GitMCP vs Sourcegraph MCP Server

GitMCP 8

The last commit on main is 8 May 2026, 182 days before this check, and there are no tags or releases (0). Nothing in the last 90 days (0). Since May, outside issues and pull requests (#244 to #271, among them the security report #249 and fixes #256, #267 and #250) have gone without a maintainer reply or merge (3). Not found in the official MCP registry under any namespace (0). A run-tests workflow with vitest and a Playwright end-to-end workflow exist on push and pull request (5). 0 + 0 + 3 + 0 + 5 = 8.

Sourcegraph MCP Server 83

Self-hosted releases in the window are 7.6.0 (6 August), 7.7.0 (26 August), 7.7.359 (27 August), 8.0.0 (17 September), 8.1.0 (14 October), 8.1.1335 (22 October) and 8.1.2687 (29 October 2026). 7.6.0, 7.7.0, 8.0.0 and 8.1.0 change the MCP server, and the two 8.1 patches don't. The weekly Cloud update notes of 2 November 2026 add a warning to MCP tool results when a code host connection has expired (30). Four releases that change the MCP server since 6 August 2026, plus weekly Cloud notes (20). A closed service with a public changelog, support at support@sourcegraph.com and published response times from two business hours for Enterprise. No public issue tracker for the server was found (12). Listed in the official MCP registry as io.github.sourcegraph/mcp per the 8 October check; the registry's API wasn't requested on 4 November (15). Release 7.6.0 moved to the MCP Go SDK v1.7.0 and protocol version 2026-07-28, and releases name the CVEs they fix. No public CI to read (6). 30+20+12+15+6 = 83.

GitMCP 15

Scored as a hosted MCP server. No status page found (0) and so no readable incident history (5). The maintainer confirmed on issue #245 that gitmcp.io was throttled by Cloudflare for a few hours in May 2026, outside the 90-day window. No rate limits are documented (0) and nothing on 429 or retries (0). No SLA (0). The service is live with no beta or preview label (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Sourcegraph MCP Server 60

Scored with the hosted lines, because the server is an HTTP endpoint on a Sourcegraph Cloud or self-hosted instance. sourcegraphstatus.com, which didn't resolve on 8 October, loaded on 4 November 2026. It is an incident.io page with components for Sourcegraph Cloud, the self-hosted release, the model provider, accounts, workspaces, analytics, the Enterprise Portal and public code search. No component names MCP. The MCP endpoint is a path on each Cloud instance, but a vendor page with no MCP component takes 15, as honeycomb-mcp, sentry-mcp and slack-mcp do, whose MCP servers also sit on infrastructure the vendor's components cover (15). Its feed and incident pages show five Cloud incidents touching 6 August to 4 November. A us-central1 partial outage from 4 August 19:25 to 6 August 05:16 UTC, increased latency and errors from 31 August 17:56 to 1 September 08:41 UTC, degraded performance from Google Cloud issues on 1 and 2 September, a US Central regional incident from 4 to 9 September, and Europe latency and errors on 20 October. Each names one region or a degradation without a full outage, so each reads as partial (minor only, 20). No request rate limits for the MCP endpoints were found in the reviewed documentation, only result limits per tool (0). No 429 or backoff guidance was found. Releases 8.0.0 and 8.1.0 say search tools separate incomplete searches and timeouts from empty results so a client can retry, and every tool reads, so retries are safe (5, a partial kept from 8 October). The SLA page, read again on 4 November, commits to 99.5 per cent monthly uptime on Business and Enterprise plans (10). The server carries no beta label, and Code Finder became generally available on 20 August 2026 (10). 15+20+0+5+10+10 = 60.

GitMCP 60

Nothing to buy, so no payment protocol (0). Free, stated in the README FAQ (20). No account or card (20). An agent connects with a URL and no signup or key (20). 0 + 20 + 20 + 20 = 60.

Sourcegraph MCP Server 15

No x402, MPP or L402 (0). The pricing page publishes a starting figure, a $16K minimum annual contract, with no per-user or per-call price and a contact-sales button, so half of the plan-pricing credit (5). A free Sourcegraph Cloud trial exists by request, with eligibility reviewed and a wait of up to an hour in business hours. No card is mentioned, so half credit (10). An agent cannot gain access alone. A company needs a contract or an approved trial, and a user approves OAuth in a browser (0).

GitMCP 36

Apache-2.0, with the whole service in the public repository (30). The README says the service stores no personal data or queries and keeps no repository content permanently, but there is no privacy policy or terms page (8). No deprecation policy or dated notices; SSE was removed on 8 May 2026 while the README still shows an SSE config for VS Code (0). The hosting stack (Cloudflare Workers, Workers AI, Vectorize, an Analytics Engine dataset) is visible in wrangler.jsonc but no processor is named for users, and invocation logs were turned off on 8 May (5). 30 + 8 + 0 + 5 = 43.

Sourcegraph MCP Server 78

Closed source under the Sourcegraph Terms of Service, last modified 22 July 2026, with supplemental terms listed in one index (15). The terms, the DPA, the security page and the privacy policy describe data handling. Cloud logs are kept up to 365 days, partner LLMs keep inputs only for abuse detection, and the privacy policy excludes customer code, which falls under the customer agreement. No retention period for code or search queries on Cloud was found (22). The current and previous major versions are supported, and release notes date removals such as the end of GitHub Enterprise Server 3.3 support, but no deprecation policy with a notice period for MCP tools was found (10). Sub-processors are listed with locations and purposes, last modified 21 August 2026, with email notice of changes, and instance telemetry is documented (18).

GitMCP 42

No credentials at all, so nothing to leak or scope (20). Every tool is a read of public content (15). Repository docs, code and fetched URLs reach the model unmarked, and fetch_generic_url_content fetches any absolute URL a document mentions, with no prompt-injection guidance in the README (2). No per-call visibility for the caller (0). SECURITY.md routes reports to a Google Form, but the server-side request forgery report in issue #249 (12 June 2026) and its proposed fix #256 have had no maintainer reply in almost five months. No certifications or bounty (5). 20 + 15 + 2 + 0 + 5 = 42.

Sourcegraph MCP Server 76

OAuth 2.0 with PKCE, dynamic client registration held to the mcp scope, one-hour access tokens, a revocation endpoint and bearer tokens in the header only. Access tokens can also carry the mcp scope and default to a 90-day expiry (30). Every documented tool reads, repository permissions apply to each call, and admins can gate MCP by RBAC role or disable single tools. There is no per-repository grant narrower than the user's own access (18). The tools return repository content, which is untrusted input. The consent screen warns that the mcp scope grants read access to private code, and no prompt-injection guidance was found (4). The audit log records access token use, repository access and API requests as structured logs for a SIEM. No MCP-specific call log is documented (9). SOC 2 and ISO/IEC 27001:2022 on the security portal, annual third-party penetration tests, CVE fixes named in release notes and an invite-only HackerOne programme reached through security@sourcegraph.com. security.txt returned 404 again on 4 November 2026 (15).

GitMCP 56

Every tool registers a zod input schema, so inputs are typed JSON Schema (25). There is no llms.txt for GitMCP itself; the README on GitHub is the only Markdown documentation (5). Descriptions are generated per repository and say what each tool reads and when it helps ("Useful for general questions. Always call this tool first if asked about owner/repo"), but not when to avoid one (12). Inputs are a query string and an optional page number, with no enums or constraints beyond types (9). The README has three worked examples and no documented error responses (5). No versioning, tags, releases or changelog (0). 25 + 5 + 12 + 9 + 5 + 0 = 56.

Sourcegraph MCP Server 71

The docs list each tool's parameters with required and optional marks, defaults and maximums. We could not read the tool definitions themselves, because every endpoint needs an Enterprise instance, so the machine-readable contract earns partial credit (15). /llms.txt and /docs/llms.txt return 404, but every docs page is served as Markdown at its URL plus .md (10). Tool entries state use cases, code_finder has best practices and a contrast with deepsearch, and a matrix shows which endpoint carries which tool (14). Required fields, defaults and bounds are documented, while search filters travel inside one query string and evaluator takes a free Lua script (9). list_refs has JSON examples and the authentication page has a troubleshooting table for invalid_scope, 401, 403 and 404, with no catalogue of tool errors (8). Versioned releases with dated MCP entries in the changelog (15).