git-mcpCAUTION
A Git MCP server that doesn't suck
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/selfagency/git-mcp/actions/workflows/ci.yml) [](https://codecov.io/gh/selfagency/git-mcp)
A Git MCP server that doesn't suck
Exposes the full Git workflow to any MCP-compatible AI agent — inspect, write, branch, remote, stash, rebase, LFS, git-flow, documentation lookup, and more. Designed to be safe by default, composable, and fast. Powered by `simple-git`.
Built for coding agents in tools like GitHub Copilot, Claude Code, Cursor, and OpenAI Codex, while remaining compatible with any MCP client that can call tools and resources.
Features
- 18 tools with 80+ actions covering everyday Git workflows, advanced recovery, history rewriting, repository analytics, forge pull requests, and external VCS awareness
- Safety-first — destructive operations require explicit confirmation; force push and hook bypass are opt-in via server config
- GPG/SSH signing for commits and tags, with server-level auto-sign support
- Git LFS — track patterns, manage objects, install hooks, migrate history
- Git Flow — drives the git-flow-next CLI, so the finish state machine, conflict recovery, and worktree lifecycle stay correct as the CLI evolves. Preset init, overview, config CRUD, generalized topic actions, and classic feature/release/hotfix/support aliases
- Documentation lookup — search git-scm.com and fetch man pages directly from the LLM
- MCP Resources — URI-addressable read-only views of status, log, branches, and diff
- Bundled agent skill —
skills/git-mcp-workflow/documents MCP-first Git workflows, recovery, worktrees, releases, and advanced operations for AI agents and coding agent
c4cd4bd1b36aOBSERVED · 2026-10-14Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add git-mcp --env GIT_SIGNING_KEY=${GIT_SIGNING_KEY} -- npx -y @selfagency/[email protected]Exposed tools (28)
27 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
git_analytics | read | |
git_bisect | read | |
git_branches | read | |
git_but_check | read | Detects whether the GitButler |
git_cherry_pick | read | |
git_commits | read | |
git_context | read | |
git_docs | read | |
git_entire_check | read | Detect whether the Entire CLI is available and whether the repository is Entire-managed |
git_flow | read | |
git_history | read | |
git_jj_check | read | Detect whether the Jujutsu |
git_lfs | read | |
git_merge | write | |
git_ping | read | |
git_pr | read | |
git_rebase | read | |
git_remotes | read | |
git_rewrite | read | |
git_stash | read | |
git_status | read | |
git_submodule | read | |
git_tag | read | |
git_tangled_check | read | Detect whether the repository origin remote points at a Tangled host (tangled.org or a |
git_workflow | read | |
git_workspace | read | |
git_worktree | read | |
open_git_mcp_docs | read | Open git-mcp documentation pages in this tab. |
Trust audit
CAUTIONgrade B · trust 81/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (13)
expect(redactToken('ghp_12345678901234567890123456789012')).toBe('***');const git = makeGit({ raw: vi.fn().mockResolvedValue('ghp_0123456789abcdef0123456789abcdef01234567\n') });.oxfmtrc.json
.oxlintrc.json
.nojekyll
vi.mock('../../platform/exec.js', () => ({vi.mock('../../git/client.js', () => ({import { getGit } from '../../git/client.js';vi.mock('../../git/client.js', () => ({import { getGit } from '../../git/client.js';@modelcontextprotocol/sdk, simple-git, zod, @octokit/rest, @vitest/coverage-v8, husky, lint-staged, ora
git-mcp is a production-grade [Model Context Protocol](https://modelcontextprotocol.io) server that gives AI agents full access to Git workflows. It uses [simple-git](https://github.com/steveukx/git-j
Gates applied: no_behavioural_pass, no_license.
c4cd4bd1b36afull audit observations/trust-audit/mcp-server/selfagency__git-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | c4cd4bd1b36a | CAUTION | B | 81 | first audit |
Questions
What is the git-mcp MCP server?
A Git MCP server that doesn't suck
What tools does git-mcp expose?
28 in total: 27 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is git-mcp safe to connect to an agent?
With care. The audit graded it B (81/100) and found 13 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does git-mcp need?
It reads GH_TOKEN, GITHUB_TOKEN and GIT_SIGNING_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does git-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @selfagency/git-mcp at 0.4.0.
How current is this page?
The grade is for one exact copy of the source (c4cd4bd1b36a), read on 2026-10-14. The repository is watched and re-audited when it changes.