By Go developers have scraped pkg.go.dev for years. There was no official API, so tool authors, IDE plugin developers, and anyone building automation had to reverse-engineer the HTML and hope the next UI update didn’t break everything. That workaround era ended on May 21, 2026. The Go team shipped a REST API at pkg.go.dev/api — and built a Model Context Protocol server at pkg.go.dev/mcp alongside it. AI coding agents can now query live Go package data without guessing.
What the API Covers
The pkgsite API provides seven endpoints under the /v1beta path. Each returns structured JSON:
/v1beta/package/{path}— package metadata: module path, version, synopsis/v1beta/module/{path}— module-level metadata/v1beta/versions/{path}— full version history/v1beta/packages/{path}— all packages within a module/v1beta/search— search by keyword, returns structured results/v1beta/imported-by/{path}— which packages import this one/v1beta/vulns/{path}— known vulnerabilities for a module
The API is stateless and GET-only — designed for caching, CI pipelines, and tool integration. An OpenAPI specification is published at pkg.go.dev/api for client generation. The team has committed to backward compatibility: nothing will silently break as v1beta evolves toward a formal v1 release.
The Importers Endpoint Is the One People Actually Wanted
Of everything in this release, imported-by was the longest-requested feature. The tracking issue at the pkgsite repository accumulated years of comments from package maintainers who wanted to know one thing: who depends on my code?
Before this API, answering that question meant scraping pkg.go.dev’s web interface or accepting that you simply wouldn’t know. Now it’s a direct query:
curl "https://pkg.go.dev/api/v1beta/imported-by/github.com/google/go-cmp/cmp"The response is a list of package paths that import your package — cloud.google.com/go/internal/testutil, cuelang.org/go/internal/cuetxtar, and so on. For maintainers evaluating a breaking change, this is no longer a research project. It’s a query.
The MCP Server Is the Bigger Story
The HTTP API is the utility play. The MCP server is the one that changes how Go development works with AI agents.
pkg.go.dev/mcp is live now. Any MCP-compatible AI coding tool — Claude Code, Cursor, or anything built on the MCP spec — can query the Go package registry directly. The Go team stated the goal plainly: “high-quality, fresh data can be provided to agents.”
That matters because it solves a concrete problem. LLMs have training cutoffs. When an agent generates Go code and reaches for an import path, it’s working from memory — and that memory may be months or years out of date. A package that was at v1.2.3 during training might be at v2.1.0 now, with the old API deprecated. Without a live data source, agents pick stale versions and developers get to debug the mismatch.
With pkg.go.dev/mcp, an agent can ask: what is the current latest version of this module? Does it have known vulnerabilities? What packages does it expose? The answers are live, not cached in a model weight.
Getting Started
The fastest way to explore the API is a direct curl against the endpoint you want:
curl "https://pkg.go.dev/api/v1beta/package/github.com/google/go-cmp/cmp"For more structured exploration, the Go team published a reference CLI client:
go install golang.org/x/pkgsite/cmd/pkgsite-cli@latestIt handles pagination and formatting, and it exposes the imported-by query via the --imported-by flag. One important caveat: the CLI’s interface is explicitly marked as unstable. Don’t write production tooling against pkgsite-cli flags — use the HTTP API directly. The API itself carries the stability commitment; the CLI is a reference implementation, not a contract.
Go’s MCP Moment
This release fits into a broader shift in the Go ecosystem. In July 2025, gopls added an experimental MCP server (available since v0.20.0), exposing LSP-powered tools like go_package_api, go_search, and go_symbol_references to AI assistants. That handles local project context — what’s in your current codebase, what references this symbol, what diagnostics does the type checker see.
pkg.go.dev/mcp handles global context — what’s published, what’s current, what’s vulnerable. Together, they give AI coding agents a reasonably complete picture of the Go world: both the code being written and the ecosystem it lives in.
Go has had excellent tooling for a long time. But programmatic access to the package registry was a conspicuous gap — the kind that makes you realize how much of the tooling ecosystem was built on fragile workarounds. The official API closes that gap. The MCP server puts it in reach for the next generation of tooling that doesn’t read HTML.
The full announcement and endpoint reference are on the Go blog. The API specification is at pkg.go.dev/api and the MCP server is live at pkg.go.dev/mcp.
