GitMCP vs Microsoft Learn MCP Server

GitMCP 36

Apache-2.0, with the whole service in the public repository (30). The README says the service stores no personal data or queries and keeps no repository content permanently, but there is no privacy policy or terms page (8). No deprecation policy or dated notices; SSE was removed on 8 May 2026 while the README still shows an SSE config for VS Code (0). The hosting stack (Cloudflare Workers, Workers AI, Vectorize, an Analytics Engine dataset) is visible in wrangler.jsonc but no processor is named for users, and invocation logs were turned off on 8 May (5). 30 + 8 + 0 + 5 = 43.

Microsoft Learn MCP Server 56

The server is closed. The repository's code is MIT and its docs CC-BY-4.0, and the Learn terms of use (12 May 2025) are linked (15). We found no statement of what the endpoint logs or keeps. The FAQ, the overview and the developer reference are silent, and only Microsoft's general privacy statement applies. The overview says the index holds public documentation only, refreshed in full once a day (10). No deprecation policy, and Microsoft says tools can be added, renamed or changed at any time (0). No subprocessors or data locations stated for this service (3). 15 + 10 + 0 + 3 = 28.

GitMCP 42

No credentials at all, so nothing to leak or scope (20). Every tool is a read of public content (15). Repository docs, code and fetched URLs reach the model unmarked, and fetch_generic_url_content fetches any absolute URL a document mentions, with no prompt-injection guidance in the README (2). No per-call visibility for the caller (0). SECURITY.md routes reports to a Google Form, but the server-side request forgery report in issue #249 (12 June 2026) and its proposed fix #256 have had no maintainer reply in almost five months. No certifications or bounty (5). 20 + 15 + 2 + 0 + 5 = 42.

Microsoft Learn MCP Server 60

No credentials at all, so nothing to leak or scope (20). All three tools are reads (15). Results come from Microsoft's own documentation and code samples, which the README says is the only source (10). No per-call visibility for the caller, since there's no account (0). MSRC reporting with a 24-hour response target in SECURITY.md and Microsoft's bug bounty programme. microsoft.com's security.txt was past its Expires date per the 30 September check (15).

GitMCP 56

Every tool registers a zod input schema, so inputs are typed JSON Schema (25). There is no llms.txt for GitMCP itself; the README on GitHub is the only Markdown documentation (5). Descriptions are generated per repository and say what each tool reads and when it helps ("Useful for general questions. Always call this tool first if asked about owner/repo"), but not when to avoid one (12). Inputs are a query string and an optional page number, with no enums or constraints beyond types (9). The README has three worked examples and no documented error responses (5). No versioning, tags, releases or changelog (0). 25 + 5 + 12 + 9 + 5 + 0 = 56.

Microsoft Learn MCP Server 42

Contract line 20 to 0. The server is closed source, Microsoft publishes no tool definitions because it treats them as dynamic, and the only typed parameters are in the README's tool table. A parameter table isn't a published JSON Schema (read-ai, zapier-mcp), and calling the server's tools/list would be a request to the product's own endpoint, which this check doesn't make. No llms.txt found, but learn.microsoft.com returns the docs pages as Markdown when asked with Accept: text/markdown (the release notes, read that way on 4 November), as for copilot-studio-mcp, azure-devops-mcp and dynamics-365-sales, and the README is Markdown (10, was 5). The README table gives one line of purpose per tool, and the repository's three agent skills and a suggested system prompt say when to use each (12). Inputs are query and url strings plus an optional language string with no listed values (6). Configuration examples for about twenty clients and a troubleshooting table. No documented error responses beyond 405 (6). A release-notes page with seven dated entries, the last on 23 March 2026. Microsoft says the tool surface is dynamic and not versioned (8). 0 + 10 + 12 + 6 + 6 + 8 = 42.

GitMCP 15

Scored as a hosted MCP server. No status page found (0) and so no readable incident history (5). The maintainer confirmed on issue #245 that gitmcp.io was throttled by Cloudflare for a few hours in May 2026, outside the 90-day window. No rate limits are documented (0) and nothing on 429 or retries (0). No SLA (0). The service is live with no beta or preview label (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Microsoft Learn MCP Server 20

Scored as a hosted MCP server. No status page for Microsoft Learn or this endpoint was found (0), so there's no readable incident history (5). The FAQ (dated 5 May 2026, re-read on 4 November) says the free endpoint has rate limits for fair use but gives no numbers, and the release notes and best-practices page give none either (0). Throttling and 429 behaviour aren't documented. The best-practices page says to refresh tools/list and retry after a 400 or 404, which is safe-retry guidance for tool changes, and every tool is a read (5, a partial kept). No SLA (0). Generally available since 7 November 2025 per the release notes (10). 0 + 5 + 0 + 5 + 0 + 10 = 20.

GitMCP 8

The last commit on main is 8 May 2026, 182 days before this check, and there are no tags or releases (0). Nothing in the last 90 days (0). Since May, outside issues and pull requests (#244 to #271, among them the security report #249 and fixes #256, #267 and #250) have gone without a maintainer reply or merge (3). Not found in the official MCP registry under any namespace (0). A run-tests workflow with vitest and a Playwright end-to-end workflow exist on push and pull request (5). 0 + 0 + 3 + 0 + 5 = 8.

Microsoft Learn MCP Server 13

The release notes, re-read on 4 November, still end at the plugin release on 23 March 2026, more than 180 days ago (0). The repository set @microsoft/learn-cli to 1.0.0 on 4 September 2026 (commit 90e1837), with no tag, release or changelog entry, so it isn't counted as a release. The plugin manifest is still 0.3.1 from 19 March 2026. No server entries in the last 90 days (0). Open issues per the 1 October check (eight, the oldest from June 2025; #100 got a documentation fix on 2 September 2026). Questions go to the GitHub repository (8). Registry line 15 to 0. The registry entry was read from the MCP registry's JSON API, a source Anchor Terminal no longer uses, and the repository carries no server.json, so no readable registry page shows the listing. The CLI has a vitest suite that the validation workflow runs on Node 22 and 24, Dependabot updates (the latest on 10 September 2026) and actions pinned to commit SHAs on 30 October. The server's own health isn't visible (5). 0 + 0 + 8 + 0 + 5 = 13.