Back to Browse
Agent tool surface (
Free
Server data from the Official MCP Registry
Read-only, commit-pinned repository context for coding agents.
About
Read-only, commit-pinned repository context for coding agents.
Security Report
4.8
Use Caution4.8High RiskRepoContext is a well-designed, read-only MCP server with appropriate security controls and permissions matching its stated purpose. Code quality is high with proper input validation, no hardcoded credentials, and clear authentication boundaries. Minor findings relate to broad exception handling and selective logging practices, which do not materially impact security. Supply chain analysis found 4 known vulnerabilities in dependencies (1 critical, 2 high severity). Package verification found 1 issue.
6 files analyzed · 9 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
What You'll Need
Set these up before or after installing:
Path to a registry created by repocontext init.
Environment variable: REPOCONTEXT_REGISTRY
How to Install
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-shmindmaster-repocontext": {
"env": {
"REPOCONTEXT_REGISTRY": "your-repocontext-registry-here"
},
"args": [
"-y",
"@shmindmaster/repocontext"
],
"command": "npx"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
GitPin
Pin agent answers to Git HEAD. Path. Line. Full SHA. Prove. Verify.
GitPin is not another “repo context” MCP. That category is full of vector indexes, dump files, and remote GitHub browsers. GitPin is a trust product: index-free, read-only, multi-repo evidence agents must prove and humans can re-check with git show.
Agent claim
→ pin.search_* (candidates only)
→ pin.prove (evidence pack: path + line + full SHA + content hash)
→ pin.verify (git show re-check; HEAD match report)
→ you run: git show <sha>:<path>
| Crowded category | GitPin product |
|---|---|
| Vector / SQLite “repo context” servers | No embeddings, no DB, no reindex |
| Filesystem MCP (writes) | Never writes indexed repos |
| One-shot repo dumps | Live prove → verify MCP loop |
| Grep hits as “the answer” | Candidates → evidence pack → verification report |
| GitHub platform MCP | Local Git roots (private/offline) |
Formerly @shmindmaster/repocontext (0.3.x). See migration.
Release:
@shmindmaster/gitpin@0.4.0. Install:npx -y @shmindmaster/gitpin@latest. Node 20+.
Five-minute path
# From a committed Git repository
npx -y @shmindmaster/gitpin@latest init --client codex
init creates ~/.gitpin/repositories.yaml outside the repo, runs doctor, prints a first evidence line with full SHA, and paste-ready MCP config. It never edits the indexed repository.
# Independently verify any claim (same contract as pin.verify)
npx -y @shmindmaster/gitpin@latest verify \
--repository my-service \
--path docs/architecture.md \
--line 42 \
--sha <full-or-short-hex>
Product job
When agents invent file contents, mix dirty worktrees, or cite the wrong branch
You want every fact re-checkable with git show <sha>:<path>
GitPin registers local Git roots, serves HEAD-only docs/code, flags stale tracked docs, returns path / line / SHA, and closes the loop with pin.verify.
Agent tool surface (pin.*) — 12 read-only tools
| Job | Tools |
|---|---|
| Discover | pin.catalog |
| Find candidates | pin.search_docs, pin.search_code |
| Prove | pin.prove (primary), pin.prove_set (1–8 cites), pin.get_doc, pin.read |
| Verify | pin.verify, pin.verify_set |
| Decide | pin.analyze → EvidenceBrief |
| Inspect / diff | pin.inspect, pin.compare |
Resource: gitpin://catalog. Prompt: prove-with-git-head (forces the product loop).
Cite formats: docs/cite-spec.md. Agent skill template: templates/gitpin-skill.md.
Functionality that is the pivot (not a rename)
- Evidence pack (
pin.prove): claim binding, line slice, full SHA,contentSha256,citation.cite/handle, next-step verify. - Multi-cite sets (
pin.prove_set/pin.verify_set): stableevidenceSetIdfor multi-repo answers and CI. - Verification report (
pin.verify/ CLI): independentgit show; optionalmustContainclaim-text; status includescontradicted. - Candidates, not claims: search returns
kind: evidence-candidateswith forcednext: pin.prove. - EvidenceBrief: multi-repo knownFacts / gaps / stable
evidenceSetId(schema v2). - Dirty exclusion: uncommitted work is never cited as HEAD evidence.
Explicit non-goals
- Semantic / embedding search
- Writing, committing, or pushing
- Replacing GitHub Issues/PRs automation
- Indexing non-Git umbrella folders as one “repo”
Configuration
| Variable | Purpose |
|---|---|
GITPIN_REGISTRY | Registry YAML path (alias: REPOCONTEXT_REGISTRY) |
GITPIN_MCP_TOKEN | HTTP bearer token (alias: REPOCONTEXT_MCP_TOKEN) |
GITPIN_ALLOWED_HOSTS | HTTP host allowlist (alias: REPOCONTEXT_ALLOWED_HOSTS) |
Default registry: ~/.gitpin/repositories.yaml (falls back to ~/.repocontext/... if present).
Docs
Tools · Compare · FAQ · Migration · Clients · Architecture · Competitive landscape
Site: shmindmaster.github.io/repocontext (GitHub path may stay repocontext; product name is GitPin).
Development
corepack enable
pnpm install --frozen-lockfile
pnpm validate
pnpm build
pnpm verify:package
pnpm site:test
License
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
80.0K
Stars
9
Installs
6.5
Security
No ratings yet
Local
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
137
Stars
564
Installs
8.0
Security
4.8
Local
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
-
Stars
90
Installs
10.0
Security
4.6
Local