git-mcp

The materials explicitly state that no keys or environment variables are required; no GitHub token or other credential requirement is described. Based on the available facts, there is no direct red flag of credential collection or abuse, though the missing documentation leaves the real authentication model insufficiently explained.

Its stated functions—GitHub repository management, branch operations, PR handling, and commit retrieval—normally imply communication with GitHub-related services. Although the objective checks list no remote endpoint, the declared purpose reasonably suggests network interaction with GitHub; there is no evidence in the materials of data being sent to unrelated third parties.

The objective checks explicitly mark this tool as executes-code, indicating it can run code locally or spawn processes. For an MCP tool this is a normal powerful capability and warrants a constrained runtime, but the materials do not show any abnormal system permission request beyond its stated function.

Given its Git/GitHub management role, it can reasonably be expected to read repository contents, branches, commits, and possibly working-directory data. With no README details, it is unclear whether it writes local files, modifies repository state, or accesses data beyond the repository scope, so the data-access boundary remains unclear and should be treated cautiously.

The project has an open-source repository, making source review theoretically possible, which is a positive risk-reducing factor. However, it comes from a third-party registry, has no declared license, shows 0 stars, unknown maintenance status, and almost no documentation, so supply-chain confidence is limited.