@cyanheads/git-mcp-server
v2.8.4A secure and scalable Git MCP server enabling AI agents to perform comprehensive Git version control operations via STDIO and Streamable HTTP.
5
Total
2
Critical
1
High
2
Medium
Findings
unknownEnvironment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
168: ## ⚙️ Configuration
169:
>>> 170: All configuration is centralized and validated at startup in `src/config/index.ts`. Key environment variables in your `.env` file include:
171:
172: | Variable | Description | Default |Report false positiveZero-width character detected (potential hidden content)
Detected by automated pattern matching (rule OB-004) with medium confidence. May be a false positive.
326: **For Developers**: When creating custom tools, always include complete data in your `responseFormatter`. Balance human-readable summaries with comprehensive structured information. See [`AGENTS.md`](AGENTS.md) for response formatter best practices and the [MCP specification](https://modelcontextprotocol.io/specification/2025-11-25/server/tools) for technical details.
327:
>>> 328: ## 🧑💻 Agent Development Guide
329:
330: For strict rules when using this server with an AI agent, refer to the **`AGENTS.md`** file in this repository. Key principles include:Report false positiveNode.js child process spawning
Detected by automated pattern matching (rule SC-005) with medium confidence. May be a false positive.
130: Plus, specialized features for **Git integration**:
131:
>>> 132: - **Cross-Runtime Compatibility**: Works seamlessly with both Bun and Node.js runtimes. Automatically detects the runtime and uses optimal process spawning (Bun.spawn in Bun, child_process.spawn in Node.js).
133: - **Provider-Based Architecture**: Pluggable git provider system with current CLI implementation and planned isomorphic-git provider for edge deployment.
134: - **Optimized Git Execution**: Direct git CLI interaction with cross-runtime support for high-performance process management, streaming I/O, and timeout handling (current CLI provider).Report false positiveHigh-entropy string (4.5 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positivePossible Base64-encoded payload (long encoded string)
Detected by automated pattern matching (rule OB-001) with medium confidence. May be a false positive.
8: <div align="center">
9:
>>> 10: [](./CHANGELOG.md) [](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2025-11-25/changelog.mdx) [](https://modelcontextprotocol.io/) [](./LICENSE) [](https://github.com/cyanheads/git-mcp-server/issues) [](https://www.typescriptlang.org/) [](https://bun.sh/)
11:
12: </div>Report false positiveScan History
| Date | Risk | Findings | Files | Duration |
|---|---|---|---|---|
| Feb 26, 2026 | critical | 5 | 5 | 0.00s |
| Feb 23, 2026 | critical | 5 | 5 | 0.00s |
| Feb 22, 2026 | critical | 5 | 5 | 0.00s |