Git (MCP reference server) vs GitLab MCP Server

Git (MCP reference server) 60

Free, self-hosted, nothing to buy, so 20 + 20 + 20. No payment protocol (0).

GitLab MCP Server 30

No x402, MPP or L402 (0). Plan prices are public for Free and Premium, Ultimate is by quote and GitLab Credits are $1 each, but the MCP server has no per-call price (10). GitLab.com Free needs no card, and the MCP server is on every tier (20). A person signs up, and an administrator must enable MCP and a user must authorise in a browser (0). 0 + 10 + 20 + 0 = 30.

Git (MCP reference server) 61

Every tool takes a typed JSON Schema the SDK derives from the function signature (25). No llms.txt. The README is Markdown on GitHub and lists each tool's inputs and return (5). Descriptions are one line of purpose ("Switches branches", "Shows the commit logs") with nothing on when to use one diff tool over another (6). Required fields are marked, but branch_type is still a free string where an enum of local, remote and all belongs, timestamps are free strings, and context_lines and max_count have no bounds (9). Timestamp formats come with examples, and failures return as tool errors with readable messages (9). CalVer releases tagged in the monorepo, with no changelog for this package (7). 25+5+6+9+9+7 = 61.

GitLab MCP Server 85

The tools reference documents every parameter with its type, required flag and enum values, and the server exposes JSON Schema through MCP; we read the reference, not the source (22). docs.gitlab.com/llms.txt is served (10). Each tool says what it does, and superseded tools name their replacement (Use get_merge_request with include: commits), though few say when not to use one (14). Enums for include facets, states, scopes and methods, with documented maximums such as first up to 100 and byte_limit up to 1 MB (13). The docs cover 403 insufficient_scope, 400 for an unknown toolset, 429 headers and troubleshooting for Windows and Claude Code, but give few example responses (11). Per-tool version history and monthly release notes (15). 22 + 10 + 14 + 13 + 11 + 15 = 85.

Git (MCP reference server) 43

No credentials to leak and nothing to scope, so the middle band (20). --repository is the only confinement, and since 2026.10.28 the server also checks the directories Git opens (a nested .git file, commondir or core.worktree pointing outside is refused). Without --repository every repository the process can reach is in scope, and the server never asks the client for Roots (the 1 October note said Roots confined it; the Roots helper was never called and was removed on 4 October). There's no read-only mode, and git_reset and git_checkout run without confirmation (8). Commit messages, diffs and file contents reach the model unmarked. Since 2026.10.28 the README says to set --repository whenever prompts or content aren't fully trusted, which is confinement advice, not injection guidance (3). No call log beyond git's own reflog (0). SECURITY.md, rewritten on 29 September 2026 and on main since the v1.0.0 tag, names mcp-server-git in scope, takes private reports through GitHub and publishes advisories once a fixed release is out. No bounty or certification. Graded as the fetch, filesystem and memory servers (12, up from 6). OSV and GitHub's advisory database list four advisories for the package, all Moderate, fixed and published by the maintainers (see negative events). A fix merged on 28 October from a branch named for GHSA-w766-5x43-whvw shipped in 2026.10.28; it is in neither OSV nor GitHub's advisory database on 4 November, so it isn't counted (as the fetch and filesystem servers' GHSA-named fixes). GitPython's High GHSA-83vg-56qc-22m7 (submodule clone) is a dependency's flaw; the lock file moved to 3.2.1 on 24 October and isn't counted. 20+8+3+0+12 = 43.

GitLab MCP Server 66

OAuth with dynamic registration and a single mcp scope that carries the user's own GitLab permissions, or fine-grained personal access tokens scoped to the MCP tool resource. The docs say GitLab doesn't verify which client uses a client ID and that REST-created apps don't enforce PKCE (22). Toolset and tool headers narrow the surface, an administrator must enable MCP for the group or instance, 19.4 governance defaults writes to Always Ask in Duo settings and 19.6 adds group rules enforced for every client, in beta (16). The docs leave prompt injection to the user ("use MCP tools only on GitLab objects you trust") (5). GitLab audit events exist on paid tiers, but we didn't read whether MCP calls are recorded (8). security.txt is valid until 31 January 2027 and points at a public HackerOne programme; certifications weren't read this run (15). 22 + 16 + 5 + 8 + 15 = 66.

Git (MCP reference server) 72

2026.10.28, stamped and tagged v2.2.0 on 28 October 2026, 7 days before this check (30). Releases of this package in the 90 days from 6 August are 2026.8.18 (an SDK pin and a README note, half at most), 2026.10.10 (tag v1.0.0), 2026.10.19 (tag v2.0.0) and 2026.10.28 (tag v2.2.0), the last three with code changes. v2.1.0 left git at 2026.10.19, and tag 2026.8.31 carries no git release. Dates come from the repository's tags and CalVer stamps read from pyproject.toml at each tag, since PyPI wasn't read today. The package has no changelog and no separate CLI or plugin (20). Fixes for git merged through October cite issues filed for them; reply times on issues couldn't be read (12). Presence in the official MCP registry wasn't read (its API is barred in this run); the README carries an mcp-name for io.github.modelcontextprotocol/server-git, which is a claim, not presence (0). Current SDK (mcp>=2.3,<3, up from the 1.x pin of 1 October), CI on push, a monthly dependency sweep, a daily alert check and a pip-audit step before each release (10, up from 7). 30+20+12+0+10 = 72.

GitLab MCP Server 85

GitLab 19.5 made the server generally available on 15 October 2026, 22 days before this check, and 19.6 changes are already on GitLab.com (30). Monthly releases 19.3, 19.4 (17 September) and 19.5 each changed MCP tools (20). Issues are public on gitlab.com, with a feedback issue (630189) for the server, but we didn't measure reply times (15). The registry entry com.gitlab/mcp sits under a domain-verified namespace with the right remote, though its version is still 0.0.1 from 2 October 2025 (10). GitLab ships through its own CI with monthly and patch releases; no official multi-language API SDK was found (10). 30 + 20 + 15 + 10 + 10 = 85.

Git (MCP reference server) 75

The package is MIT, inside a repository moving new contributions to Apache-2.0, both OSI licences (28). Local software that keeps nothing and calls no network service. There's no written statement, but the source shows it (20). RELEASING.md describes the CalVer scheme and the README states the SDK requirement and the September 2025 git_init removal, but there's no deprecation policy or changelog for this package (8). No telemetry in the code (20). 28+20+8+20 = 76.

GitLab MCP Server 87

GitLab's code is public in gitlab-org/gitlab, with the core under MIT and enterprise functions under GitLab's own licence; we didn't establish which licence covers the MCP server code (20). The privacy statement and a sub-processor page of 63 entries name AI providers and their purposes, but that page shows no update date and links no DPA (20). A dated deprecations and removals page and per-tool version history, with superseded tools kept as callable aliases (20). Sub-processors and their locations are disclosed, and Dedicated customers choose their AWS region (18). 20 + 20 + 20 + 18 = 78.

Git (MCP reference server) 55

Scored as a local stdio package. Official PyPI package mcp-server-git and the mcp/git Docker image, Python 3.10 or later stated (20). The monorepo's python.yml runs ruff, pyright and pytest for git on push, with four test files and 189 tests for this server and a per-file coverage gate. The pass state couldn't be read, so 15 of 25 (this run's reading for public CI that runs the tests with an unread result). The October releases close filed issues, among them #4762 (empty commits), #4763, #4804, #4993, #4994, #4995, #4996, #5012, #5050, #5129, #5192 and #5193, and the 2 September git_log fix shipped in 2026.10.10; the open issue list couldn't be read (15). CalVer versions (2026.10.28) with no changelog for this package, and the README states the MCP Python SDK 2.x requirement (5). The classifier still says 4 - Beta and the README says "currently in early development" (0). 20+15+15+5+0 = 55.

GitLab MCP Server 62

Hosted reading for GitLab.com. Status page at status.gitlab.com (status.io) with an API and a GitLab Duo component (20). Its incident history lives under /pages/, which the site's robots.txt disallows; our reader fetched that history page once before the rule was checked, so its contents are set aside and not scored. The front page shows only the current state, all operational on 6 November, so there is no readable history (5). MCP limits are published per plan, 60 a minute and 3,600 an hour on Free, 600 and 5,000 on Premium and Ultimate (15). 429 responses carry Retry-After and RateLimit-Reset, and a rate-limited upstream API comes back as a rate_limited tool result; accept_merge_request requires the head SHA, but we found no general idempotency guidance for writes (12). No uptime SLA on the pricing page (0). Generally available since 19.5 (10). 20 + 5 + 15 + 12 + 0 + 10 = 62.