Publish hygiene: files allowlist, x402 in blurb

README.md

@@ -6,7 +6,7 @@
   **[qian.ag](https://qian.ag)** · [npm](https://www.npmjs.com/package/@qianexchange/mcp) · [Docs](https://docs.qian.ag/mcp) · [License: MIT](LICENSE)
 </div>
 
-MCP server for [Qian](https://qian.ag), a multichain exchange and payments layer for every asset. Any MCP-capable agent can launch tokens, trade, and read market data on every chain Qian supports (Robinhood Chain, Base, Ethereum), plus trade tokenized stocks on Robinhood Chain.
+MCP server for [Qian](https://qian.ag), a multichain exchange and payments layer for every asset. Any MCP-capable agent can launch tokens, trade, and read market data on every chain Qian supports (Robinhood Chain, Base, Ethereum), trade tokenized stocks on Robinhood Chain, and pay x402-gated APIs in USDC.
 
 Non-custodial: the server runs on your machine and signs with your key. Qian never holds keys or funds. Every launched token's liquidity is locked forever in QianLocker.
 

package.json

@@ -1,8 +1,9 @@
 {
   "name": "@qianexchange/mcp",
   "version": "0.2.0",
-  "description": "MCP server for the Qian multichain DEX & launchpad (qian.ag) — launch and trade tokens from any MCP-capable agent",
+  "description": "MCP server for Qian (qian.ag) — trade tokens and stocks, launch tokens, and pay x402 APIs in USDC from any MCP-capable agent",
   "type": "module",
+  "files": ["server.js", "SECURITY.md"],
   "bin": { "qian-mcp": "server.js" },
   "author": "[email protected]",
   "license": "MIT",