NAME

cli-mcp-go-ecosystem - read-only CLI + MCP server over proxy.golang.org and vuln.go.dev

SYNOPSIS

cli-mcp-go-ecosystem

DESCRIPTION

cli-mcp-go-ecosystem is a live public demo of cli-mcp: one binary that exposes read-only Go-ecosystem data as both a CLI and an MCP server, projecting the same urfave/cli tree through both surfaces.

Data sources (both public, no auth):

- proxy.golang.org for Go module metadata (latest version,
  known versions, version info, raw go.mod text).
- vuln.go.dev for Go vulnerability advisories (lookup by
  GO-YYYY-NNNN id, lookup by module path).

How the projection works:

- Every leaf command becomes an MCP tool. The tool name is the
  underscore-joined command path, so `module latest` becomes
  the MCP tool `module_latest`, `vuln by-id` becomes `vuln_by-id`.
- Tool input schemas are derived from each leaf's flags and
  ArgsUsage. Positional arguments land in an `args` array.
- The same Action runs for CLI and MCP. WriteJSON writes the
  same shape to c.Writer either way; the MCP runtime captures
  that output as the tool result's text content.

Three usage forms, one code path:

1. Plain CLI:
   cli-mcp-go-ecosystem module latest github.com/urfave/cli/v3

2. MCP server (Streamable HTTP):
   cli-mcp-go-ecosystem mcp serve-http --addr 127.0.0.1:8080
   curl -sS -X POST http://127.0.0.1:8080/mcp ...

3. MCP client (mcporter), back to a CLI shape from the caller:
   # mcporter.json points at the live fly.io endpoint
   mcporter call go-ecosystem.module_latest \
     --args '{"args":["github.com/urfave/cli/v3"]}'

Operating model for an agent calling these tools:

- Every operation is read-only. There is no state to corrupt,
  no credentials to leak, no rate-limited write quota to burn.
  Safe to call eagerly.
- The upstreams (proxy.golang.org, vuln.go.dev) impose their
  own rate limits and may return 410 Gone for unpublished or
  retracted modules. The CLI surfaces those errors verbatim;
  do not retry tight on 4xx.
- JSON output is the contract. Stdout from a successful call
  is always valid JSON (or raw text for `module gomod`). Parse
  it, do not screen-scrape help text.
- The live endpoint at cli-mcp-go-ecosystem.fly.dev runs on
  one shared-cpu-1x machine that auto-stops when idle. First
  call after idle has cold-start latency; subsequent calls
  are cheap.

Usage:

cli-mcp-go-ecosystem [GLOBAL OPTIONS] [command [COMMAND OPTIONS]] [ARGUMENTS...]

COMMANDS

module

Go module proxy lookups (proxy.golang.org)

latest

latest version of a module

versions

all known versions of a module

info

metadata for a specific version

gomod

raw go.mod text for a specific version

vuln

Go vulnerability database lookups (vuln.go.dev)

by-id

advisory by GO-YYYY-NNNN id

by-module

every advisory affecting a module path

mcp

MCP server transports

serve

run as MCP server over stdio

serve-http

run as MCP server over Streamable HTTP

--addr="": listen address ($ADDR env overrides) (default: "127.0.0.1:8080")

--landing="": text body for GET /

--no-health: disable the /healthz endpoint

cli-mcp-go-ecosystem CLI reference