godpowers 2.5.1 → 2.6.0

package/CHANGELOG.md

@@ -7,6 +7,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.6.0] - 2026-06-10
+
+### Added
+- Added the `@godpowers/mcp` companion package with read-only MCP tools for
+  status, next, gate checks, artifact linting, and requirement tracing.
+- Added `godpowers mcp-info --project=.` as a read-only main-package helper
+  that prints setup instructions without loading the MCP SDK.
+- Added MCP protocol tests that spawn the companion server over stdio, list
+  tools, and call each tool against the quick-proof fixture.
+
+### Changed
+- Updated dashboard and quick-proof host guarantee output to include MCP
+  availability.
+- Updated `/god-status` and `/god-next` to prefer MCP tools when available and
+  fall back to CLI or runtime modules otherwise.
+- Updated release checks to verify the companion package protocol and package
+  contents while keeping the main `godpowers` package dependency-free.
+
+## [2.5.2] - 2026-06-10
+
+### Added
+- Added regression coverage proving an installed `godpowers-runtime` bundle can
+  be used as a local npm package for `godpowers gate`.
+- Added regression coverage proving build gates fail when build state records a
+  failed verification command.
+
+### Fixed
+- Fixed installed runtime bundles so `godpowers-runtime` includes `bin/` next
+  to `package.json`, allowing host workflows to call the documented
+  `godpowers gate` command from the installed runtime package.
+- Fixed the build gate so `.godpowers/build/STATE.md` fails closed when any
+  verification command is recorded as failed, instead of passing because a
+  different command passed.
+
 ## [2.5.1] - 2026-06-10
 
 ### Added

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/aihxp/godpowers/actions/workflows/ci.yml/badge.svg)](https://github.com/aihxp/godpowers/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-2.5.1-blue)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-2.6.0-blue)](CHANGELOG.md)
 [![npm](https://img.shields.io/npm/v/godpowers.svg)](https://www.npmjs.com/package/godpowers)
 
 **Ship fast. Ship right. Ship everything. Ship accountably.**
@@ -30,10 +30,13 @@ Godpowers makes AI coding accountable: every serious run should leave disk
 state, artifacts, validation gates, host guarantees, and a next action. Code is
 only one output. The project memory and proof trail matter too.
 
-Version 2.5.1 adds three Codex host-run proof studies on top of the 2.5.0
-executable tier gates, while keeping the 2.4 command-family UX, external CLI
-canary evidence, prompt-size guardrails, legacy command quarantine, lib
-coverage gating, and package verification before publish.
+Version 2.6.0 adds the optional `@godpowers/mcp` companion package with
+read-only MCP tools for status, next-route, gate, artifact lint, and requirement
+trace workflows. It keeps the 2.5.2 installed-runtime gate and build-gate
+fixes, the 2.5.1 Codex host proof studies, executable tier gates, 2.4
+command-family UX, external CLI canary evidence, prompt-size guardrails, legacy
+command quarantine, lib coverage gating, and package verification before
+publish.
 
 Maintainer hardening continues on the 2.x line with small, audited public
 surface updates when they close real workflow gaps. The 2.1.0 patch closes a command-injection vector in the
@@ -257,6 +260,7 @@ npx godpowers status --project=. --brief
 npx godpowers status --project=. --json
 npx godpowers quick-proof --project=.
 npx godpowers gate --tier=prd --project=.
+npx godpowers mcp-info --project=.
 npx godpowers dogfood
 npx godpowers extension-scaffold --name=@godpowers/my-pack --output=.
 ```
@@ -288,9 +292,30 @@ npx godpowers gate --tier=harden --project=.
 The gate reads disk artifacts, runs the shared artifact linter, checks build
 verification evidence, and blocks unresolved Critical harden findings.
 
-The runtime remains dependency-free. YAML parsing is intentionally limited to
-the documented Godpowers subset used by intent, routing, workflow, and
-extension files, with parser coverage in `scripts/test-yaml-parser.js`.
+The main `godpowers` runtime remains dependency-free. The optional
+`@godpowers/mcp` companion package owns the MCP SDK dependency and exposes
+read-only tools through explicit host setup. YAML parsing is intentionally
+limited to the documented Godpowers subset used by intent, routing, workflow,
+and extension files, with parser coverage in `scripts/test-yaml-parser.js`.
+
+### MCP Companion
+
+MCP-capable hosts can use the optional companion package without adding an SDK
+dependency to the main `godpowers` package:
+
+```bash
+npx godpowers mcp-info --project=.
+npx -y -p godpowers@2.6.0 -p @godpowers/mcp@2.6.0 godpowers-mcp serve --project=.
+```
+
+The companion exposes `status`, `next`, `gate_check`, `lint_artifact`, and
+`trace_requirement`. Host registration is opt-in:
+
+```bash
+npx -y -p godpowers@2.6.0 -p @godpowers/mcp@2.6.0 godpowers-mcp setup --host=codex --project=. --write
+```
+
+See [MCP Companion](docs/mcp.md) for package boundaries and setup details.
 
 ### Slash Commands
 

package/RELEASE.md

@@ -1,52 +1,60 @@
-# Godpowers 2.5.1 Release
+# Godpowers 2.6.0 Release
 
 > Status: Release candidate
 > Date: 2026-06-10
 
-Godpowers 2.5.1 ships the Phase 2 host proof campaign as a docs patch release.
-It keeps the 2.5.0 executable tier gates intact while adding Codex host-run
-evidence for a CLI package, a browser app, and a TODO-backed React component
-project.
+[DECISION] Godpowers 2.6.0 is the Phase 3 MCP companion package release.
+[DECISION] This release keeps the main `godpowers` package dependency-free while adding an optional `@godpowers/mcp` package for MCP-capable hosts.
+[DECISION] This release preserves the 2.5.2 installed-runtime gate command fix and build-gate false-pass fix.
 
 ## What's in this release
 
-- 112 slash commands
-- 40 specialist agents
-- 13 executable workflows
-- 42 intent recipes
-- 8 installer CLI helpers
+- [DECISION] 112 slash commands.
+- [DECISION] 40 specialist agents.
+- [DECISION] 13 executable workflows.
+- [DECISION] 42 intent recipes.
+- [DECISION] 9 installer CLI helpers.
+- [DECISION] 5 read-only MCP tools in `@godpowers/mcp`.
 
 ## Highlights
 
-- Run A completed a Codex host proof on slugify-cli with 13 of 13 workflow steps
-  complete, 16 of 16 requirements done, passing tests, passing production
-  audit, passing pack dry run, and no tracked source diff.
-- Run B completed a Codex host proof on Countdown with local browser evidence,
-  6 of 7 requirements done, dependency audit repair, and deployed-origin proof
-  deferred pending a staging URL.
-- Run C completed a documented failed Codex host proof on
-  react-github-readme-button, with local tests, lint, build, browser smoke, and
-  production audit passing before the run blocked on Critical dev-tooling audit
-  findings.
-- The host proof campaign captured command usage, gate failures, repairs,
-  blocker files, cost availability, and proof limits in `docs/case-studies/`.
+- [DECISION] `@godpowers/mcp` exposes `status`, `next`, `gate_check`, `lint_artifact`, and `trace_requirement` over stdio.
+- [DECISION] `godpowers mcp-info --project=.` prints setup instructions without requiring or loading the MCP SDK in the main package.
+- [DECISION] `godpowers-mcp setup --host=codex --project=. --write` writes a managed Codex MCP registration only after the user explicitly asks for it.
+- [DECISION] Dashboard and Quick Proof host guarantee lines now include MCP availability.
+- [DECISION] The main `godpowers` package still has no production dependencies.
 
 ## Validation
 
-- `npm run test:e2e` passed.
-- `node scripts/test-runtime-verification.js` passed.
-- `node scripts/test-agent-browser.js` passed.
-- `npm run release:check` passed before publish.
+- [DECISION] `npm --workspace @godpowers/mcp test` passed before the latest `main` merge.
+- [DECISION] `npm --workspace @godpowers/mcp run pack:check` passed before the latest `main` merge.
+- [DECISION] `npm run test:e2e` passed before the latest `main` merge.
+- [DECISION] `node scripts/test-runtime-verification.js` passed before the latest `main` merge.
+- [DECISION] `node scripts/test-agent-browser.js` passed before the latest `main` merge.
+- [DECISION] `npm run release:check` passed before the latest `main` merge with `coverage:lib` at 92.85 percent line coverage, `npm audit --omit=dev` reporting 0 vulnerabilities, public surface docs matching version 2.6.0, root package contents verified at 535 files, and MCP package contents verified at 8 files.
+- [DECISION] Post-merge 2.6.0 `npm --workspace @godpowers/mcp test` passed.
+- [DECISION] Post-merge 2.6.0 `npm --workspace @godpowers/mcp run pack:check` passed.
+- [DECISION] Post-merge 2.6.0 `node scripts/test-gate.js` passed.
+- [DECISION] Post-merge 2.6.0 `node scripts/test-install-smoke.js` passed.
+- [DECISION] Post-merge 2.6.0 `node scripts/static-check.js` passed.
+- [DECISION] Post-merge 2.6.0 `npm run test:e2e` passed.
+- [DECISION] Post-merge 2.6.0 `node scripts/test-runtime-verification.js` passed.
+- [DECISION] Post-merge 2.6.0 `node scripts/test-agent-browser.js` passed.
+- [DECISION] Post-merge 2.6.0 `npm run release:check` passed with `coverage:lib` at 92.88 percent line coverage, `npm audit --omit=dev` reporting 0 vulnerabilities, public surface docs matching version 2.6.0, root package contents verified at 535 files, and MCP package contents verified at 8 files.
 
 ## Upgrade
 
-- `npm install -g godpowers@2.5.1` or `npx godpowers@2.5.1`
-- Re-run `/god-context` in each project to refresh installed runtime metadata.
-- Existing `.godpowers/` state remains compatible.
+- [DECISION] Use `npm install -g godpowers@2.6.0` or `npx godpowers@2.6.0` after the package is published.
+- [DECISION] Use optional MCP package install `npm install -g godpowers @godpowers/mcp` when the host can register MCP servers.
+- [DECISION] Re-run `/god-context` in each project to refresh installed runtime metadata.
+- [DECISION] Existing `.godpowers/` state remains compatible.
 
 ## Notes
 
-- GitHub release created for `v2.5.1`.
-- The tag matches the npm package version.
-- The `v2.5.1` tag points to the release commit that matches the npm
-  `godpowers@2.5.1` package.
+- [DECISION] The npm `godpowers@2.5.2` package is published with provenance.
+- [DECISION] GitHub release `v2.5.2` was created at `https://github.com/aihxp/godpowers/releases/tag/v2.5.2`.
+- [DECISION] The 2.5.2 release-status closeout confirmed GitHub workflow `27289417888`, npm `latest` version 2.5.2, published-install verification, `npm run lint`, and `npm run release:check`.
+- [DECISION] GitHub release `v2.6.0` should be created only after the release gate passes on the merged branch.
+- [DECISION] The tag should match the npm package version.
+- [DECISION] The companion package should publish as `@godpowers/mcp@2.6.0` after the release gate passes.
+- [DECISION] The `v2.6.0` tag is not pushed yet because the current tag workflow publishes only the root `godpowers` package and does not publish `@godpowers/mcp`.

package/bin/install.js

@@ -52,6 +52,7 @@ function showHelp() {
   log('  status               Show the Godpowers Dashboard for a project');
   log('  next                 Show the dashboard and recommended next command');
   log('  gate                 Check a tier artifact gate');
+  log('  mcp-info             Show read-only MCP companion setup instructions');
   log('  quick-proof          Show a runnable proof from the shipped fixture');
   log('  automation-status    Show host automation provider support');
   log('  automation-setup     Show an opt-in automation setup plan');
@@ -100,6 +101,7 @@ function showHelp() {
   log('  npx godpowers status --project=.');
   log('  npx godpowers next --project=.');
   log('  npx godpowers gate --tier=prd --project=.');
+  log('  npx godpowers mcp-info --project=.');
   log('  npx godpowers quick-proof --project=.');
   log('  npx godpowers automation-status --project=.');
   log('  npx godpowers automation-setup --project=.');
@@ -211,6 +213,7 @@ module.exports = {
   runDashboardCommand: cliDispatch.runDashboardCommand,
   runDogfoodCommand: cliDispatch.runDogfoodCommand,
   runQuickProofCommand: cliDispatch.runQuickProofCommand,
+  runMcpInfoCommand: cliDispatch.runMcpInfoCommand,
   runExtensionScaffoldCommand: cliDispatch.runExtensionScaffoldCommand,
   runGateCommand: cliDispatch.runGateCommand,
   applyDefaultRuntimeSelection,

package/lib/cli-dispatch.js

@@ -74,6 +74,16 @@ function runQuickProofCommand(opts) {
   }
 }
 
+function runMcpInfoCommand(opts) {
+  const mcpInfo = require('./mcp-info');
+  const result = mcpInfo.info(opts.project);
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    console.log(mcpInfo.render(result));
+  }
+}
+
 function runExtensionScaffoldCommand(opts) {
   const authoring = require('./extension-authoring');
   if (!opts.extensionName) {
@@ -134,6 +144,7 @@ const COMMAND_RUNNERS = {
   status: runDashboardCommand,
   next: runDashboardCommand,
   'quick-proof': runQuickProofCommand,
+  'mcp-info': runMcpInfoCommand,
   'automation-status': runAutomationCommand,
   'automation-setup': runAutomationCommand,
   dogfood: runDogfoodCommand,
@@ -157,6 +168,7 @@ module.exports = {
   runDashboardCommand,
   runDogfoodCommand,
   runQuickProofCommand,
+  runMcpInfoCommand,
   runExtensionScaffoldCommand,
   runGateCommand
 };

package/lib/gate.js

@@ -115,17 +115,57 @@ function checkArtifacts(projectRoot, tier, artifacts, opts, result) {
 }
 
 function extractPassedCommands(text) {
-  const commands = [];
+  return extractCommandStatuses(text)
+    .filter((entry) => entry.status === 'pass')
+    .map((entry) => entry.command)
+    .filter((command, index, commands) => commands.indexOf(command) === index);
+}
+
+function extractFailedCommands(text) {
+  return extractCommandStatuses(text)
+    .filter((entry) => entry.status === 'fail')
+    .map((entry) => entry.command)
+    .filter((command, index, commands) => commands.indexOf(command) === index);
+}
+
+function extractCommand(line) {
+  const exact = line.match(/\b(?:exact\s+executed\s+command|verification\s+command|command)\s*:\s*`([^`\n]+)`/i);
+  if (exact) return exact[1].trim();
+  const backtickWithStatus = line.match(/`([^`\n]+)`\s*:\s*(pass|passed|green|success|succeeded|ok|fail|failed|red|error)\b/i);
+  if (backtickWithStatus) return backtickWithStatus[1].trim();
+  const labeled = line.match(/\bcommand\s*:\s*([^;]+?)(?:\s{2,}|\s+status\s*:|\s+result\s*:|$)/i);
+  return labeled ? labeled[1].trim() : null;
+}
+
+function explicitStatus(line) {
+  const status = line.match(/\b(?:status|result|gate status)\s*:\s*(pass|passed|green|success|succeeded|ok|fail|failed|red|error)\b/i);
+  if (!status) return null;
+  return /fail|red|error/i.test(status[1]) ? 'fail' : 'pass';
+}
+
+function inlineCommandStatus(line) {
+  if (/\b(fail|failed|red|error)\b/i.test(line)) return 'fail';
+  if (/\b(pass|passed|green|success|succeeded|ok)\b/i.test(line)) return 'pass';
+  return null;
+}
+
+function extractCommandStatuses(text) {
+  const entries = [];
+  let currentCommand = null;
   for (const line of text.split(/\r?\n/)) {
-    const backtick = line.match(/`([^`\n]+)`/);
-    const labeled = line.match(/\bcommand\s*:\s*([^;]+?)(?:\s{2,}|\s+status\s*:|\s+result\s*:|$)/i);
-    const command = backtick ? backtick[1].trim() : (labeled ? labeled[1].trim() : null);
-    if (!command) continue;
-    if (/\b(pass|passed|green|success|succeeded|ok)\b/i.test(line)) {
-      commands.push(command);
+    const command = extractCommand(line);
+    if (command) {
+      currentCommand = command;
+      const status = explicitStatus(line) || inlineCommandStatus(line);
+      if (status) entries.push({ command, status });
+      continue;
     }
+
+    if (!currentCommand) continue;
+    const status = explicitStatus(line);
+    if (status) entries.push({ command: currentCommand, status });
   }
-  return [...new Set(commands)];
+  return entries;
 }
 
 function checkBuildEvidence(projectRoot, result) {
@@ -133,6 +173,25 @@ function checkBuildEvidence(projectRoot, result) {
   const file = relToAbs(projectRoot, relPath);
   if (!fs.existsSync(file)) return;
   const text = fs.readFileSync(file, 'utf8');
+  const failedCommands = extractFailedCommands(text);
+  if (failedCommands.length > 0) {
+    const finding = makeFinding(
+      'build-verification-failed-command',
+      'error',
+      relPath,
+      `Build state records failed verification command(s): ${failedCommands.join(', ')}.`
+    );
+    result.findings.push(finding);
+    addFindingSummary(result.summary, finding.severity);
+    result.checks.push(makeCheck(
+      'build-verification-failed-command',
+      'fail',
+      relPath,
+      finding.reason
+    ));
+    result.summary.buildVerificationFailedCommands = failedCommands;
+    return;
+  }
   const passedCommands = extractPassedCommands(text);
   if (passedCommands.length === 0) {
     const finding = makeFinding(
@@ -265,6 +324,8 @@ function render(result) {
 module.exports = {
   check,
   checkAsync,
+  extractCommandStatuses,
+  extractFailedCommands,
   extractPassedCommands,
   exitCode,
   render

package/lib/host-capabilities.js

@@ -48,6 +48,48 @@ function installedAgentSurfaces(homeDir) {
   };
 }
 
+function detectMcpAvailability(projectRoot, opts = {}) {
+  if (opts.mcp) return opts.mcp;
+  if (Object.prototype.hasOwnProperty.call(opts, 'mcpAvailable')) {
+    return {
+      available: Boolean(opts.mcpAvailable),
+      source: opts.mcpAvailable ? (opts.mcpSource || 'override') : 'override'
+    };
+  }
+
+  const env = opts.env || process.env;
+  if (env.GODPOWERS_MCP === '1' || env.GODPOWERS_MCP === 'true') {
+    return { available: true, source: 'environment' };
+  }
+
+  const root = projectRoot || process.cwd();
+  if (exists(path.join(root, 'packages', 'mcp', 'package.json'))) {
+    return { available: true, source: 'workspace package' };
+  }
+
+  try {
+    require.resolve('@godpowers/mcp/package.json', { paths: [root, __dirname] });
+    return { available: true, source: 'installed package' };
+  } catch (error) {
+    // Continue to host registration detection.
+  }
+
+  const homeDir = opts.homeDir || os.homedir();
+  const codexConfig = path.join(homeDir, '.codex', 'config.toml');
+  if (exists(codexConfig)) {
+    try {
+      const text = fs.readFileSync(codexConfig, 'utf8');
+      if (/\[mcp_servers\.godpowers\]/.test(text)) {
+        return { available: true, source: 'codex registration' };
+      }
+    } catch (error) {
+      return { available: false, source: 'codex registration unreadable' };
+    }
+  }
+
+  return { available: false, source: 'not configured' };
+}
+
 function detect(projectRoot, opts = {}) {
   const env = opts.env || process.env;
   const homeDir = opts.homeDir || os.homedir();
@@ -62,6 +104,7 @@ function detect(projectRoot, opts = {}) {
   const extensionAuthoring = exists(path.join(root, 'lib', 'extension-authoring.js'))
     && exists(path.join(root, 'schema', 'extension-manifest.v1.json'));
   const suiteReleaseDryRun = exists(path.join(root, 'lib', 'suite-state.js'));
+  const mcp = detectMcpAvailability(root, opts);
 
   const gaps = [];
   if (!shell) gaps.push('shell unavailable');
@@ -86,6 +129,7 @@ function detect(projectRoot, opts = {}) {
       npm,
       gh,
       agentSpawn,
+      mcp,
       codeIntelligence: codeIntel,
       extensionAuthoring,
       suiteReleaseDryRun
@@ -97,9 +141,13 @@ function detect(projectRoot, opts = {}) {
 
 function summary(report) {
   if (!report) return 'unknown';
-  if (report.level === 'full') return `full on ${report.host}`;
+  const mcp = report.guarantees && report.guarantees.mcp;
+  const mcpText = mcp && mcp.available
+    ? `; MCP available via ${mcp.source}`
+    : '; MCP not configured';
+  if (report.level === 'full') return `full on ${report.host}${mcpText}`;
   const gap = report.gaps && report.gaps.length > 0 ? `, ${report.gaps[0]}` : '';
-  return `${report.level} on ${report.host}${gap}`;
+  return `${report.level} on ${report.host}${gap}${mcpText}`;
 }
 
 function render(report) {
@@ -112,6 +160,7 @@ function render(report) {
   lines.push(`  Git: ${report.guarantees.git || 'not detected'}`);
   lines.push(`  npm: ${report.guarantees.npm || 'not detected'}`);
   lines.push(`  GitHub CLI: ${report.guarantees.gh || 'not detected'}`);
+  lines.push(`  MCP: ${report.guarantees.mcp.available ? `available via ${report.guarantees.mcp.source}` : 'not configured'}`);
   lines.push(`  Code intelligence: ${codeIntelligence.summary(report.guarantees.codeIntelligence)}`);
   lines.push(`  Gaps: ${report.gaps.length > 0 ? report.gaps.join('; ') : 'none'}`);
   return lines.join('\n');
@@ -124,6 +173,7 @@ module.exports = {
   _private: {
     commandVersion,
     hostName,
-    installedAgentSurfaces
+    installedAgentSurfaces,
+    detectMcpAvailability
   }
 };

package/lib/installer-args.js

@@ -5,6 +5,7 @@ const COMMANDS = new Set([
   'status',
   'next',
   'quick-proof',
+  'mcp-info',
   'automation-status',
   'automation-setup',
   'dogfood',

package/lib/installer-files.js

@@ -65,7 +65,7 @@ function copyRecursive(src, dest, root) {
 
 function copyRuntimeBundle(srcDir, destDir) {
   ensureDir(destDir);
-  for (const dir of ['lib', 'routing', 'workflows', 'schema', 'templates', 'references']) {
+  for (const dir of ['bin', 'lib', 'routing', 'workflows', 'schema', 'templates', 'references']) {
     const src = path.join(srcDir, dir);
     if (fs.existsSync(src)) {
       copyRecursive(src, path.join(destDir, dir));

package/lib/mcp-info.js

@@ -0,0 +1,93 @@
+const path = require('path');
+
+const identity = require('./package-identity');
+
+const MCP_PACKAGE = '@godpowers/mcp';
+
+function projectPath(projectRoot) {
+  return path.resolve(projectRoot || process.cwd());
+}
+
+function serverCommand(projectRoot, version = identity.PACKAGE_VERSION) {
+  return {
+    command: 'npx',
+    args: [
+      '-y',
+      '-p',
+      `${identity.PACKAGE_NAME}@${version}`,
+      '-p',
+      `${MCP_PACKAGE}@${version}`,
+      'godpowers-mcp',
+      'serve',
+      '--project',
+      projectPath(projectRoot)
+    ]
+  };
+}
+
+function setupCommand(projectRoot, version = identity.PACKAGE_VERSION) {
+  return {
+    command: 'npx',
+    args: [
+      '-y',
+      '-p',
+      `${identity.PACKAGE_NAME}@${version}`,
+      '-p',
+      `${MCP_PACKAGE}@${version}`,
+      'godpowers-mcp',
+      'setup',
+      '--host=codex',
+      '--project',
+      projectPath(projectRoot),
+      '--write'
+    ]
+  };
+}
+
+function info(projectRoot, version = identity.PACKAGE_VERSION) {
+  const project = projectPath(projectRoot);
+  return {
+    package: MCP_PACKAGE,
+    version,
+    project,
+    boundary: 'The MCP SDK dependency is isolated in @godpowers/mcp. The main godpowers package has no production dependencies.',
+    tools: ['status', 'next', 'gate_check', 'lint_artifact', 'trace_requirement'],
+    server: serverCommand(project, version),
+    setup: setupCommand(project, version),
+    automaticRegistration: false
+  };
+}
+
+function renderCommand(command) {
+  return `${command.command} ${command.args.join(' ')}`;
+}
+
+function render(result) {
+  return [
+    'Godpowers MCP',
+    '',
+    `Package: ${result.package}@${result.version}`,
+    `Project: ${result.project}`,
+    `Boundary: ${result.boundary}`,
+    '',
+    'Tools:',
+    `  ${result.tools.join(', ')}`,
+    '',
+    'Run server:',
+    `  ${renderCommand(result.server)}`,
+    '',
+    'Opt-in Codex setup:',
+    `  ${renderCommand(result.setup)}`,
+    '',
+    'Automatic registration: disabled'
+  ].join('\n');
+}
+
+module.exports = {
+  MCP_PACKAGE,
+  serverCommand,
+  setupCommand,
+  info,
+  render,
+  renderCommand
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "godpowers",
-  "version": "2.5.1",
+  "version": "2.6.0",
   "description": "AI-powered development system: 112 slash commands and 40 specialist agents that take a project from raw idea to hardened production. Runs inside Claude Code, Codex, Cursor, Windsurf, Gemini, and 10+ other AI coding tools.",
   "bin": {
     "godpowers": "./bin/install.js"
@@ -22,13 +22,18 @@
     "test:linter": "node scripts/test-artifact-linter.js",
     "test:diff": "node scripts/test-artifact-diff.js",
     "test:e2e": "node tests/integration/full-arc.test.js",
+    "test:mcp": "npm --workspace @godpowers/mcp test",
     "coverage": "c8 --reporter=text --reporter=lcov node scripts/run-tests.js",
     "coverage:lib": "c8 --include=lib/**/*.js --check-coverage --lines 90 --reporter=text node scripts/run-tests.js",
     "test:audit": "npm audit --omit=dev && git diff --check && npm run test:surface",
     "pack:check": "node scripts/check-package-contents.js",
-    "release:check": "npm run coverage:lib && npm run test:audit && npm run pack:check",
+    "pack:mcp:check": "npm --workspace @godpowers/mcp run pack:check",
+    "release:check": "npm run coverage:lib && npm run test:audit && npm run pack:check && npm run pack:mcp:check",
     "lint": "node scripts/static-check.js"
   },
+  "workspaces": [
+    "packages/mcp"
+  ],
   "keywords": [
     "ai",
     "ai-agent",

package/skills/god-next.md

@@ -22,7 +22,8 @@ routing definitions, recipes, command families, and user intent.
 3. Read routing definitions from `<runtimeRoot>/routing/*.yaml` and recipes from `<runtimeRoot>/routing/recipes/*.yaml`.
 4. Load `<runtimeRoot>/lib/command-families.js` before resolving broad intent.
 5. Load `<runtimeRoot>/lib/dashboard.js` and render the shared dashboard before route-specific detail.
-6. If no dashboard module is available, say `Dashboard engine: unavailable, manual scan used`.
+6. Prefer the MCP `next` tool when it is available, and fall back to the CLI or runtime module when it is not.
+7. If no dashboard module is available, say `Dashboard engine: unavailable, manual scan used`.
 
 ## Required references
 

package/skills/god-status.md

@@ -31,10 +31,11 @@ proactive checks, blockers, planning visibility, and the next action first.
 1. Check whether `.godpowers/PROGRESS.md` or `.godpowers/state.json` exists. If neither exists, report that no Godpowers project was found and suggest `/god-init`.
 2. Resolve the runtime root and load `<runtimeRoot>/lib/dashboard.js`.
 3. Call `dashboard.compute(projectRoot)` and render with `dashboard.render(result)`.
-4. Use PROGRESS.md only as fallback or legacy explanation when state.json is missing.
-5. Scan canonical artifact paths for PRD, design, architecture, roadmap, stack, repo, build, deploy, observe, launch, harden, sync, checkpoint, and requirements evidence.
-6. Compare disk state to recorded state and flag phantom resume or untracked work.
-7. Offer `/god-repair` when recorded state and disk evidence conflict.
+4. Prefer the MCP `status` tool when it is available, and fall back to the CLI or runtime module when it is not.
+5. Use PROGRESS.md only as fallback or legacy explanation when state.json is missing.
+6. Scan canonical artifact paths for PRD, design, architecture, roadmap, stack, repo, build, deploy, observe, launch, harden, sync, checkpoint, and requirements evidence.
+7. Compare disk state to recorded state and flag phantom resume or untracked work.
+8. Offer `/god-repair` when recorded state and disk evidence conflict.
 
 ## Required reference