diff --git a/README.md b/README.md
index 567c56a..9bc6131 100644
--- a/README.md
+++ b/README.md
@@ -32,9 +32,7 @@ These examples show declaration and adapter boundaries, not a full hosted applic
 
 ## Dependency-security boundary
 
-The published `@theorvane/type-mcp` package currently exact-pins an MCP SDK release whose transitive `@hono/node-server` graph is affected by [GHSA-frvp-7c67-39w9](https://github.com/advisories/GHSA-frvp-7c67-39w9). This **examples application** uses an npm `overrides` entry to resolve its lockfile to `@modelcontextprotocol/sdk@1.30.0` and `@hono/node-server@2.0.12`; `npm run audit:prod` verifies the resulting production graph.
-
-This override is intentionally scoped to this repository and is **not a remediation for downstream TypeMCP consumers**. The package-level remediation remains tracked in [Theorvane/type-mcp#93](https://github.com/Theorvane/type-mcp/issues/93).
+These examples use the published `@theorvane/type-mcp@^0.2.2` remediation. Its consumer-enforceable dependency contract resolves `@modelcontextprotocol/sdk@1.30.0` and `@hono/node-server@2.0.12`; `npm run audit:prod` verifies the installed production graph with no local npm override.
 
 ## Development
 
@@ -49,7 +47,7 @@ npm run check
 ## Packages
 
 - [`@theorvane/type-chain`](https://www.npmjs.com/package/@theorvane/type-chain) `0.1.1`
-- [`@theorvane/type-mcp`](https://www.npmjs.com/package/@theorvane/type-mcp) `0.2.0`
+- [`@theorvane/type-mcp`](https://www.npmjs.com/package/@theorvane/type-mcp) `0.2.2` or later within the `0.2.x` range
 
 ## License
 
diff --git a/package-lock.json b/package-lock.json
index 3525ab6..fe0b1eb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,7 +10,7 @@
 			"dependencies": {
 				"@langchain/core": "^1.2.3",
 				"@theorvane/type-chain": "^0.1.1",
-				"@theorvane/type-mcp": "^0.2.0",
+				"@theorvane/type-mcp": "^0.2.2",
 				"langchain": "^1.5.4",
 				"zod": "^4.4.3"
 			},
@@ -1216,12 +1216,13 @@
 			}
 		},
 		"node_modules/@theorvane/type-mcp": {
-			"version": "0.2.1",
-			"resolved": "https://registry.npmjs.org/@theorvane/type-mcp/-/type-mcp-0.2.1.tgz",
-			"integrity": "sha512-PafubwBhNu9b4nhsT0YX4gZRyiRQtqYmm2hKBPmd9xXG7NX87lOiAEXnkwfWsUwjf0bS88kHdNt3NRhY+/kPvw==",
+			"version": "0.2.2",
+			"resolved": "https://registry.npmjs.org/@theorvane/type-mcp/-/type-mcp-0.2.2.tgz",
+			"integrity": "sha512-Oj7ZNnJsC0SWdXrCiUNMfd3HYLtBkm7rNyL5xSsvVkUvowoTT+f+5ojl6Lq0DMLeKuMMRwFIMimwdzT35MWI2w==",
 			"license": "MIT",
 			"dependencies": {
-				"@modelcontextprotocol/sdk": "1.26.0",
+				"@hono/node-server": "2.0.12",
+				"@modelcontextprotocol/sdk": "1.30.0",
 				"zod": "^4.4.3"
 			},
 			"engines": {
diff --git a/package.json b/package.json
index 3241cc3..afe6f62 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
 	"dependencies": {
 		"@langchain/core": "^1.2.3",
 		"@theorvane/type-chain": "^0.1.1",
-		"@theorvane/type-mcp": "^0.2.0",
+		"@theorvane/type-mcp": "^0.2.2",
 		"langchain": "^1.5.4",
 		"zod": "^4.4.3"
 	},
@@ -33,10 +33,5 @@
 		"tsx": "^4.21.0",
 		"typescript": "^5.9.3",
 		"vitest": "^4.1.0"
-	},
-	"overrides": {
-		"@theorvane/type-mcp": {
-			"@modelcontextprotocol/sdk": "1.30.0"
-		}
 	}
 }
diff --git a/test/dependency-security.test.ts b/test/dependency-security.test.ts
index 076de06..c557313 100644
--- a/test/dependency-security.test.ts
+++ b/test/dependency-security.test.ts
@@ -10,25 +10,19 @@ type Lockfile = {
 };
 
 describe("production dependency security", () => {
-	it("pins the examples application to the audited MCP SDK graph", () => {
+	it("uses the published TypeMCP remediation without a local override", () => {
 		const packageJson = JSON.parse(
 			readFileSync(resolve(repositoryRoot, "package.json"), "utf8"),
 		) as {
-			readonly overrides?: {
-				readonly "@theorvane/type-mcp"?: {
-					readonly "@modelcontextprotocol/sdk"?: string;
-				};
+			readonly dependencies?: {
+				readonly "@theorvane/type-mcp"?: string;
 			};
 		};
 		const lockfile = JSON.parse(
 			readFileSync(resolve(repositoryRoot, "package-lock.json"), "utf8"),
 		) as Lockfile;
 
-		expect(
-			packageJson.overrides?.["@theorvane/type-mcp"]?.[
-				"@modelcontextprotocol/sdk"
-			],
-		).toBe("1.30.0");
+		expect(packageJson.dependencies?.["@theorvane/type-mcp"]).toBe("^0.2.2");
 		expect(
 			lockfile.packages["node_modules/@modelcontextprotocol/sdk"]?.version,
 		).toBe("1.30.0");