Back to Browse

Repo Forensics MCP Server

Developer ToolsModerate7.8MCP RegistryLocal
Free

Server data from the Official MCP Registry

Local read-only MCP tools for Git repository archaeology, churn, hotspots, and hygiene. Tools...

About

Local read-only MCP tools for Git repository archaeology, churn, hotspots, and hygiene. Tools...

Security Report

7.8
Moderate7.8Low Risk

This is a well-designed, security-conscious MCP server for local Git repository analysis. It implements proper path traversal protection, avoids network operations and credential leakage, uses input validation with Zod, and maintains a read-only posture. Minor code quality improvements around error handling are suggested, but no security vulnerabilities were identified. Supply chain analysis found 1 known vulnerability in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

5 files analyzed · 5 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

process_spawn

Check that this permission is expected for this type of plugin.

env_vars

Check that this permission is expected for this type of plugin.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-mrfentmen-repo-forensics-mcp": {
      "args": [
        "-y",
        "repo-forensics-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

repo-forensics-mcp

A local-only MCP companion for understanding a Git repository before a review, refactor, or release.

Tools

  • repository_summary: branch, working tree status, remotes, and latest commit metadata.
  • recent_changes: bounded recent commit history.
  • file_hotspots: files appearing most often in recent history.
  • top_level_hygiene: top-level large files, .gitignore presence, and dirty state without reading file contents.

The server invokes local Git with fixed argument arrays. By default, paths must stay under the parent workspace of the package process; set REPO_FORENSICS_ROOT to an explicit workspace root when launching it. It returns remote names rather than remote URLs to avoid leaking credentials. It does not fetch, push, write files, inspect remote services, or send repository data over the network. Hotspots and hygiene are heuristics, not a complete code-quality or security audit.

Run

npm install
npm run build
node dist/index.js

Reviews

No reviews yet

Be the first to review this server!