MCP.Market

GitPin MCP server

by shmindmaster·io.github.shmindmaster/gitpin·v0.6.4
No reviews yet

Prove and verify multi-repo claims at Git HEAD: path, line, full SHA, no index.

A92/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
Growing

0 stars61 downloads/wk

Reviews

Write one

Nobody has reviewed GitPin yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

GitPin tools (12)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • pin.analyze

    EvidenceBrief (knownFacts/gaps/evidenceSetId), documentation gaps, or coverage compare. Decision evidence—not a dump.

  • pin.catalog

    Call first to discover registered Git roots (HEAD SHAs, doc counts, stale). Not a content claim. Use before search/prove.

  • pin.compare

    Diff changed paths between two hex revisions. Bounded change evidence for reviews—not semantic search.

  • pin.get_doc

    Read one committed documentation page as a pinned evidence slice with full SHA. Prefer pin.prove for claims.

  • pin.inspect

    Inspect HEAD-pinned status, commits, manifests, tests, or recent changes. status shows dirty work excluded from evidence.

  • pin.prove

    Primary product tool: one-path evidence pack (slice, path, line, full SHA, content hash, handle, verify next-step). Prefer for every factual claim.

  • pin.prove_set

    Multi-cite evidence set (1–8 paths, multi-repo OK). Use when an answer needs several citations. Next: pin.verify_set.

  • pin.read

    Read a HEAD-only source slice (path, lines, full SHA). Sensitive paths blocked. Prefer pin.prove when making a claim.

  • pin.search_code

    Find code candidates via git grep at HEAD. Never treat hits as final claims—pin.prove then pin.verify (or prove_set/verify_set).

  • pin.search_docs

    Find documentation candidates (not claims). Before any factual assertion call pin.prove or pin.prove_set, then pin.verify.

  • pin.verify

    Close the prove loop: re-check path@SHA with git show; optional mustContain for claim-text. Reports HEAD match and claimVerdict.

  • pin.verify_set

    Batch re-check up to 8 citations (from pin.prove_set or a pack). For multi-repo answers and CI citation gates.

Public scan report

scanner v0.1.10 · 2026-10-03 · same rubric, same numbers if you re-run it

no findings
  • Code scan74 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 3 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How GitPin compares

Against every graded Developer tools MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
92/100
higher than 90% of 1,119 Developer tools servers
Tools
12
the typical Developer tools server has 7
Tools that change things
0%
typical: 5%. Fewer write tools means less an agent can break
Downloads a week
61
more than 45% of 436 Developer tools servers with a package

What its tools let an agent do: 12 read

Install GitPin in Claude Code, Cursor or VS Code

Runs npx -y gitpin on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add gitpin -- npx -y gitpin
Add to Cursor

What the publisher says

From the GitPin repository's README, as published. We do not edit it. Read it on GitHub

GitPin

Make agent-authored changes show exact evidence before merge.

GitPin is an agent-delivery assurance gate with a local evidence MCP. It makes material PR claims cover the actual diff and point to exact committed line slices. The local MCP supplies index-free, read-only, multi-repo evidence that humans and CI can re-check with git show.

Public-good thesis: evidence for agent-authored software changes should remain inspectable with ordinary local Git, independent of the coding agent or proprietary hosted platform that produced the change.

Agent claim
    → pin.search_*   (candidates only)
    → pin.prove      (evidence pack: path + line + full SHA + content hash)
    → pin.verify     (git show re-check; HEAD match report)
    → you run: git show <sha>:<path>

Formerly RepoContext 0.3.x. See migration.

Required PR evidence gate

gitpin gate --base <full-base-sha> --head <full-head-sha>

The gate reads policy only from the trusted base commit, reads the submitted manifest only from the head commit, compares the merge-base diff, and verifies exact line-slice hashes. It never executes PR code and never labels a locator match as proof of semantic correctness. Use the GitPin GitHub Action setup to make it a required check. That guide also documents an optional, separate CrewScore check for teams that want written-control coverage alongside GitPin evidence verification.

Versioned distribution: This source tree and its packed documentation describe GitPin 0.6.4 without asserting publication status. Availability is established only by independently verifying the npm, MCP Registry, GitHub Release, and Pages receipts. Install with npx -y gitpin@0.6.4 only after the npm receipt resolves. Node 20+.

GitPin is maintained by Sarosh Hussain, who leads the project's technical direction. Pendoah is his company and operating context; GitPin remains the product and repository.

Five-minute path

# From a committed Git repository
# This exact version becomes usable only after npm publication is verified.
npx -y gitpin@0.6.4 init --client codex

init creates ~/.gitpin/repositories.yaml outside the repo, runs doctor, prints a first evidence line with full SHA, and paste-ready MCP config. It never edits the indexed repository.

# Independently verify any claim (same contract as pin.verify)
# This exact version becomes usable only after npm publication is verified.
npx -y gitpin@0.6.4 verify \
  --repository my-service \
  --path docs/architecture.md \
  --line 42 \
  --sha <full-or-short-hex>

Product job

When agents invent file contents, mix dirty worktrees, or cite the wrong branch You want every fact re-checkable with git show : GitPin registers local Git roots, serves HEAD-only docs/code, flags stale tracked docs, returns path / line / SHA, and closes the loop with pin.verify.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

GitPin: common questions

Is GitPin MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the GitPin safety report
How do I install GitPin?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does GitPin need an API key?
No secret keys are declared. It reads 1 setting from the environment.
Is GitPin maintained?
The last commit was 35 days ago (2026-09-30). The latest release is v0.6.4.
What can I use instead of GitPin?
Servers from other publishers that do the same job: Ekbasis MCP server, OctoCounts MCP Server and Emfirge MCP server.
How does GitPin compare with other Developer tools MCP servers?
safety score 92/100 (higher than 90% of 1,119 Developer tools servers); tools 12 (the typical Developer tools server has 7); tools that change things 0% (typical: 5%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to GitPin

Same job from other publishers: the closest match first, then the best rated.

  • Ekbasis
    Foresee what git commands and multi-step changes will do, as calibrated probabilities
    B
  • OctoCounts MCP Server
    Analyze and compare public GitHub repo line counts (SLOC) via OctoCounts, from any MCP client.
    A
  • Emfirge
    Git branch for your cloud. Understand AWS risk, prove fixes, and ship safer changes.
    A
  • GitHub
    Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.
    A
  • Gk CLI
    The GitKraken MCP Server for managing repos, PRs, issues across GitHub, GitLab, Bitbucket and more.
    B