GitMCP vs Graphify

GitMCP 8

The last commit on main is 8 May 2026, 182 days before this check, and there are no tags or releases (0). Nothing in the last 90 days (0). Since May, outside issues and pull requests (#244 to #271, among them the security report #249 and fixes #256, #267 and #250) have gone without a maintainer reply or merge (3). Not found in the official MCP registry under any namespace (0). A run-tests workflow with vitest and a Playwright end-to-end workflow exist on push and pull request (5). 0 + 0 + 3 + 0 + 5 = 8.

Graphify 80

0.9.100 was tagged and dated in CHANGELOG.md on 1 November 2026, the day of this check (30). PyPI's pages didn't resolve from the shell on 1 November, so release dates come from the tags and the changelog. 68 dated releases in the 90 days to 1 November, 0.9.33 (5 August) to 0.9.100 (20). The 0.9.97 to 0.9.100 entries credit community pull requests by name, with issue and pull request numbers up to #4933, and the default branch had commits on every day from 25 October to 1 November. Issue threads and reply times weren't read, a judgement call (18 of 25). The official MCP registry still holds only io.github.Graphify-Labs/graphify, Graphify Cloud's hosted server at api.graphify.com/mcp; the local graphify-mcp isn't listed. Published on PyPI (5 of 15). A frozen uv.lock in CI on four Python versions, dependency floors raised for named CVEs (Pillow and pypdf in 0.9.96, anyio in the mcp extra in 0.9.97), and trusted publishing. No Dependabot configuration, and the bandit and pip-audit jobs still carry continue-on-error (7 of 10). 30+20+18+5+7 = 80. The 26 October check published 81 on the same lines, which add to 80, so the score is corrected to the sum.

GitMCP 36

Apache-2.0, with the whole service in the public repository (30). The README says the service stores no personal data or queries and keeps no repository content permanently, but there is no privacy policy or terms page (8). No deprecation policy or dated notices; SSE was removed on 8 May 2026 while the README still shows an SSE config for VS Code (0). The hosting stack (Cloudflare Workers, Workers AI, Vectorize, an Analytics Engine dataset) is visible in wrangler.jsonc but no processor is named for users, and invocation logs were turned off on 8 May (5). 30 + 8 + 0 + 5 = 43.

Graphify 81

The editorial half. Apache 2.0, with the MIT portion before 0.9.25 kept in LICENSE-MIT (30). The README's privacy section says what stays local, which env vars send docs to which provider, that Kimi routes to China and how to turn backends off, and the docs agree. The README still says every query is logged by default while the code and configuration docs say logging is off by default, and graphify.com's security page says the core makes no network calls of its own, which the claude CLI fallback for community names stretches (20 of 30). The changelog dates breaking changes and removals, SECURITY.md supports the latest 0.9.x only, and graph.json carries a schema version. No deprecation policy or notice period (8 of 20). No telemetry, stated in the README and on the security page, and none found in the source (20).

GitMCP 15

Scored as a hosted MCP server. No status page found (0) and so no readable incident history (5). The maintainer confirmed on issue #245 that gitmcp.io was throttled by Cloudflare for a few hours in May 2026, outside the 90-day window. No rate limits are documented (0) and nothing on 429 or retries (0). No SLA (0). The service is live with no beta or preview label (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Graphify 58

Read with the local-software lines, since the owner runs it. graphifyy installs from PyPI with uv or pipx, with requires-python >=3.10 stated (20). The CI workflow runs pytest on Python 3.10, 3.12, 3.13 and 3.14, an end-to-end graphify install, the Pi guard tests and generated-skill checks on every push and pull request to v8, over 458 test files (workflow unchanged at 0.9.100). Whether the latest runs pass couldn't be read, because GitHub's web pages weren't reachable (15 of 25). Open issues weren't read. The changelog fixes many extraction regressions each release, each credited to a reporter and a pull request, which reads as handled rather than left open (15 of 25). CHANGELOG.md marks breaking changes, such as full-path node IDs in 0.9.0 and Java inherits edges in 0.8.18, and announces AST cache bumps, but on 0.x they ship in ordinary releases with no Breaking section (8 of 15). Version 0.9.100 of 1 November 2026 (0).

GitMCP 42

No credentials at all, so nothing to leak or scope (20). Every tool is a read of public content (15). Repository docs, code and fetched URLs reach the model unmarked, and fetch_generic_url_content fetches any absolute URL a document mentions, with no prompt-injection guidance in the README (2). No per-call visibility for the caller (0). SECURITY.md routes reports to a Google Form, but the server-side request forgery report in issue #249 (12 June 2026) and its proposed fix #256 have had no maintainer reply in almost five months. No certifications or bounty (5). 20 + 15 + 2 + 0 + 5 = 42.

Graphify 66

Local-software reading, as for vibe-trading. 30 for what leaves the machine by default, 20 for approvals and least privilege, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Code parsing is local and no telemetry code was found. The HTTP server binds 127.0.0.1 with a Host allow-list and a constant-time key check, but only warns when bound to 0.0.0.0 without a key, and turns DNS-rebinding protection off for a wildcard bind. Headless extract sends docs to whichever provider's key is in the environment, with a printed notice, and community naming falls back to claude -p when no key is set (21). No MCP tool writes, and uninstall --purge refuses to delete the project or home folder. The Claude hooks add a reminder before every Bash, Grep, Read and Glob call once a graph exists (since 0.9.96 worded as facts rather than a MANDATORY command, though the Cursor rule still says MANDATORY), the default install edits the user-wide ~/.claude/CLAUDE.md, and git hooks rebuild on every commit and checkout. Settings files get a .graphify-bak copy (14). The semantic pass wraps each file in a hash-stamped untrusted_source block, defangs chat-template tokens, sanitises labels in MCP output and redacts credential-shaped text, and SECURITY.md says this lowers injection rather than stopping it (11). An opt-in query log, a stderr line naming the backend and the variable that chose it, and a local cost.json (8). SECURITY.md with private reporting and a threat table, a valid security.txt, one published advisory with a fix, PyPI trusted publishing, and bandit and pip-audit in CI set not to fail the build, and Security lines in the changelog for dependency floors (0.9.96, 0.9.97) and wider credential redaction (0.9.97). The SOC 2 engagement covers the hosted product only and has no report yet. No bug bounty (12).

GitMCP 56

Every tool registers a zod input schema, so inputs are typed JSON Schema (25). There is no llms.txt for GitMCP itself; the README on GitHub is the only Markdown documentation (5). Descriptions are generated per repository and say what each tool reads and when it helps ("Useful for general questions. Always call this tool first if asked about owner/repo"), but not when to avoid one (12). Inputs are a query string and an optional page number, with no enums or constraints beyond types (9). The README has three worked examples and no documented error responses (5). No versioning, tags, releases or changelog (0). 25 + 5 + 12 + 9 + 5 + 0 = 56.

Graphify 77

MCP reading. All ten tools carry typed JSON Schema inputs in serve.py, though get_node and get_neighbors mark no field required and no tool has an output schema (20 of 25). llms.txt at docs.graphify.com, a Markdown copy of every page, llms-full.txt, and an MCP tool reference generated from serve.py (10). Descriptions say what each tool does in one sentence; the three PR tools also say when to call them, the graph tools don't say when not to (10 of 20). Types, defaults and a bfs/dfs enum, but depth is limited to 1 to 6 in text and code rather than in the schema, and relation_filter is a free string (10 of 15). Worked examples in the README and docs, documented exit codes 0, 3 and 4, refusals that list candidate nodes, and a troubleshooting page (12 of 15). A dated CHANGELOG.md with 243 dated entries on 1 November 2026, a docs changelog, and schema_version in graph.json (15).

GitMCP 58

Four tools per repository endpoint and five on gitmcp.io/docs, each short (25). Code search pages 30 results with a page number, and documentation search returns matched chunks instead of the whole file, but there is no size control on the fetch tool (10). Errors come back as tool text with no documented codes (5). Every tool is a read and the source sets readOnlyHint, but issue #266 reports the annotations are passed in a position the MCP SDK ignores, and the fix #267 is unmerged (8). No parameters to set up and nothing to configure; there are no SDKs, which a keyless MCP endpoint doesn't need (10). 25 + 10 + 5 + 8 + 10 = 58.

Graphify 77

MCP reading. Ten compact tools, about 7,900 characters of tool-definition source in serve.py (25). token_budget on query_graph, get_neighbors and get_community (default 2,000), depth capped at 6, max_hops, top_n, relation_filter and context_filter, and --budget on the CLI. No cursor paging (17 of 20). Exit codes for answer, ambiguous name and no match, ambiguous names refused with candidates instead of guessed, and a clear message when graph.json is missing or corrupt. MCP errors come back as text (15 of 20). Every tool reads, so calls are safe to repeat, but none carries readOnlyHint or destructiveHint (10 of 20). graphify install and /graphify . build a first graph, graph_stats is the documented first call, and code needs no key. Python only, though the CLI works from any language (10 of 15).