@cyanheads/git-mcp-server 2.1.4 → 2.1.6

package/dist/mcp-server/tools/gitReset/logic.js

@@ -1,9 +1,9 @@
-import { exec } from "child_process";
+import { execFile } from "child_process";
 import { promisify } from "util";
 import { z } from "zod";
 import { BaseErrorCode, McpError } from "../../../types-global/errors.js"; // Direct import for types-global
 import { logger, sanitization } from "../../../utils/index.js"; // logger (./utils/internal/logger.js), RequestContext (./utils/internal/requestContext.js), sanitization (./utils/security/sanitization.js)
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 // Define the reset modes
 const ResetModeEnum = z.enum(["soft", "mixed", "hard", "merge", "keep"]);
 // Define the input schema for the git_reset tool using Zod
@@ -73,24 +73,25 @@ export async function resetGitState(input, context) {
             throw error;
         throw new McpError(BaseErrorCode.VALIDATION_ERROR, `Invalid path: ${error instanceof Error ? error.message : String(error)}`, { context, operation, originalError: error });
     }
-    // Basic sanitization for commit ref
-    const safeCommit = input.commit?.replace(/[`$&;*()|<>]/g, "");
     try {
         // Construct the git reset command
-        let command = `git -C "${targetPath}" reset`;
+        const args = ["-C", targetPath, "reset"];
         if (input.mode) {
-            command += ` --${input.mode}`;
+            args.push(`--${input.mode}`);
         }
-        if (safeCommit) {
-            command += ` ${safeCommit}`;
+        if (input.commit) {
+            args.push(input.commit);
         }
         // Handling file paths requires careful command construction, often without a commit ref.
         // Example: `git reset HEAD -- path/to/file` or `git reset -- path/to/file` (unstages)
         // For simplicity, this initial version focuses on resetting the whole HEAD/index/tree.
         // Add file path logic here if needed, adjusting command structure.
-        logger.debug(`Executing command: ${command}`, { ...context, operation });
+        logger.debug(`Executing command: git ${args.join(" ")}`, {
+            ...context,
+            operation,
+        });
         // Execute command. Reset output is often minimal on success, but stderr might indicate issues.
-        const { stdout, stderr } = await execAsync(command);
+        const { stdout, stderr } = await execFileAsync("git", args);
         logger.debug(`Git reset stdout: ${stdout}`, { ...context, operation });
         if (stderr) {
             // Log stderr as info, as it often contains the primary status message

package/dist/mcp-server/tools/gitSetWorkingDir/logic.js

@@ -1,10 +1,10 @@
-import { exec } from "child_process";
+import { execFile } from "child_process";
 import fs from "fs/promises";
 import { promisify } from "util";
 import { z } from "zod";
 import { BaseErrorCode, McpError } from "../../../types-global/errors.js"; // Direct import for types-global
 import { logger, sanitization } from "../../../utils/index.js"; // RequestContext (./utils/internal/requestContext.js), logger (./utils/internal/logger.js), sanitization (./utils/security/sanitization.js)
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 // Define the Zod schema for input validation
 export const GitSetWorkingDirInputSchema = z.object({
     path: z
@@ -70,7 +70,7 @@ export async function gitSetWorkingDirLogic(input, context) {
     let isGitRepo = false;
     let initializedRepo = false;
     try {
-        const { stdout } = await execAsync("git rev-parse --is-inside-work-tree", {
+        const { stdout } = await execFileAsync("git", ["rev-parse", "--is-inside-work-tree"], {
             cwd: sanitizedPath,
         });
         if (stdout.trim() === "true") {
@@ -94,7 +94,9 @@ export async function gitSetWorkingDirLogic(input, context) {
     if (!isGitRepo && input.initializeIfNotPresent) {
         logger.info(`Path is not a Git repository. Attempting to initialize (initializeIfNotPresent=true) with initial branch 'main'.`, { ...context, operation, path: sanitizedPath });
         try {
-            await execAsync("git init --initial-branch=main", { cwd: sanitizedPath });
+            await execFileAsync("git", ["init", "--initial-branch=main"], {
+                cwd: sanitizedPath,
+            });
             initializedRepo = true;
             isGitRepo = true; // Now it is a git repo
             logger.info('Successfully initialized Git repository with initial branch "main".', { ...context, operation, path: sanitizedPath });

package/dist/mcp-server/tools/gitShow/logic.js

@@ -1,9 +1,9 @@
-import { exec } from "child_process";
+import { execFile } from "child_process";
 import { promisify } from "util";
 import { z } from "zod";
 import { BaseErrorCode, McpError } from "../../../types-global/errors.js"; // Direct import for types-global
 import { logger, sanitization } from "../../../utils/index.js"; // logger (./utils/internal/logger.js), RequestContext (./utils/internal/requestContext.js), sanitization (./utils/security/sanitization.js)
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 // Define the input schema for the git_show tool using Zod
 // No refinements needed here, so we don't need a separate BaseSchema
 export const GitShowInputSchema = z.object({
@@ -89,14 +89,17 @@ export async function gitShowLogic(input, context) {
     try {
         // Construct the refspec, combining ref and filePath if needed
         const refSpec = input.filePath
-            ? `${input.ref}:"${input.filePath}"`
-            : `"${input.ref}"`;
+            ? `${input.ref}:${input.filePath}`
+            : input.ref;
         // Construct the command
-        const command = `git -C "${targetPath}" show ${refSpec}`;
-        logger.debug(`Executing command: ${command}`, { ...context, operation });
+        const args = ["-C", targetPath, "show", refSpec];
+        logger.debug(`Executing command: git ${args.join(" ")}`, {
+            ...context,
+            operation,
+        });
         // Execute command. Note: git show might write to stderr for non-error info (like commit details before diff)
         // We primarily care about stdout for the content. Errors usually have non-zero exit code.
-        const { stdout, stderr } = await execAsync(command);
+        const { stdout, stderr } = await execFileAsync("git", args);
         if (stderr) {
             // Log stderr as debug info, as it might contain commit details etc.
             logger.debug(`Git show command produced stderr (may be informational)`, {

package/dist/mcp-server/tools/gitStash/logic.js

@@ -1,9 +1,9 @@
-import { exec } from "child_process";
+import { execFile } from "child_process";
 import { promisify } from "util";
 import { z } from "zod";
 import { BaseErrorCode, McpError } from "../../../types-global/errors.js"; // Direct import for types-global
 import { logger, sanitization } from "../../../utils/index.js"; // logger (./utils/internal/logger.js), RequestContext (./utils/internal/requestContext.js), sanitization (./utils/security/sanitization.js)
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 // Define the BASE input schema for the git_stash tool using Zod
 export const GitStashBaseSchema = z.object({
     path: z
@@ -90,16 +90,16 @@ export async function gitStashLogic(input, context) {
         throw new McpError(BaseErrorCode.VALIDATION_ERROR, `Invalid stash reference format: ${input.stashRef}. Expected format: stash@{n}`, { context, operation });
     }
     try {
-        let command;
+        let args;
         let result;
         switch (input.mode) {
             case "list":
-                command = `git -C "${targetPath}" stash list`;
-                logger.debug(`Executing command: ${command}`, {
+                args = ["-C", targetPath, "stash", "list"];
+                logger.debug(`Executing command: git ${args.join(" ")}`, {
                     ...context,
                     operation,
                 });
-                const { stdout: listStdout } = await execAsync(command);
+                const { stdout: listStdout } = await execFileAsync("git", args);
                 const stashes = listStdout
                     .trim()
                     .split("\n")
@@ -121,13 +121,13 @@ export async function gitStashLogic(input, context) {
             case "pop":
                 // stashRef is validated by Zod refine
                 const stashRefApplyPop = input.stashRef;
-                command = `git -C "${targetPath}" stash ${input.mode} ${stashRefApplyPop}`;
-                logger.debug(`Executing command: ${command}`, {
+                args = ["-C", targetPath, "stash", input.mode, stashRefApplyPop];
+                logger.debug(`Executing command: git ${args.join(" ")}`, {
                     ...context,
                     operation,
                 });
                 try {
-                    const { stdout, stderr } = await execAsync(command);
+                    const { stdout, stderr } = await execFileAsync("git", args);
                     // Check stdout/stderr for conflict messages, although exit code 0 usually means success
                     const conflicts = /conflict/i.test(stdout) || /conflict/i.test(stderr);
                     const message = conflicts
@@ -166,12 +166,12 @@ export async function gitStashLogic(input, context) {
             case "drop":
                 // stashRef is validated by Zod refine
                 const stashRefDrop = input.stashRef;
-                command = `git -C "${targetPath}" stash drop ${stashRefDrop}`;
-                logger.debug(`Executing command: ${command}`, {
+                args = ["-C", targetPath, "stash", "drop", stashRefDrop];
+                logger.debug(`Executing command: git ${args.join(" ")}`, {
                     ...context,
                     operation,
                 });
-                await execAsync(command);
+                await execFileAsync("git", args);
                 result = {
                     success: true,
                     mode: "drop",
@@ -180,16 +180,15 @@ export async function gitStashLogic(input, context) {
                 };
                 break;
             case "save":
-                command = `git -C "${targetPath}" stash save`;
+                args = ["-C", targetPath, "stash", "save"];
                 if (input.message) {
-                    // Ensure message is properly quoted for the shell
-                    command += ` "${input.message.replace(/"/g, '\\"')}"`;
+                    args.push(input.message);
                 }
-                logger.debug(`Executing command: ${command}`, {
+                logger.debug(`Executing command: git ${args.join(" ")}`, {
                     ...context,
                     operation,
                 });
-                const { stdout: saveStdout } = await execAsync(command);
+                const { stdout: saveStdout } = await execFileAsync("git", args);
                 const stashCreated = !/no local changes to save/i.test(saveStdout);
                 const saveMessage = stashCreated
                     ? `Changes stashed successfully.` +

package/dist/mcp-server/tools/gitStatus/logic.js

@@ -1,9 +1,9 @@
-import { exec } from "child_process";
+import { execFile } from "child_process";
 import { promisify } from "util";
 import { z } from "zod";
 import { BaseErrorCode, McpError } from "../../../types-global/errors.js"; // Direct import for types-global
 import { logger, sanitization } from "../../../utils/index.js"; // logger (./utils/internal/logger.js), RequestContext (./utils/internal/requestContext.js), sanitization (./utils/security/sanitization.js)
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 // Define the input schema for the git_status tool using Zod
 export const GitStatusInputSchema = z.object({
     path: z
@@ -197,10 +197,12 @@ export async function getGitStatus(input, context) {
     }
     try {
         // Using --porcelain=v1 for stable, scriptable output and -b for branch info
-        // Ensure the path passed to -C is correctly quoted for the shell
-        const command = `git -C "${targetPath}" status --porcelain=v1 -b`;
-        logger.debug(`Executing command: ${command}`, { ...context, operation });
-        const { stdout, stderr } = await execAsync(command);
+        const args = ["-C", targetPath, "status", "--porcelain=v1", "-b"];
+        logger.debug(`Executing command: git ${args.join(" ")}`, {
+            ...context,
+            operation,
+        });
+        const { stdout, stderr } = await execFileAsync("git", args);
         if (stderr) {
             // Log stderr as warning but proceed to parse stdout
             logger.warning(`Git status command produced stderr (may be informational)`, { ...context, operation, stderr });
@@ -216,8 +218,14 @@ export async function getGitStatus(input, context) {
         // This handles the case of an empty repo after init but before first commit
         if (structuredResult.is_clean && !structuredResult.current_branch) {
             try {
-                const branchCommand = `git -C "${targetPath}" rev-parse --abbrev-ref HEAD`;
-                const { stdout: branchStdout } = await execAsync(branchCommand);
+                const branchArgs = [
+                    "-C",
+                    targetPath,
+                    "rev-parse",
+                    "--abbrev-ref",
+                    "HEAD",
+                ];
+                const { stdout: branchStdout } = await execFileAsync("git", branchArgs);
                 const currentBranchName = branchStdout.trim(); // Renamed variable for clarity
                 if (currentBranchName && currentBranchName !== "HEAD") {
                     structuredResult.current_branch = currentBranchName;

package/dist/mcp-server/tools/gitTag/logic.js

@@ -1,9 +1,9 @@
-import { exec } from "child_process";
+import { execFile } from "child_process";
 import { promisify } from "util";
 import { z } from "zod";
 import { BaseErrorCode, McpError } from "../../../types-global/errors.js"; // Direct import for types-global
 import { logger, sanitization } from "../../../utils/index.js"; // logger (./utils/internal/logger.js), RequestContext (./utils/internal/requestContext.js), sanitization (./utils/security/sanitization.js)
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 // Define the base input schema for the git_tag tool using Zod
 // We export this separately to access its .shape for registration
 export const GitTagBaseSchema = z.object({
@@ -111,16 +111,16 @@ export async function gitTagLogic(input, context) {
         throw new McpError(BaseErrorCode.VALIDATION_ERROR, `Invalid commit reference format: ${input.commitRef}`, { context, operation });
     }
     try {
-        let command;
+        let args;
         let result;
         switch (input.mode) {
             case "list":
-                command = `git -C "${targetPath}" tag --list`;
-                logger.debug(`Executing command: ${command}`, {
+                args = ["-C", targetPath, "tag", "--list"];
+                logger.debug(`Executing command: git ${args.join(" ")}`, {
                     ...context,
                     operation,
                 });
-                const { stdout: listStdout } = await execAsync(command);
+                const { stdout: listStdout } = await execFileAsync("git", args);
                 const tags = listStdout
                     .trim()
                     .split("\n")
@@ -130,20 +130,20 @@ export async function gitTagLogic(input, context) {
             case "create":
                 // TagName is validated by Zod refine
                 const tagNameCreate = input.tagName;
-                command = `git -C "${targetPath}" tag`;
+                args = ["-C", targetPath, "tag"];
                 if (input.annotate) {
                     // Message is validated by Zod refine
-                    command += ` -a -m "${input.message.replace(/"/g, '\\"')}"`;
+                    args.push("-a", "-m", input.message);
                 }
-                command += ` "${tagNameCreate}"`;
+                args.push(tagNameCreate);
                 if (input.commitRef) {
-                    command += ` "${input.commitRef}"`;
+                    args.push(input.commitRef);
                 }
-                logger.debug(`Executing command: ${command}`, {
+                logger.debug(`Executing command: git ${args.join(" ")}`, {
                     ...context,
                     operation,
                 });
-                await execAsync(command);
+                await execFileAsync("git", args);
                 result = {
                     success: true,
                     mode: "create",
@@ -154,12 +154,12 @@ export async function gitTagLogic(input, context) {
             case "delete":
                 // TagName is validated by Zod refine
                 const tagNameDelete = input.tagName;
-                command = `git -C "${targetPath}" tag -d "${tagNameDelete}"`;
-                logger.debug(`Executing command: ${command}`, {
+                args = ["-C", targetPath, "tag", "-d", tagNameDelete];
+                logger.debug(`Executing command: git ${args.join(" ")}`, {
                     ...context,
                     operation,
                 });
-                await execAsync(command);
+                await execFileAsync("git", args);
                 result = {
                     success: true,
                     mode: "delete",

package/dist/mcp-server/tools/gitWorktree/logic.js

@@ -1,9 +1,9 @@
-import { exec } from "child_process";
+import { execFile } from "child_process";
 import { promisify } from "util";
 import { z } from "zod";
 import { logger, sanitization } from "../../../utils/index.js";
 import { BaseErrorCode, McpError } from "../../../types-global/errors.js";
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 // Define the BASE input schema for the git_worktree tool using Zod
 export const GitWorktreeBaseSchema = z.object({
     path: z
@@ -176,18 +176,19 @@ export async function gitWorktreeLogic(input, context) {
         throw new McpError(BaseErrorCode.VALIDATION_ERROR, `Invalid path: ${error instanceof Error ? error.message : String(error)}`, { context, operation, originalError: error });
     }
     try {
-        let command = `git -C "${targetPath}" worktree `;
+        let args;
         let result;
         switch (input.mode) {
             case "list":
-                command += "list";
-                if (input.verbose)
-                    command += " --porcelain"; // Use porcelain for structured output
-                logger.debug(`Executing command: ${command}`, {
+                args = ["-C", targetPath, "worktree", "list"];
+                if (input.verbose) {
+                    args.push("--porcelain");
+                } // Use porcelain for structured output
+                logger.debug(`Executing command: git ${args.join(" ")}`, {
                     ...context,
                     operation,
                 });
-                const { stdout: listStdout } = await execAsync(command);
+                const { stdout: listStdout } = await execFileAsync("git", args);
                 if (input.verbose) {
                     const worktrees = parsePorcelainWorktreeList(listStdout);
                     result = { success: true, mode: "list", worktrees };
@@ -214,21 +215,25 @@ export async function gitWorktreeLogic(input, context) {
             case "add":
                 // worktreePath is guaranteed by refine
                 const sanitizedWorktreePathAdd = sanitization.sanitizePath(input.worktreePath, { allowAbsolute: true, rootDir: targetPath }).sanitizedPath;
-                command += `add `;
-                if (input.force)
-                    command += "--force ";
-                if (input.detach)
-                    command += "--detach ";
-                if (input.newBranch)
-                    command += `-b "${input.newBranch}" `;
-                command += `"${sanitizedWorktreePathAdd}"`;
-                if (input.commitish)
-                    command += ` "${input.commitish}"`;
-                logger.debug(`Executing command: ${command}`, {
+                args = ["-C", targetPath, "worktree", "add"];
+                if (input.force) {
+                    args.push("--force");
+                }
+                if (input.detach) {
+                    args.push("--detach");
+                }
+                if (input.newBranch) {
+                    args.push("-b", input.newBranch);
+                }
+                args.push(sanitizedWorktreePathAdd);
+                if (input.commitish) {
+                    args.push(input.commitish);
+                }
+                logger.debug(`Executing command: git ${args.join(" ")}`, {
                     ...context,
                     operation,
                 });
-                await execAsync(command);
+                await execFileAsync("git", args);
                 // To get the HEAD of the new worktree, we might need another command or parse output if available
                 // For simplicity, we'll report success. A more robust solution might `git -C new_worktree_path rev-parse HEAD`
                 result = {
@@ -243,15 +248,16 @@ export async function gitWorktreeLogic(input, context) {
             case "remove":
                 // worktreePath is guaranteed by refine
                 const sanitizedWorktreePathRemove = sanitization.sanitizePath(input.worktreePath, { allowAbsolute: true, rootDir: targetPath }).sanitizedPath;
-                command += `remove `;
-                if (input.force)
-                    command += "--force ";
-                command += `"${sanitizedWorktreePathRemove}"`;
-                logger.debug(`Executing command: ${command}`, {
+                args = ["-C", targetPath, "worktree", "remove"];
+                if (input.force) {
+                    args.push("--force");
+                }
+                args.push(sanitizedWorktreePathRemove);
+                logger.debug(`Executing command: git ${args.join(" ")}`, {
                     ...context,
                     operation,
                 });
-                const { stdout: removeStdout } = await execAsync(command);
+                const { stdout: removeStdout } = await execFileAsync("git", args);
                 result = {
                     success: true,
                     mode: "remove",
@@ -267,12 +273,19 @@ export async function gitWorktreeLogic(input, context) {
                     allowAbsolute: true,
                     rootDir: targetPath,
                 }).sanitizedPath;
-                command += `move "${sanitizedOldPathMove}" "${sanitizedNewPathMove}"`;
-                logger.debug(`Executing command: ${command}`, {
+                args = [
+                    "-C",
+                    targetPath,
+                    "worktree",
+                    "move",
+                    sanitizedOldPathMove,
+                    sanitizedNewPathMove,
+                ];
+                logger.debug(`Executing command: git ${args.join(" ")}`, {
                     ...context,
                     operation,
                 });
-                await execAsync(command);
+                await execFileAsync("git", args);
                 result = {
                     success: true,
                     mode: "move",
@@ -282,18 +295,21 @@ export async function gitWorktreeLogic(input, context) {
                 };
                 break;
             case "prune":
-                command += "prune ";
-                if (input.dryRun)
-                    command += "--dry-run ";
-                if (input.verbose)
-                    command += "--verbose ";
-                if (input.expire)
-                    command += `--expire "${input.expire}" `;
-                logger.debug(`Executing command: ${command}`, {
+                args = ["-C", targetPath, "worktree", "prune"];
+                if (input.dryRun) {
+                    args.push("--dry-run");
+                }
+                if (input.verbose) {
+                    args.push("--verbose");
+                }
+                if (input.expire) {
+                    args.push(`--expire=${input.expire}`);
+                }
+                logger.debug(`Executing command: git ${args.join(" ")}`, {
                     ...context,
                     operation,
                 });
-                const { stdout: pruneStdout, stderr: pruneStderr } = await execAsync(command);
+                const { stdout: pruneStdout, stderr: pruneStderr } = await execFileAsync("git", args);
                 // Prune often outputs to stderr even on success for verbose/dry-run
                 const pruneMessage = pruneStdout.trim() ||
                     pruneStderr.trim() ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyanheads/git-mcp-server",
-  "version": "2.1.4",
+  "version": "2.1.6",
   "description": "An MCP (Model Context Protocol) server enabling LLMs and AI agents to interact with Git repositories. Provides tools for comprehensive Git operations including clone, commit, branch, diff, log, status, push, pull, merge, rebase, worktree, tag management, and more, via the MCP standard. STDIO & HTTP.",
   "main": "dist/index.js",
   "files": [
@@ -36,22 +36,15 @@
   },
   "dependencies": {
     "@hono/node-server": "^1.14.4",
-    "@modelcontextprotocol/inspector": "^0.14.3",
-    "@modelcontextprotocol/sdk": "^1.13.0",
-    "@types/jsonwebtoken": "^9.0.10",
-    "@types/node": "^24.0.3",
+    "@modelcontextprotocol/sdk": "^1.13.2",
+    "@types/node": "^24.0.7",
     "@types/sanitize-html": "^2.16.0",
     "@types/validator": "^13.15.2",
-    "chalk": "^5.4.1",
     "chrono-node": "2.8.0",
-    "cli-table3": "^0.6.5",
-    "dotenv": "^16.5.0",
-    "express": "^5.1.0",
-    "hono": "^4.8.2",
-    "ignore": "^7.0.5",
+    "dotenv": "^17.0.0",
+    "hono": "^4.8.3",
     "jose": "^6.0.11",
-    "jsonwebtoken": "^9.0.2",
-    "openai": "^5.6.0",
+    "openai": "^5.8.2",
     "partial-json": "^0.1.7",
     "sanitize-html": "^2.17.0",
     "tiktoken": "^1.0.21",
@@ -59,8 +52,7 @@
     "typescript": "^5.8.3",
     "validator": "^13.15.15",
     "winston": "^3.17.0",
-    "winston-daily-rotate-file": "^5.0.0",
-    "yargs": "^18.0.0",
+    "winston-transport": "^4.9.0",
     "zod": "^3.25.67"
   },
   "keywords": [
@@ -113,11 +105,8 @@
     "node": ">=20.0.0"
   },
   "devDependencies": {
-    "@types/express": "^5.0.3",
-    "@types/js-yaml": "^4.0.9",
-    "js-yaml": "^4.1.0",
-    "prettier": "^3.5.3",
-    "typedoc": "^0.28.5"
+    "prettier": "^3.6.2",
+    "typedoc": "^0.28.6"
   },
   "publishConfig": {
     "access": "public"