git

modelcontextprotocol/servers/src/git

This MCP server lets an AI agent inspect and modify Git repositories on the local machine using GitPython and the git CLI. Its biggest risk is that unless the optional --repository flag is configured, an agent steered by prompt injection can read or modify any Git repository on the user's filesystem.

What it can reach

Files

Reads and modifies Git repositories, working trees, staging areas, branches, and commit history on the local filesystem (confined to a single repository only when --repository is passed).

Shell commands

Executes the git command-line binary without a shell via GitPython to run repository operations such as status, diff, add, checkout, branch, rev-parse, and stash.

Findings

1. MediumUnrestricted access to all local Git repositories by default

   src/git/src/mcp_server_git/server.py:399

   When the server is started without the --repository (-r) flag—which is the default CLI behavior and the configuration used in the README's VS Code one-click install buttons—no path confinement is enforced. Because every tool accepts repo_path as an argument, prompt injection from untrusted files, issues, or web pages can direct the agent to read sensitive files and commit history (via git_show, git_log, or git_diff) or alter branches and staged state (via git_checkout, git_reset, git_add, or git_commit) in any Git repository on the user's machine.

   Fix: Always configure the server with the --repository <path> argument in your MCP client settings, or change the CLI default to confine operations to the current working directory unless an explicit flag opts into unrestricted access.

2. LowDocker container creates an unprivileged user but runs as root

   src/git/Dockerfile:42

   The Dockerfile creates a dedicated non-root user named 'app' and assigns ownership of the virtual environment to 'app:app', but omits a 'USER app' instruction before the entrypoint. Consequently, the server runs as root inside the container when launched with Docker.

   Fix: Add 'USER app' immediately before 'ENTRYPOINT ["mcp-server-git"]' in src/git/Dockerfile.