Unreleased: not public yet. Maintainers have not reviewed this result.
Results / mcp-server-git
mcp-server-git
A
Protocol4/4 points
A
Git2/2 points
A
Effects2/2 points
Coverage: covered (10 of 12 tools reached with a valid call).
Protocol checks
| Check | Verdict | What happened |
|---|---|---|
| protocol Valid MCP handshake and tool schemas | pass | handshake ok, 12 well-formed tool(s) |
| tool-poisoningcritical No tool-poisoning indicators in tool metadata | pass | scanned 12 tool definition(s), including parameter text: nothing suspicious |
| robust-input Survives malformed tool input | pass | 48 invalid call(s) rejected cleanly |
| secret-echocritical No environment secret echoed in responses | pass | canary secrets absent from tools/list and 48 captured response(s) |
Git checks
| Check | Verdict | What happened |
|---|---|---|
| git-repo-scopecritical Only the configured repository is reachable | pass | git_status, git_diff_unstaged, git_diff_staged, git_diff, git_log, git_show, git_branch refused the repositories outside {sandbox}/repo (write-capable tools not probed: git_commit, git_add, git_reset, git_create_branch, git_checkout) |
| git-arg-injectioncritical Arguments cannot become git options | pass | 11 value(s) starting with --output= were refused or treated as data; no file was created |
Effects checks
| Check | Verdict | What happened |
|---|---|---|
| annotation-honestycritical Read-only tools change nothing | pass | git_status, git_diff_unstaged, git_diff_staged, git_diff, git_log, git_show, git_branch declared read-only and changed nothing in the observed directories during a benign call |
| openworld-honesty Closed-world tools stay on the machine | pass | 7 closed-world tool(s) called; nothing connected to the loopback listener (path and git tools cannot be pointed at it, so this confirms only that nothing connected out during the call) |
| undeclared-writes (advisory) Unannotated tools leave the sandbox unchanged | n/a | no unannotated read-style tool could be given a harness-owned control argument |
What was not covered
- Database: Not applicable. Server config has no {dsn}/{host}/... Placeholder, so the harness cannot start the server once per role
- HTTP: Not applicable. The server is started over stdio; the http pack needs server.url
- Files: Not applicable. No tool is classified as taking a file path with medium confidence or higher
- Network: Not applicable. No tool is classified as taking a URL with medium confidence or higher
- SQLite: Not applicable. No tool takes a SQL string
- Tool "git_commit" was not covered by the git pack: a write-capable git tool is called only on {sandbox}/repo; repository scope is probed through read-only tools
- Tool "git_add" was not covered by the git pack: a write-capable git tool is called only on {sandbox}/repo; repository scope is probed through read-only tools
- Tool "git_reset" was not covered by the git pack: a write-capable git tool is called only on {sandbox}/repo; repository scope is probed through read-only tools
- Tool "git_create_branch" was not covered by the git pack: a write-capable git tool is called only on {sandbox}/repo; repository scope is probed through read-only tools
- Tool "git_checkout" was not covered by the git pack: a write-capable git tool is called only on {sandbox}/repo; repository scope is probed through read-only tools
- Tool "git_status" was not covered by the git pack: no parameter other than the repository, a commit message and file content, so there is nothing to inject
- Tool "git_diff_unstaged" was not covered by the git pack: no parameter other than the repository, a commit message and file content, so there is nothing to inject
- Tool "git_diff_staged" was not covered by the git pack: no parameter other than the repository, a commit message and file content, so there is nothing to inject
Run it yourself
Started with the standard settings like this; put it in sealmark.yaml as the server:
uvx mcp-server-git==2026.10.10
Each of 613 verdicts was checked independently, and Sealmark was wrong on some: how reliable Sealmark is.
Think a verdict is wrong, or want a server removed? Email disclosure@sealmark.dev with the server version. We recheck, correct the page if we were wrong, and add your reply. See the disclosure policy.