Extension candidate: git-pkgs-mcp. A Model Context Protocol server that exposes git-pkgs commands as tools for AI coding agents.

git-pkgs already aggregates dependency data across multiple sources and commands -- list, vulns, outdated, licenses, stale, blame, history, diff. An MCP server would let agents call these directly with structured input and output instead of reimplementing the data gathering.

Auto-discovery via git pkgs help --format json

Rather than hard-coding tool definitions, the MCP server can discover commands automatically. Adding --format json to the existing help command would dump the full command tree as structured JSON -- command names, descriptions, flags with types and defaults, subcommands, aliases.

Cobra supports replacing the help command via SetHelpCommand(). A custom help command checks the format flag: text delegates to Cobra's default, json walks the command tree using cmd.Commands() and cmd.LocalFlags().VisitAll() to serialize metadata.

On startup, the MCP server calls git pkgs help --format json and generates tool definitions from the result. Plugin commands (git-pkgs-foo) appear in the command tree automatically since they're registered before help runs. Installing git-pkgs-scorecard means the next MCP server restart picks it up as a new tool with no configuration.

For plugins that want richer metadata than the basic name and short description Cobra knows about, they can optionally support git-pkgs-foo --describe to export detailed tool definitions (argument schemas, output format descriptions, examples). The MCP server checks for this and enriches the auto-discovered definition.

git pkgs help --format json is useful beyond MCP -- the LSP server (#115), documentation generation, and shell completion could all consume it. Worth implementing as a prerequisite.

Tools

Tools to expose would map roughly to existing commands:

• list -- current dependencies with versions, ecosystems, scopes
• vulns -- known vulnerabilities with severity and fix versions
• outdated -- packages with newer versions available
• licenses -- license info with compliance checking
• history -- when dependencies were added/updated/removed
• blame -- who added each dependency
• diff -- dependency changes between commits or branches
• stale -- untouched dependencies
• why -- explain why a dependency exists
• maintainers -- maintainer count and identity (once Maintainer data #111 lands)
• scorecard -- OpenSSF scores (once Scorecard command #113 exists as an extension)

Each tool returns JSON. The server shells out to git pkgs commands with --format json, so it stays thin and picks up new features as they're added to the core CLI. Would benefit from #116 (read-only database package) for performance on rapid-fire queries.

Can be installed via the extension mechanism so git pkgs mcp starts the server.