feat: add git-explorer MCP server for read-only repository access

Implements a new MCP server that provides read-only access to git
repositories using go-git. Designed for deployment verification by
comparing deployed flake revisions against source repositories.

9 tools: resolve_ref, get_log, get_commit_info, get_diff_files,
get_file_at_commit, is_ancestor, commits_between, list_branches,
search_commits.

Includes CLI commands, NixOS module, and comprehensive tests.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CLAUDE.md

@@ -26,6 +26,12 @@ Query Prometheus metrics, Alertmanager alerts, and Loki logs. Unlike other serve
 - 3 optional Loki tools (when `LOKI_URL` is set): query_logs, list_labels, list_label_values
 - Configurable Prometheus, Alertmanager, and Loki URLs via flags or environment variables
 
+### Git Explorer (`git-explorer`)
+Read-only access to git repository information. Designed for deployment verification.
+- 9 tools: resolve_ref, get_log, get_commit_info, get_diff_files, get_file_at_commit, is_ancestor, commits_between, list_branches, search_commits
+- Uses go-git library for pure Go implementation
+- All operations are read-only (never modifies repository)
+
 The nixpkgs/options/hm servers share a database-backed architecture:
 - Full-text search across option/package names and descriptions
 - Query specific options/packages with full metadata
@@ -62,8 +68,10 @@ labmcp/
 │   │   └── main.go             # NixOS options CLI (legacy)
 │   ├── hm-options/
 │   │   └── main.go             # Home Manager options CLI
-│   └── lab-monitoring/
-│       └── main.go             # Prometheus/Alertmanager CLI
+│   ├── lab-monitoring/
+│   │   └── main.go             # Prometheus/Alertmanager CLI
+│   └── git-explorer/
+│       └── main.go             # Git repository explorer CLI
 ├── internal/
 │   ├── database/
 │   │   ├── interface.go        # Store interface (options + packages)
@@ -96,18 +104,26 @@ labmcp/
 │   │   ├── parser.go           # nix-env JSON parsing
 │   │   ├── types.go            # Package types, channel aliases
 │   │   └── *_test.go           # Parser tests
-│   └── monitoring/
-│       ├── types.go            # Prometheus/Alertmanager/Loki API types
-│       ├── prometheus.go       # Prometheus HTTP client
-│       ├── alertmanager.go     # Alertmanager HTTP client
-│       ├── loki.go             # Loki HTTP client
+│   ├── monitoring/
+│   │   ├── types.go            # Prometheus/Alertmanager/Loki API types
+│   │   ├── prometheus.go       # Prometheus HTTP client
+│   │   ├── alertmanager.go     # Alertmanager HTTP client
+│   │   ├── loki.go             # Loki HTTP client
+│   │   ├── handlers.go         # MCP tool definitions + handlers
+│   │   ├── format.go           # Markdown formatting utilities
+│   │   └── *_test.go           # Tests (httptest-based)
+│   └── gitexplorer/
+│       ├── client.go           # go-git repository wrapper
+│       ├── types.go            # Type definitions
 │       ├── handlers.go         # MCP tool definitions + handlers
-│       ├── format.go           # Markdown formatting utilities
-│       └── *_test.go           # Tests (httptest-based)
+│       ├── format.go           # Markdown formatters
+│       ├── validation.go       # Path validation
+│       └── *_test.go           # Tests
 ├── nix/
 │   ├── module.nix                  # NixOS module for nixos-options
 │   ├── hm-options-module.nix       # NixOS module for hm-options
 │   ├── lab-monitoring-module.nix   # NixOS module for lab-monitoring
+│   ├── git-explorer-module.nix     # NixOS module for git-explorer
 │   └── package.nix                 # Parameterized Nix package
 ├── testdata/
 │   └── options-sample.json     # Test fixture
@@ -158,6 +174,20 @@ labmcp/
 | `list_labels` | List available label names from Loki (requires `LOKI_URL`) |
 | `list_label_values` | List values for a specific label from Loki (requires `LOKI_URL`) |
 
+### Git Explorer Server (git-explorer)
+
+| Tool | Description |
+|------|-------------|
+| `resolve_ref` | Resolve a git ref (branch, tag, commit) to its full commit hash |
+| `get_log` | Get commit log with optional filters (author, path, limit) |
+| `get_commit_info` | Get full details for a specific commit |
+| `get_diff_files` | Get list of files changed between two commits |
+| `get_file_at_commit` | Get file contents at a specific commit |
+| `is_ancestor` | Check if one commit is an ancestor of another |
+| `commits_between` | Get all commits between two refs |
+| `list_branches` | List all branches in the repository |
+| `search_commits` | Search commit messages for a pattern |
+
 ## Key Implementation Details
 
 ### Database
@@ -261,6 +291,20 @@ lab-monitoring labels                         # List Loki labels
 lab-monitoring labels --values job            # List values for a label
 ```
 
+### git-explorer
+```bash
+git-explorer serve                            # Run MCP server on STDIO
+git-explorer serve --transport http           # Run MCP server on HTTP
+git-explorer --repo /path resolve <ref>       # Resolve ref to commit hash
+git-explorer --repo /path log --limit 10      # Show commit log
+git-explorer --repo /path show <ref>          # Show commit details
+git-explorer --repo /path diff <from> <to>    # Files changed between commits
+git-explorer --repo /path cat <ref> <path>    # File contents at commit
+git-explorer --repo /path branches            # List branches
+git-explorer --repo /path search <query>      # Search commit messages
+git-explorer --version                        # Show version
+```
+
 ### Channel Aliases
 
 **nixpkgs-search/nixos-options**: `nixos-unstable`, `nixos-stable`, `nixos-24.11`, `nixos-24.05`, etc.
@@ -314,6 +358,7 @@ Each package's version is defined in multiple places that must stay in sync *for
 - **nixpkgs-search**: `cmd/nixpkgs-search/main.go` + `internal/mcp/server.go` (`DefaultNixOSConfig`, `DefaultNixpkgsPackagesConfig`)
 - **nixos-options**: `cmd/nixos-options/main.go` + `internal/mcp/server.go` (`DefaultNixOSConfig`)
 - **hm-options**: `cmd/hm-options/main.go` + `internal/mcp/server.go` (`DefaultHomeManagerConfig`)
+- **git-explorer**: `cmd/git-explorer/main.go` + `internal/mcp/server.go` (`DefaultGitExplorerConfig`)
 - **nix/package.nix**: Shared across all packages (bump to highest version when any package changes)
 
 ### User Preferences
@@ -341,6 +386,7 @@ nix build .#nixpkgs-search
 nix build .#nixos-options
 nix build .#hm-options
 nix build .#lab-monitoring
+nix build .#git-explorer
 
 # Run directly
 nix run .#nixpkgs-search -- options serve
@@ -349,6 +395,7 @@ nix run .#nixpkgs-search -- index nixos-unstable
 nix run .#hm-options -- serve
 nix run .#hm-options -- index hm-unstable
 nix run .#lab-monitoring -- serve
+nix run .#git-explorer -- --repo . serve
 ```
 
 ### Indexing Performance