What it is
The Git server is a Python reference server maintained by the MCP project. As of October 2026 it remains one of seven servers in the main modelcontextprotocol/servers repository; it was not among the retired reference servers moved to the archived servers-archived repo. It is actively maintained: PyPI version 2026.10.19 rebuilt it on the Python SDK 2.x and it now speaks both the 2025-11-25 and 2026-07-28 protocol revisions.
It exposes 12 tools: git_status, git_diff_unstaged, git_diff_staged, git_diff, git_commit, git_add, git_reset, git_log, git_create_branch, git_checkout, git_show and git_branch. There is no git_init; a December 2025 advisory showed the old one could create repositories anywhere on disk.
You run it with uvx mcp-server-git --repository path/to/repo, with pip, or with the mcp/git Docker image. It works on local repositories only; it has no network tools and does not talk to GitHub or any other host.
Install
uvx mcp-server-git --repository path/to/repoOur review
This server earns its place in one situation: a client such as Claude Desktop that cannot run shell commands but should be able to read diffs and make commits. There it does the job with typed inputs and plain-text output, and a failed call returns an error message the model can read and correct. In Claude Code, Cursor or any agent with a terminal, it duplicates git itself with fewer options.
Scope stops at the local working tree. There is no push, pull, fetch, merge, rebase or stash, so the model can prepare and commit work but a person still publishes it, which some teams will count as a safety feature. The README still calls the server early development and warns that tools may change, and they have: the October 2026 rebuild changed how unknown tool names are reported and made tool calls run one at a time.
Its security record argues for staying current. Four advisories have been published against mcp-server-git: three medium-severity issues in December 2025 covering argument injection in git_diff and git_checkout, missing path validation for --repository and the unrestricted git_init tool, and a git_add path traversal in February 2026 that could stage files outside the repository. Each shipped with a fix, and the October releases also require GitPython 3.1.60 or later for upstream advisories.
Scoping is coarser than the flag suggests. --repository walks up to the repository root, so pointing it at a subfolder grants the whole repository, and without the flag each call may name any repo_path on the machine. git_reset only unstages, but git_checkout can switch branches under an editor with unsaved work, and the server asks for no confirmation; that falls to the client's approval prompts. What the model reads here is your own history and files, a far smaller prompt-injection surface than a server that fetches web pages.
Where it earns its place
A product manager editing a docs repository from Claude Desktop
See what changed since last week and commit a wording fix
git_log with start_timestamp set to '1 week ago', git_diff against main, then git_add and git_commit. Free; the main risk is committing to the wrong branch, so keep approval prompts on for writes.
A platform team building an internal code-review agent with no shell access
Let the agent read diffs and history on a checked-out repo and nothing more
Run the mcp/git Docker image with only that repository mounted and allow just the read tools (status, diff, log, show, branch) in the client. It avoids sandboxing a shell, and pushing stays with CI.
Before you commit
- Setup
- uvx mcp-server-git --repository /path/to/repo, pip install mcp-server-git, or the mcp/git Docker image with the repo bind-mounted. The README has configs for Claude Desktop, VS Code, Zed and Zencoder; tools appear once the client restarts.
- Integrations
- 12 tools. Read: git_status, git_diff_unstaged, git_diff_staged, git_diff, git_log, git_show, git_branch. Write: git_add, git_commit, git_reset (unstage only), git_create_branch, git_checkout.
- Data and privacy
- Runs locally with your user's file permissions and makes no network calls, but the diffs and file contents it returns go to whichever model provider your client uses. Four advisories between December 2025 and February 2026 covered argument injection, path traversal and unvalidated repository paths.
- Cost at scale
- Free and open source. The cost is context: git_diff and git_show return full text, so a large diff lands in the context window whole; context_lines and max_count are the only size controls.
- Limits
- No remote operations, stash, merge, blame or tag tools; stdio only, so it cannot be shared as a remote server; tool calls are serialised, so parallel calls queue.
What's good
- 12 typed tools for status, diffs, commits, branches and log
- Makes no network calls of its own
- Actively maintained; supports both 2025-11-25 and 2026-07-28 protocol versions
- Published advisories were fixed promptly
What's not
- No push, pull, merge, rebase or stash
- --repository scopes to the whole repo, and omitting it allows any path
- Still labelled early development; behaviour has changed between releases
- Redundant for agents with a terminal
Best for
People using chat-style MCP clients who want the model to inspect and commit local changes without shell access.
Alternatives
Git (reference server): common questions
- Is Git (reference server) worth it?
- A tidy, well-patched way to give a shell-less chat client Git, though any agent with a terminal already has a better one. We rate it 3.8 out of 5.
- How much does Git (reference server) cost?
- Free and open source.
- What are the downsides of Git (reference server)?
- No push, pull, merge, rebase or stash; --repository scopes to the whole repo, and omitting it allows any path; still labelled early development; behaviour has changed between releases; redundant for agents with a terminal.
- Who is Git (reference server) best for?
- People using chat-style MCP clients who want the model to inspect and commit local changes without shell access.
- How much does Git (reference server) cost for a team or in production?
- Free and open source. The cost is context: git_diff and git_show return full text, so a large diff lands in the context window whole; context_lines and max_count are the only size controls.
- Is Git (reference server) safe for company data?
- Runs locally with your user's file permissions and makes no network calls, but the diffs and file contents it returns go to whichever model provider your client uses. Four advisories between December 2025 and February 2026 covered argument injection, path traversal and unvalidated repository paths.
- What are the best Git (reference server) alternatives?
- The closest alternatives we have reviewed are GitHub MCP Server and Filesystem (reference server).
Answers checked Oct 23, 2026.