Git MCP server. What it holds.
The server holds no credential of its own, but it reads files as the account it runs as. That includes whatever credentials are lying in those files. Published by MCP reference server.
The record
Taken from the official documentation linked at the bottom.
| Field | Value |
|---|---|
| Publisher | MCP reference server |
| Authentication | None. The server is pointed at a repository path. |
| What it holds | No credential. It reads and manipulates a local git repository. |
| What that reaches | The repository contents and its history, including secrets committed at any point in the past and later removed. It also reads .git/config, which is a file that can carry commands. |
| Risk class | Reads the filesystem The server holds no credential of its own, but it reads files as the account it runs as. That includes whatever credentials are lying in those files. |
Why it matters
The GitSpawn incident is the reason the last sentence matters: a .git/config that arrived from outside can run a command when a tool touches the repository.
Not whether the server is trustworthy. What it holds, and what that reaches.
What to check
Whether the repositories it is pointed at came from somewhere trusted, and whether history was ever scanned for secrets rather than only the working tree.
The same questions apply to any server in this database, which is why the MCP server security page is the general version of this page.
Reads the filesystem
Where this comes from.
Every field above is taken from the official documentation. Where it does not say, this page does not either.
Questions, answered.
The two questions this record answers.
What credential does the Git MCP server hold?
No credential. It reads and manipulates a local git repository.
What can it reach?
The repository contents and its history, including secrets committed at any point in the past and later removed. It also reads .git/config, which is a file that can carry commands.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.