feat: add Sourcegraph plugin

[saoudrizwan]

sourcegraph

Adds a Sourcegraph plugin for repository-scale code search, navigation, history, diffs, references, definitions, and Deep Search workflows. The plugin is useful when Cline needs to understand large or unfamiliar codebases through an existing Sourcegraph instance instead of relying only on local checkout search.

The skill pack includes query patterns, common search examples, and focused workflows for implementing features, understanding unfamiliar code, debugging issues, fixing bugs, and reviewing changes. The guidance pushes Cline toward narrow repo/file scopes, exact searches before broad searches, and explicit handling of private repository results.

Cline Primitives

MCP: registers sourcegraph as a Streamable HTTP MCP server at <SOURCEGRAPH_ENDPOINT>/.api/mcp when both SOURCEGRAPH_ENDPOINT and SOURCEGRAPH_ACCESS_TOKEN are available in the Cline environment. The server is registered with Authorization: token <SOURCEGRAPH_ACCESS_TOKEN> and exposes Sourcegraph code search, navigation, history, diff, and Deep Search tools.

Skills: bundles searching-sourcegraph with supporting examples and workflow guides for disciplined Sourcegraph use across feature work, code exploration, debugging, bug fixing, and code review.

Rules: adds guardrails for missing MCP configuration, credential handling, private repository scope discipline, and treating Sourcegraph output as private and untrusted.

Requirements

Users need a Sourcegraph instance with MCP enabled and an access token that can use the MCP endpoint. Set SOURCEGRAPH_ENDPOINT to the instance origin, such as https://sourcegraph.example.com, and set SOURCEGRAPH_ACCESS_TOKEN in the environment where Cline loads plugins before installing, re-enabling, or reinstalling the plugin.

If either environment variable is missing, the plugin still installs its skills and rules but does not register a dead MCP server entry.

Trust Boundaries

The MCP Authorization header is persisted in Cline's plugin-owned MCP settings while the plugin is installed and enabled. Disabling or uninstalling the plugin removes that plugin-owned MCP entry.

When the MCP tools are used, search queries, repository names, file paths, and selected code context are sent to the configured Sourcegraph instance. Results may include private code, commit history, diffs, and generated search summaries, so the plugin tells Cline to treat tool output as private and untrusted.

[saoudrizwan]

Closing this plugin PR for now because this cleanup pass is limiting plugin marketplace PRs to plugins that only bundle MCP servers and/or skills. This PR includes additional plugin primitive(s): rules.

Those primitives may still be useful, but we are keeping this batch scoped to MCP and skill distribution.