Unreleased: not public yet. Maintainers have not reviewed this result.
Results / git-mcp-server
git-mcp-server
A
Protocol4/4 points
Coverage: hygiene only (0 of 33 tools reached with a valid call). Only protocol hygiene was graded, so the A says little about what the tools do.
Protocol checks
| Check | Verdict | What happened |
|---|---|---|
| protocol Valid MCP handshake and tool schemas | pass | handshake ok, 33 well-formed tool(s) |
| tool-poisoningcritical No tool-poisoning indicators in tool metadata | pass | scanned 33 tool definition(s), 1 resource(s), including parameter text: nothing suspicious |
| robust-input Survives malformed tool input | pass | 96 invalid call(s) rejected cleanly |
| secret-echocritical No environment secret echoed in responses | pass | canary secrets absent from tools/list and 96 captured response(s) |
Network checks
| Check | Verdict | What happened |
|---|---|---|
| net-loopback-ssrfcritical Refuses loopback targets (SSRF) | inconclusive | the listener saw nothing, but 9 of 9 probes were not explicitly refused (9 failed without saying the target was refused), so a refusal cannot be told from a tool that cannot fetch at all (a reply that only reports a failed fetch (proxy, socket, DNS) is not read as a refusal; set net.control_url to a URL the tool can reach) |
| net-scheme-allowlistcritical Only http(s) schemes accepted | inconclusive | no scheme had an observable effect, but 6 of 7 probes were not explicitly refused, so a refusal cannot be told from a tool that cannot fetch at all (a reply that only reports a failed fetch (proxy, socket, DNS) is not read as a refusal; set net.control_url to a URL the tool can reach) |
| net-caps Response size and time are capped | n/a | net-loopback-ssrf was inconclusive: the server never reached the loopback listener, so no loopback URL is known to be fetchable; response size and time caps were not measured |
| net-redirect Redirects are re-validated | n/a | the server refused or never reached the loopback listener, so redirect handling could not be observed (a server that blocks loopback cannot be sent a redirect it would follow) |
What was not covered
- Database: Not applicable. Server config has no {dsn}/{host}/... Placeholder, so the harness cannot start the server once per role
- HTTP: Not applicable. The server is started over stdio; the http pack needs server.url
- Files: Not applicable. No tool is classified as taking a file path with medium confidence or higher
- Git: Not applicable. No tool is classified as taking a git repository path with medium confidence or higher
- Network: Inconclusive. The listener saw nothing, but 9 of 9 probes were not explicitly refused (9 failed without saying the target was refused), so a refusal cannot be told from a tool that cannot fetch at all (a reply that only reports a failed fetch (proxy, socket, DNS) is not read as a refusal; set net.control_url to a URL the tool can reach)
- SQLite: Not applicable. No tool takes a SQL string
- Effects: Not applicable. No tool declares annotations, so there is nothing to compare with what the sandbox observed
- Malformed-input probes cover the first 25 of 33 tools
- Tool "get_issue_by_url" (url) was not probed by the net pack: the listener saw nothing, but 9 of 9 probes were not explicitly refused (9 failed without saying the target was refused), so a refusal cannot be told from a tool that cannot fetch at all (a reply that only reports a failed fetch (proxy, socket, DNS) is not read as a refusal; set net.control_url to a URL the tool can reach)
- Tools that a server lists only for clients that declare roots, sampling or elicitation capabilities are not seen: the harness declares none
- Tool "list_platforms" is covered by the core checks only: the tool takes no parameters; add it under tools: to include it
- Tool "test_platform_connection" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
- Tool "refresh_platform_username" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
- Tool "get_platform_config" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
- Tool "get_current_user_info" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
Run it yourself
Started with the standard settings like this; put it in sealmark.yaml as the server:
uvx git-mcp-server==0.2.5
Each of 613 verdicts was checked independently, and Sealmark was wrong on some: how reliable Sealmark is.
Think a verdict is wrong, or want a server removed? Email disclosure@sealmark.dev with the server version. We recheck, correct the page if we were wrong, and add your reply. See the disclosure policy.