diff --git a/.devin-plugin/plugin.json b/.devin-plugin/plugin.json
index 7135b00..85632ba 100644
--- a/.devin-plugin/plugin.json
+++ b/.devin-plugin/plugin.json
@@ -24,5 +24,5 @@
     "ai-catalog",
     "mcp"
   ],
-  "mcpServers": "mcp_config.json"
+  "mcpServers": "mcp.json"
 }
diff --git a/README.md b/README.md
index 38f3cc1..a63bba3 100644
--- a/README.md
+++ b/README.md
@@ -22,7 +22,7 @@ Skill content is vendored under `skills/` — see [VENDOR.md](VENDOR.md).
 
 ## JFrog MCP
 
-The plugin registers this MCP server (declared in `mcp_config.json` and referenced from `.devin-plugin/plugin.json`):
+The plugin registers this MCP server (declared in `mcp.json` and referenced from `.devin-plugin/plugin.json`):
 
 ```json
 {
@@ -74,7 +74,7 @@ Confirm `jfrog` is listed (and Connected after OAuth). Ask the agent to list too
 ```
 devin-plugin/
 ├── .devin-plugin/plugin.json
-├── mcp_config.json           # JFrog Platform MCP (remote HTTP + OAuth)
+├── mcp.json                  # JFrog Platform MCP (remote HTTP + OAuth)
 ├── skills/
 │   ├── jfrog/
 │   ├── jfrog-init/
diff --git a/SECURITY.md b/SECURITY.md
index 4ae29da..2a0a23c 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -10,6 +10,6 @@ Include steps to reproduce, affected versions or commits, and impact if known.
 
 ## Scope
 
-This repository ships a **Devin CLI plugin** (vendored skills plus a bundled JFrog Platform MCP entry). Do not put OAuth client secrets or access tokens in `mcp_config.json`.
+This repository ships a **Devin CLI plugin** (vendored skills plus a bundled JFrog Platform MCP entry). Do not put OAuth client secrets or access tokens in `mcp.json`.
 
 Do not commit secrets, API keys, or credentials. Skill runtime data under `**/local-cache/` must not be checked into git.
diff --git a/mcp_config.json b/mcp.json
similarity index 100%
rename from mcp_config.json
rename to mcp.json