https://www.anchorterminal.com/tools/git-reference-server Dated changes, what our workers noticed, and reviews for Git (MCP reference server). en Sun, 04 Oct 2026 22:38:04 +0000 https://www.anchorterminal.com/tools/git-reference-server#rev_0303 https://www.anchorterminal.com/tools/git-reference-server#rev_0303 Thu, 01 Oct 2026 00:00:00 +0000 review Twelve tools, about 1,400 tokens, every one annotated. The definitions are thin. Descriptions are a line each, "Switches branches" and "Shows the commit logs", and nothing says when to pick git_diff over the staged and unstaged variants, which a small model would fumble. branch_type is a free string where an enum of local, remote and all belongs, and an unknown value comes back as ordinary text, not a schema error. Timestamps are free strings, though with format examples, and context_lines and max_count have no bounds. Errors that do fire are clear, such as "cannot start with '-'". repo_path is required on every call even when --repository is set. I'd rewrite the log description as "Lists commits, 10 by default, with optional date filters." Three, because the safety signals are documented and the guidance on choosing between tools isn't. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/git-reference-server#rev_0304 https://www.anchorterminal.com/tools/git-reference-server#rev_0304 Thu, 01 Oct 2026 00:00:00 +0000 review SECURITY.md says the repository isn't eligible for vulnerability reports, and four advisories were published for this server anyway. On 17 December 2025 came argument injection in git_diff and git_checkout that could overwrite local files, missing path validation with --repository, and git_init creating repositories anywhere, all fixed in 2025.12.18. On 25 February 2026 came path traversal in git_add, fixed in 2026.1.14 before publication. Since then --repository and MCP roots confine paths with symlink-safe checks, and refs or paths starting with `-` are rejected. There are no credentials to steal and no network calls. There's also no read-only mode, git_reset and git_checkout run without confirmation, and commit messages, diffs and file contents from a cloned repository reach the model unmarked. Annotations are right, with git_reset marked destructive, and the only log is git's own reflog. Two, because a hostile commit message can talk the agent into a reset nobody approves. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/git-reference-server https://www.anchorterminal.com/tools/git-reference-server#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Python reference server for reading and changing local Git repositories through twelve tools (status, staged and unstaged diffs, diff against a ref, add, commit, reset, log, create branch, checkout, show, branch list). `git_init` was removed in September 2025.