modelcontextprotocol/servers
Watch
1
0
Fork
You've already forked servers
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
4,115 commits 1 branch 46 tags 29 MiB
Commit graph servers/src/git/uv.lock
Author SHA1 Message Date
GitHub Actions
2182f5959f Automatic update of packages 2026-06-16 14:53:11 +00:00
olaservo
0588ec098e fix(security): bump vulnerable deps; harden git_add (defense-in-depth) 
Real fixes (deps):
- python (git/fetch/time): idna 3.10->3.18 (GHSA-65pc), starlette
  0.49.1->1.3.1 (GHSA-86qp)
- npm: vitest ^2.1.8->^4.1.8 (critical GHSA-5xrq UI server RCE). vitest 4
  pulls vite 8 (rolldown, no esbuild), clearing the esbuild/vite advisories
  natively. Remaining root overrides: qs>=6.15.2 (GHSA-q8mj, via express),
  hono>=4.12.21 (via @modelcontextprotocol/sdk).
- npm audit: 0 vulnerabilities; all TS (313) + Python (git/fetch/time) suites
  and TS builds pass.

Hardening (git_add):
- The repo already mitigates CVE-2026-27735 by using repo.git.add (the git
  CLI rejects out-of-tree paths, PR #3164's fix), not repo.index.add (which
  did not). Add an explicit path-boundary check in git_add as defense in
  depth plus regression tests asserting the security invariant (out-of-tree
  paths are never staged), guarding against a regression to repo.index.add.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-14 13:46:02 -07:00
Ola Hungerford
f5054df1fb
 		fix(deps): bump gitpython and urllib3 to resolve HIGH security alerts (#4283) 
- git: gitpython >=3.1.45 -> >=3.1.50 (lock 3.1.49 -> 3.1.50)
  Fixes GHSA-mv93-w799-cj2w: newline injection in config_writer()
  bypasses the CVE-2026-42215 patch, enabling RCE via core.hooksPath.
- fetch: urllib3 2.6.3 -> 2.7.0 (transitive via requests)
  Fixes GHSA-qccp-gfcp-xxvc (sensitive headers forwarded across origins
  on proxied redirects) and GHSA-mf9v-mfxr-j63j (decompression-bomb
  safeguards bypassed in the streaming API).

Resolves Dependabot alerts #129, #131, #132.
Tests pass (fetch: 20 passed; git: all test bodies pass, only
pre-existing Windows tmpdir-teardown errors remain).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-05 11:24:07 -04:00
olaservo
0db9a34071 chore(deps): bump python deps to address security alerts 
Bumps vulnerable Python deps via `uv lock --upgrade-package` across the
three Python workspaces (src/git, src/fetch, src/time):

High severity
- gitpython 3.1.45 -> 3.1.49 (src/git): command injection via Git options
  bypass and unsafe `multi_options` validation (GHSA-x9j5-25mq-w6vh,
  GHSA-2gv7-q9w6-xfwm)
- lxml 5.3.0 -> 6.1.0 (src/fetch): XXE in default iterparse() and
  ETCompatXMLParser() (GHSA-pjj9-h2g6-3v7q)
- pyjwt 2.10.1 -> 2.12.1 (all): accepts unknown `crit` header extensions
  (GHSA-75c5-xw7c-p5pm)

Medium / low
- cryptography 46.0.5 -> 48.0.0 (all): buffer overflow with non-contiguous
  buffers; incomplete DNS name constraint enforcement
- python-dotenv 1.0.1/1.2.1 -> 1.2.2 (all): symlink-following arbitrary
  file overwrite in set_key
- python-multipart 0.0.22 -> 0.0.27 (all): DoS via large preamble/epilogue
- pytest 8.3.x -> 9.0.3 (all): vulnerable tmpdir handling
- pygments 2.19.2 -> 2.20.0 (src/fetch): ReDoS in GUID matcher
- requests 2.32.4 -> 2.33.1 (src/fetch): insecure temp file reuse in
  extract_zipped_paths()

All three workspaces sync cleanly and `uv run pytest` passes:
- src/fetch: 20 passed
- src/time: 38 passed
- src/git: 41 passed (35 preexisting Windows-only fixture cleanup
  errors are reproducible on main and unrelated to this change)

Supersedes/extends dependabot PR #3748 (which only bumped requests and
cryptography to 46.0.6).
 2026-05-05 06:55:44 -07:00
dependabot[bot]
e3ea3c8b7f
 		Bump the uv group across 3 directories with 1 update 
Bumps the uv group with 1 update in the /src/fetch directory: [cryptography](https://github.com/pyca/cryptography).
Bumps the uv group with 1 update in the /src/git directory: [cryptography](https://github.com/pyca/cryptography).
Bumps the uv group with 1 update in the /src/time directory: [cryptography](https://github.com/pyca/cryptography).


Updates `cryptography` from 46.0.3 to 46.0.5
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/46.0.3...46.0.5)

Updates `cryptography` from 46.0.3 to 46.0.5
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/46.0.3...46.0.5)

Updates `cryptography` from 46.0.3 to 46.0.5
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/46.0.3...46.0.5)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: indirect
  dependency-group: uv
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: indirect
  dependency-group: uv
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-11 02:51:37 +00:00
dependabot[bot]
a1f9dfa470
 		Bump the uv group across 3 directories with 1 update 
Bumps the uv group with 1 update in the /src/fetch directory: [python-multipart](https://github.com/Kludex/python-multipart).
Bumps the uv group with 1 update in the /src/git directory: [python-multipart](https://github.com/Kludex/python-multipart).
Bumps the uv group with 1 update in the /src/time directory: [python-multipart](https://github.com/Kludex/python-multipart).


Updates `python-multipart` from 0.0.21 to 0.0.22
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Kludex/python-multipart/compare/0.0.21...0.0.22)

Updates `python-multipart` from 0.0.21 to 0.0.22
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Kludex/python-multipart/compare/0.0.21...0.0.22)

Updates `python-multipart` from 0.0.21 to 0.0.22
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Kludex/python-multipart/compare/0.0.21...0.0.22)

---
updated-dependencies:
- dependency-name: python-multipart
  dependency-version: 0.0.22
  dependency-type: indirect
  dependency-group: uv
- dependency-name: python-multipart
  dependency-version: 0.0.22
  dependency-type: indirect
  dependency-group: uv
- dependency-name: python-multipart
  dependency-version: 0.0.22
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-26 23:57:45 +00:00
dependabot[bot]
b906f726fa
 		Bump the uv group across 3 directories with 5 updates 
Bumps the uv group with 5 updates in the /src/fetch directory:

| Package | From | To |
| --- | --- | --- |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.2.0` | `1.23.0` |
| [requests](https://github.com/psf/requests) | `2.32.3` | `2.32.4` |
| [h11](https://github.com/python-hyper/h11) | `0.14.0` | `0.16.0` |
| [starlette](https://github.com/Kludex/starlette) | `0.41.2` | `0.49.1` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.2.3` | `2.6.3` |

Bumps the uv group with 3 updates in the /src/git directory: [mcp](https://github.com/modelcontextprotocol/python-sdk), [h11](https://github.com/python-hyper/h11) and [starlette](https://github.com/Kludex/starlette).
Bumps the uv group with 2 updates in the /src/time directory: [h11](https://github.com/python-hyper/h11) and [starlette](https://github.com/Kludex/starlette).


Updates `mcp` from 1.2.0 to 1.23.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](https://github.com/modelcontextprotocol/python-sdk/compare/v1.2.0...v1.23.0)

Updates `requests` from 2.32.3 to 2.32.4
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](https://github.com/psf/requests/compare/v2.32.3...v2.32.4)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.2 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

Updates `urllib3` from 2.2.3 to 2.6.3
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/2.2.3...2.6.3)

Updates `mcp` from 1.2.0 to 1.23.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](https://github.com/modelcontextprotocol/python-sdk/compare/v1.2.0...v1.23.0)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.2 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

Updates `mcp` from 1.2.0 to 1.23.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](https://github.com/modelcontextprotocol/python-sdk/compare/v1.2.0...v1.23.0)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.2 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

Updates `mcp` from 1.1.0 to 1.23.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](https://github.com/modelcontextprotocol/python-sdk/compare/v1.2.0...v1.23.0)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.3 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

Updates `mcp` from 1.1.0 to 1.23.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](https://github.com/modelcontextprotocol/python-sdk/compare/v1.2.0...v1.23.0)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.3 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

Updates `mcp` from 1.1.0 to 1.23.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](https://github.com/modelcontextprotocol/python-sdk/compare/v1.2.0...v1.23.0)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.3 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.3 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.3 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0)

Updates `starlette` from 0.41.3 to 0.49.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.41.2...0.49.1)

---
updated-dependencies:
- dependency-name: mcp
  dependency-version: 1.23.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: requests
  dependency-version: 2.32.4
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: urllib3
  dependency-version: 2.6.3
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mcp
  dependency-version: 1.23.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mcp
  dependency-version: 1.23.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mcp
  dependency-version: 1.23.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mcp
  dependency-version: 1.23.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mcp
  dependency-version: 1.23.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: starlette
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-17 18:03:32 +00:00
Christoph Blecker
99813ce5c9
 		Update gitpython library for git mcp server (#2948) 
* bump: gitpython dependency from 3.1.43 to 3.1.45

* test: use default branch name instead of hardcoding 'master'

* fix: handle d.diff as string in GitPython 3.1.45+
 2025-11-25 20:35:33 +00:00
David Soria Parra
e515378a90
 		restore git as ola asked for it 2025-05-29 13:42:18 +01:00
David Soria Parra
d53d6cc75c
 		Archive unmaintained servers 
Removed the following servers from main branch:
- aws-kb-retrieval-server
- brave-search
- everart
- gdrive
- git
- github
- gitlab
- google-maps
- postgres
- puppeteer
- redis
- sentry
- slack
- sqlite

These servers remain maintained:
- sequentialthinking
- time
- memory
- fetch
- filesystem
- everything

Full history preserved in archive-servers branch

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-05-29 12:04:51 +01:00
Tadas Antanavicius
f7885220ac
 		Fix git 2025-03-27 14:19:18 -07:00
Mike Gehard
021a95c904 Allow to check out branches 
The git server currently lacks branch switching capabilities, limiting both
LLMs and developers. This adds branch checkout so LLMs can
help developers add new functionality in a new feature branch.
 2024-12-08 16:26:58 -05:00
David Soria Parra
e7e1c85058
 		python servers 0.6.2 2024-12-04 15:57:31 +00:00
David Soria Parra
ec3c60c0c0
 		move sqlite server to python 3.10 2024-11-22 23:12:59 +00:00
David Soria Parra
100323a425
 		Reworking the git server 2024-11-21 23:16:04 +00:00
Justin Spahr-Summers
46dde5252c
 		Add pyright in dev 2024-11-21 21:40:29 +00:00
Justin Spahr-Summers
06cb2759b8
 		Fix package and executable names, re-sync uv 2024-11-21 21:07:25 +00:00
David Soria Parra
ca3174c10c
 		move to python 3.10 2024-11-20 14:31:52 +00:00
David Soria Parra
bf3f3fdb0e
 		major update to the git server 2024-11-20 12:03:47 +00:00
David Soria Parra
8a77721d64
 		update git server to most recent MCP SDK 2024-11-19 23:15:21 +00:00
Justin Spahr-Summers
37415258b9
 		Initial commit 2024-11-19 13:29:12 +00:00