diff --git a/.cursor-plugin/plugin.json b/.cursor-plugin/plugin.json
index 20875e3..00b3f0b 100644
--- a/.cursor-plugin/plugin.json
+++ b/.cursor-plugin/plugin.json
@@ -14,5 +14,5 @@
     "mcp"
   ],
   "skills": "./skills/",
-  "mcpServers": "./mcp.json"
+  "mcpServers": "./.mcp.json"
 }
diff --git a/mcp.json b/mcp.json
index fd6585f..ff87f2a 100644
--- a/mcp.json
+++ b/mcp.json
@@ -2,7 +2,8 @@
   "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
   "mcpServers": {
     "polymorfa-docs": {
-      "url": "https://docs.polymorfa.com/mcp"
+      "url": "https://docs.polymorfa.com/mcp",
+      "type": "streamable-http"
     }
   }
 }
diff --git a/scripts/validate.py b/scripts/validate.py
index b93573a..15bff4e 100644
--- a/scripts/validate.py
+++ b/scripts/validate.py
@@ -8,3 +8,14 @@
 for filename in ("plugin.json", ".claude-plugin/plugin.json", ".cursor-plugin/plugin.json", "gemini-extension.json"):
     assert json.loads((root / filename).read_text())["version"] == "0.1.0", filename
 print("Manifests and skills validated")
+for filename, transport in [("mcp.json", "streamable-http"), (".mcp.json", "http")]:
+    servers = json.loads((root / filename).read_text())["mcpServers"]
+    assert servers == {"polymorfa-docs": {"type": transport, "url": "https://docs.polymorfa.com/mcp"}}, filename
+for filename in (".claude-plugin/plugin.json", ".cursor-plugin/plugin.json"):
+    manifest = json.loads((root / filename).read_text())
+    for field, kind in (("mcpServers", "file"), ("skills", "directory")):
+        relative = Path(manifest[field])
+        assert not relative.is_absolute() and ".." not in relative.parts, (filename, field)
+        target = (root / relative).resolve()
+        assert target.is_relative_to(root), (filename, field)
+        assert target.is_file() if kind == "file" else target.is_dir(), (filename, field)