{ "data": { "a": { "slug": "git-reference-server", "name": "Git (MCP reference server)", "vendor": "MCP project (reference servers)", "vendorUrl": "https://modelcontextprotocol.io", "kind": "mcp", "category": "code", "summary": "Python reference server for reading and changing local Git repositories through twelve tools (status, staged and unstaged diffs, diff against a ref, add, commit, reset, log, create branch, checkout, show, branch list). `git_init` was removed in September 2025.", "url": "https://www.anchorterminal.com/tools/git-reference-server", "markdownUrl": "https://www.anchorterminal.com/tools/git-reference-server.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/git-reference-server.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/git-reference-server.json", "dns": "git-reference-server.grade.anchorterminal.com", "repo": "https://github.com/modelcontextprotocol/servers", "license": "MIT and Apache-2.0", "transports": [ "stdio" ], "packages": [ { "registry": "pypi", "name": "mcp-server-git" }, { "registry": "oci", "name": "mcp/git" } ], "auth": "none", "authNotes": "Local process operating on a repository path.", "pricing": "free", "pricingNotes": "Open source.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "Local reference server, no payments.", "endpoints": [] }, "toolCount": 12, "popularity": { "githubStars": 90000, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-09-26" }, "docsUrl": "https://github.com/modelcontextprotocol/servers/blob/main/src/git/README.md", "capabilities": [ "code.git" ], "tags": [ "reference", "local", "open-source", "python" ], "lastRelease": "2026-10-28", "graded": true, "disclosure": "MCP started at Anthropic, which makes the Claude models our research agents and review panel run on (Anthropic donated it to the Agentic AI Foundation, a directed fund under the Linux Foundation, in December 2025), and this server is graded by the same checklist as every other listing.", "anchor": { "graded": true, "score": 50.3, "grade": "D", "agentReady": false, "rank": 1059, "ranked": true, "rankOf": 1486, "categoryRank": 14, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 71, "maintenance": 72, "payments": 60, "reliability": 55, "schema": 61, "security": 43, "transparency": 75 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -10, "negativeNotes": [ "-4, four advisories for mcp-server-git, each Moderate, fixed and published by the maintainers (1 each). GHSA-9xwc-hfwc-8w59 (CVE-2025-68144, argument injection in `git_diff` and `git_checkout`), GHSA-j22h-9j4x-23w5 (CVE-2025-68145, missing path validation with `--repository`) and GHSA-5cgr-j3jf-jw3v (CVE-2025-68143, `git_init` creating repositories anywhere), published 17 December 2025 and fixed in 2025.12.18 or earlier, and GHSA-vjqx-cfc4-9h6v (CVE-2026-27735, `git_add` path traversal), published 26 February 2026 and fixed in 2026.1.14. https://osv.dev/list?q=mcp-server-git\u0026ecosystem=PyPI", "-3, a released fix of the server's own described flaw with no advisory. ae40ec23 (15 March 2026, first released in 2026.6.4 on 4 June 2026) added the missing argument-injection guards to `git_show`, `git_create_branch`, `git_log` and `git_branch`, \"preventing user-supplied values from being interpreted as CLI flags\", the same class as GHSA-9xwc-hfwc-8w59, and cites no GHSA id. https://github.com/modelcontextprotocol/servers/commits/main/src/git", "-3, published behaviour changed for existing clients with word only on release day. 2026.10.10 (10 October 2026) makes `git_commit` with nothing staged fail where earlier versions made an empty commit and reported success (cb2cd0d5, #4762), and 2026.10.28 refuses a nested repository whose Git directories point outside `--repository` (e7f2595f). There is no changelog for this package and no pre-release tag; the README changed with each release. One folded term. https://github.com/modelcontextprotocol/servers/blob/main/src/git/README.md" ], "verdict": "Twelve tools of about 1,700 tokens, each with `readOnlyHint` or `destructiveHint` set, on MCP SDK 2.x since October 2026. `--repository` is the only confinement and isn't on by default. Four Moderate advisories since December 2025 are fixed, and two October releases changed working calls with no changelog.", "bestFor": "Local commit loops in a sandboxed checkout where an agent stages, commits and branches.", "disclosure": "MCP started at Anthropic, which makes the Claude models our research agents and review panel run on (Anthropic donated it to the Agentic AI Foundation, a directed fund under the Linux Foundation, in December 2025), and this server is graded by the same checklist as every other listing.", "strengths": [ "Twelve tools of about 1,700 tokens in total, each with `readOnlyHint` or `destructiveHint` set", "`--repository` confines every call, and since 2026.10.28 the Git directories a call opens are checked too", "Refs and paths starting with `-` are rejected on every tool that passes them to git", "SECURITY.md names the package in scope and takes private reports through GitHub", "No credentials, no network calls and no telemetry" ], "weaknesses": [ "Without `--repository` the server reads and writes any repository its process can reach", "Four Moderate advisories since December 2025 (argument injection, path validation, `git_init`, `git_add` traversal), all fixed", "October releases changed working calls (empty commits refused, nested repositories refused) with no changelog for the package", "Classed beta and described as early development", "No push, fetch or remote operations, and no read-only mode" ], "agentNotes": [ "Start the server with `--repository`; without it, any repository the process can reach is writable", "Pass `repo_path` on every call, even when the server was started with `--repository`", "Stage with `git_add` before `git_commit`; since 2026.10.10 a commit with nothing staged returns an error", "Set `max_count` and a date range on `git_log`; diffs and `git_show` have no size cap", "Push with another tool; this server has no remote operations" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 50.3 } ], "editorialScores": { "ergonomics": 71, "maintenance": 72, "payments": 60, "reliability": 55, "schema": 61, "security": 43, "transparency": 76 }, "provenanceScore": 74, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "claudeCode": "claude mcp add git -- uvx mcp-server-git --repository /path/to/repo", "config": { "mcpServers": { "git": { "args": [ "mcp-server-git", "--repository", "/path/to/repo" ], "command": "uvx" } } } }, "letme": { "capability": "https://letme.dev/code.git", "tool": "https://letme.dev/git-reference-server" }, "sameCompany": [ "fetch-reference-server", "puppeteer-reference-server-archived", "filesystem-reference-server", "memory-reference-server", "postgres-reference-server-archived", "sequential-thinking-reference-server" ], "area": "developer", "provenance": { "legalEntity": "Model Context Protocol, a Series of LF Projects, LLC", "domain": "modelcontextprotocol.io", "domainRegistered": "2024-11-18", "endpointOnVendorDomain": null, "terms": "https://www.lfprojects.org/policies/terms-of-use/", "privacy": "https://www.lfprojects.org/policies/privacy-policy/", "statusPage": "", "changelog": "https://github.com/modelcontextprotocol/servers/releases", "securityTxt": "valid", "checked": "2026-09-26", "score": 74 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/git-reference-server.json", "live": { "slug": "git-reference-server", "versions": [ { "registry": "github", "name": "modelcontextprotocol/servers", "version": "v2.3.0", "released": "2026-11-04", "seenAt": "2026-11-06T23:28:14.469005153Z" }, { "registry": "pypi", "name": "mcp-server-git", "version": "2026.11.4", "released": "2026-11-04", "seenAt": "2026-11-06T23:28:14.184834414Z" } ], "githubStars": 91838, "pypiWeekly": 101390, "securityTxt": { "url": "https://modelcontextprotocol.io/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:01:43.564896778Z" }, "domain": { "domain": "modelcontextprotocol.io", "checkedAt": "2026-11-01T14:07:30.038395054Z" }, "github": { "repo": "modelcontextprotocol/servers", "checkedAt": "2026-11-02T09:08:15.395430974Z", "stars": 91747, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-29T05:27:40Z", "openIssues": 30, "openPRs": 8, "issuesOpened90d": 289, "issuesClosed90d": 487, "prsMerged90d": 276, "ci": { "branch": "main", "runs": 50, "success": 44, "failure": 0, "other": 6, "latest": "success", "latestAt": "2026-10-28T20:46:50Z" }, "advisories": [ { "ghsa": "GHSA-w766-5x43-whvw", "severity": "medium", "published": "2026-10-28T21:13:40Z" }, { "ghsa": "GHSA-mvf5-2qqv-rg3c", "severity": "medium", "published": "2026-10-25T00:19:52Z" }, { "ghsa": "GHSA-hhwq-wxfx-cj7g", "severity": "low", "published": "2026-10-25T00:19:37Z" }, { "ghsa": "GHSA-53mr-w429-c597", "severity": "low", "published": "2026-10-25T00:19:21Z" }, { "ghsa": "GHSA-v38p-wf49-hx2j", "severity": "medium", "published": "2026-10-25T00:19:06Z" }, { "ghsa": "GHSA-66qx-2266-pmj6", "severity": "low", "published": "2026-10-25T00:18:52Z" }, { "ghsa": "GHSA-7rgq-gccq-qphx", "severity": "medium", "published": "2026-10-25T00:18:38Z" }, { "ghsa": "GHSA-4gxg-m5jx-9j57", "severity": "medium", "published": "2026-10-25T00:18:21Z" }, { "ghsa": "GHSA-3jqg-r5pp-rmp2", "severity": "low", "published": "2026-10-25T00:15:37Z" }, { "ghsa": "GHSA-vjqx-cfc4-9h6v", "cve": "CVE-2026-27735", "severity": "medium", "published": "2026-02-25T23:21:57Z" }, { "ghsa": "GHSA-j22h-9j4x-23w5", "cve": "CVE-2025-68145", "severity": "medium", "published": "2025-12-17T16:04:43Z" }, { "ghsa": "GHSA-9xwc-hfwc-8w59", "cve": "CVE-2025-68144", "severity": "medium", "published": "2025-12-17T16:01:56Z" }, { "ghsa": "GHSA-5cgr-j3jf-jw3v", "cve": "CVE-2025-68143", "severity": "medium", "published": "2025-12-17T15:55:26Z" }, { "ghsa": "GHSA-hc55-p739-j48w", "cve": "CVE-2025-53110", "severity": "high", "published": "2025-07-01T18:39:04Z" }, { "ghsa": "GHSA-q66q-fx2p-7w4m", "cve": "CVE-2025-53109", "severity": "high", "published": "2025-07-01T18:38:24Z" } ], "replies": { "sampled": 25, "unanswered": 8, "medianDays": 0.5 } }, "updatedAt": "2026-11-07T16:01:43.564896778Z" } }, "answer": "GitLab MCP Server scores 67.3 (B) on agent readiness against Git (MCP reference server)'s 50.3 (D), and leads in 5 of 7 scored categories. Git (MCP reference server) leads on agent ergonomics and payments \u0026 pricing.", "b": { "slug": "gitlab-mcp", "name": "GitLab MCP Server", "vendor": "GitLab Inc.", "vendorUrl": "https://about.gitlab.com", "kind": "mcp", "category": "code", "summary": "GitLab's official MCP server, built into GitLab at /api/v4/mcp, gives MCP clients tools for projects, merge requests, work items, repositories, CI/CD pipelines and GitLab Duo agents, on GitLab.com, Self-Managed and Dedicated.", "url": "https://www.anchorterminal.com/tools/gitlab-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/gitlab-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/gitlab-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/gitlab-mcp.json", "dns": "gitlab-mcp.grade.anchorterminal.com", "repo": "https://gitlab.com/gitlab-org/gitlab", "transports": [ "streamable-http" ], "remoteUrl": "https://gitlab.com/api/v4/mcp", "packages": [], "auth": "oauth", "authNotes": "OAuth 2.0 access token with the `mcp` scope, through dynamic client registration (10 registrations an hour per IP) or a pre-registered OAuth application, or a fine-grained personal access token with the MCP tool resource and Execute permission. Legacy, project and group access tokens are refused with 403 `insufficient_scope`. An administrator must first allow MCP access for the top-level group (GitLab.com) or the instance. Pre-registered apps created through the REST API don't enforce PKCE. The endpoint answers 401 with RFC 9728 resource metadata naming gitlab.com as authorisation server.", "pricing": "freemium", "pricingNotes": "The MCP server is on Free, Premium and Ultimate since GitLab 19.2. GitLab.com Free is $0 for up to 5 users per top-level group with no card; Premium is $29 a user a month billed annually; Ultimate is by quote. Duo Agent Platform tools need Premium or Ultimate with Duo, or GitLab Credits at $1 each.", "priceSummary": "$1 / credit", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the MCP server or the pricing page (checked 2026-11-06).", "endpoints": [] }, "toolCount": 47, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.gitlab.com/user/model_context_protocol/mcp_server/", "llmsTxt": "https://docs.gitlab.com/llms.txt", "registryName": "com.gitlab/mcp", "capabilities": [ "code.repo", "code.git", "code.deploy" ], "tags": [ "hosted", "self-hosted", "freemium", "mcp", "remote-mcp", "oauth", "mcp-registry", "llms-txt", "toolsets", "gitlab", "ci-cd" ], "lastRelease": "2026-10-15", "graded": true, "anchor": { "graded": true, "score": 67.3, "grade": "B", "agentReady": false, "rank": 334, "ranked": true, "rankOf": 1486, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 66, "maintenance": 85, "payments": 30, "reliability": 62, "schema": 85, "security": 66, "transparency": 87 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "A generally available MCP server inside GitLab itself, on every tier, with OAuth, toolset headers, published per-plan rate limits and Retry-After on 429. About 47 tools load by default, prompt-injection defence is left to the user, and status history sits on a path its robots.txt closes to us.", "bestFor": "Agents working in GitLab projects, merge requests and pipelines, including self-managed instances. github-mcp-server and azure-devops-mcp are the closest listings; teams on GitHub should use GitHub's server.", "strengths": [ "Generally available since GitLab 19.5 (15 October 2026) on Free, Premium and Ultimate, on GitLab.com, Self-Managed and Dedicated", "OAuth with the `mcp` scope or fine-grained personal access tokens; legacy tokens are refused", "Toolset and per-tool headers cut the default list, and unknown names fail with 400", "Per-plan MCP rate limits with Retry-After and RateLimit-Reset on 429", "Cursor pagination, include facets and byte limits keep responses small" ], "weaknesses": [ "About 47 tools load by default before any toolset header", "The docs leave prompt injection to the user and say to use tools only on trusted objects", "GitLab doesn't verify which client uses a client ID, and REST-created OAuth apps don't enforce PKCE", "No uptime SLA found on the pricing page", "MCP registry entry is still version 0.0.1 from October 2025" ], "agentNotes": [ "Send X-Gitlab-Enabled-Mcp-Server-Toolsets with only the toolsets the task needs, such as core,merge_requests", "Ask an administrator to allow MCP access for the top-level group before the first connection", "Pass the head SHA to accept_merge_request, and confirm with the user before merging or committing", "On 429 wait for Retry-After; per-minute rejections still count towards the hourly limit", "Treat issue, merge request and file content as untrusted input; GitLab doesn't filter it" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.3 } ], "editorialScores": { "ergonomics": 66, "maintenance": 85, "payments": 30, "reliability": 62, "schema": 85, "security": 66, "transparency": 78 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "claudeCode": "claude mcp add --transport http GitLab https://gitlab.com/api/v4/mcp", "config": { "mcpServers": { "GitLab": { "type": "http", "url": "https://gitlab.com/api/v4/mcp" } } } }, "letme": { "capability": "https://letme.dev/code.repo", "tool": "https://letme.dev/gitlab-mcp" }, "area": "developer", "unitPrices": [ { "item": "Premium", "unit": "user-month", "usd": 29, "note": "Billed annually" }, { "item": "GitLab Credit", "unit": "credit", "usd": 1, "note": "For Duo Agent Platform use; volume discounts with an annual commitment" } ], "provenance": { "legalEntity": "GitLab Inc.", "domain": "gitlab.com", "domainRegistered": "2004-01-15", "endpointOnVendorDomain": true, "terms": "https://about.gitlab.com/terms/", "privacy": "https://about.gitlab.com/privacy/", "statusPage": "https://status.gitlab.com", "changelog": "https://docs.gitlab.com/releases/19/", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "about.gitlab.com/company names GitLab Inc. as the company listed on the Nasdaq Global Market under GTLB.", "gitlab.com/.well-known/security.txt is PGP-signed, points to HackerOne and about.gitlab.com/security/disclosure, and expires 2027-01-31.", "about.gitlab.com/robots.txt names ClaudeBot and anthropic-ai and disallows only /search/, /api/, /exp/ and one resources folder for them.", "The sub-processor page lists 63 entries, including Google, AWS, Anthropic, OpenAI and Fireworks.ai for AI functions and HiddenLayer for prompt-injection security, with locations, and no visible update date.", "RDAP gives gitlab.com a registration date of 15 January 2004." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/gitlab-mcp.json", "live": { "slug": "gitlab-mcp", "probe": { "target": "https://gitlab.com/api/v4/mcp", "method": "mcp-initialize", "lastAt": "2026-11-07T18:20:27.082866325Z", "lastOk": true, "lastStatus": 401, "lastMs": 287, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 196, "p95ms24h": 315, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.gitlab.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:50.529753137Z" }, "versions": [ { "registry": "mcp-registry", "name": "com.gitlab/mcp", "version": "0.0.1", "seenAt": "2026-11-07T18:16:28.95801333Z" } ], "securityTxt": { "url": "https://gitlab.com/.well-known/security.txt", "state": "valid", "expires": "2027-01-31T05:00:00.000Z", "checkedAt": "2026-11-07T16:00:35.978160451Z" }, "llmsTxt": { "url": "https://docs.gitlab.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:35.836590435Z" }, "pages": [ { "url": "https://docs.gitlab.com/releases/19/", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:06:25.949810739Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e555fad0fadb" }, { "url": "https://about.gitlab.com/privacy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T13:58:29.597957724Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "205ffc09f256" }, { "url": "https://about.gitlab.com/terms/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T13:58:31.769260175Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "33bec44fb3b9" } ], "mcpTools": { "url": "https://gitlab.com/api/v4/mcp", "checkedAt": "2026-11-07T01:44:49.273162786Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:44:49.273162786Z" }, "updatedAt": "2026-11-07T18:20:27.082866325Z" } }, "edges": [ { "by": 30, "category": "payments", "leads": "git-reference-server", "name": "Payments \u0026 pricing", "reasons": { "a": "Free, self-hosted, nothing to buy, so 20 + 20 + 20. No payment protocol (0).", "b": "No x402, MPP or L402 (0). Plan prices are public for Free and Premium, Ultimate is by quote and GitLab Credits are $1 each, but the MCP server has no per-call price (10). GitLab.com Free needs no card, and the MCP server is on every tier (20). A person signs up, and an administrator must enable MCP and a user must authorise in a browser (0). 0 + 10 + 20 + 0 = 30." }, "scores": { "a": 60, "b": 30 } }, { "by": 24, "category": "schema", "leads": "gitlab-mcp", "name": "Schema \u0026 documentation", "reasons": { "a": "Every tool takes a typed JSON Schema the SDK derives from the function signature (25). No llms.txt. The README is Markdown on GitHub and lists each tool's inputs and return (5). Descriptions are one line of purpose (\"Switches branches\", \"Shows the commit logs\") with nothing on when to use one diff tool over another (6). Required fields are marked, but `branch_type` is still a free string where an enum of local, remote and all belongs, timestamps are free strings, and `context_lines` and `max_count` have no bounds (9). Timestamp formats come with examples, and failures return as tool errors with readable messages (9). CalVer releases tagged in the monorepo, with no changelog for this package (7). 25+5+6+9+9+7 = 61.", "b": "The tools reference documents every parameter with its type, required flag and enum values, and the server exposes JSON Schema through MCP; we read the reference, not the source (22). docs.gitlab.com/llms.txt is served (10). Each tool says what it does, and superseded tools name their replacement (`Use get_merge_request with include: commits`), though few say when not to use one (14). Enums for include facets, states, scopes and methods, with documented maximums such as first up to 100 and byte_limit up to 1 MB (13). The docs cover 403 insufficient_scope, 400 for an unknown toolset, 429 headers and troubleshooting for Windows and Claude Code, but give few example responses (11). Per-tool version history and monthly release notes (15). 22 + 10 + 14 + 13 + 11 + 15 = 85." }, "scores": { "a": 61, "b": 85 } }, { "by": 23, "category": "security", "leads": "gitlab-mcp", "name": "Security \u0026 auth", "reasons": { "a": "No credentials to leak and nothing to scope, so the middle band (20). `--repository` is the only confinement, and since 2026.10.28 the server also checks the directories Git opens (a nested `.git` file, `commondir` or `core.worktree` pointing outside is refused). Without `--repository` every repository the process can reach is in scope, and the server never asks the client for Roots (the 1 October note said Roots confined it; the Roots helper was never called and was removed on 4 October). There's no read-only mode, and `git_reset` and `git_checkout` run without confirmation (8). Commit messages, diffs and file contents reach the model unmarked. Since 2026.10.28 the README says to set `--repository` whenever prompts or content aren't fully trusted, which is confinement advice, not injection guidance (3). No call log beyond git's own reflog (0). SECURITY.md, rewritten on 29 September 2026 and on main since the v1.0.0 tag, names mcp-server-git in scope, takes private reports through GitHub and publishes advisories once a fixed release is out. No bounty or certification. Graded as the fetch, filesystem and memory servers (12, up from 6). OSV and GitHub's advisory database list four advisories for the package, all Moderate, fixed and published by the maintainers (see negative events). A fix merged on 28 October from a branch named for GHSA-w766-5x43-whvw shipped in 2026.10.28; it is in neither OSV nor GitHub's advisory database on 4 November, so it isn't counted (as the fetch and filesystem servers' GHSA-named fixes). GitPython's High GHSA-83vg-56qc-22m7 (submodule clone) is a dependency's flaw; the lock file moved to 3.2.1 on 24 October and isn't counted. 20+8+3+0+12 = 43.", "b": "OAuth with dynamic registration and a single `mcp` scope that carries the user's own GitLab permissions, or fine-grained personal access tokens scoped to the MCP tool resource. The docs say GitLab doesn't verify which client uses a client ID and that REST-created apps don't enforce PKCE (22). Toolset and tool headers narrow the surface, an administrator must enable MCP for the group or instance, 19.4 governance defaults writes to Always Ask in Duo settings and 19.6 adds group rules enforced for every client, in beta (16). The docs leave prompt injection to the user (\"use MCP tools only on GitLab objects you trust\") (5). GitLab audit events exist on paid tiers, but we didn't read whether MCP calls are recorded (8). security.txt is valid until 31 January 2027 and points at a public HackerOne programme; certifications weren't read this run (15). 22 + 16 + 5 + 8 + 15 = 66." }, "scores": { "a": 43, "b": 66 } }, { "by": 13, "category": "maintenance", "leads": "gitlab-mcp", "name": "Maintenance \u0026 community", "reasons": { "a": "2026.10.28, stamped and tagged v2.2.0 on 28 October 2026, 7 days before this check (30). Releases of this package in the 90 days from 6 August are 2026.8.18 (an SDK pin and a README note, half at most), 2026.10.10 (tag v1.0.0), 2026.10.19 (tag v2.0.0) and 2026.10.28 (tag v2.2.0), the last three with code changes. v2.1.0 left git at 2026.10.19, and tag 2026.8.31 carries no git release. Dates come from the repository's tags and CalVer stamps read from pyproject.toml at each tag, since PyPI wasn't read today. The package has no changelog and no separate CLI or plugin (20). Fixes for git merged through October cite issues filed for them; reply times on issues couldn't be read (12). Presence in the official MCP registry wasn't read (its API is barred in this run); the README carries an `mcp-name` for io.github.modelcontextprotocol/server-git, which is a claim, not presence (0). Current SDK (`mcp\u003e=2.3,\u003c3`, up from the 1.x pin of 1 October), CI on push, a monthly dependency sweep, a daily alert check and a pip-audit step before each release (10, up from 7). 30+20+12+0+10 = 72.", "b": "GitLab 19.5 made the server generally available on 15 October 2026, 22 days before this check, and 19.6 changes are already on GitLab.com (30). Monthly releases 19.3, 19.4 (17 September) and 19.5 each changed MCP tools (20). Issues are public on gitlab.com, with a feedback issue (630189) for the server, but we didn't measure reply times (15). The registry entry com.gitlab/mcp sits under a domain-verified namespace with the right remote, though its version is still 0.0.1 from 2 October 2025 (10). GitLab ships through its own CI with monthly and patch releases; no official multi-language API SDK was found (10). 30 + 20 + 15 + 10 + 10 = 85." }, "scores": { "a": 72, "b": 85 } }, { "by": 12, "category": "transparency", "leads": "gitlab-mcp", "name": "Transparency \u0026 trust", "reasons": { "a": "The package is MIT, inside a repository moving new contributions to Apache-2.0, both OSI licences (28). Local software that keeps nothing and calls no network service. There's no written statement, but the source shows it (20). RELEASING.md describes the CalVer scheme and the README states the SDK requirement and the September 2025 `git_init` removal, but there's no deprecation policy or changelog for this package (8). No telemetry in the code (20). 28+20+8+20 = 76.", "b": "GitLab's code is public in gitlab-org/gitlab, with the core under MIT and enterprise functions under GitLab's own licence; we didn't establish which licence covers the MCP server code (20). The privacy statement and a sub-processor page of 63 entries name AI providers and their purposes, but that page shows no update date and links no DPA (20). A dated deprecations and removals page and per-tool version history, with superseded tools kept as callable aliases (20). Sub-processors and their locations are disclosed, and Dedicated customers choose their AWS region (18). 20 + 20 + 20 + 18 = 78." }, "scores": { "a": 75, "b": 87 } }, { "by": 7, "category": "reliability", "leads": "gitlab-mcp", "name": "Reliability", "reasons": { "a": "Scored as a local stdio package. Official PyPI package mcp-server-git and the mcp/git Docker image, Python 3.10 or later stated (20). The monorepo's python.yml runs ruff, pyright and pytest for git on push, with four test files and 189 tests for this server and a per-file coverage gate. The pass state couldn't be read, so 15 of 25 (this run's reading for public CI that runs the tests with an unread result). The October releases close filed issues, among them #4762 (empty commits), #4763, #4804, #4993, #4994, #4995, #4996, #5012, #5050, #5129, #5192 and #5193, and the 2 September `git_log` fix shipped in 2026.10.10; the open issue list couldn't be read (15). CalVer versions (2026.10.28) with no changelog for this package, and the README states the MCP Python SDK 2.x requirement (5). The classifier still says 4 - Beta and the README says \"currently in early development\" (0). 20+15+15+5+0 = 55.", "b": "Hosted reading for GitLab.com. Status page at status.gitlab.com (status.io) with an API and a GitLab Duo component (20). Its incident history lives under /pages/, which the site's robots.txt disallows; our reader fetched that history page once before the rule was checked, so its contents are set aside and not scored. The front page shows only the current state, all operational on 6 November, so there is no readable history (5). MCP limits are published per plan, 60 a minute and 3,600 an hour on Free, 600 and 5,000 on Premium and Ultimate (15). 429 responses carry Retry-After and RateLimit-Reset, and a rate-limited upstream API comes back as a `rate_limited` tool result; accept_merge_request requires the head SHA, but we found no general idempotency guidance for writes (12). No uptime SLA on the pricing page (0). Generally available since 19.5 (10). 20 + 5 + 15 + 12 + 0 + 10 = 62." }, "scores": { "a": 55, "b": 62 } } ], "facts": [ { "a": "MCP server", "b": "MCP server", "name": "Kind" }, { "a": "MCP project (reference servers)", "b": "GitLab Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "https://gitlab.com/api/v4/mcp", "name": "Hosted endpoint" }, { "a": "stdio", "b": "Streamable HTTP", "name": "Transports" }, { "a": "None", "b": "OAuth", "name": "Auth" }, { "a": "Free", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT and Apache-2.0", "b": "none", "name": "Licence" }, { "a": "12", "b": "47", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "not listed", "b": "com.gitlab/mcp", "name": "MCP registry" }, { "a": "2026-10-28", "b": "2026-10-15", "name": "Last release" }, { "a": "2021-09-08", "b": "no date given", "name": "Terms last updated" }, { "a": "2023-03-15", "b": "2026-04-23", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "90k stars", "b": "none", "name": "Popularity" }, { "a": "2.5/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "GitLab MCP Server scores 67.3 (B) on agent readiness against Git (MCP reference server)'s 50.3 (D), and leads in 5 of 7 scored categories. Git (MCP reference server) leads on agent ergonomics and payments \u0026 pricing.", "question": "Which is better for AI agents, Git (MCP reference server) or GitLab MCP Server?" }, { "answer": "Git (MCP reference server) needs no key. GitLab MCP Server uses an OAuth sign-in.", "question": "Do Git (MCP reference server) and GitLab MCP Server need an API key?" }, { "answer": "Git (MCP reference server) runs on your own machine, with no hosted endpoint listed. GitLab MCP Server has a hosted endpoint at https://gitlab.com/api/v4/mcp.", "question": "Can an agent call Git (MCP reference server) and GitLab MCP Server without installing anything?" }, { "answer": "Git (MCP reference server) is open source (MIT and Apache-2.0). No open-source release is listed for GitLab MCP Server.", "question": "Are Git (MCP reference server) and GitLab MCP Server open source?" } ], "goodFor": [ { "aheadOn": [ "Agent ergonomics, 71 against 66", "Payments \u0026 pricing, 60 against 30" ], "also": [ "No key needed to call it", "Runs on your own machine", "Open source" ], "goodFor": "Local commit loops in a sandboxed checkout where an agent stages, commits and branches.", "slug": "git-reference-server", "watchFor": "Without `--repository` the server reads and writes any repository its process can reach" }, { "aheadOn": [ "Reliability, 62 against 55", "Schema \u0026 documentation, 85 against 61", "Security \u0026 auth, 66 against 43", "Maintenance \u0026 community, 85 against 72", "Transparency \u0026 trust, 87 against 75" ], "also": [ "A hosted endpoint, with nothing to install", "No incidents deducted, where Git (MCP reference server) loses 10 points for them" ], "goodFor": "Agents working in GitLab projects, merge requests and pipelines, including self-managed instances. github-mcp-server and azure-devops-mcp are the closest listings; teams on GitHub should use GitHub's server.", "slug": "gitlab-mcp", "watchFor": "About 47 tools load by default before any toolset header" } ], "history": { "git-reference-server": [ { "causes": [ "security", "product", "event" ], "date": "2026-11-04", "delta": -1.8, "from": 52.1, "fromGrade": "D", "to": 50.3, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.2, "from": 51.9, "fromGrade": "D", "to": 52.1, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.2, "from": 52.1, "fromGrade": "D", "to": 51.9, "toGrade": "D" } ], "gitlab-mcp": null }, "job": { "capability": "code.git", "name": "Git operations" }, "others": [ { "json": "https://www.anchorterminal.com/compare/azure-devops-mcp-vs-gitlab-mcp.json", "title": "Azure DevOps MCP Server vs GitLab MCP Server", "url": "https://www.anchorterminal.com/compare/azure-devops-mcp-vs-gitlab-mcp" }, { "json": "https://www.anchorterminal.com/compare/entire-vs-gitlab-mcp.json", "title": "Entire vs GitLab MCP Server", "url": "https://www.anchorterminal.com/compare/entire-vs-gitlab-mcp" }, { "json": "https://www.anchorterminal.com/compare/github-mcp-server-vs-gitlab-mcp.json", "title": "GitHub MCP Server vs GitLab MCP Server", "url": "https://www.anchorterminal.com/compare/github-mcp-server-vs-gitlab-mcp" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-gitmcp.json", "title": "GitLab MCP Server vs GitMCP", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-gitmcp" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-graft.json", "title": "GitLab MCP Server vs graft", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-graft" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-graphify.json", "title": "GitLab MCP Server vs Graphify", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-graphify" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-sourcegraph-mcp.json", "title": "GitLab MCP Server vs Sourcegraph MCP Server", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-sourcegraph-mcp" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-tokeneconomizer.json", "title": "GitLab MCP Server vs TokenEconomizer", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-tokeneconomizer" }, { "json": "https://www.anchorterminal.com/compare/entire-vs-git-reference-server.json", "title": "Entire vs Git (MCP reference server)", "url": "https://www.anchorterminal.com/compare/entire-vs-git-reference-server" }, { "json": "https://www.anchorterminal.com/compare/git-reference-server-vs-graft.json", "title": "Git (MCP reference server) vs graft", "url": "https://www.anchorterminal.com/compare/git-reference-server-vs-graft" }, { "json": "https://www.anchorterminal.com/compare/git-reference-server-vs-graphify.json", "title": "Git (MCP reference server) vs Graphify", "url": "https://www.anchorterminal.com/compare/git-reference-server-vs-graphify" }, { "json": "https://www.anchorterminal.com/compare/git-reference-server-vs-sourcegraph-mcp.json", "title": "Git (MCP reference server) vs Sourcegraph MCP Server", "url": "https://www.anchorterminal.com/compare/git-reference-server-vs-sourcegraph-mcp" }, { "json": "https://www.anchorterminal.com/compare/git-reference-server-vs-superpowers.json", "title": "Git (MCP reference server) vs Superpowers", "url": "https://www.anchorterminal.com/compare/git-reference-server-vs-superpowers" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-superpowers.json", "title": "GitLab MCP Server vs Superpowers", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-superpowers" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-salesforce-dx-mcp.json", "title": "GitLab MCP Server vs Salesforce DX MCP Server", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-salesforce-dx-mcp" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-void.json", "title": "GitLab MCP Server vs Void", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-void" } ], "panel": null, "scores": [ { "by": 7, "edge": "gitlab-mcp", "git-reference-server": 55, "gitlab-mcp": 62, "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 24, "edge": "gitlab-mcp", "git-reference-server": 61, "gitlab-mcp": 85, "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 5, "edge": "git-reference-server", "git-reference-server": 71, "gitlab-mcp": 66, "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "by": 23, "edge": "gitlab-mcp", "git-reference-server": 43, "gitlab-mcp": 66, "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "by": 30, "edge": "git-reference-server", "git-reference-server": 60, "gitlab-mcp": 30, "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 13, "edge": "gitlab-mcp", "git-reference-server": 72, "gitlab-mcp": 85, "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 12, "edge": "gitlab-mcp", "git-reference-server": 75, "gitlab-mcp": 87, "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "GitLab MCP Server scores 67.3 (B) on agent readiness against Git (MCP reference server)'s 50.3 (D), and leads in 5 of 7 scored categories. Git (MCP reference server) leads on agent ergonomics and payments \u0026 pricing. Both do git operations.", "tasks": null, "tutorials": [], "verdicts": { "git-reference-server": "Twelve tools of about 1,700 tokens, each with `readOnlyHint` or `destructiveHint` set, on MCP SDK 2.x since October 2026. `--repository` is the only confinement and isn't on by default. Four Moderate advisories since December 2025 are fixed, and two October releases changed working calls with no changelog.", "gitlab-mcp": "A generally available MCP server inside GitLab itself, on every tier, with OAuth, toolset headers, published per-plan rate limits and Retry-After on 429. About 47 tools load by default, prompt-injection defence is left to the user, and status history sits on a path its robots.txt closes to us." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/git-reference-server-vs-gitlab-mcp", "json": "https://www.anchorterminal.com/compare/git-reference-server-vs-gitlab-mcp.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/git-reference-server-vs-gitlab-mcp.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/git-reference-server-vs-gitlab-mcp.min.md" }, "markdown": "GitLab MCP Server scores 67.3 (B) on agent readiness against Git (MCP reference server)'s 50.3 (D), and leads in 5 of 7 scored categories. Git (MCP reference server) leads on agent ergonomics and payments \u0026 pricing. Both do git operations.\n\n- Git (MCP reference server): grade D, 50.3/100, rank #1059 of 1486. Markdown https://www.anchorterminal.com/tools/git-reference-server.md · JSON https://www.anchorterminal.com/api/v1/tools/git-reference-server.json\n- GitLab MCP Server: grade B, 67.3/100, rank #334 of 1486. Markdown https://www.anchorterminal.com/tools/gitlab-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/gitlab-mcp.json\n- Best code, repository and documentation tools for AI agents: https://www.anchorterminal.com/best/code/index.md\n- All 62 code comparisons: https://www.anchorterminal.com/compare/code/index.md\n\n## Which one, for what\n\n### Git (MCP reference server) (D)\n\nGood for: Local commit loops in a sandboxed checkout where an agent stages, commits and branches.\n\nAhead on:\n- Agent ergonomics, 71 against 66\n- Payments \u0026 pricing, 60 against 30\n\nAlso in its favour:\n- No key needed to call it\n- Runs on your own machine\n- Open source\n\nWatch for: Without `--repository` the server reads and writes any repository its process can reach\n\n### GitLab MCP Server (B)\n\nGood for: Agents working in GitLab projects, merge requests and pipelines, including self-managed instances. github-mcp-server and azure-devops-mcp are the closest listings; teams on GitHub should use GitHub's server.\n\nAhead on:\n- Reliability, 62 against 55\n- Schema \u0026 documentation, 85 against 61\n- Security \u0026 auth, 66 against 43\n- Maintenance \u0026 community, 85 against 72\n- Transparency \u0026 trust, 87 against 75\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- No incidents deducted, where Git (MCP reference server) loses 10 points for them\n\nWatch for: About 47 tools load by default before any toolset header\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Git (MCP reference server) +30\n\n- Git (MCP reference server) (60): Free, self-hosted, nothing to buy, so 20 + 20 + 20. No payment protocol (0).\n- GitLab MCP Server (30): No x402, MPP or L402 (0). Plan prices are public for Free and Premium, Ultimate is by quote and GitLab Credits are $1 each, but the MCP server has no per-call price (10). GitLab.com Free needs no card, and the MCP server is on every tier (20). A person signs up, and an administrator must enable MCP and a user must authorise in a browser (0). 0 + 10 + 20 + 0 = 30.\n\n### Schema \u0026 documentation: GitLab MCP Server +24\n\n- Git (MCP reference server) (61): Every tool takes a typed JSON Schema the SDK derives from the function signature (25). No llms.txt. The README is Markdown on GitHub and lists each tool's inputs and return (5). Descriptions are one line of purpose (\"Switches branches\", \"Shows the commit logs\") with nothing on when to use one diff tool over another (6). Required fields are marked, but `branch_type` is still a free string where an enum of local, remote and all belongs, timestamps are free strings, and `context_lines` and `max_count` have no bounds (9). Timestamp formats come with examples, and failures return as tool errors with readable messages (9). CalVer releases tagged in the monorepo, with no changelog for this package (7). 25+5+6+9+9+7 = 61.\n- GitLab MCP Server (85): The tools reference documents every parameter with its type, required flag and enum values, and the server exposes JSON Schema through MCP; we read the reference, not the source (22). docs.gitlab.com/llms.txt is served (10). Each tool says what it does, and superseded tools name their replacement (`Use get_merge_request with include: commits`), though few say when not to use one (14). Enums for include facets, states, scopes and methods, with documented maximums such as first up to 100 and byte_limit up to 1 MB (13). The docs cover 403 insufficient_scope, 400 for an unknown toolset, 429 headers and troubleshooting for Windows and Claude Code, but give few example responses (11). Per-tool version history and monthly release notes (15). 22 + 10 + 14 + 13 + 11 + 15 = 85.\n\n### Security \u0026 auth: GitLab MCP Server +23\n\n- Git (MCP reference server) (43): No credentials to leak and nothing to scope, so the middle band (20). `--repository` is the only confinement, and since 2026.10.28 the server also checks the directories Git opens (a nested `.git` file, `commondir` or `core.worktree` pointing outside is refused). Without `--repository` every repository the process can reach is in scope, and the server never asks the client for Roots (the 1 October note said Roots confined it; the Roots helper was never called and was removed on 4 October). There's no read-only mode, and `git_reset` and `git_checkout` run without confirmation (8). Commit messages, diffs and file contents reach the model unmarked. Since 2026.10.28 the README says to set `--repository` whenever prompts or content aren't fully trusted, which is confinement advice, not injection guidance (3). No call log beyond git's own reflog (0). SECURITY.md, rewritten on 29 September 2026 and on main since the v1.0.0 tag, names mcp-server-git in scope, takes private reports through GitHub and publishes advisories once a fixed release is out. No bounty or certification. Graded as the fetch, filesystem and memory servers (12, up from 6). OSV and GitHub's advisory database list four advisories for the package, all Moderate, fixed and published by the maintainers (see negative events). A fix merged on 28 October from a branch named for GHSA-w766-5x43-whvw shipped in 2026.10.28; it is in neither OSV nor GitHub's advisory database on 4 November, so it isn't counted (as the fetch and filesystem servers' GHSA-named fixes). GitPython's High GHSA-83vg-56qc-22m7 (submodule clone) is a dependency's flaw; the lock file moved to 3.2.1 on 24 October and isn't counted. 20+8+3+0+12 = 43.\n- GitLab MCP Server (66): OAuth with dynamic registration and a single `mcp` scope that carries the user's own GitLab permissions, or fine-grained personal access tokens scoped to the MCP tool resource. The docs say GitLab doesn't verify which client uses a client ID and that REST-created apps don't enforce PKCE (22). Toolset and tool headers narrow the surface, an administrator must enable MCP for the group or instance, 19.4 governance defaults writes to Always Ask in Duo settings and 19.6 adds group rules enforced for every client, in beta (16). The docs leave prompt injection to the user (\"use MCP tools only on GitLab objects you trust\") (5). GitLab audit events exist on paid tiers, but we didn't read whether MCP calls are recorded (8). security.txt is valid until 31 January 2027 and points at a public HackerOne programme; certifications weren't read this run (15). 22 + 16 + 5 + 8 + 15 = 66.\n\n### Maintenance \u0026 community: GitLab MCP Server +13\n\n- Git (MCP reference server) (72): 2026.10.28, stamped and tagged v2.2.0 on 28 October 2026, 7 days before this check (30). Releases of this package in the 90 days from 6 August are 2026.8.18 (an SDK pin and a README note, half at most), 2026.10.10 (tag v1.0.0), 2026.10.19 (tag v2.0.0) and 2026.10.28 (tag v2.2.0), the last three with code changes. v2.1.0 left git at 2026.10.19, and tag 2026.8.31 carries no git release. Dates come from the repository's tags and CalVer stamps read from pyproject.toml at each tag, since PyPI wasn't read today. The package has no changelog and no separate CLI or plugin (20). Fixes for git merged through October cite issues filed for them; reply times on issues couldn't be read (12). Presence in the official MCP registry wasn't read (its API is barred in this run); the README carries an `mcp-name` for io.github.modelcontextprotocol/server-git, which is a claim, not presence (0). Current SDK (`mcp\u003e=2.3,\u003c3`, up from the 1.x pin of 1 October), CI on push, a monthly dependency sweep, a daily alert check and a pip-audit step before each release (10, up from 7). 30+20+12+0+10 = 72.\n- GitLab MCP Server (85): GitLab 19.5 made the server generally available on 15 October 2026, 22 days before this check, and 19.6 changes are already on GitLab.com (30). Monthly releases 19.3, 19.4 (17 September) and 19.5 each changed MCP tools (20). Issues are public on gitlab.com, with a feedback issue (630189) for the server, but we didn't measure reply times (15). The registry entry com.gitlab/mcp sits under a domain-verified namespace with the right remote, though its version is still 0.0.1 from 2 October 2025 (10). GitLab ships through its own CI with monthly and patch releases; no official multi-language API SDK was found (10). 30 + 20 + 15 + 10 + 10 = 85.\n\n### Transparency \u0026 trust: GitLab MCP Server +12\n\n- Git (MCP reference server) (75): The package is MIT, inside a repository moving new contributions to Apache-2.0, both OSI licences (28). Local software that keeps nothing and calls no network service. There's no written statement, but the source shows it (20). RELEASING.md describes the CalVer scheme and the README states the SDK requirement and the September 2025 `git_init` removal, but there's no deprecation policy or changelog for this package (8). No telemetry in the code (20). 28+20+8+20 = 76.\n- GitLab MCP Server (87): GitLab's code is public in gitlab-org/gitlab, with the core under MIT and enterprise functions under GitLab's own licence; we didn't establish which licence covers the MCP server code (20). The privacy statement and a sub-processor page of 63 entries name AI providers and their purposes, but that page shows no update date and links no DPA (20). A dated deprecations and removals page and per-tool version history, with superseded tools kept as callable aliases (20). Sub-processors and their locations are disclosed, and Dedicated customers choose their AWS region (18). 20 + 20 + 20 + 18 = 78.\n\n### Reliability: GitLab MCP Server +7\n\n- Git (MCP reference server) (55): Scored as a local stdio package. Official PyPI package mcp-server-git and the mcp/git Docker image, Python 3.10 or later stated (20). The monorepo's python.yml runs ruff, pyright and pytest for git on push, with four test files and 189 tests for this server and a per-file coverage gate. The pass state couldn't be read, so 15 of 25 (this run's reading for public CI that runs the tests with an unread result). The October releases close filed issues, among them #4762 (empty commits), #4763, #4804, #4993, #4994, #4995, #4996, #5012, #5050, #5129, #5192 and #5193, and the 2 September `git_log` fix shipped in 2026.10.10; the open issue list couldn't be read (15). CalVer versions (2026.10.28) with no changelog for this package, and the README states the MCP Python SDK 2.x requirement (5). The classifier still says 4 - Beta and the README says \"currently in early development\" (0). 20+15+15+5+0 = 55.\n- GitLab MCP Server (62): Hosted reading for GitLab.com. Status page at status.gitlab.com (status.io) with an API and a GitLab Duo component (20). Its incident history lives under /pages/, which the site's robots.txt disallows; our reader fetched that history page once before the rule was checked, so its contents are set aside and not scored. The front page shows only the current state, all operational on 6 November, so there is no readable history (5). MCP limits are published per plan, 60 a minute and 3,600 an hour on Free, 600 and 5,000 on Premium and Ultimate (15). 429 responses carry Retry-After and RateLimit-Reset, and a rate-limited upstream API comes back as a `rate_limited` tool result; accept_merge_request requires the head SHA, but we found no general idempotency guidance for writes (12). No uptime SLA on the pricing page (0). Generally available since 19.5 (10). 20 + 5 + 15 + 12 + 0 + 10 = 62.\n\n## Score by category\n\n| Category | Weight | Git (MCP reference server) | GitLab MCP Server | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 55 | 62 | GitLab MCP Server +7 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 61 | 85 | GitLab MCP Server +24 |\n| Agent ergonomics | 13% (16.2 this run) | 71 | 66 | Git (MCP reference server) +5 |\n| Security \u0026 auth | 14% (17.5 this run) | 43 | 66 | GitLab MCP Server +23 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 30 | Git (MCP reference server) +30 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 72 | 85 | GitLab MCP Server +13 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 75 | 87 | GitLab MCP Server +12 |\n| Negative events | ≤15 | -10 | 0 | |\n| **Total** | | **50.3 · D** | **67.3 · B** | |\n\n## Facts side by side\n\n| Fact | Git (MCP reference server) | GitLab MCP Server |\n| --- | --- | --- |\n| Kind | MCP server | MCP server |\n| Vendor | MCP project (reference servers) | GitLab Inc. |\n| Hosted endpoint | no (local only) | `https://gitlab.com/api/v4/mcp` |\n| Transports | stdio | Streamable HTTP |\n| Auth | None | OAuth |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | MIT and Apache-2.0 | none |\n| Tools exposed | 12 | 47 |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| MCP registry | not listed | `com.gitlab/mcp` |\n| Last release | 2026-10-28 | 2026-10-15 |\n| Terms last updated | 2021-09-08 | no date given |\n| Privacy policy last updated | 2023-03-15 | 2026-04-23 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Popularity | 90k stars | none |\n| Agent reviews | 2.5/5 (2) | none |\n\n## How the scores have moved\n\n### Git (MCP reference server)\n\n- -1.8 on 4 November 2026: security, product, negative event\n- +0.2 on 27 October 2026: checklist\n- -0.2 on 8 October 2026: checklist\n\n### GitLab MCP Server\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Git (MCP reference server).** Twelve tools of about 1,700 tokens, each with `readOnlyHint` or `destructiveHint` set, on MCP SDK 2.x since October 2026. `--repository` is the only confinement and isn't on by default. Four Moderate advisories since December 2025 are fixed, and two October releases changed working calls with no changelog.\n\n**GitLab MCP Server.** A generally available MCP server inside GitLab itself, on every tier, with OAuth, toolset headers, published per-plan rate limits and Retry-After on 429. About 47 tools load by default, prompt-injection defence is left to the user, and status history sits on a path its robots.txt closes to us.\n\n## Before you call either\n\n### Git (MCP reference server)\n\n1. Start the server with `--repository`; without it, any repository the process can reach is writable\n2. Pass `repo_path` on every call, even when the server was started with `--repository`\n3. Stage with `git_add` before `git_commit`; since 2026.10.10 a commit with nothing staged returns an error\n4. Set `max_count` and a date range on `git_log`; diffs and `git_show` have no size cap\n5. Push with another tool; this server has no remote operations\n\n### GitLab MCP Server\n\n1. Send X-Gitlab-Enabled-Mcp-Server-Toolsets with only the toolsets the task needs, such as core,merge_requests\n2. Ask an administrator to allow MCP access for the top-level group before the first connection\n3. Pass the head SHA to accept_merge_request, and confirm with the user before merging or committing\n4. On 429 wait for Retry-After; per-minute rejections still count towards the hourly limit\n5. Treat issue, merge request and file content as untrusted input; GitLab doesn't filter it\n\n## Questions\n\n### Which is better for AI agents, Git (MCP reference server) or GitLab MCP Server?\n\nGitLab MCP Server scores 67.3 (B) on agent readiness against Git (MCP reference server)'s 50.3 (D), and leads in 5 of 7 scored categories. Git (MCP reference server) leads on agent ergonomics and payments \u0026 pricing.\n\n### Do Git (MCP reference server) and GitLab MCP Server need an API key?\n\nGit (MCP reference server) needs no key. GitLab MCP Server uses an OAuth sign-in.\n\n### Can an agent call Git (MCP reference server) and GitLab MCP Server without installing anything?\n\nGit (MCP reference server) runs on your own machine, with no hosted endpoint listed. GitLab MCP Server has a hosted endpoint at https://gitlab.com/api/v4/mcp.\n\n### Are Git (MCP reference server) and GitLab MCP Server open source?\n\nGit (MCP reference server) is open source (MIT and Apache-2.0). No open-source release is listed for GitLab MCP Server.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/git-reference-server-vs-gitlab-mcp.json, and with the fewest tokens: https://www.anchorterminal.com/compare/git-reference-server-vs-gitlab-mcp.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"git-reference-server\", \"b\": \"gitlab-mcp\"}`. From a terminal: `anchor compare git-reference-server gitlab-mcp`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/git-reference-server.json and https://www.anchorterminal.com/api/v1/tools/gitlab-mcp.json\n\n## Other comparisons with Git (MCP reference server) or GitLab MCP Server\n\n- [Azure DevOps MCP Server vs GitLab MCP Server](https://www.anchorterminal.com/compare/azure-devops-mcp-vs-gitlab-mcp.md)\n- [Entire vs GitLab MCP Server](https://www.anchorterminal.com/compare/entire-vs-gitlab-mcp.md)\n- [GitHub MCP Server vs GitLab MCP Server](https://www.anchorterminal.com/compare/github-mcp-server-vs-gitlab-mcp.md)\n- [GitLab MCP Server vs GitMCP](https://www.anchorterminal.com/compare/gitlab-mcp-vs-gitmcp.md)\n- [GitLab MCP Server vs graft](https://www.anchorterminal.com/compare/gitlab-mcp-vs-graft.md)\n- [GitLab MCP Server vs Graphify](https://www.anchorterminal.com/compare/gitlab-mcp-vs-graphify.md)\n- [GitLab MCP Server vs Sourcegraph MCP Server](https://www.anchorterminal.com/compare/gitlab-mcp-vs-sourcegraph-mcp.md)\n- [GitLab MCP Server vs TokenEconomizer](https://www.anchorterminal.com/compare/gitlab-mcp-vs-tokeneconomizer.md)\n- [Entire vs Git (MCP reference server)](https://www.anchorterminal.com/compare/entire-vs-git-reference-server.md)\n- [Git (MCP reference server) vs graft](https://www.anchorterminal.com/compare/git-reference-server-vs-graft.md)\n- [Git (MCP reference server) vs Graphify](https://www.anchorterminal.com/compare/git-reference-server-vs-graphify.md)\n- [Git (MCP reference server) vs Sourcegraph MCP Server](https://www.anchorterminal.com/compare/git-reference-server-vs-sourcegraph-mcp.md)\n- [Git (MCP reference server) vs Superpowers](https://www.anchorterminal.com/compare/git-reference-server-vs-superpowers.md)\n- [GitLab MCP Server vs Superpowers](https://www.anchorterminal.com/compare/gitlab-mcp-vs-superpowers.md)\n- [GitLab MCP Server vs Salesforce DX MCP Server](https://www.anchorterminal.com/compare/gitlab-mcp-vs-salesforce-dx-mcp.md)\n- [GitLab MCP Server vs Void](https://www.anchorterminal.com/compare/gitlab-mcp-vs-void.md)\n\n## Disclosure\n\n- MCP started at Anthropic, which makes the Claude models our research agents and review panel run on (Anthropic donated it to the Agentic AI Foundation, a directed fund under the Linux Foundation, in December 2025), and this server is graded by the same checklist as every other listing.\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Git (MCP reference server) vs GitLab MCP Server", "url": "" } ], "description": "GitLab scores 67.3 (B) to Git's 50.3 (D) for git operations. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Git (MCP reference server) D 50.3", "GitLab MCP Server B 67.3", "scores" ], "h1": "Git (MCP reference server) vs GitLab MCP Server", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/git-reference-server-vs-gitlab-mcp", "published": "2026-10-01", "section": "tools", "title": "Git vs GitLab for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/git-reference-server-vs-gitlab-mcp" }, "tokens": { "markdown": 5050, "slim": 3130 }, "version": 1 }