Distribute complypack skill and MCP server as a multi-platform plugin

[jpower432]

Is your feature request related to a problem? Please describe.

The complypack skill and MCP server are tightly coupled but distributed separately. The skill overrides agent default behavior to force MCP tool calls instead of generating policy from training data -- without it, agents hallucinate plausible-looking Rego from memory instead of reading actual control definitions. Today the skill is distributed via OpenPackage or manual file copy, and the MCP server requires a locally-built Go binary. This friction reduces adoption and increases misconfiguration across Claude Code, Cursor, and OpenCode.

Describe the solution you'd like

Package both components as a single distributable unit using a container-hosted MCP server on GHCR and native per-platform plugin manifests.

Container image (ghcr.io/complytime/complypack): packages the Go binary. Every MCP client that supports stdio transport consumes it identically via docker run --rm -i.

Per-platform plugin manifests: each platform has its own plugin discovery format. Ship a manifest for each so the skill is auto-discovered and the MCP config references the container.

  plugin/
    .claude-plugin/
      plugin.json
    .cursor-plugin/
      plugin.json
    .opencode/
      INSTALL.md
    skills/
      complypack/
        SKILL.md               # Single source of truth
    .mcp.json                  # References container image
    INSTALL.md

MCP config pattern (all platforms):

{
  "mcpServers": {
    "complypack": {
      "command": "docker",
      "args": ["run", "--rm", "-i",
               "-v", "./complypack.yaml:/config/complypack.yaml:ro",
               "ghcr.io/complytime/complypack:v2.0.0",
               "mcp", "serve", "--config", "/config/complypack.yaml"]
    }
  }
}

Platform	Skill Discovery	MCP Server	Install Method
Claude Code	.claude-plugin/plugin.json + skills/	.mcp.json auto-started	/plugin install or --plugin-dir
Cursor	.cursor-plugin/plugin.json + skills field	Project .cursor/mcp.json (manual)	Copy or git reference
OpenCode	.opencode/skills/ or plugin entry	opencode.json MCP config (manual)	plugin array in opencode.json

Milestones:

Milestone	Checkpoint	Activity
1. Container Image	1.1	Create multi-stage Dockerfile for complypack Go binary
	1.2	Create GitHub Actions workflow to build and push to GHCR on version tags
	1.3	Verify docker run --rm -i ghcr.io/complytime/complypack mcp serve works with stdio transport
2. Plugin Manifests	2.1	Create .claude-plugin/plugin.json manifest and .mcp.json referencing container
	2.2	Create .cursor-plugin/plugin.json manifest with skills field
	2.3	Create OpenCode integration files
	2.4	Restructure skills/complypack/ into plugin directory layout
3. Docs and Cleanup	3.1	Write per-platform install instructions
	3.2	Remove openpackage.yml and legacy symlink setup
	3.3	Update README with plugin install instructions

Describe alternatives you've considered

• OpenPackage (current): Universal CLI package manager for AI agent configs. Supports cross-platform install via opkg install. Adds an external dependency for a problem solvable with native plugin formats.

• skills-installer CLI (Kamalnrf/claude-plugins): Community registry that auto-indexes GitHub repos with SKILL.md files. Covers 15+ clients. Zero packaging work, but only distributes skills -- no MCP server bundling. Solves half the problem.

• Binary in plugin bin/ directory: Claude Code plugins support a bin/ directory that is added to PATH. Ship pre-built platform binaries or a download-on-first-use bootstrap script. Avoids the Docker dependency but introduces binary distribution complexity (multi-arch builds, large repo size, or network fetch on first run).

• Container-only (no skill): Publish only the container to GHCR. MCP config works across all platforms. But without the skill, agents fall back to training data instead of calling MCP tools -- the skill is the behavioral constraint that makes the MCP server effective.

Additional context
The Superpowers plugin (github.com/obra/superpowers) demonstrates the multi-manifest pattern: one shared skills/ directory with per-platform adapters (.claude-plugin/plugin.json, .cursor-plugin/plugin.json, gemini-extension.json, .opencode/INSTALL.md). Complypack can follow the same structure, with the addition of a container-based MCP server that Superpowers
does not need (Superpowers is skills-only, no MCP).