diff --git a/.changeset/bundle-only-deps.md b/.changeset/bundle-only-deps.md
new file mode 100644
index 0000000..654a395
--- /dev/null
+++ b/.changeset/bundle-only-deps.md
@@ -0,0 +1,5 @@
+---
+"@taskade/mcp-server": patch
+---
+
+Install no runtime dependencies. `bin/cli.mjs` already bundles the MCP SDK, `node-fetch` and `zod`, so these packages and `mcp-proxy` move to `devDependencies`. `npx @taskade/mcp-server` now installs 1 package instead of 120. The README no longer documents a `--http` mode, because the package runs over stdio only.
diff --git a/.github/workflows/force-release.yml b/.github/workflows/force-release.yml
index 4308f4d..281a98d 100644
--- a/.github/workflows/force-release.yml
+++ b/.github/workflows/force-release.yml
@@ -22,8 +22,9 @@ jobs:
           registry-url: "https://registry.npmjs.org"
 
       # npm OIDC trusted publishing requires npm >= 11.5.1; Node 22 bundles npm 10.x.
+      # Do not use npm 12. See release.yml.
       - name: Upgrade npm for trusted publishing
-        run: npm install -g npm@latest && npm --version
+        run: npm install -g npm@^11.5.1 && npm --version
 
       - name: Use OIDC instead of a classic npm token
         run: |
diff --git a/.github/workflows/publish-mcp-registry.yml b/.github/workflows/publish-mcp-registry.yml
index 2f8bf2f..dd8c8b8 100644
--- a/.github/workflows/publish-mcp-registry.yml
+++ b/.github/workflows/publish-mcp-registry.yml
@@ -4,9 +4,11 @@ name: Publish to MCP Registry
 # (https://registry.modelcontextprotocol.io) using GitHub OIDC — no secrets.
 #
 # Trigger:
-#   - automatically when a release tags the server package (changesets pushes a
-#     `@taskade/mcp-server@<version>` tag right after the npm publish succeeds), so
-#     the npm version always exists before we register it.
+#   - automatically when a `@taskade/mcp-server@<version>` tag is pushed. The
+#     "Push release tags" step in release.yml pushes it after the npm publish, so
+#     the npm version always exists before we register it. That step runs only
+#     with the release App token, because a tag pushed with GITHUB_TOKEN does not
+#     start this workflow.
 #   - manually via "Run workflow" to (re)publish the current npm version.
 #
 # Note: the server.json version is auto-synced from packages/server/package.json
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c9bb687..2efdd27 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,10 +15,27 @@ jobs:
       contents: write
       pull-requests: write
     steps:
+      # Optional release GitHub App. When the repository has the variable
+      # RELEASE_APP_ID, the App token opens the version PR and pushes the
+      # release tags. Events from an App token start other workflows (CI on the
+      # version PR, the MCP Registry publish on the tag). Events from GITHUB_TOKEN
+      # do not. Without the variable, this step does not run and the job uses GITHUB_TOKEN.
+      - name: Create release App token
+        id: app-token
+        if: vars.RELEASE_APP_ID != ''
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          # git push uses this token. github.token is the checkout default.
+          token: ${{ steps.app-token.outputs.token || github.token }}
 
       - name: Install Node.js
         uses: actions/setup-node@v4
@@ -27,8 +44,10 @@ jobs:
           registry-url: "https://registry.npmjs.org"
 
       # npm OIDC trusted publishing requires npm >= 11.5.1; Node 22 bundles npm 10.x.
+      # Do not use npm 12. npm 12 returns `npm info --json` as an array. `changeset publish`
+      # then finds no published versions and tries to publish the current version again.
       - name: Upgrade npm for trusted publishing
-        run: npm install -g npm@latest && npm --version
+        run: npm install -g npm@^11.5.1 && npm --version
 
       # setup-node's registry-url writes `_authToken=${NODE_AUTH_TOKEN}`. An empty
       # token makes npm skip OIDC and fail E404. Strip it so publish uses GitHub OIDC.
@@ -50,7 +69,7 @@ jobs:
           title: 'chore: release'
           commit: 'chore: release'
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
 
       - name: Publish
         if: steps.changesets.outputs.hasChangesets == 'false'
@@ -58,3 +77,10 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
+
+      # `changeset publish` creates a tag for each new version but does not push it.
+      # The tag push starts publish-mcp-registry.yml. A tag push with GITHUB_TOKEN
+      # does not start it, so this step runs only with the App token.
+      - name: Push release tags
+        if: steps.changesets.outputs.hasChangesets == 'false' && steps.app-token.outputs.token != ''
+        run: git push origin --tags
diff --git a/README.md b/README.md
index d1e68ff..8718e33 100644
--- a/README.md
+++ b/README.md
@@ -288,13 +288,9 @@ Add a `.vscode/mcp.json` to your workspace (VS Code uses the `servers` key; `${i
 }
 ```
 
-### 7. HTTP / SSE Mode (remote & custom clients)
+### 7. Remote and HTTP clients
 
-```bash
-TASKADE_API_KEY=your-api-key npx @taskade/mcp-server --http
-```
-
-The server starts at `http://localhost:3000` (configure with `PORT` env var). Connect via SSE at `http://localhost:3000/sse?access_token=your-api-key`.
+The local package runs over stdio only. It has no HTTP or SSE mode. For a client that connects over HTTP, use the hosted server at `https://www.taskade.com/mcp` (see [Quick Start: hosted server](#quick-start-hosted-server)).
 
 ---
 
diff --git a/packages/server/README.md b/packages/server/README.md
index 1c67207..276039f 100644
--- a/packages/server/README.md
+++ b/packages/server/README.md
@@ -16,4 +16,6 @@ npx -y @taskade/mcp-server
 
 You'll need a Taskade personal access token — generate one at [https://www.taskade.com/settings/api](https://www.taskade.com/settings/api).
 
-See the [root README](https://github.com/taskade/mcp#readme) for client configuration (Claude Desktop, Cursor, Claude Code), HTTP/SSE mode, and the complete tool list.
+See the [root README](https://github.com/taskade/mcp#readme) for client configuration (Claude Desktop, Cursor, Claude Code) and the complete tool list.
+
+This package runs over stdio only. For a client that connects over HTTP, use the hosted server at `https://www.taskade.com/mcp`.
diff --git a/packages/server/package.json b/packages/server/package.json
index e52a897..9300b6d 100644
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -26,10 +26,8 @@
     "start:server": "tsx src/http.ts --watch"
   },
   "devDependencies": {
-    "@taskade/mcp-openapi-codegen": "*"
-  },
-  "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.0",
+    "@taskade/mcp-openapi-codegen": "*",
     "mcp-proxy": "^3.2.0",
     "node-fetch": "^3.3.2",
     "zod": "^3.25.28"