golang-pkg-go-dev — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited golang-pkg-go-dev (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Dependencies: godig — go install github.com/samber/godig/cmd/godig@latest (or use a registered godig MCP server / the hosted instance instead).
godig queries the pkg.go.dev API. Use it to answer questions about Go packages and modules: docs, symbols, versions, importers and vulnerabilities. It works as a CLI and as an MCP server. All operations are read-only and need no authentication.
Trigger on questions like:
go install github.com/samber/godig/cmd/godig@latestgodig mcp runs over stdio by default, or streamable HTTP with --transport http.
stdio (the client launches godig on demand):
claude mcp add pkg-go-dev -- godig mcpstreamable HTTP (shared server at /mcp, default :8080):
godig mcp --transport http --addr :8080
claude mcp add --transport http pkg-go-dev http://localhost:8080/mcpHosted instance (no install needed) — a public server runs at https://godig.samber.dev/mcp:
claude mcp add --transport http pkg-go-dev https://godig.samber.dev/mcpThe CLI and the MCP server expose the same operations under matching names. Prefer the CLI when godig is installed; the hosted instance is a fallback when it is not.
Global flags (all commands): -o/--output table|json|raw|md (default table — pass -o md for chat), --base-url, --timeout, --log-level debug|info|warn|error|off. All are also settable via GODIG_* env vars.
| Command | Args | Specific flags | Purpose | |||
|---|---|---|---|---|---|---|
overview | <path> | --version | Compact summary (metadata, versions, licenses, vulns) — start here | |||
search | <query> | --symbol --limit --filter | Find packages (optionally exporting a symbol) | |||
package info | <path> | --module --version | Package metadata | |||
package imports | <path> | --module --version | Packages this package imports (plain list) | |||
package doc | <path> | `--module --version --goos --goarch --format md\ | text\ | html\ | markdown` | Full package doc (LARGE) |
package examples | <path> | --module --version --goos --goarch --symbol | Runnable examples (LARGE; scope with --symbol) | |||
package licenses | <path> | --module --version | License files, full text (LARGE) | |||
symbol doc | <path> <symbol> | --module --version --goos --goarch | One symbol's signature + doc (token-efficient) | |||
symbol examples | <path> <symbol> | --module --version --goos --goarch | One symbol's runnable examples | |||
symbols | <path> | --module --version --goos --goarch --limit --filter | List exported symbols | |||
module info | <path> | --version | Module metadata | |||
module licenses | <path> | --version | Module license files (LARGE) | |||
module readme | <path> | --version | Module README, full Markdown (LARGE) | |||
dependencies | <path> | --version | go.mod deps: requires / replaces / excludes / go directive | |||
packages | <path> | --version --limit --filter | Packages contained in a module | |||
versions | <path> | --limit --filter | All versions, newest first | |||
major-versions | <path> | --limit --filter --exclude-pseudo | Major versions (v1, v2 …) living as separate modules | |||
imported-by | <path> | --module --version --limit --filter | Packages that import this one | |||
vulns | <path> | --module --version --limit --filter | Known vulnerabilities | |||
mcp | — | `--transport stdio\ | http --addr --cache-ttl --cache-size` | Run as an MCP server | ||
version | — | — | Print godig version / commit / build date |
When godig runs as an MCP server, each data command above is exposed as an operation of the same name.
Exit codes: 0 success, 1 runtime error (network, package not found), 2 usage error — a missing/invalid argument or flag (e.g. a non-positive --limit), or a command group invoked with no subcommand (godig package). Check for 2 to tell a malformed call apart from a failed lookup.
Full -o md output for every command: sample-output.md.
doc/examples/module readme/licenses (LARGE) only when the full text is needed.table default, json, raw) but prefer md here.<path> is a full import path, e.g. github.com/samber/lo — pass it as the positional argument.--version pins a specific module version (v1.5.0, latest, master, main); --module disambiguates which module a package belongs to.--filter narrows list results server-side with a Go boolean expression — see Filter syntax.--goos/--goarch set the documentation/symbols build context (e.g. linux/amd64).symbol doc/symbol examples over the package-wide package doc/package examples when you only need one symbol — far fewer tokens.godig invocations in a single turn) rather than one after another — wall-clock drops from sum-of-latencies to slowest-single-call. For a large fan-out (documenting many symbols, comparing many candidate libraries, auditing CVEs across a dependency set), dispatch parallel sub-agents (up to 5) via the Agent tool, each running its own godig calls and returning a compact summary, so the raw LARGE output never lands in the main context.--limit to cap.--filter (on search, versions, major-versions, packages, imported-by, symbols, vulns) takes a Go boolean expression evaluated server-side, once per result item. It is not a regex — wrap the whole expression in single quotes for the shell.
search exposes packagePath, not path). An unknown field fails with undefined identifier: <name> (HTTP 400), which names the offending field. Casing is not uniform: most fields use the lowercase JSON key, but vulns uses Go-style names (ID, not id), and kind values are capitalized (Function, not func).== != < <= > >=, boolean && || !, parentheses for grouping.contains(s, sub), hasPrefix(s, pre), hasSuffix(s, suf)."Function"), true/false, numbers.Filterable fields per command (string unless noted):
| Command | Fields |
|---|---|
search | modulePath, packagePath, synopsis, version |
versions | version, modulePath, deprecated (bool), retracted (bool), hasGoMod (bool), commitTime |
packages | path, name, synopsis, isRedistributable (bool) |
imported-by | path (the importing package path) |
symbols | name, kind (Function/Method/Type/Variable/Constant), synopsis, parent |
vulns | ID, package, Details |
major-versions | modulePath, major, version, isLatest (bool) |
godig symbols github.com/samber/lo --filter 'kind=="Function"' -o md
godig symbols github.com/samber/lo --filter 'kind=="Function" && hasPrefix(name,"Map")' -o md
godig versions github.com/samber/lo --filter 'hasPrefix(version,"v1.5")' -o md
godig versions github.com/samber/lo --filter 'deprecated==false && retracted==false' -o md
godig search "result option" --filter 'hasPrefix(packagePath,"github.com/samber/")' -o mdAlways request Markdown output (-o md):
# Overview — start here (compact, one call)
godig overview github.com/samber/ro -o md
# Search
godig search "result option monad" --limit 5 -o md
# Package facets
godig package info github.com/samber/ro -o md
godig package imports github.com/samber/ro -o md
godig package doc github.com/samber/ro --format md -o md
godig package examples github.com/samber/ro --symbol Map -o md
godig package licenses github.com/samber/ro -o md
# Single symbol (token-efficient vs package-wide doc/examples)
godig symbol doc github.com/samber/lo Map -o md
godig symbol examples github.com/samber/oops OopsError.Error -o md
# Module facets
godig module info github.com/samber/ro -o md
godig module readme github.com/samber/ro -o raw
godig dependencies github.com/samber/ro -o md
# Lists (auto-paginated; --limit to cap)
godig versions github.com/samber/ro -o md
godig major-versions github.com/samber/lo -o md
godig packages github.com/samber/ro -o md
godig imported-by github.com/samber/ro --limit 20 -o md
godig symbols github.com/samber/ro --filter 'kind=="Function"' -o md
# Pin a version / set the build context
godig versions github.com/samber/ro --filter 'hasPrefix(version,"v0.3")' -o md
godig package doc github.com/samber/lo --version v1.50.0 -o md
godig symbols github.com/samber/ro --goos linux --goarch amd64 -o md
# Vulnerabilities
godig vulns github.com/samber/ro -o mdThis skill is not exhaustive. godig --help and each sub-command's --help list current flags and output formats; the data mirrors what pkg.go.dev exposes.
If you encounter a bug or unexpected behavior in godig, open an issue at <https://github.com/samber/godig/issues>.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.