Add plugin trace-mcp

[nikolai-vysotskyi]

What changes

Adds plugins/nikolai-vysotskyi/trace-mcp: a portable Agent Plugins 1.0 package for trace-mcp, a local code-intelligence MCP server. Upstream: https://github.com/nikolai-vysotskyi/trace-mcp

Contents: plugin.json, mcp.json (one stdio server, bare trace-mcp command), README.md, MIT LICENSE, and four skills (trace-mcp, trace-mcp-refactoring, trace-mcp-codemod, trace-mcp-pre-commit).

User value

A MiniMax Code user can ask who calls a function and what breaks if its signature changes, and get the answer from the index instead of the agent reading files one by one.

Example prompt:

Find every caller of `validateHostedPluginDirectory` in this repo and tell me what breaks if I change its signature.

Expected result: the agent calls the trace-mcp search and impact tools and answers with the call sites plus the blast radius, without opening each file. On an unindexed project the agent runs trace init once first.

Plugin submission checklist

• Plugin lives at plugins/<github-owner>/<plugin-name>.
• plugin.json name matches the Plugin directory.
• README.md includes a real example prompt and expected result.
• LICENSE and plugin.json declare an open-source license (MIT in both, same as upstream).
• Required executables, accounts, paid services, and supported platforms are disclosed (Node.js 22+, trace-mcp on PATH via npm install -g trace-mcp, macOS/Linux/Windows; no account, no paid service, no key).
• Network destinations and data handled by the plugin are disclosed (index stays on the user's machine; at most one anonymous usage ping per day with the exact opt-outs; nothing else leaves the machine).
• No credentials, private endpoints, hidden telemetry, installers, symlinks, or native binaries are included (the one ping is documented in README under Data and network, not hidden).
• Every scaffold TODO has been replaced (no TODO string in the package; verified by search).
• npm run check passes (left to CI; see Evidence).

Evidence

I read scripts/lib/validation.mjs and checked this package against it without executing repo code: owner and plugin names match the required patterns, plugin.json name equals the directory, all manifest fields are in the allowed set, mcp.json holds one stdio server with a bare command, 4 skill directories (limit 64) each with frontmatter name equal to the directory and a non-empty body, non-empty README.md and LICENSE, zero symlinks. The shipped plugin.json, mcp.json, and skill files are byte-identical to the ones at the upstream repo root and in its skills/ directory, where other runtimes already consume them; the only new file is the hosted README.md.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}