MCP server · Audited from source

Git MCP server

by idosal/git-mcpApache-2.0 licenceAudited 20 Sep 2026 · source fbd3556f2e5f

npm git-mcp 1.0.0sse★ 8,411

✕BLOCKGrade D · 69/100 · 20 Sep 2026 · fbd3556

Safer alternatives View source on GitHub ↗

Is it safe? No — BLOCK, grade D (69/100). It exposes 9 tools: 9 read, 0 write and 0 destructive. The audit recorded 17 findings (0 critical, 2 high, 1 medium, 9 low). Maintainer's description: Put an end to code hallucinations! GitMCP is a free, open-source, remote MCP server for any GitHub project

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Git MCP server (idosal/git-mcp)”. Retrieved 20 Sep 2026. https://modelsatlas.com/mcp/idosal/git-4

Why this is BLOCK. The audit found 0 critical and 2 high findings; the most severe is Code injection at worker-configuration.d.ts:2235. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

2 MCP servers are called Git. You are viewing idosal/git-mcp. Compare all 2 →

idosal/git-mcp★ 8,411✕BLOCK
cyanheads/git-mcp-server★ 239✕BLOCK

Trust audit

Audit 0.4.1 · full source read 20 Sep 2026

Trust score69/100✕BLOCK D

0 critical2 high1 medium9 low5 info

17 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared5 observations
NetworkDeclared4 observations
ShellDeclared2 observations
DependenciesNot pinnedSome ranges float
SecretsNone foundNo keys in source

Findings (17)

Sorted by severity

HIGHCode injectioncode.eval_exec · worker-configuration.d.ts:2235

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

exec(input?: (string | URLPatternInit), baseURL?: string): URLPatternResult | null;

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

HIGHCode injectioncode.eval_exec · worker-configuration.d.ts:4670

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

exec(query: string): Promise<D1ExecResult>;

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

MEDIUMInventory / provenanceinv.symlink · static/img

F-13 Inventory / provenanceCWE-1104Layer L0

static/img

Why: link not followed
Fix: —

LOWFilesystem / pathfs.traversal · .react-router/types/app/routes/+types/$.ts:6

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import type { Info as Parent0 } from "../../+types/root.js"

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · .react-router/types/app/routes/+types/_index.ts:6

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import type { Info as Parent0 } from "../../+types/root.js"

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · .react-router/types/app/routes/+types/api.chat.ts:6

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import type { Info as Parent0 } from "../../+types/root.js"

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · app/components/content.tsx:3

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import type { UrlType } from "../../src/shared/repoData";

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · app/components/content.tsx:4

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { generateServerName } from "../../src/shared/nameUtils";

Why: No further detail recorded for this rule.
Fix: —

LOWObfuscation / stealthobf.decode_call · worker-configuration.d.ts:220

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

atob(data: string): string;

Why: No further detail recorded for this rule.
Fix: —

LOWObfuscation / stealthobf.decode_call · worker-configuration.d.ts:306

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

declare function atob(data: string): string;

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainsupply.unpinned · package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@ai-sdk/anthropic, @ai-sdk/cohere, @ai-sdk/google, @ai-sdk/groq, @ai-sdk/openai, @ai-sdk/react, @ai-sdk/xai, @cloudflare/workers-oauth-provider

Why: 66 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWPrompt injectionprompt.credential_read · .github/CONTRIBUTING.md:56

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

- Add any necessary environment variables (ask project maintainers if you need access to specific API keys)

Why: asks the agent to read credentials
Fix: —

INFOInventory / provenanceinv.oversize · img/GitMCP_PW.mp4

F-13 Inventory / provenanceCWE-1104Layer L0

img/GitMCP_PW.mp4

Why: 9170599 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · img/GitMCP_final.mp4

F-13 Inventory / provenanceCWE-1104Layer L0

img/GitMCP_final.mp4

Why: 12447559 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · img/cover.png

F-13 Inventory / provenanceCWE-1104Layer L0

img/cover.png

Why: 1373072 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · public/img/GitMCP_PW.mp4

F-13 Inventory / provenanceCWE-1104Layer L0

public/img/GitMCP_PW.mp4

Why: 9170599 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · public/img/GitMCP_final.mp4

F-13 Inventory / provenanceCWE-1104Layer L0

public/img/GitMCP_final.mp4

Why: 12447559 bytes not read
Fix: —

Tools it exposes

9 declared in source · 0 destructive

9 read0 write0 destructive

Tool	What it does	Risk
`fetch_documentation`	Fetch documentation for a repository (URL will be provided when called).	read
`fetch_generic_documentation`	Fetch documentation for any GitHub repository by providing owner and project name	read
`fetch_generic_url_content`	Generic tool to fetch content from any absolute URL, respecting robots.txt rules. Use this to retrieve referenced urls (absolute urls) that were mentioned in previously fetched documentation.	read
`fetch_threejs_urls_inside_docs`	Fetch content from URLs that are inside the reference docs. Usually contains	read
`match_common_libs_owner_repo_mapping`	Match a library name to an owner/repo. Don	read
`search_documentation`	Search documentation for a repository (URL will be provided when called).	read
`search_generic_code`	Search for code in any GitHub repository by providing owner, project name, and search query. Returns matching files. Supports pagination with 30 results per page.	read
`search_generic_documentation`	Semantically search in documentation for any GitHub repository by providing owner, project name, and search query. Useful for specific queries.	read
`search_threejs_documentation`	Semantically search the repository documentation for the given query. Use this if you need to find information you don	read

Safer alternatives

All git & code hosting servers →

Git Ingest✓SAFE

adhikasp/mcp-git-ingest

A Model Context Protocol (MCP) server that helps read GitHub repository structure and important files.

2 readGrade B

Overleaf CLI✓SAFE

aloth/olcli

Overleaf CLI - pull, push, sync, compile LaTeX projects from your terminal. Git remote helper, MCP server for AI agents, and TypeScript library.

1 destructiveGrade B

Gitingest✓SAFE

puravparab/gitingest-mcp

mcp server for gitingest

3 readGrade B

Audit history

2026-09-20
✕BLOCK D 69 / 100
Source changed, verdict held · fbd3556f2e5f

README badge

Badges show the current verdict, BLOCK included

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Git MCP server

What is the Git MCP server?

Put an end to code hallucinations! GitMCP is a free, open-source, remote MCP server for any GitHub project

What tools does Git expose?

9 in total: 9 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Git safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does Git need?

It reads GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Git run?

It speaks sse, so it runs as a service you connect to over the network. It is published on npm as git-mcp at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (fbd3556f2e5f), read on 2026-09-20. The repository is watched and re-audited when it changes.

Which Git MCP server is the right one?

2 unrelated servers share the name “Git”; compare them side by side before you install.

I already installed Git. What should I do?

Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.

Can the verdict change?

Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

idosal/git-mcp on GitHub — the source we read, its licence, stars and activityObserved · 20 Sep 2026
ModelsAtlas trust audit — BLOCK verdict for commit fbd3556f2e5fObserved · 20 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Git MCP server?
GChatGPT CClaude PPerplexity
What tools does Git expose?
GChatGPT CClaude PPerplexity
Is Git safe to connect to an agent?
GChatGPT CClaude PPerplexity