AgentArmorHQ
Sign in
Permissions and access

Pin mcp-server-git to 2025.12.18 or later and set --repository

AgentArmorHQ team2 min read

You will upgrade mcp-server-git past the fixed release and restrict it to one repository. This closes path and argument issues that let it touch repos outside its intended scope.

Before 2025.12.18

  • git_init accepts arbitrary paths
  • git_diff/git_checkout pass flag-like input to git
  • repo_path not checked against --repository

2025.12.18 or later

  • Path and argument validation added
  • Operations kept inside the configured repository
  • git_init removed in 2025.9.25 and not relied on

Why it matters

Before version 2025.12.18, git_init accepted arbitrary filesystem paths and created repositories without checking the location (GHSA-5cgr-j3jf-jw3v (opens external site)). Separately, git_diff and git_checkout passed user-controlled values straight to git, so flag-like input such as --output= could overwrite arbitrary files (GHSA-9xwc-hfwc-8w59 (opens external site)). When --repository was set, repo_path in later tool calls was not checked against that repository, which led to operations outside it (GHSA-j22h-9j4x-23w5 (opens external site)).

Steps

  1. Check which version you have installed. If it is older than 2025.12.18, it is affected.
  2. Upgrade mcp-server-git to 2025.12.18 or later. Use the same package manager you installed it with, and pin the version in your lockfile or config so it does not drift back.
  3. Confirm git_init is not in use. It was removed in 2025.9.25, so older setups that depended on it need a different way to create repositories.
  4. Set --repository to the single repository the server should work in, using the full absolute path. Do not point it at a parent directory that holds many projects.
  5. Run the server with a user account that has read and write access only to that repository, not your full home directory.
  6. Restart any MCP client that launches the server so it picks up the new version and flag.
  7. Review git operations you have run through the server recently, and check for unexpected changes outside the target repository.

Common mistakes

  • Setting --repository but leaving an old version installed. The path check was added in 2025.12.18, so the flag alone is not enough.
  • Assuming the server is limited to one repo just because the flag exists. Upgrade first, then confirm behavior.
  • Pinning a version in one environment while a client config still launches an older copy.
  • Giving the server credentials with access to every repository on the machine.

Checklist

0 of 7 done

Sources

  1. GitHub Advisory Database: GHSA-5cgr-j3jf-jw3v (CVE-2025-68143)
  2. GitHub Advisory Database: GHSA-9xwc-hfwc-8w59 (CVE-2025-68144)
  3. GitHub Advisory Database: GHSA-j22h-9j4x-23w5 (CVE-2025-68145)
Was this guide useful?