@byh3071/vhk 0.5.2 → 0.6.0

package/README.md

@@ -1,12 +1,14 @@
 ---
 id: vhk-readme
-date: 2026-05-23
-tags: [vhk, cli, readme, v0.5.2]
+date: 2026-05-24
+tags: [vhk, cli, readme, v0.6.0]
 ---
 
 # 🔧 VHK — Vibe Harness Kit
 
-> AI 코딩 에이전트를 부리는 사람을 위한 **한국어 풀사이클 CLI** (v0.5.2)
+> AI 코딩 에이전트를 부리는 사람을 위한 **한국어 풀사이클 CLI** (v0.6.0)
+>
+> 🍽️ **VHK는 VHK로 부트스트랩됨** — 이 레포의 `docs/`, `CLAUDE.md`, `.cursorrules`도 `vhk init`이 만들었습니다.
 
 명령어를 외우지 않아도 됩니다. `vhk`만 치면 메뉴가 나오고, 한국어로 말해도 알아듣습니다.
 
@@ -87,6 +89,8 @@ vhk 기획 끝났고 바로 시작
 | `vhk undo` | `되돌리기`, `취소` | 최근 커밋 soft reset (변경은 staged 유지) |
 | `vhk diff` | `변경`, `차이` | staged / unstaged / 새 파일 요약 (줄 수 합계는 tracked·HEAD 기준) |
 | `vhk status` | `상태`, `현황` | 브랜치·변경·커밋·원격·버전 대시보드 |
+| `vhk mcp` | — | MCP 서버 시작 (Cursor 등 MCP 클라이언트용, stdio) |
+| `vhk mcp-init` | `mcp설정` | Cursor `.cursor/mcp.json` 자동 생성 |
 
 ### init 옵션
 
@@ -103,6 +107,42 @@ vhk 기획 끝났고 바로 시작
 |------|------|
 | `--since YYYY-MM-DD` | 분석 시작일 (기본: 오늘) |
 
+## Cursor와 MCP로 연동하기
+
+`v0.6.0`부터 vhk는 [Model Context Protocol](https://modelcontextprotocol.io) 서버를 내장합니다. Cursor 채팅에서 자연어로 vhk 도구를 호출할 수 있습니다.
+
+```powershell
+vhk mcp-init           # .cursor/mcp.json 자동 생성
+# → Cursor 재시작 후 채팅에서 자연어로 vhk 도구 호출 가능
+# 예: "상태 알려줘" → Cursor가 vhk status 도구 호출
+```
+
+노출되는 MCP 도구 8개: `save`, `undo`, `status`, `diff`, `ship`, `doctor`, `check`, `recap`.
+
+MCP 서버를 수동으로 띄우려면:
+
+```powershell
+vhk mcp                # stdio 서버 시작 (Cursor가 자동으로 호출)
+```
+
+## v0.6.0 하이라이트
+
+| 기능 | 설명 |
+|------|------|
+| **MCP 서버** | `vhk mcp` — 8개 도구(save/undo/status/diff/ship/doctor/check/recap)를 stdio로 노출. Cursor 등 MCP 클라이언트에서 자연어로 호출 |
+| **mcp-init** | `vhk mcp-init` — Cursor `.cursor/mcp.json` 자동 생성. 재시작 한 번으로 연동 완료 |
+| **자연어 라우팅 확장** | `vhk mcp설정` → `vhk mcp-init` 별칭 |
+| **보안** | MCP save 도구의 shell injection 차단 — 모든 git 호출에 `execFileSync` 사용 |
+
+## v0.5.3 하이라이트
+
+| 기능 | 설명 |
+|------|------|
+| **셀프호스팅** | `vhk init`이 vhk-cli 레포 자체를 부트스트랩 — 자기 도구로 자기 레포 만들기 |
+| **CHANGELOG.md** | 변경 이력 표준 파일 신설. `vhk ship`이 `[Unreleased]` → `[버전]` 자동 이동 |
+| **doctor 업데이트 알림** | `vhk doctor`가 npm 최신 버전 비교 후 `🆕 v0.X.X 사용 가능` 한 줄 표시 |
+| **init 안전성** | 옵션값 포함 명령 라우팅 버그 픽스, 사용자 정의 `package.json` scripts 보존 |
+
 ## v0.5.0 하이라이트
 
 | 기능 | 설명 |

package/dist/chunk-IU37BEQA.js

@@ -0,0 +1,298 @@
+#!/usr/bin/env node
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/mcp/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { execFileSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
+var SERVER_VERSION = "0.6.0";
+var SHIM_BINARIES = /* @__PURE__ */ new Set(["pnpm", "npm", "npx", "yarn"]);
+function platformCmd(cmd) {
+  if (process.platform === "win32" && SHIM_BINARIES.has(cmd)) {
+    return `${cmd}.cmd`;
+  }
+  return cmd;
+}
+function safeExecFile(cmd, args) {
+  try {
+    const out = execFileSync(platformCmd(cmd), args, {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).toString();
+    return { ok: true, out: out.trim() };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { ok: false, err: msg };
+  }
+}
+function isGitRepo() {
+  return safeExecFile("git", ["rev-parse", "--is-inside-work-tree"]).ok;
+}
+function createVhkMcpServer() {
+  const server = new McpServer({
+    name: "vhk",
+    version: SERVER_VERSION
+  });
+  server.registerTool(
+    "save",
+    {
+      description: "\uBCC0\uACBD\uC0AC\uD56D \uC800\uC7A5 (git add \u2192 commit \u2192 push)",
+      inputSchema: {
+        message: z.string().optional().describe("\uCEE4\uBC0B \uBA54\uC2DC\uC9C0 (\uBE44\uC6B0\uBA74 \uC790\uB3D9 \uC0DD\uC131)")
+      }
+    },
+    async ({ message }) => {
+      if (!isGitRepo()) {
+        return { content: [{ type: "text", text: "\u274C git \uC800\uC7A5\uC18C\uAC00 \uC544\uB2D9\uB2C8\uB2E4." }] };
+      }
+      const status = safeExecFile("git", ["status", "--porcelain"]);
+      if (!status.ok) {
+        return { content: [{ type: "text", text: `\u274C git status \uC2E4\uD328: ${status.err}` }] };
+      }
+      if (!status.out) {
+        return { content: [{ type: "text", text: "\u{1F4ED} \uC800\uC7A5\uD560 \uBCC0\uACBD\uC0AC\uD56D\uC774 \uC5C6\uC2B5\uB2C8\uB2E4." }] };
+      }
+      const files = status.out.split("\n");
+      const now = /* @__PURE__ */ new Date();
+      const ts = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-${String(now.getDate()).padStart(2, "0")} ${String(now.getHours()).padStart(2, "0")}:${String(now.getMinutes()).padStart(2, "0")}`;
+      const commitMsg = message?.trim() || `\u2728 vhk save: ${ts}`;
+      const add = safeExecFile("git", ["add", "."]);
+      if (!add.ok) {
+        return { content: [{ type: "text", text: `\u274C git add \uC2E4\uD328: ${add.err}` }] };
+      }
+      const commit = safeExecFile("git", ["commit", "-m", commitMsg]);
+      if (!commit.ok) {
+        return { content: [{ type: "text", text: `\u274C commit \uC2E4\uD328: ${commit.err}` }] };
+      }
+      const push = safeExecFile("git", ["push"]);
+      const pushResult = push.ok ? "+ \uC6D0\uACA9 \uC5C5\uB85C\uB4DC \uC644\uB8CC" : "(\uC6D0\uACA9 \uC800\uC7A5\uC18C \uC5C6\uAC70\uB098 push \uC2E4\uD328 \u2192 \uC2A4\uD0B5)";
+      return {
+        content: [
+          {
+            type: "text",
+            text: `\u2705 ${files.length}\uAC1C \uD30C\uC77C \uC800\uC7A5 \uC644\uB8CC! ${pushResult}
+\uCEE4\uBC0B: ${commitMsg}`
+          }
+        ]
+      };
+    }
+  );
+  server.registerTool("undo", { description: "\uCD5C\uADFC \uCEE4\uBC0B \uB418\uB3CC\uB9AC\uAE30 (soft reset, \uBCC0\uACBD\uC0AC\uD56D\uC740 \uC720\uC9C0)" }, async () => {
+    if (!isGitRepo()) {
+      return { content: [{ type: "text", text: "\u274C git \uC800\uC7A5\uC18C\uAC00 \uC544\uB2D9\uB2C8\uB2E4." }] };
+    }
+    const last = safeExecFile("git", ["log", "--oneline", "-1"]);
+    if (!last.ok || !last.out) {
+      return { content: [{ type: "text", text: "\u{1F4ED} \uB418\uB3CC\uB9B4 \uCEE4\uBC0B\uC774 \uC5C6\uC2B5\uB2C8\uB2E4." }] };
+    }
+    const reset = safeExecFile("git", ["reset", "--soft", "HEAD~1"]);
+    if (!reset.ok) {
+      return { content: [{ type: "text", text: `\u274C reset \uC2E4\uD328: ${reset.err}` }] };
+    }
+    return {
+      content: [
+        {
+          type: "text",
+          text: `\u2705 \uB418\uB3CC\uB9AC\uAE30 \uC644\uB8CC!
+\uCDE8\uC18C\uB41C \uCEE4\uBC0B: ${last.out}
+\u{1F4A1} \uBCC0\uACBD\uC0AC\uD56D\uC740 \uC2A4\uD14C\uC774\uC9D5 \uC601\uC5ED\uC5D0 \uB0A8\uC544\uC788\uC2B5\uB2C8\uB2E4.`
+        }
+      ]
+    };
+  });
+  server.registerTool("status", { description: "\uD504\uB85C\uC81D\uD2B8 \uC0C1\uD0DC \uB300\uC2DC\uBCF4\uB4DC (\uBE0C\uB79C\uCE58/\uBCC0\uACBD\uC0AC\uD56D/\uCD5C\uADFC \uCEE4\uBC0B)" }, async () => {
+    const lines = [];
+    if (existsSync("package.json")) {
+      try {
+        const pkg = JSON.parse(readFileSync("package.json", "utf-8"));
+        lines.push(`\u{1F4E6} \uD504\uB85C\uC81D\uD2B8: ${pkg.name ?? "(\uC774\uB984 \uC5C6\uC74C)"} v${pkg.version ?? "?"}`);
+      } catch {
+      }
+    }
+    if (!isGitRepo()) {
+      lines.push("\u26A0\uFE0F  git \uC800\uC7A5\uC18C\uAC00 \uC544\uB2D9\uB2C8\uB2E4");
+      return { content: [{ type: "text", text: lines.join("\n") }] };
+    }
+    const branch = safeExecFile("git", ["branch", "--show-current"]);
+    if (branch.ok) lines.push(`\u{1F33F} \uBE0C\uB79C\uCE58: ${branch.out || "(detached)"}`);
+    const status = safeExecFile("git", ["status", "--porcelain"]);
+    if (status.ok) {
+      if (!status.out) {
+        lines.push("\u{1F4DD} \uBCC0\uACBD\uC0AC\uD56D: \u2705 \uAE68\uB057\uD568");
+      } else {
+        const fileLines = status.out.split("\n");
+        const staged = fileLines.filter((l) => l[0] !== " " && l[0] !== "?").length;
+        const unstaged = fileLines.filter((l) => l[1] === "M" || l[1] === "D").length;
+        const untracked = fileLines.filter((l) => l.startsWith("??")).length;
+        const parts = [];
+        if (staged) parts.push(`\uC2A4\uD14C\uC774\uC9D5 ${staged}\uAC1C`);
+        if (unstaged) parts.push(`\uC218\uC815 ${unstaged}\uAC1C`);
+        if (untracked) parts.push(`\uC0C8\uD30C\uC77C ${untracked}\uAC1C`);
+        lines.push(`\u{1F4DD} \uBCC0\uACBD\uC0AC\uD56D: ${parts.join(", ")}`);
+      }
+    }
+    const log = safeExecFile("git", ["log", "--oneline", "-3"]);
+    if (log.ok && log.out) {
+      lines.push("\u{1F4DC} \uCD5C\uADFC \uCEE4\uBC0B:");
+      log.out.split("\n").forEach((l) => lines.push(`   ${l}`));
+    }
+    return { content: [{ type: "text", text: lines.join("\n") }] };
+  });
+  server.registerTool("diff", { description: "\uBCC0\uACBD\uC0AC\uD56D \uD655\uC778 (staged/unstaged/\uC0C8\uD30C\uC77C + \uCD1D \uBCC0\uACBD \uC694\uC57D)" }, async () => {
+    if (!isGitRepo()) {
+      return { content: [{ type: "text", text: "\u274C git \uC800\uC7A5\uC18C\uAC00 \uC544\uB2D9\uB2C8\uB2E4." }] };
+    }
+    const unstaged = safeExecFile("git", ["diff", "--stat"]);
+    const staged = safeExecFile("git", ["diff", "--cached", "--stat"]);
+    const untracked = safeExecFile("git", ["ls-files", "--others", "--exclude-standard"]);
+    const unstagedOut = unstaged.ok ? unstaged.out : "";
+    const stagedOut = staged.ok ? staged.out : "";
+    const untrackedOut = untracked.ok ? untracked.out : "";
+    if (!unstagedOut && !stagedOut && !untrackedOut) {
+      return { content: [{ type: "text", text: "\u2705 \uBCC0\uACBD\uC0AC\uD56D \uC5C6\uC74C! \uAE68\uB057\uD569\uB2C8\uB2E4." }] };
+    }
+    const lines = [];
+    if (stagedOut) {
+      lines.push("\u{1F4E6} \uCEE4\uBC0B \uB300\uAE30 (staged):");
+      lines.push(stagedOut);
+    }
+    if (unstagedOut) {
+      lines.push("\u270F\uFE0F \uC218\uC815\uB428 (unstaged):");
+      lines.push(unstagedOut);
+    }
+    if (untrackedOut) {
+      const files = untrackedOut.split("\n");
+      lines.push(`\u2795 \uC0C8 \uD30C\uC77C (${files.length}\uAC1C):`);
+      files.forEach((f) => lines.push(`   + ${f}`));
+    }
+    const numstat = safeExecFile("git", ["diff", "--numstat", "HEAD"]);
+    if (numstat.ok && numstat.out) {
+      let totalAdd = 0;
+      let totalDel = 0;
+      let fileCount = 0;
+      numstat.out.split("\n").forEach((line) => {
+        const [add, del] = line.split("	");
+        totalAdd += parseInt(add, 10) || 0;
+        totalDel += parseInt(del, 10) || 0;
+        fileCount += 1;
+      });
+      lines.push(`
+\u{1F4CA} \uCD1D \uBCC0\uACBD: ${fileCount}\uAC1C \uD30C\uC77C, +${totalAdd}\uC904 -${totalDel}\uC904`);
+    }
+    return { content: [{ type: "text", text: lines.join("\n") }] };
+  });
+  server.registerTool("ship", { description: "\uBC30\uD3EC \uCCB4\uD06C\uB9AC\uC2A4\uD2B8 \uC2E4\uD589 (\uBE4C\uB4DC + \uD14C\uC2A4\uD2B8 + \uBC84\uC804 + git \uC0C1\uD0DC)" }, async () => {
+    const checks = [];
+    const build = safeExecFile("pnpm", ["build"]);
+    checks.push(build.ok ? "\u2705 \uBE4C\uB4DC \uC131\uACF5" : "\u274C \uBE4C\uB4DC \uC2E4\uD328");
+    const test = safeExecFile("pnpm", ["test", "--run"]);
+    checks.push(test.ok ? "\u2705 \uD14C\uC2A4\uD2B8 \uD1B5\uACFC" : "\u274C \uD14C\uC2A4\uD2B8 \uC2E4\uD328");
+    if (existsSync("package.json")) {
+      try {
+        const pkg = JSON.parse(readFileSync("package.json", "utf-8"));
+        checks.push(`\u{1F4E6} \uBC84\uC804: ${pkg.version}`);
+      } catch {
+      }
+    }
+    if (isGitRepo()) {
+      const status = safeExecFile("git", ["status", "--porcelain"]);
+      if (status.ok) {
+        if (status.out) {
+          checks.push(`\u26A0\uFE0F \uCEE4\uBC0B\uB418\uC9C0 \uC54A\uC740 \uBCC0\uACBD\uC0AC\uD56D ${status.out.split("\n").length}\uAC1C`);
+        } else {
+          checks.push("\u2705 \uC6CC\uD0B9 \uB514\uB809\uD1A0\uB9AC \uAE68\uB057\uD568");
+        }
+      }
+    }
+    return { content: [{ type: "text", text: "\u{1F680} \uBC30\uD3EC \uCCB4\uD06C\uB9AC\uC2A4\uD2B8\n" + checks.join("\n") }] };
+  });
+  server.registerTool("doctor", { description: "\uAC1C\uBC1C \uD658\uACBD \uC810\uAC80 (Node/Git/npm/pnpm/TypeScript)" }, async () => {
+    const checks = [];
+    const node = safeExecFile("node", ["--version"]);
+    checks.push(node.ok ? `\u2705 Node.js: ${node.out}` : "\u274C Node.js: \uC124\uCE58 \uC548 \uB428");
+    const git = safeExecFile("git", ["--version"]);
+    checks.push(git.ok ? `\u2705 Git: ${git.out}` : "\u274C Git: \uC124\uCE58 \uC548 \uB428");
+    const pnpm = safeExecFile("pnpm", ["--version"]);
+    checks.push(pnpm.ok ? `\u2705 pnpm: v${pnpm.out}` : "\u26A0\uFE0F pnpm: \uC124\uCE58 \uC548 \uB428");
+    const npm = safeExecFile("npm", ["--version"]);
+    checks.push(npm.ok ? `\u2705 npm: v${npm.out}` : "\u274C npm: \uC124\uCE58 \uC548 \uB428");
+    const tsc = safeExecFile("npx", ["tsc", "--version"]);
+    checks.push(tsc.ok ? `\u2705 TypeScript: ${tsc.out}` : "\u26A0\uFE0F TypeScript: \uD504\uB85C\uC81D\uD2B8\uC5D0 \uC5C6\uC74C");
+    return { content: [{ type: "text", text: "\u{1FA7A} \uD658\uACBD \uC810\uAC80 \uACB0\uACFC\n" + checks.join("\n") }] };
+  });
+  server.registerTool("check", { description: "\uD504\uB85C\uC81D\uD2B8 \uAD6C\uC870 \uC810\uAC80 (\uD544\uC218 \uD30C\uC77C + VHK \uD558\uB124\uC2A4 \uD30C\uC77C)" }, async () => {
+    const required = ["package.json", "tsconfig.json", "README.md", ".gitignore"];
+    const recommended = ["CLAUDE.md", ".cursorrules", "docs/PRD.md", "docs/ARCHITECTURE.md"];
+    const lines = ["\u{1F50D} \uD504\uB85C\uC81D\uD2B8 \uC810\uAC80", "", "\uD544\uC218:"];
+    required.forEach((f) => {
+      lines.push(`  ${existsSync(f) ? "\u2705" : "\u274C"} ${f}`);
+    });
+    lines.push("", "\uAD8C\uC7A5 (VHK \uD558\uB124\uC2A4):");
+    recommended.forEach((f) => {
+      lines.push(`  ${existsSync(f) ? "\u2705" : "\u26A0\uFE0F"} ${f}`);
+    });
+    return { content: [{ type: "text", text: lines.join("\n") }] };
+  });
+  server.registerTool(
+    "recap",
+    {
+      description: "\uCD5C\uADFC \uC791\uC5C5 \uC694\uC57D (\uCEE4\uBC0B \uD788\uC2A4\uD1A0\uB9AC \uAE30\uBC18, \uB0A0\uC9DC \uD3EC\uD568)",
+      inputSchema: {
+        count: z.number().optional().describe("\uD45C\uC2DC\uD560 \uCEE4\uBC0B \uC218 (\uAE30\uBCF8: 10)")
+      }
+    },
+    async ({ count }) => {
+      if (!isGitRepo()) {
+        return { content: [{ type: "text", text: "\u274C git \uC800\uC7A5\uC18C\uAC00 \uC544\uB2D9\uB2C8\uB2E4." }] };
+      }
+      const n = count && count > 0 ? Math.floor(count) : 10;
+      const log = safeExecFile("git", ["log", "--format=%h %ad %s", "--date=short", `-${n}`]);
+      if (!log.ok) {
+        return { content: [{ type: "text", text: `\u274C git log \uC2E4\uD328: ${log.err}` }] };
+      }
+      if (!log.out) {
+        return { content: [{ type: "text", text: "\u{1F4ED} \uCEE4\uBC0B \uD788\uC2A4\uD1A0\uB9AC\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4." }] };
+      }
+      return { content: [{ type: "text", text: `\u{1F4CB} \uCD5C\uADFC \uC791\uC5C5 (${n}\uAC1C):
+${log.out}` }] };
+    }
+  );
+  return server;
+}
+async function startMcpServer() {
+  const server = createVhkMcpServer();
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+
+export {
+  __commonJS,
+  __toESM,
+  startMcpServer
+};

package/dist/index.js

@@ -1,29 +1,9 @@
 #!/usr/bin/env node
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
+import {
+  __commonJS,
+  __toESM,
+  startMcpServer
+} from "./chunk-IU37BEQA.js";
 
 // node_modules/.pnpm/ignore@7.0.5/node_modules/ignore/index.js
 var require_ignore = __commonJS({
@@ -523,6 +503,12 @@ var RULES = [
     confidence: "high",
     test: (t2) => /프로젝트.*(만들|시작)|폴더.*만들|만들고\s*싶|하네스|초기화/.test(t2) || /^시작$/.test(t2)
   },
+  {
+    command: "mcp-init",
+    explanation: "Cursor MCP \uC5F0\uB3D9 \uC124\uC815 (vhk mcp-init)",
+    confidence: "high",
+    test: (t2) => /mcp.*(설정|연동|초기|init)|커서.*(연동|설정|mcp)|cursor.*mcp/.test(t2)
+  },
   {
     command: "secure",
     explanation: "\uBCF4\uC548 \uC2A4\uCE94 (vhk \uBCF4\uC548)",
@@ -647,6 +633,9 @@ var KNOWN_COMMAND_TOKENS = /* @__PURE__ */ new Set([
   "diff",
   "\uBCC0\uACBD",
   "\uCC28\uC774",
+  "mcp",
+  "mcp-init",
+  "mcp\uC124\uC815",
   "help"
 ]);
 function isOptionToken(token) {
@@ -657,11 +646,11 @@ function detectNaturalLanguageInput(argv) {
   if (rest.length === 0) return null;
   const first = rest[0];
   if (isOptionToken(first)) return null;
+  if (rest.some(isOptionToken)) return null;
   const input = rest.join(" ").trim();
   if (!input) return null;
   const firstIsKnown = KNOWN_COMMAND_TOKENS.has(first);
   if (firstIsKnown && rest.length === 1) return null;
-  if (firstIsKnown && rest.slice(1).every(isOptionToken)) return null;
   if (firstIsKnown && rest.length > 1) {
     if (routeNaturalLanguage(input)) return input;
     return null;
@@ -670,7 +659,7 @@ function detectNaturalLanguageInput(argv) {
 }
 
 // src/lib/nlp-run.ts
-import chalk16 from "chalk";
+import chalk17 from "chalk";
 import inquirer7 from "inquirer";
 
 // src/i18n/ko.ts
@@ -854,7 +843,9 @@ var ko = {
     projectFiles: "\u{1F4C1} \uD504\uB85C\uC81D\uD2B8 \uD30C\uC77C \uD655\uC778:",
     envNotIgnored: "\u26A0\uFE0F .env\uAC00 .gitignore\uC5D0 \uC5C6\uC74C! \uCD94\uAC00\uD558\uC138\uC694",
     nextOkMessage: "\uD658\uACBD \uC810\uAC80 \uD1B5\uACFC! \uC774\uC81C \uD504\uB85C\uC81D\uD2B8\uB97C \uC2DC\uC791\uD558\uC138\uC694.",
-    nextRetryMessage: "\uC704 \uB3C4\uAD6C\uB97C \uC124\uCE58\uD55C \uD6C4 \uB2E4\uC2DC \uC810\uAC80\uD558\uC138\uC694."
+    nextRetryMessage: "\uC704 \uB3C4\uAD6C\uB97C \uC124\uCE58\uD55C \uD6C4 \uB2E4\uC2DC \uC810\uAC80\uD558\uC138\uC694.",
+    updateAvailable: (latest) => `\u{1F195} v${latest} \uC0AC\uC6A9 \uAC00\uB2A5 \u2014 npm i -g @byh3071/vhk`,
+    updateCurrent: "\uCD5C\uC2E0 \uBC84\uC804\uC744 \uC4F0\uACE0 \uC788\uC5B4\uC694"
   },
   nlp: {
     matched: "\uC774\uAC8C \uB9DE\uB098\uC694?",
@@ -909,7 +900,14 @@ var ko = {
     checkSecurity: "\uBCF4\uC548 \uC2A4\uCE94\uC744 \uB3CC\uB838\uB098\uC694?",
     hintSecurity: "vhk \uBCF4\uC548 scan",
     checkCommit: "\uBAA8\uB4E0 \uBCC0\uACBD\uC774 \uCEE4\uBC0B\uB418\uC5C8\uB098\uC694?",
-    hintCommit: "git status \uD655\uC778"
+    hintCommit: "git status \uD655\uC778",
+    changelogUpdated: (version) => `CHANGELOG.md \uAC31\uC2E0\uB428 \u2014 [Unreleased] \u2192 [${version}] \uC139\uC158\uC73C\uB85C \uC774\uB3D9`,
+    changelogNoUnreleased: "CHANGELOG.md\uC5D0 [Unreleased] \uC139\uC158\uC774 \uC5C6\uC5B4 \uC790\uB3D9 \uAC31\uC2E0\uC744 \uC2A4\uD0B5\uD588\uC5B4\uC694",
+    changelogMissing: "CHANGELOG.md\uAC00 \uC5C6\uC5B4\uC694. \uB9CC\uB4E4\uBA74 ship\uC774 \uC790\uB3D9\uC73C\uB85C [Unreleased] \u2192 \uBC84\uC804 \uC139\uC158\uC73C\uB85C \uC62E\uACA8\uC90D\uB2C8\uB2E4."
+  },
+  mcp: {
+    initTitle: "Cursor MCP \uC5F0\uB3D9 \uC124\uC815",
+    serverStarted: "VHK MCP \uC11C\uBC84 \uC2DC\uC791\uB428"
   }
 };
 function lookup(path15) {
@@ -1730,7 +1728,7 @@ function enhancePackageScripts(projectDir) {
   const pkgPath = path3.join(projectDir, "package.json");
   if (!fs3.existsSync(pkgPath)) return false;
   const pkg = JSON.parse(fs3.readFileSync(pkgPath, "utf-8"));
-  pkg.scripts = { ...pkg.scripts, ...VHK_PACKAGE_SCRIPTS };
+  pkg.scripts = { ...VHK_PACKAGE_SCRIPTS, ...pkg.scripts };
   fs3.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
   return true;
 }
@@ -2796,6 +2794,27 @@ function getVhkVersion() {
   }
   return void 0;
 }
+function fetchLatestNpmVersion(packageName) {
+  try {
+    const result = execSync(`npm view ${packageName} version`, {
+      encoding: "utf-8",
+      timeout: 5e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (/^\d+\.\d+\.\d+/.test(result)) return result;
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function compareSemver(a, b) {
+  const parse = (v) => v.replace(/^v/i, "").split("-")[0].split(".").map((n) => parseInt(n, 10) || 0);
+  const [a1 = 0, a2 = 0, a3 = 0] = parse(a);
+  const [b1 = 0, b2 = 0, b3 = 0] = parse(b);
+  if (a1 !== b1) return a1 - b1;
+  if (a2 !== b2) return a2 - b2;
+  return a3 - b3;
+}
 async function doctor() {
   console.log(chalk10.bold(`
 ${ko.doctor.title}
@@ -2823,6 +2842,14 @@ ${ko.doctor.title}
   } else {
     console.log(chalk10.green("  \u2705 VHK") + chalk10.dim(" \u2014 \uC124\uCE58\uB428"));
   }
+  if (vhkVersion) {
+    const latest = fetchLatestNpmVersion("@byh3071/vhk");
+    if (latest && compareSemver(latest, vhkVersion) > 0) {
+      console.log(chalk10.yellow(`  ${ko.doctor.updateAvailable(latest)}`));
+    } else if (latest) {
+      console.log(chalk10.dim(`     ${ko.doctor.updateCurrent}`));
+    }
+  }
   console.log("");
   console.log(chalk10.bold(`  ${ko.doctor.projectFiles}`));
   const cwd = process.cwd();
@@ -2885,6 +2912,29 @@ var CHECKLIST = [
 function sanitizeVersion(version) {
   return version.trim().replace(/^v/i, "").replace(/[^a-zA-Z0-9._-]/g, "-") || "0.0.0";
 }
+function updateChangelogUnreleased(cwd, version, date) {
+  const changelogPath = path13.join(cwd, "CHANGELOG.md");
+  if (!fs13.existsSync(changelogPath)) return { status: "missing" };
+  const content = fs13.readFileSync(changelogPath, "utf-8");
+  const unreleasedHeading = /^## \[Unreleased\][^\n]*$/m;
+  if (!unreleasedHeading.test(content)) return { status: "no-unreleased" };
+  const blankUnreleased = [
+    "## [Unreleased]",
+    "",
+    "### Added",
+    "- ",
+    "",
+    "### Fixed",
+    "- ",
+    "",
+    "---",
+    "",
+    `## [${version}] \u2014 ${date}`
+  ].join("\n");
+  const updated = content.replace(unreleasedHeading, blankUnreleased);
+  fs13.writeFileSync(changelogPath, updated, "utf-8");
+  return { status: "updated", version };
+}
 async function ship() {
   console.log(chalk11.bold(`
 ${ko.ship.title}
@@ -2976,6 +3026,14 @@ ${ko.ship.title}
   fs13.writeFileSync(filePath, content, "utf-8");
   console.log(chalk11.green(`
   ${ko.ship.buildLogDone(path13.relative(cwd, filePath))}`));
+  const changelogResult = updateChangelogUnreleased(cwd, versionSlug, today);
+  if (changelogResult.status === "updated") {
+    log.success(ko.ship.changelogUpdated(changelogResult.version));
+  } else if (changelogResult.status === "no-unreleased") {
+    log.warn(ko.ship.changelogNoUnreleased);
+  } else {
+    log.info(ko.ship.changelogMissing);
+  }
   printNextStep({
     message: ko.ship.deployMessage,
     command: "npm publish --access=public",
@@ -3488,6 +3546,55 @@ ${t("diff.summaryHeader")}`));
   console.log("");
 }
 
+// src/commands/mcp-init.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import chalk16 from "chalk";
+function resolveVhkMcpPath() {
+  try {
+    const url = import.meta.resolve?.("@byh3071/vhk/dist/mcp/index.js");
+    if (typeof url === "string") return fileURLToPath2(url);
+  } catch {
+  }
+  return join(process.cwd(), "node_modules", "@byh3071", "vhk", "dist", "mcp", "index.js");
+}
+async function mcpInit() {
+  console.log(chalk16.bold("\n\u{1F50C} " + t("mcp.initTitle")));
+  console.log(chalk16.gray("\u2500".repeat(40)));
+  const cursorDir = join(process.cwd(), ".cursor");
+  if (!existsSync(cursorDir)) {
+    mkdirSync(cursorDir, { recursive: true });
+  }
+  const configPath = join(cursorDir, "mcp.json");
+  const vhkEntry = {
+    command: "node",
+    args: [resolveVhkMcpPath()]
+  };
+  let config;
+  if (existsSync(configPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync(configPath, "utf-8"));
+      config = {
+        mcpServers: { ...parsed.mcpServers ?? {}, vhk: vhkEntry }
+      };
+    } catch {
+      console.log(chalk16.yellow("\u26A0\uFE0F  \uAE30\uC874 .cursor/mcp.json \uD30C\uC2F1 \uC2E4\uD328 \u2014 \uC0C8 \uD30C\uC77C\uB85C \uB36E\uC5B4\uC501\uB2C8\uB2E4."));
+      config = { mcpServers: { vhk: vhkEntry } };
+    }
+  } else {
+    config = { mcpServers: { vhk: vhkEntry } };
+  }
+  writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  console.log(chalk16.green("\n\u2705 Cursor MCP \uC124\uC815 \uC644\uB8CC!"));
+  console.log(chalk16.cyan("\u{1F4C1} \uC0DD\uC131\uB41C \uD30C\uC77C:"));
+  console.log(`   ${configPath}`);
+  console.log(chalk16.cyan("\n\u{1F504} \uB2E4\uC74C \uB2E8\uACC4:"));
+  console.log("   1. Cursor\uB97C \uC7AC\uC2DC\uC791\uD558\uC138\uC694");
+  console.log("   2. Cursor \uCC44\uD305\uC5D0\uC11C vhk \uB3C4\uAD6C\uB97C \uC0AC\uC6A9\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4");
+  console.log(chalk16.gray('\n\u{1F4A1} \uC608: "\uD504\uB85C\uC81D\uD2B8 \uC0C1\uD0DC \uC54C\uB824\uC918" \u2192 Cursor\uAC00 vhk status \uD638\uCD9C'));
+}
+
 // src/lib/nlp-run.ts
 async function dispatchNlpRoute(route, input) {
   switch (route.command) {
@@ -3518,19 +3625,21 @@ async function dispatchNlpRoute(route, input) {
       return status();
     case "diff":
       return diff();
+    case "mcp-init":
+      return mcpInit();
   }
 }
 async function runNaturalLanguageRoute(input) {
   const route = routeNaturalLanguage(input);
   if (!route) {
-    console.log(chalk16.yellow(`
+    console.log(chalk17.yellow(`
   \u2753 "${input}" \u2014 ${ko.nlp.notMatched}
 `));
     return;
   }
   console.log("");
-  console.log(chalk16.cyan(`  \u{1F4AC} "${input}"`));
-  console.log(chalk16.cyan(`  \u2192 ${route.explanation}`));
+  console.log(chalk17.cyan(`  \u{1F4AC} "${input}"`));
+  console.log(chalk17.cyan(`  \u2192 ${route.explanation}`));
   if (route.confidence === "low") {
     const { confirm } = await inquirer7.prompt([{
       type: "confirm",
@@ -3539,7 +3648,7 @@ async function runNaturalLanguageRoute(input) {
       default: true
     }]);
     if (!confirm) {
-      console.log(chalk16.dim(`  ${ko.nlp.menuHint}`));
+      console.log(chalk17.dim(`  ${ko.nlp.menuHint}`));
       return;
     }
   }
@@ -3564,14 +3673,17 @@ var KO_ALIASES = {
   status: "\uC0C1\uD0DC",
   diff: "\uBCC0\uACBD"
 };
-program.name("vhk").description("VHK \u2014 \uBC14\uC774\uBE0C\uCF54\uB529 \uD504\uB85C\uC81D\uD2B8 \uCF54\uCE58 (\uD55C\uAD6D\uC5B4\uB85C \uC548\uB0B4\uD569\uB2C8\uB2E4)").version("0.5.2");
+program.name("vhk").description("VHK \u2014 \uBC14\uC774\uBE0C\uCF54\uB529 \uD504\uB85C\uC81D\uD2B8 \uCF54\uCE58 (\uD55C\uAD6D\uC5B4\uB85C \uC548\uB0B4\uD569\uB2C8\uB2E4)").version("0.6.0");
 program.configureHelp({
   formatHelp(cmd, helper) {
     if (cmd.parent) {
       return defaultHelp.formatHelp(cmd, helper);
     }
     const subs = helper.visibleCommands(cmd).filter((c) => c.name() !== "help");
-    const terms = subs.map((c) => `${c.name()} (${KO_ALIASES[c.name()]})`);
+    const terms = subs.map((c) => {
+      const alias = KO_ALIASES[c.name()];
+      return alias ? `${c.name()} (${alias})` : c.name();
+    });
     const termWidth = Math.max(...terms.map((t2) => t2.length), 0);
     const lines = [
       helper.commandDescription(cmd),
@@ -3604,6 +3716,12 @@ program.command("status").alias("\uC0C1\uD0DC").description("\uD504\uB85C\uC81D\
   await status();
 });
 program.command("diff").alias("\uBCC0\uACBD").alias("\uCC28\uC774").description("Git \uBCC0\uACBD\uC0AC\uD56D \uD55C\uAD6D\uC5B4 \uC694\uC57D (staged / unstaged / \uC0C8 \uD30C\uC77C)").action(diff);
+program.command("mcp").description("MCP \uC11C\uBC84 \uC2DC\uC791 (Cursor \uB4F1 MCP \uD074\uB77C\uC774\uC5B8\uD2B8\uC6A9)").action(async () => {
+  await startMcpServer();
+});
+program.command("mcp-init").alias("mcp\uC124\uC815").description("Cursor MCP \uC5F0\uB3D9 \uC124\uC815 \uC790\uB3D9 \uC0DD\uC131 (.cursor/mcp.json)").action(async () => {
+  await mcpInit();
+});
 program.on("command:*", async (operands) => {
   const unknown = operands[0] ?? "";
   const rest = operands.slice(1);

package/dist/mcp/index.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import {
+  startMcpServer
+} from "../chunk-IU37BEQA.js";
+
+// src/mcp/index.ts
+startMcpServer().catch((err) => {
+  console.error("VHK MCP \uC11C\uBC84 \uC2DC\uC791 \uC2E4\uD328:", err);
+  process.exit(1);
+});

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "@byh3071/vhk",
-  "version": "0.5.2",
+  "version": "0.6.0",
   "description": "Vibe Harness Kit — 바이브코딩 풀사이클 CLI",
   "bin": {
-    "vhk": "./dist/index.js"
+    "vhk": "dist/index.js",
+    "vhk-mcp": "dist/mcp/index.js"
   },
   "type": "module",
   "scripts": {
@@ -11,7 +12,13 @@
     "build": "tsup",
     "test": "vitest",
     "test:run": "vitest --run",
-    "prepublishOnly": "pnpm build && pnpm test:run"
+    "prepublishOnly": "pnpm build && pnpm test:run",
+    "save": "vhk save",
+    "check": "vhk check",
+    "scan": "vhk secure scan",
+    "recap": "vhk recap",
+    "ship": "vhk ship",
+    "doctor": "vhk doctor"
   },
   "files": [
     "dist",
@@ -30,19 +37,21 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/byh3071-cpu/vhk.git"
+    "url": "git+https://github.com/byh3071-cpu/vhk.git"
   },
   "engines": {
     "node": ">=20"
   },
   "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "@notionhq/client": "^5.22.0",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "handlebars": "^4.7.9",
     "inquirer": "^9.3.8",
     "ora": "^9.4.0",
-    "simple-git": "^3.36.0"
+    "simple-git": "^3.36.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/inquirer": "^9.0.9",