ShadowGitSAFE
A Model Context Protocol (MCP) server that provides AI assistants with secure, read-only access to your ShadowGit repositories. This enables powerful debugging and code analysis capabilities by giving AI access to your project's fine-grained git history.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/shadowgit-mcp-server)
A Model Context Protocol (MCP) server that provides AI assistants with secure git access to your ShadowGit repositories, including the ability to create organized commits through the Session API. This enables powerful debugging, code analysis, and clean commit management by giving AI controlled access to your project's git history.
What is ShadowGit?
ShadowGit automatically captures every save as a git commit while also providing a Session API that allows AI assistants to pause auto-commits and create clean, organized commits. The MCP server provides both read access to your detailed development history and the ability to manage AI-assisted changes properly.
Installation
npm install -g shadowgit-mcp-server
Setup with Claude Code
# Add to Claude Code claude mcp add shadowgit -- shadowgit-mcp-server # Restart Claude Code to load the server
Setup with Claude Desktop
Add to your Claude Desktop MCP configuration:
macOS/Linux: ~/.config/Claude/claude_desktop_config.json Windows: %APPDATA%\\Claude\\claude_desktop_config.json
{
"mcpServers": {
"shadowgit": {
"command": "shadowgit-mcp-server"
}
}
}Requirements
- Node.js 18+
- ShadowGit app installed and running with tracked repositories
- Session API requires ShadowGit version >= 0.3.0
- Git available in PATH
How It Works
MCP servers are stateless and use stdio transport:
- The server runs on-demand when AI tools (Claude, Cursor) invoke it
- Communication happens via stdin/stdout, not HTTP
- The server starts when needed and exits when done
- No persistent daemon or background process
Environment Variables
You can configure the server behavior using these optional environment variables:
SHADOWGIT_TIMEOUT- Command execution timeou
6e475d74c063OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add shadowgit-mcp-server -- npx -y [email protected]
{
"mcpServers": {
"shadowgit-mcp-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (5)
2 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
checkpoint | write | Create a git commit with your changes. Call this AFTER completing your work but BEFORE end_session. Creates a clean commit for the user to review. |
end_session | read | End your work session to resume ShadowGit auto-commits. MUST be called AFTER checkpoint to properly close your work session. |
git_command | write | Execute a read-only git command on a ShadowGit repository. Only safe, read-only commands are allowed. |
list_repos | read | List all available ShadowGit repositories. Use this first to discover which repositories you can work with. |
start_session | write | Start a work session. MUST be called BEFORE making any changes. Without this, ShadowGit will create fragmented auto-commits during your work! |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (3 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (6)
import { GitExecutor } from '../../src/core/git-executor';jest.mock('../../src/utils/logger', () => ({'show ../../../etc/passwd',
import { RepositoryManager } from '../../src/core/repository-manager';import { getStorageLocation, fileExists, readJsonFile } from '../../src/utils/file-utils';@modelcontextprotocol/sdk, @jest/globals, @types/jest, @types/node, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, esbuild, eslint
Gates applied: no_behavioural_pass.
6e475d74c063full audit observations/trust-audit/mcp-server/blade47__shadowgit.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 6e475d74c063 | SAFE | B | 89 | first audit |
Questions
What is the ShadowGit MCP server?
A Model Context Protocol (MCP) server that provides AI assistants with secure, read-only access to your ShadowGit repositories. This enables powerful debugging and code analysis capabilities by giving AI access to your project's fine-grained git history.
What tools does ShadowGit expose?
5 in total: 2 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is ShadowGit safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does ShadowGit need?
No credential environment variables were found in its source, so it appears to need none.
How does ShadowGit run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as shadowgit-mcp-server at 1.1.2.
How current is this page?
The grade is for one exact copy of the source (6e475d74c063), read on 2026-10-08. The repository is watched and re-audited when it changes.