GitMCP vs Ref

GitMCP 36

Apache-2.0, with the whole service in the public repository (30). The README says the service stores no personal data or queries and keeps no repository content permanently, but there is no privacy policy or terms page (8). No deprecation policy or dated notices; SSE was removed on 8 May 2026 while the README still shows an SSE config for VS Code (0). The hosting stack (Cloudflare Workers, Workers AI, Vectorize, an Analytics Engine dataset) is visible in wrangler.jsonc but no processor is named for users, and invocation logs were turned off on 8 May (5). 30 + 8 + 0 + 5 = 43.

Ref 69

Per the 8 October check, not re-read on 4 November (ref.tools and docs.ref.tools are paused for this run pending a ruling on Ref's terms). The stdio server is MIT, and it is a thin client. The search service is closed. Its terms and privacy policy are drawn by script and were read on 8 October only from the script files the pages load, which this run doesn't count, so both are unread here. The line is held, as Prefactor's licence and data-handling lines were when its script-drawn terms were struck (18). The security page describes encryption, tenant isolation, zero-data-retention terms at model providers and a seven-day limit on agent transcripts. No DPA was found, and Centure.ai is named on the comparison page but not in the subprocessor table (18). No deprecation policy found. The pricing page says legacy $9 and $19 subscriptions continue unchanged (3). 19 subprocessors are named with what each can see. Data locations aren't stated (14). 18+18+3+14 = 53.

GitMCP 8

The last commit on main is 8 May 2026, 182 days before this check, and there are no tags or releases (0). Nothing in the last 90 days (0). Since May, outside issues and pull requests (#244 to #271, among them the security report #249 and fixes #256, #267 and #250) have gone without a maintainer reply or merge (3). Not found in the official MCP registry under any namespace (0). A run-tests workflow with vitest and a Playwright end-to-end workflow exist on push and pull request (5). 0 + 0 + 3 + 0 + 5 = 8.

Ref 35

No dated release or API change of Ref Context is readable within 180 days. The ref-tools-mcp package was last published on 4 November 2025 (3.0.3, the version-bump commit is dated the same day in the repository), 365 days before this check. The 31 July and 30 September 2026 updates were read on 8 October from mailchi.mp, whose robots.txt now disallows every crawler, so they're struck; the docs changelog index gives months only, and both covered Ref Plans. The repository's last commits, on 28 September 2026, are dependency updates, which can't set recency (0 of 30). No releases or dated entries in the 90 days from 6 August (0). Per the 8 October reading of GitHub's API, closed issues show two to five comments each and September's open pull requests one comment each, and the docs promise a reply within one business day (15). The official MCP registry lists tools.ref/ref-tools-mcp under Ref's own domain, at 3.0.1 from 28 October 2025, still on 4 November (15). Dependabot alerts were cleared on 28 September 2026. The only workflow builds a bundle on release, with no tests (5). 0+0+15+15+5 = 35.

GitMCP 60

Nothing to buy, so no payment protocol (0). Free, stated in the README FAQ (20). No account or card (20). An agent connects with a URL and no signup or key (20). 0 + 20 + 20 + 20 = 60.

Ref 35

Per the 8 October check, not re-read on 4 November (ref.tools and docs.ref.tools are paused for this run pending a ruling on Ref's terms). No x402, MPP or L402 (0). One credit per tool call and $10 per 1,000 extra credits are published without a login (20). The free plan is 200 one-time credits that never expire, not a recurring allowance, and the docs don't say whether sign-up needs a card (15). A person has to sign up in a browser to get a key (0).

GitMCP 42

No credentials at all, so nothing to leak or scope (20). Every tool is a read of public content (15). Repository docs, code and fetched URLs reach the model unmarked, and fetch_generic_url_content fetches any absolute URL a document mentions, with no prompt-injection guidance in the README (2). No per-call visibility for the caller (0). SECURITY.md routes reports to a Google Form, but the server-side request forgery report in issue #249 (12 June 2026) and its proposed fix #256 have had no maintainer reply in almost five months. No certifications or bounty (5). 20 + 15 + 2 + 0 + 5 = 42.

Ref 63

Per the 8 October check, not re-read on 4 November. OAuth through Scalekit with two scopes, public_docs:read and private_docs:read, or an API key. Key rotation and revocation aren't described in the docs (26). Less 10 because the install docs give ?apiKey=YOUR_API_KEY in the URL as a documented option (16). Both tools are read-only, the scopes separate public from private search, and team roles limit who can add to the index (16). ref_read_url returns third-party web content. Ref's comparison page says Centure.ai detects and blocks prompt injection in scraped and uploaded content, which we can't test (11). ref.tools/activity logs user identity, tool calls and arguments (13). A valid security.txt (expires 1 July 2027) and a security@ref.tools contact, with no acknowledgement time. SOC 2 is in progress, not complete. No bug bounty or published advisories found, OSV holds none for ref-tools-mcp, and the repository has no SECURITY.md. This run reads security.txt plus a reporting route with no stated time as 7 (mails-ai, tokenrip), in place of the 8 given on 8 October (7). 26-10+16+11+13+7 = 63.

GitMCP 56

Every tool registers a zod input schema, so inputs are typed JSON Schema (25). There is no llms.txt for GitMCP itself; the README on GitHub is the only Markdown documentation (5). Descriptions are generated per repository and say what each tool reads and when it helps ("Useful for general questions. Always call this tool first if asked about owner/repo"), but not when to avoid one (12). Inputs are a query string and an optional page number, with no enums or constraints beyond types (9). The README has three worked examples and no documented error responses (5). No versioning, tags, releases or changelog (0). 25 + 5 + 12 + 9 + 5 + 0 = 56.

Ref 68

Both tools have typed JSON Schema inputs in the open-source server (25). docs.ref.tools/llms.txt, llms-full.txt and a Markdown copy of every docs page exist (10). The descriptions say what each tool does and that a read takes the exact URL from a search, with nothing on when not to use them (12). Each tool takes one required string with no enums or bounds, and private search is switched on by writing ref_src=private inside the query text (7). The README shows two worked search-and-read sequences with token counts. No error responses are documented (6). The npm package follows semver, but the repository has no changelog file and no GitHub releases, and product changes appear only in monthly newsletters listed on the docs changelog page (per the 8 October check), whose copies on mailchi.mp now disallow every crawler (8).

GitMCP 58

Four tools per repository endpoint and five on gitmcp.io/docs, each short (25). Code search pages 30 results with a page number, and documentation search returns matched chunks instead of the whole file, but there is no size control on the fetch tool (10). Errors come back as tool text with no documented codes (5). Every tool is a read and the source sets readOnlyHint, but issue #266 reports the annotations are passed in a position the MCP SDK ignores, and the fix #267 is unmerged (8). No parameters to set up and nothing to configure; there are no SDKs, which a keyless MCP endpoint doesn't need (10). 25 + 10 + 5 + 8 + 10 = 58.

Ref 67

Two tools whose definitions and server instructions total under 1,000 characters (25). There are no size or paging parameters. The README says a session never returns the same search result twice and a read returns the most relevant sections, about 5,000 tokens at most (12). In the open-source server, failures come back as ordinary text without isError, and any 401 from the API becomes a message to verify an email address. No error list is documented, and the hosted server's code is closed (6). Both tools carry readOnlyHint: true, with no destructiveHint or idempotentHint. Both only read, so retries are safe (16). One required parameter per tool. No SDK was found (8).