Unreleased: not public yet. Maintainers have not reviewed this result.
Results / @cyanheads/git-mcp-server
@cyanheads/git-mcp-server
A
Protocol4/4 points
D
Git1/2 pointscritical: git-repo-scope
F
Network1.5/4 pointscritical: net-loopback-ssrf
A
Effects1/1 points
Coverage: covered (23 of 28 tools reached with a valid call).
Protocol checks
| Check | Verdict | What happened |
|---|---|---|
| protocol Valid MCP handshake and tool schemas | pass | handshake ok, 28 well-formed tool(s) |
| tool-poisoningcritical No tool-poisoning indicators in tool metadata | pass | scanned 28 tool definition(s), 1 prompt(s) and 1 resource(s), including parameter text: nothing suspicious |
| robust-input Survives malformed tool input | pass | 85 invalid call(s) rejected cleanly |
| secret-echocritical No environment secret echoed in responses | pass | canary secrets absent from tools/list and 85 captured response(s) |
Git checks
| Check | Verdict | What happened |
|---|---|---|
| git-repo-scopecritical Only the configured repository is reachable | fail | a repository other than {sandbox}/repo could be read: git_branch on symlink; git_diff on symlink; git_log on symlink; git_reflog on symlink; git_status on symlink |
| git-arg-injectioncritical Arguments cannot become git options | pass | 48 value(s) starting with --output= were refused or treated as data; no file was created |
Network checks
| Check | Verdict | What happened |
|---|---|---|
| net-loopback-ssrfcritical Refuses loopback targets (SSRF) | fail | git_clone, git_remote contacted a loopback listener the harness owns (loopback, localhost, ipv6, short, hex, decimal, unspecified, ipv4-mapped, redirect): 18 of 18 probes reached it |
| net-scheme-allowlistcritical Only http(s) schemes accepted | pass | 14 probes with file:, ftp:, gopher:, dict:, data: and javascript: URLs had no observable effect (a scheme the HTTP library does not support passes trivially) |
| net-caps Response size and time are capped | fail | size: the server read the whole 64 MiB body (the listener sent 64 of 64 MiB) and returned 0.00 MiB: it capped its reply, not what it reads; time: no reply within 18 s (timeout_probe_sec 10 + 8 s) |
| net-redirect Redirects are re-validated | partial | redirects are followed; whether the target is re-validated could not be told apart, because the server accepted every loopback spelling directly |
Effects checks
| Check | Verdict | What happened |
|---|---|---|
| annotation-honestycritical Read-only tools change nothing | pass | git_diff, git_log, git_reflog, git_status declared read-only and changed nothing in the observed directories during a benign call (git_blame, git_show not judged: the control call failed) |
| openworld-honesty Closed-world tools stay on the machine | n/a | no tool declares openWorldHint: false that could be given a harness-owned control argument |
| undeclared-writes (advisory) Unannotated tools leave the sandbox unchanged | n/a | no unannotated read-style tool could be given a harness-owned control argument |
What was not covered
- Database: Not applicable. Server config has no {dsn}/{host}/... Placeholder, so the harness cannot start the server once per role
- HTTP: Not applicable. The server is started over stdio; the http pack needs server.url
- Files: Not applicable. No tool is classified as taking a file path with medium confidence or higher
- SQLite: Not applicable. No tool takes a SQL string
- Malformed-input probes cover the first 25 of 28 tools
- Tool "git_add" also looks like a path tool (secondary class); only its primary class (git) was probed
- Tool "git_blame" also looks like a path tool (secondary class); only its primary class (git) was probed
- Tool "git_branch" also looks like a path tool (secondary class); only its primary class (git) was probed
- Tool "git_checkout" also looks like a path tool (secondary class); only its primary class (git) was probed
- Tool "git_cherry_pick" also looks like a path tool (secondary class); only its primary class (git) was probed
- Tool "git_clean" also looks like a path tool (secondary class); only its primary class (git) was probed
- Tool "git_clone" also looks like a path tool (secondary class); only its primary class (git) was probed
Run it yourself
Started with the standard settings like this; put it in sealmark.yaml as the server:
npx -y @cyanheads/git-mcp-server@2.15.3
Each of 613 verdicts was checked independently, and Sealmark was wrong on some: how reliable Sealmark is.
Think a verdict is wrong, or want a server removed? Email disclosure@sealmark.dev with the server version. We recheck, correct the page if we were wrong, and add your reply. See the disclosure policy.