packages_by_owner`   | List packages published by a specific user or org               | No            |
-| `lpm_package_skills`      | Fetch Agent Skills for a package                                | Optional      |
 | `lpm_pool_stats`          | Get your Pool revenue earnings for the current month            | Yes           |
 | `lpm_user_info`           | Get authenticated user info, orgs, and usage                    | Yes           |
 
@@ -115,13 +117,13 @@ For local development, copy `.env.example` to `.env.local` and set your local re
 A typical AI agent workflow for finding and adding a package:
 
 1. **Search** — `lpm_search` to find packages matching the need
-2. **Understand** — `lpm_package_context` to get everything in one call: metadata, API docs, and usage guide
-3. **Browse** — `lpm_browse_source` (tree first, then specific files) for deeper code understanding if needed
-4. **Install** — `lpm_add` for components/blocks/Swift or `lpm_install` for dependencies
+2. **Evaluate** — `lpm_package_context` to understand the package before installing (metadata, API docs, usage guide)
+3. **Install** — `lpm_install` for managed dependencies (JS + Swift) or `lpm_add` for source components
+4. **Build** — `lpm_package_skills` for usage patterns, then read local files directly
 
 The `lpm_package_context` response includes `package.installMethod.command` (`lpm add` or `lpm install`) so agents know which tool to use.
 
-> **Tip:** Use `lpm_package_context` as the default. Fall back to individual tools (`lpm_package_info`, `lpm_api_docs`, `lpm_llm_context`) only when you need the full readme or want to re-check a single aspect.
+> **Tip:** After installing, prefer reading local files over `lpm_browse_source`. Local reads are faster and don't hit the server. Use `lpm_browse_source` only when evaluating a package you can't install (e.g., checking before purchase).
 
 > **Version resolution:** Version-sensitive tools (`lpm_api_docs`, `lpm_llm_context`, `lpm_package_context`, `lpm_package_skills`, `lpm_browse_source`) resolve the version from the local project's package.json dependencies when no explicit version is specified. This ensures you get docs matching the version you actually have installed.
 
@@ -462,7 +464,7 @@ Browse source code of an LPM package you have access to. Call without `path` to
 
 ### lpm_add
 
-Add an LPM package to the project by extracting source files for customization. Use for UI components, blocks, templates, Swift packages, and MCP servers. Requires LPM CLI installed locally.
+Add an LPM package to the project by extracting source files for customization. Use for UI components, blocks, templates, and MCP servers. Requires LPM CLI installed locally.
 
 **Parameters:**
 
@@ -492,7 +494,7 @@ Add an LPM package to the project by extracting source files for customization.
 
 ### lpm_install
 
-Install an LPM package as a dependency to node_modules (like npm install). Use for JS libraries, utilities, and SDKs. Requires LPM CLI installed locally.
+Install an LPM package as a managed dependency. JS packages go to node_modules, Swift packages edit Package.swift via SE-0292. Requires LPM CLI installed locally.
 
 **Parameters:**
 
@@ -509,25 +511,70 @@ Install an LPM package as a dependency to node_modules (like npm install). Use f
 }
 ```
 
-### lpm_get_install_command
+### lpm_audit
 
-Get the correct CLI command to install an LPM package. Returns `lpm add` (source extraction) or `lpm install` (node_modules) based on the package type and ecosystem.
+Run a security audit on the project's LPM dependencies. Returns behavioral tags (eval, childProcess, shell), AI security findings, quality scores, and lifecycle scripts.
+
+**Parameters:**
+
+- `path` (string, optional) — Project directory to audit (defaults to current directory)
+
+**Example response:**
+
+```json
+{
+  "success": true,
+  "totalPackages": 3,
+  "packagesWithIssues": 1,
+  "packages": [
+    {
+      "name": "@lpm.dev/alice.ui-kit",
+      "version": "2.0.0",
+      "qualityScore": 85,
+      "issues": []
+    },
+    {
+      "name": "@lpm.dev/bob.exec-tool",
+      "version": "1.0.0",
+      "qualityScore": 45,
+      "issues": ["uses child_process", "[moderate] Executes shell commands with user input"]
+    }
+  ]
+}
+```
+
+### lpm_marketplace_info
+
+Get marketplace information for an LPM package — pricing, licensing, seat management, and purchase status.
 
 **Parameters:**
 
 - `name` (string, required) — Package name
-- `version` (string, optional) — Specific version
 
 **Example response:**
 
 ```json
 {
-  "command": "lpm add @lpm.dev/alice.ui-kit",
-  "method": "add",
-  "explanation": "Extracts source files into your project for customization."
+  "name": "@lpm.dev/acme.pro-suite",
+  "isMarketplace": true,
+  "distributionMode": "marketplace",
+  "pricing": { "monthlyPriceCents": 2900, "yearlyPriceCents": 29000 },
+  "licenseType": "per-seat",
+  "accessInfo": { "hasLicense": true, "seatsUsed": 3, "seatsTotal": 5 }
 }
 ```
 
+### lpm_docs
+
+Search or read LPM documentation. Use when the user asks how to use LPM itself.
+
+**Parameters:**
+
+- `page` (string, optional) — Doc page slug (e.g., `cli/commands`, `packages/swift-registry`)
+- `query` (string, optional) — Search query (e.g., `npmrc`, `CI deployment`)
+
+Without parameters: returns the full docs index.
+
 ### lpm_quality_report
 
 Get the quality score and detailed check breakdown for an LPM package. Covers 28 checks across documentation, code quality, testing, and maintenance health.
@@ -649,12 +696,14 @@ Responses are cached in memory to reduce API calls:
 | `lpm_package_context`     | 5 minutes |
 | `lpm_package_skills`      | 5 minutes |
 | `lpm_browse_source`       | 5 minutes |
-| `lpm_get_install_command` | 5 minutes |
+| `lpm_marketplace_info`    | 5 minutes |
+| `lpm_docs`                | 30 minutes |
 | `lpm_quality_report`      | 5 minutes |
 | `lpm_search_owners`       | 5 minutes |
 | `lpm_packages_by_owner`   | 5 minutes |
 | `lpm_pool_stats`          | 1 hour    |
 | `lpm_user_info`           | 5 minutes |
+| `lpm_audit`               | No cache  |
 | `lpm_add`                 | No cache  |
 | `lpm_install`             | No cache  |
 

package/lib/server.js

@@ -4,10 +4,12 @@ import { getBaseUrl, getToken } from "./auth.js"
 import { MemoryCache } from "./cache.js"
 import { add } from "./tools/add.js"
 import { apiDocs } from "./tools/api-docs.js"
+import { audit } from "./tools/audit.js"
 import { browseSource } from "./tools/browse-source.js"
-import { getInstallCommand } from "./tools/get-install-command.js"
+import { docs } from "./tools/docs.js"
 import { install } from "./tools/install.js"
 import { llmContext } from "./tools/llm-context.js"
+import { marketplaceInfo } from "./tools/marketplace-info.js"
 import { packageContext } from "./tools/package-context.js"
 import { packageInfo } from "./tools/package-info.js"
 import { packageSkills } from "./tools/package-skills.js"
@@ -25,7 +27,7 @@ import { userInfo } from "./tools/user-info.js"
 export function createServer() {
 	const server = new McpServer({
 		name: "lpm-registry",
-		version: "0.1.0",
+		version: "0.2.0",
 	})
 
 	const cache = new MemoryCache()
@@ -89,7 +91,7 @@ export function createServer() {
 
 	server.tool(
 		"lpm_package_context",
-		"Get complete context for an LPM package in a single call — combines condensed package metadata (name, version, description, install method, dependencies), structured API docs (functions, classes, types), and LLM usage guide (quickStart, patterns, gotchas). Use this as the primary tool when you need to understand and use a package.",
+		"Get complete context for an LPM package in a single call — combines condensed package metadata (name, version, description, install method, dependencies), structured API docs (functions, classes, types), and LLM usage guide (quickStart, patterns, gotchas). Use this BEFORE installing to evaluate and understand a package. If the package is already installed locally, prefer reading local files directly and use lpm_package_skills for usage patterns instead.",
 		{
 			name: z
 				.string()
@@ -106,7 +108,7 @@ export function createServer() {
 
 	server.tool(
 		"lpm_package_skills",
-		"Get author-written Agent Skills for an LPM package - usage patterns, anti-patterns, gotchas, and best practices. Skills are version-specific and automatically resolve from local package.json if no version is specified.",
+		"Get author-written Agent Skills for an LPM package — usage patterns, anti-patterns, gotchas, and best practices for code generation. Use this when BUILDING with an already-installed package. Skills are version-specific and automatically resolve from local package.json if no version is specified.",
 		{
 			name: z
 				.string()
@@ -170,25 +172,33 @@ export function createServer() {
 	)
 
 	server.tool(
-		"lpm_get_install_command",
-		"Get the correct CLI command to install an LPM package. Returns either `lpm add` (extracts source files for customization — components, blocks, Swift packages) or `lpm install` (installs to node_modules as a dependency — libraries, utilities).",
+		"lpm_audit",
+		"Run a security audit on the project's LPM dependencies. Returns behavioral tags (eval, childProcess, shell, dynamicRequire), AI security findings, quality scores, and lifecycle scripts. Requires LPM CLI installed and authentication.",
+		{
+			path: z
+				.string()
+				.optional()
+				.describe("Project directory to audit (defaults to current directory)"),
+		},
+		params => audit(params, context),
+	)
+
+	server.tool(
+		"lpm_marketplace_info",
+		"Get marketplace information for an LPM package — pricing, licensing model, seat management, and purchase status. Use this before recommending a paid package to check cost and access.",
 		{
 			name: z
 				.string()
 				.describe(
 					"Package name in owner.package-name or @lpm.dev/owner.package-name format",
 				),
-			version: z
-				.string()
-				.optional()
-				.describe("Specific version to install (defaults to latest)"),
 		},
-		params => getInstallCommand(params, context),
+		params => marketplaceInfo(params, context),
 	)
 
 	server.tool(
 		"lpm_add",
-		"Add an LPM package to the project by extracting source files for customization. Use for UI components, blocks, templates, Swift packages, and MCP servers. Requires LPM CLI installed.",
+		"Add an LPM package to the project by extracting source files for customization. Use for UI components, blocks, templates, and MCP servers. Requires LPM CLI installed.",
 		{
 			name: z
 				.string()
@@ -235,7 +245,7 @@ export function createServer() {
 
 	server.tool(
 		"lpm_install",
-		"Install an LPM package as a dependency to node_modules (like npm install). Use for JS libraries, utilities, and SDKs. Requires LPM CLI installed.",
+		"Install an LPM package as a managed dependency. JS packages go to node_modules (like npm install), Swift packages edit Package.swift via SE-0292. Use for libraries, utilities, and SDKs. Requires LPM CLI installed.",
 		{
 			name: z
 				.string()
@@ -252,9 +262,11 @@ export function createServer() {
 
 	server.tool(
 		"lpm_browse_source",
-		`Browse source code of an LPM package you have access to. Use without \`path\` to see the file tree first, then request specific files or directories with \`path\`. Requires authentication. Pool packages require Pool subscription, marketplace packages require a license.
+		`LAST RESORT: Browse source code of an LPM package remotely. Only use this when you cannot install the package (e.g., evaluating before purchase, checking capabilities without access). If you can install the package, prefer lpm_add or lpm_install first, then read the local files directly — it is faster.
+
+Requires authentication. Pool packages require Pool subscription, marketplace packages require a license.
 
-IMPORTANT: Prefer fetching directory paths (e.g., "src", "components") to get all files under that directory in a single request, rather than requesting individual files one by one. To get ALL source files at once, pass an empty string "" as path.`,
+If you must use this tool: fetch directory paths (e.g., "src") to get multiple files in one request rather than individual files.`,
 		{
 			name: z
 				.string()
@@ -353,5 +365,25 @@ IMPORTANT: Prefer fetching directory paths (e.g., "src", "components") to get al
 		params => search(params, context),
 	)
 
+	server.tool(
+		"lpm_docs",
+		"Search or read LPM documentation. Use this when the user asks how to use LPM itself — setup, CLI commands, publishing, CI/CD, Swift registry, organizations, billing, etc. Without parameters: returns the docs index. With `page`: returns that specific page. With `query`: searches page titles and returns matching content.",
+		{
+			page: z
+				.string()
+				.optional()
+				.describe(
+					'Documentation page slug (e.g., "cli/commands", "packages/swift-registry", "getting-started/installation")',
+				),
+			query: z
+				.string()
+				.optional()
+				.describe(
+					'Search query to find relevant docs (e.g., "npmrc", "swift", "CI deployment")',
+				),
+		},
+		params => docs(params, context),
+	)
+
 	return server
 }

package/lib/tools/audit.js

@@ -0,0 +1,50 @@
+import { runCli } from "../cli.js"
+import { errorResponse, textResponse } from "../format.js"
+
+/**
+ * Run a security audit on the project's LPM dependencies.
+ * Returns behavioral tags, AI security findings, quality scores, and lifecycle scripts.
+ *
+ * @param {{ path?: string }} params
+ * @param {{ getToken: () => Promise<string|null> }} ctx
+ */
+export async function audit({ path }, ctx) {
+	const token = await ctx.getToken()
+	if (!token) {
+		return errorResponse(
+			"Authentication required. Set LPM_TOKEN environment variable or run `lpm login`.",
+		)
+	}
+
+	const args = ["audit", "--json"]
+
+	const result = await runCli(args, {
+		timeout: 30_000,
+		...(path && { cwd: path }),
+	})
+
+	if (!result.success) {
+		return errorResponse(result.error || "Failed to run audit.")
+	}
+
+	const data = result.data
+
+	// Format for AI consumption
+	const summary = {
+		success: true,
+		totalPackages: data.totalPackages || 0,
+		packagesWithIssues: data.packagesWithIssues || 0,
+		packages: (data.packages || []).map(pkg => ({
+			name: pkg.name,
+			version: pkg.version,
+			qualityScore: pkg.qualityScore,
+			issues: pkg.issues || [],
+		})),
+	}
+
+	if (data.summary) {
+		summary.summary = data.summary
+	}
+
+	return textResponse(JSON.stringify(summary, null, 2))
+}

package/lib/tools/docs.js

@@ -0,0 +1,101 @@
+import { CACHE_TTL } from "../constants.js"
+import { errorResponse, textResponse } from "../format.js"
+
+const DOCS_BASE_URL = "https://lpm.dev/api/docs"
+
+/**
+ * Search or read LPM documentation.
+ *
+ * - Without `page`: returns the full docs index (page titles and slugs).
+ * - With `page`: returns the content of that specific documentation page.
+ * - With `query`: searches page titles for matches and returns their content.
+ *
+ * @param {{ page?: string, query?: string }} params
+ * @param {{ cache: import('../cache.js').MemoryCache }} ctx
+ */
+export async function docs({ page, query }, ctx) {
+	// Mode 1: Fetch a specific page
+	if (page) {
+		const slug = page.replace(/^\//, "").replace(/\/$/, "")
+		const cacheKey = `docs:page:${slug}`
+
+		const cached = ctx.cache.get(cacheKey)
+		if (cached) return cached
+
+		const response = await fetchText(`${DOCS_BASE_URL}/${slug}`)
+		if (!response.ok) {
+			if (response.status === 404) {
+				return errorResponse(
+					`Documentation page "${slug}" not found. Use this tool without a page parameter to see all available pages.`,
+				)
+			}
+			return errorResponse(`Failed to fetch docs (${response.status})`)
+		}
+
+		const content = await response.text()
+		const result = textResponse(content)
+		ctx.cache.set(cacheKey, result, CACHE_TTL.LONG)
+		return result
+	}
+
+	// Mode 2: Search or list index
+	const cacheKey = "docs:index"
+	let indexText = ctx.cache.get(cacheKey)
+
+	if (!indexText) {
+		const response = await fetchText(DOCS_BASE_URL)
+		if (!response.ok) {
+			return errorResponse(`Failed to fetch docs index (${response.status})`)
+		}
+		indexText = await response.text()
+		ctx.cache.set(cacheKey, indexText, CACHE_TTL.LONG)
+	} else {
+		// Cache stores the textResponse wrapper, extract the text
+		indexText =
+			typeof indexText === "string"
+				? indexText
+				: indexText?.content?.[0]?.text || indexText
+	}
+
+	// If query is provided, filter the index and fetch matching pages
+	if (query) {
+		const queryLower = query.toLowerCase()
+		const lines =
+			typeof indexText === "string"
+				? indexText.split("\n")
+				: String(indexText).split("\n")
+		const matches = lines.filter(
+			line => line.includes(" — ") && line.toLowerCase().includes(queryLower),
+		)
+
+		if (matches.length === 0) {
+			return textResponse(
+				`No documentation pages found matching "${query}".\n\nAvailable pages:\n${indexText}`,
+			)
+		}
+
+		// Fetch content of matching pages (up to 3)
+		const results = []
+		for (const match of matches.slice(0, 3)) {
+			const slug = match.split(" — ")[0].trim()
+			const response = await fetchText(`${DOCS_BASE_URL}/${slug}`)
+			if (response.ok) {
+				const content = await response.text()
+				results.push(`--- ${slug} ---\n${content}`)
+			}
+		}
+
+		return textResponse(results.join("\n\n"))
+	}
+
+	// No query, no page — return the full index
+	return textResponse(
+		typeof indexText === "string" ? indexText : String(indexText),
+	)
+}
+
+async function fetchText(url) {
+	return fetch(url, {
+		headers: { Accept: "text/plain" },
+	})
+}

package/lib/tools/get-install-command.js

@@ -4,8 +4,8 @@ import { errorResponse, parseName, textResponse } from "../format.js"
 
 /**
  * Get the correct CLI install command for an LPM package.
- * Returns `lpm add` for source packages (components, blocks, MCP servers, Swift)
- * or `lpm install` for dependency packages (installed to node_modules).
+ * Returns `lpm add` for source packages (components, blocks, MCP servers)
+ * or `lpm install` for managed dependencies (JS to node_modules, Swift to Package.swift).
  *
  * @param {{ name: string, version?: string }} params
  * @param {{ cache: import('../cache.js').MemoryCache, getToken: () => Promise<string|null>, getBaseUrl: () => string }} ctx
@@ -33,11 +33,11 @@ export async function getInstallCommand({ name, version }, ctx) {
 	const result = await registryGet(`/${fullName}`, token, baseUrl)
 
 	if (!result.ok) {
-		// Fallback: return `lpm add` as the default command when metadata is unavailable
+		// Fallback: return `lpm install` as the default command when metadata is unavailable
 		if (result.status === 404) {
 			return errorResponse(`Package ${fullName} not found.`)
 		}
-		const response = textResponse(`lpm add ${fullName}${versionSuffix}`)
+		const response = textResponse(`lpm install ${fullName}${versionSuffix}`)
 		return response
 	}
 
@@ -45,13 +45,11 @@ export async function getInstallCommand({ name, version }, ctx) {
 	const ecosystem = data.ecosystem || "js"
 	const packageType = data.packageType || "package"
 
-	// Source-based packages use `lpm add` (extracts files into the project)
-	// Only plain JS packages without a special type use `lpm install` (node_modules)
+	// Source packages (components, blocks, templates) use `lpm add`
+	// Everything else uses `lpm install` (JS → node_modules, Swift → Package.swift)
+	const sourceTypes = new Set(["component", "block", "template", "mcp-server"])
 	const useAdd =
-		ecosystem !== "js" ||
-		packageType !== "package" ||
-		data.lpmSource ||
-		data.hasLpmConfig
+		sourceTypes.has(packageType) || data.lpmSource || data.hasLpmConfig
 
 	const command = useAdd
 		? `lpm add ${fullName}${versionSuffix}`
@@ -59,7 +57,9 @@ export async function getInstallCommand({ name, version }, ctx) {
 
 	const explanation = useAdd
 		? "Extracts source files into your project for customization."
-		: "Installs as a dependency in node_modules (like npm install)."
+		: ecosystem === "swift"
+			? "Installs as a managed dependency via SE-0292 (edits Package.swift)."
+			: "Installs as a dependency in node_modules (like npm install)."
 
 	const response = textResponse(
 		JSON.stringify(

package/lib/tools/marketplace-info.js

@@ -0,0 +1,80 @@
+import { registryGet } from "../api.js"
+import { CACHE_TTL } from "../constants.js"
+import { errorResponse, parseName, textResponse } from "../format.js"
+
+/**
+ * Get marketplace information for an LPM package.
+ * Returns pricing, licensing model, seat management details, and purchase status.
+ *
+ * @param {{ name: string }} params
+ * @param {{ cache: import('../cache.js').MemoryCache, getToken: () => Promise<string|null>, getBaseUrl: () => string }} ctx
+ */
+export async function marketplaceInfo({ name }, ctx) {
+	let owner, pkgName
+	try {
+		const parsed = parseName(name)
+		owner = parsed.owner
+		pkgName = parsed.name
+	} catch (err) {
+		return errorResponse(err.message)
+	}
+
+	const fullName = `@lpm.dev/${owner}.${pkgName}`
+	const token = await ctx.getToken()
+	const cacheKey = `marketplace-info:${owner}.${pkgName}:auth=${!!token}`
+
+	const cached = ctx.cache.get(cacheKey)
+	if (cached) return cached
+
+	const baseUrl = ctx.getBaseUrl()
+	const result = await registryGet(`/${fullName}`, token, baseUrl)
+
+	if (!result.ok) {
+		if (result.status === 404) {
+			return errorResponse(`Package ${fullName} not found.`)
+		}
+		return errorResponse(
+			result.data?.error || `Request failed (${result.status})`,
+		)
+	}
+
+	const data = result.data
+	const distributionMode = data.distributionMode || "private"
+
+	if (distributionMode !== "marketplace") {
+		const response = textResponse(
+			JSON.stringify(
+				{
+					name: fullName,
+					distributionMode,
+					isMarketplace: false,
+					message: `This package uses ${distributionMode} distribution, not marketplace.`,
+				},
+				null,
+				2,
+			),
+		)
+		ctx.cache.set(cacheKey, response, CACHE_TTL.SHORT)
+		return response
+	}
+
+	const summary = {
+		name: fullName,
+		isMarketplace: true,
+		distributionMode: "marketplace",
+		description: data.description || "",
+		// Pricing
+		pricing: data.marketplace?.pricing || null,
+		licenseType: data.marketplace?.licenseType || null,
+		// Seat management
+		seats: data.marketplace?.seats || null,
+		// Access info for the current user
+		accessInfo: data.accessInfo || null,
+		// Latest version
+		latestVersion: data["dist-tags"]?.latest || null,
+	}
+
+	const response = textResponse(JSON.stringify(summary, null, 2))
+	ctx.cache.set(cacheKey, response, CACHE_TTL.SHORT)
+	return response
+}

package/lib/tools/package-info.js

@@ -12,20 +12,24 @@ const ADD_TYPES = new Set(["component", "block", "template", "mcp-server"])
  * @returns {{ command: string, description: string }}
  */
 export function getInstallMethod(packageType, ecosystem) {
-	if (ecosystem === "swift" || ecosystem === "xcframework") {
+	// Source-extract types always use `lpm add`
+	if (ADD_TYPES.has(packageType)) {
 		return {
 			command: "lpm add",
-			description: "Extracts Swift source files into your project",
+			description: "Extracts source files into your project for customization",
 		}
 	}
 
-	if (ADD_TYPES.has(packageType)) {
+	// Swift/XCFramework use `lpm install` (SE-0292 registry mode)
+	if (ecosystem === "swift" || ecosystem === "xcframework") {
 		return {
-			command: "lpm add",
-			description: "Extracts source files into your project for customization",
+			command: "lpm install",
+			description:
+				"Installs as a managed dependency via SE-0292 (edits Package.swift)",
 		}
 	}
 
+	// JS dependencies/libraries use `lpm install`
 	if (packageType === "dependency" || packageType === "library") {
 		return {
 			command: "lpm install",
@@ -34,10 +38,10 @@ export function getInstallMethod(packageType, ecosystem) {
 		}
 	}
 
-	// Default: lpm add for source packages, lpm install for generic packages
+	// Default: lpm install for managed dependencies
 	return {
-		command: "lpm add",
-		description: "Extracts source files into your project for customization",
+		command: "lpm install",
+		description: "Installs as a managed dependency",
 	}
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@lpm-registry/mcp-server",
-	"version": "0.1.1",
+	"version": "0.2.0",
 	"description": "MCP server for the LPM package registry — exposes package info, quality reports, name checks, pool stats, and marketplace search as AI tools",
 	"author": "LPM <hello@lpm.dev> (https://lpm.dev)",
 	"repository": {