feat: add Sonatype Guide plugin

[saoudrizwan]

sonatype-guide

Adds a Sonatype Guide plugin for dependency security, version recommendations, license and policy checks, malicious package detection, and supply-chain risk review.

The plugin bundles a dependency review skill and conditionally registers the sonatype-guide remote MCP server when SONATYPE_GUIDE_TOKEN is available in the Cline environment. If the token is not set, the plugin still provides the skill and safety rule, but does not write an unusable MCP entry.

Cline Primitives

• MCP: sonatype-guide connects to Sonatype Guide over Streamable HTTP using a bearer token from SONATYPE_GUIDE_TOKEN.
• Skills: dependency evaluation, upgrade advice, project audits, package comparisons, PURL construction, vulnerability interpretation, and policy compliance review.
• Rules: dependency mutation guardrails, token handling, untrusted output handling, and guidance for missing MCP configuration.

Requirements

Users need a Sonatype Guide account, an API token, and network access to https://mcp.guide.sonatype.com/mcp.

SONATYPE_GUIDE_TOKEN must be set in the environment where Cline loads plugins before installing or re-enabling the plugin if users want the MCP server registered. Without that token, the plugin intentionally skips MCP registration so Cline does not persist a broken static header.

Trust Boundaries

When MCP tools are used, package coordinates from manifests or lockfiles are sent to Sonatype Guide for analysis. The returned vulnerability, license, policy, dependency, and package metadata should be treated as private and untrusted.

The MCP Authorization header is persisted in Cline's plugin-owned MCP settings while the plugin is installed or enabled. Disabling or uninstalling the plugin removes the plugin-owned MCP entry.

The bundled workflow asks before dependency manifest changes, lockfile changes, version changes, or package manager install/update commands, and it avoids claiming a dependency has been checked when MCP tools are unavailable.

[saoudrizwan]

Closing this plugin PR for now because this cleanup pass is limiting plugin marketplace PRs to plugins that only bundle MCP servers and/or skills. This PR includes additional plugin primitive(s): rules.

Those primitives may still be useful, but we are keeping this batch scoped to MCP and skill distribution.