diff --git a/README.md b/README.md
index dcf95e6..33597c3 100644
--- a/README.md
+++ b/README.md
@@ -6,6 +6,7 @@
   <a href="https://github.com/BlockSiFr/ttp-protocol/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/BlockSiFr/ttp-protocol/actions/workflows/ci.yml/badge.svg"></a>
   <img alt="tests" src="https://img.shields.io/badge/tests-123%20passing-00E676?style=flat-square&labelColor=0A0A0F">
   <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-Apache--2.0-0066CC?style=flat-square&labelColor=0A0A0F"></a>
+  <a href="https://www.npmjs.com/package/@blocksifr/pctr"><img alt="npm" src="https://img.shields.io/npm/v/@blocksifr/pctr?style=flat-square&labelColor=0A0A0F&color=00D4FF"></a>
   <img alt="dependencies" src="https://img.shields.io/badge/dependencies-none-00B8A9?style=flat-square&labelColor=0A0A0F">
 </p>
 
@@ -41,9 +42,8 @@ Objective  ->  Trust Route  ->  Consequence Preview  ->  Execution Authority  ->
 | **3. Authority** | Is this exact execution allowed right now? | `pctr protect <action>` |
 
 ```bash
-npm link ./packages/pctr   # not on npm yet; link it from a clone
-pctr init                  # discover agents and tools, write pctr.json
-pctr scan                  # what consequences can they reach?
+npx @blocksifr/pctr init   # discover agents and tools, write pctr.json
+npx @blocksifr/pctr scan   # what consequences can they reach?
 ```
 
 <p align="center">
diff --git a/assets/pctr-scan.svg b/assets/pctr-scan.svg
index e828d70..c8515e2 100644
--- a/assets/pctr-scan.svg
+++ b/assets/pctr-scan.svg
@@ -3,7 +3,7 @@
   <rect width="760" height="36" rx="10" fill="#12121A"/>
   <rect y="26" width="760" height="10" fill="#12121A"/>
   <circle cx="24" cy="18" r="5" fill="#FF5F57"/><circle cx="43" cy="18" r="5" fill="#FEBC2E"/><circle cx="62" cy="18" r="5" fill="#28C840"/>
-  <text x="84" y="22" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" font-size="12" fill="#6E7681">pctr scan</text>
+  <text x="84" y="22" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" font-size="12" fill="#6E7681">npx @blocksifr/pctr scan</text>
   <g font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" font-size="13.5" fill="#C9D1D9">
     <text x="22" y="68"><tspan fill="#00D4FF" font-weight="700" xml:space="preserve">PCTR</tspan></text>
     <text x="22" y="89"><tspan fill="#C9D1D9" xml:space="preserve"></tspan></text>
diff --git a/packages/pctr/README.md b/packages/pctr/README.md
index ab9671c..f774f4f 100644
--- a/packages/pctr/README.md
+++ b/packages/pctr/README.md
@@ -12,14 +12,13 @@ Objective  ->  Trust Route  ->  Consequence Preview  ->  Execution Authority  ->
 
 <img src="../../assets/pctr-scan.svg" alt="pctr scan finds five agents, three tools and four potential actions, and reports one critical protected consequence: customers.delete can be reached through support-agent and admin-agent without independent execution authority" width="100%">
 
-Not on npm yet — from a clone of this repo:
-
 ```bash
-npm link ./packages/pctr    # then the bare `pctr` command works anywhere
-pctr init                   # discover agents and tools, write pctr.json
-pctr scan                   # what consequences can they reach?
+npx @blocksifr/pctr init    # discover agents and tools, write pctr.json
+npx @blocksifr/pctr scan    # what consequences can they reach?
 ```
 
+Or install it: `npm i -g @blocksifr/pctr`, then just `pctr init` and `pctr scan`.
+
 No account. No network. Everything stays in `./pctr.json` and `./.pctr`.
 
 ## Share what you find
diff --git a/packages/pctr/action.yml b/packages/pctr/action.yml
index dcffc03..e4f50c2 100644
--- a/packages/pctr/action.yml
+++ b/packages/pctr/action.yml
@@ -21,7 +21,7 @@ inputs:
   version:
     description: 'Version of @blocksifr/pctr to run.'
     required: false
-    default: 'latest'
+    default: 'latest'   # published on npm: https://www.npmjs.com/package/@blocksifr/pctr
 
 outputs:
   critical:
diff --git a/packages/pctr/scripts/render-terminal-svg.mjs b/packages/pctr/scripts/render-terminal-svg.mjs
index 596b434..8abe9cd 100644
--- a/packages/pctr/scripts/render-terminal-svg.mjs
+++ b/packages/pctr/scripts/render-terminal-svg.mjs
@@ -97,7 +97,7 @@ const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="${width}" height="${
   <rect width="${width}" height="${TOP - 10}" rx="10" fill="${THEME.chrome}"/>
   <rect y="${TOP - 20}" width="${width}" height="10" fill="${THEME.chrome}"/>
   <circle cx="24" cy="18" r="5" fill="#FF5F57"/><circle cx="43" cy="18" r="5" fill="#FEBC2E"/><circle cx="62" cy="18" r="5" fill="#28C840"/>
-  <text x="84" y="22" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" font-size="12" fill="${THEME.dim}">pctr scan</text>
+  <text x="84" y="22" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" font-size="12" fill="${THEME.dim}">npx @blocksifr/pctr scan</text>
   <g font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" font-size="13.5" fill="${THEME.text}">
 ${body}
   </g>
diff --git a/packages/pctr/src/report.mjs b/packages/pctr/src/report.mjs
index 3cbe35e..404e588 100644
--- a/packages/pctr/src/report.mjs
+++ b/packages/pctr/src/report.mjs
@@ -85,4 +85,4 @@ export function renderReport(graph, { title = 'PCTR consequence scan', includeBa
 }
 
 const footer = () =>
-  `---\n<sub>Scanned with [PCTR](${HOMEPAGE}) — \`pctr scan\`. Nothing left this machine.</sub>\n`;
+  `---\n<sub>Scanned with [PCTR](${HOMEPAGE}) — \`npx @blocksifr/pctr scan\`. Nothing left this machine.</sub>\n`;