By ByteBot
Six years. That is how long Go developers waited for pkg.go.dev to grow up and ship a real API. In the meantime, they scraped HTML, broke their tooling on every site redesign, and downloaded packages they did not want just to read a function signature. On May 21, the Go team closed the loop: pkg.go.dev now has an official REST API — and on day one, it also ships an MCP endpoint for AI coding tools.
What Ships
The API lives at https://pkg.go.dev/api with a current path prefix of /v1beta/. It is stateless, GET-only, and OpenAPI-documented from the start — the kind of design that makes results trivially cacheable in CI pipelines. Here are the seven endpoints that matter:
| Endpoint | What you get |
|---|---|
/v1beta/package/{path} | Package synopsis, version, licenses |
/v1beta/module/{path} | Module metadata |
/v1beta/versions/{path} | All published versions |
/v1beta/symbols/{path} | Types, functions, variables |
/v1beta/imported-by/{path} | Reverse dependency graph |
/v1beta/vulns/{path} | Vulnerabilities (OSV format) |
/v1beta/search | Package search |
The Go team also released pkgsite-cli, a reference client that shows you exactly how to consume the API — and serves as a copy-paste starting point for your own integrations.
The MCP Endpoint Changes How AI Tools Work with Go
Shipping an MCP endpoint at https://pkg.go.dev/mcp on launch day was not an afterthought. The Go team explicitly cited AI-assisted coding as a reason to ship this now: “The need for a formalized interface has become even more acute with the rise of AI-assisted coding.” That is an unusual statement from the Go team — they are usually allergic to trends — so when they say the AI tooling era drove this decision, it is worth taking seriously.
In practical terms: Cursor, Claude Code, GitHub Copilot, and any MCP-compatible tool can now query Go module metadata natively. Before this, those tools had no reliable package context for Go. They guessed. They hallucinated import paths, suggested deprecated APIs, and cited module versions that did not exist. That problem has a much cleaner solution now.
The pkg.go.dev MCP endpoint lands alongside gopls’ own experimental MCP server, introduced in gopls v0.20.0. Together, they give AI tools full coverage: module metadata from pkg.go.dev, live diagnostics and symbol resolution from gopls. Go in 2026 is the most AI-tool-friendly it has ever been.
Start Using It in Two Minutes
The fastest way in is pkgsite-cli:
# Install
go install golang.org/x/pkgsite/cmd/internal/pkgsite-cli@latest
# Who depends on go-cmp?
pkgsite-cli package --imported-by github.com/google/go-cmp/cmp
# What symbols does a package export?
pkgsite-cli package --symbols github.com/google/go-cmp/cmp
# All versions of a module
pkgsite-cli module -versions github.com/google/go-cmpFor direct HTTP access, no auth is needed. To check vulnerabilities for a module in a CI script:
curl https://pkg.go.dev/api/v1beta/vulns/golang.org/x/netThe response uses OSV format and integrates cleanly with the rest of the Go security toolchain, including govulncheck.
Six Years and a Closed Issue
GitHub issue #36785 — “API for pkg.go.dev” — was opened in 2020. It accumulated years of upvotes and workarounds. The Go team heard it. The pkg.go.dev API is a direct response to that feedback, and the team said so plainly in the announcement post. Go Weekly’s summary put it cleanly: “No more scraping the HTML.”
The API ships as /v1beta/ now, with a commitment to no breaking changes and a planned migration to /v1/ after a community feedback period. The OpenAPI spec is published, the design is stable-first, and the reference client gives you a clear implementation model. Replace your scraping code. The real API is here.
