gitwarren-appBLOCK
Code review for your own machines and your own agents. Reviews live where the code does — reached over SSH, WSL or your own tailnet. Desktop app or just a browser tab. No server, no account.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/klarluft/gitwarren-app/actions/workflows/ci.yml) [](https://www.npmjs.com/package/gitwarren) [](https://www.npmjs.com/package/gitwarren) [](LICENSE) [](https://glama.ai/mcp/servers/klarluft/gitwarren-app)
Code review for your own git repositories, on your own machines. Your machines, your agents, no one else's server — and no account.
Built for the moment a coding agent — Claude Code, Codex, or anything else that edits files on your disk — has just finished, and its work is sitting in your worktree uncommitted. Read that diff here, on your own machine, before it becomes a commit.
[gitwarren.com](https://gitwarren.com) has downloads for macOS, Windows and Linux.
What it does
Tell GitWarren which local git repositories you care about, then open reviews against them — a review is a comparison of two refs, presented the way a pull request is, with conversation, commits and files changed tabs.
- Review work before it is a commit. If the branch you are reviewing is
checked out in a worktree, GitWarren finds that worktree — wherever it is — and folds its staged, unstaged and untracked changes into the diff. That is exactly when review is most useful, and it is the p
8f4d1fa2c9a3OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add gitwarren -- npx -y [email protected] mcp
Exposed tools (17)
8 read · 6 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add_repository | write | |
add_review_comment | write | |
agent_identity | read | |
create_review | write | |
delete_review_comment | destructive | |
get_repository | read | |
get_review | read | |
list_repositories | read | |
list_review_comments | read | |
list_reviews | read | |
remove_repository | destructive | |
remove_review | destructive | |
reply_to_review_comment | read | |
resolve_review_comment | read | |
update_repository | write | |
update_review | write | |
update_review_comment | write |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (10 observation(s))
- Network
- declared (10 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (20)
~/.ssh ... websocket
const TOKEN = 'a-test-token-that-is-long-enough'
delete_review_comment, remove_repository, remove_review
git-search.test.ts
import { connectOverWsl } from '../../src/core/hosts/wsl.ts'import { connectOverWsl } from '../../src/core/hosts/wsl.ts'import { createHostPool } from '../../src/core/hosts/pool.ts'import { listDistros } from '../../src/core/hosts/wsl.ts'import { installOnHost } from '../../src/core/hosts/install.ts'`src/mcp/gui-link.ts` emits `http://127.0.0.1:<port>/#h=<instance>/review/4/...`
http://127.0.0.1:41427/#h=d8b0e181-4bb1-4c7b-80e0-aedc58db1de7/review/4/conversation
`http://127.0.0.1:41427/#h=0e37f642-.../review/4/conversation`. So the whole
serve --bg --http=8080 http://127.0.0.1:43111` in front of a header-echoing
guiUrl: http://127.0.0.1:41427/#h=4e0b0adb.../review/2/conversation
better-sqlite3, electron-updater, @base-ui/react, @eslint/js, @modelcontextprotocol/sdk, @tailwindcss/vite, @types/better-sqlite3, @types/node
docs/comment-on-a-line.gif
gitwarren-logo.png
1. Open **Keychain Access → Certificate Assistant → Request a Certificate From
curl -fsSL https://gitwarren.com/install.sh | sh # macOS and Linux, no Homebrew needed
| `curl -fsSL https://gitwarren.com/install.sh \| sh` | The same tarball, without Homebrew — for a Linux box or a Mac with nothing on it. Unpacks into `~/.gitwarren/daemon/<version>/` and writes `~/.g
Gates applied: no_behavioural_pass.
8f4d1fa2c9a3full audit observations/trust-audit/mcp-server/klarluft__gitwarren-app.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 8f4d1fa2c9a3 | BLOCK | D | 69 | first audit |
Questions
What is the gitwarren-app MCP server?
Code review for your own machines and your own agents. Reviews live where the code does — reached over SSH, WSL or your own tailnet. Desktop app or just a browser tab. No server, no account.
What tools does gitwarren-app expose?
17 in total: 8 read-only, 6 that write, and 3 that can delete or overwrite (delete_review_comment, remove_repository, remove_review). Every one is listed on this page with its risk.
Is gitwarren-app safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does gitwarren-app need?
It reads CSC_KEYCHAIN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does gitwarren-app run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as gitwarren at 0.1.18.
How current is this page?
The grade is for one exact copy of the source (8f4d1fa2c9a3), read on 2026-10-10. The repository is watched and re-audited when it changes.