MCP server
Gitwright can expose the open repository to a local MCP client over a loopback JSON-RPC endpoint. It is off by default and only starts when you enable it.
Endpoint and authentication
| Property | Value |
|---|---|
| Bind address | 127.0.0.1 only |
| Path | /mcp |
| Default port | 47123 (configurable from 1024 to 65535) |
| Authentication | Authorization: Bearer <token> |
The token is generated on first use, stored in the OS keychain and shown in Settings, where it can be copied or rotated. Rotating invalidates the previous token immediately. A request without a valid token is rejected before any tool runs.
The server is never bound to a non-loopback address. It is not reachable from another machine on the network.
Which repository
The server works on the repository of the focused window. Switching windows changes the repository an agent sees; there is no endpoint that accepts an arbitrary path.
Tools
Read tools run immediately and are bounded:
| Tool | Returns | Cap |
|---|---|---|
git_status | Branch, upstream, ahead/behind, operation state, changed paths | Current status |
git_diff | Unified diff for one path, working tree or index, optional revisions | 512 KiB |
git.diffRefs | Unified diff between two revisions | 512 KiB |
git_log | Recent commits with paging | 20 by default, 100 maximum |
git_branches | Local and remote branches | Current refs |
git_remotes | Remotes and URLs | Current remotes |
git_stashes | Stash list | Current stashes |
git.tags | Tags with target, message and tagger | 1000 tags |
git.commit | One commit’s metadata, message and file list | 16 KiB body, 500 files |
git.blame | Blame for a path | 200 lines by default, 1000 maximum |
files_search | Path or content search in the repository | 100 results by default, 500 maximum |
files_read | Bounded text read of one file | 256 KiB |
Status responses list at most 500 changed paths. Every tool has a 30-second timeout.
Mutating tools never run on the first call:
| Tool | Effect |
|---|---|
git.fetch | Fetch one remote or all remotes |
index.stage | Stage one file |
index.unstage | Unstage one file |
Each of those returns approval_required with an approvalId. The application shows an approval prompt; the client can also answer with approval.resolve. Requests expire after two minutes, and an expired, unknown or already-resolved id executes nothing.
Approval is per call. Approving one stage does not authorise the next one, and there is no “approve all” mode.
Bounds
- Every response has a size cap, so a huge diff or file cannot flood a client’s context.
- The tools read only; the only writes are the three approved mutations above.
- No tool runs a shell, edits file content, creates commits, changes branches or pushes.
Enabling and disabling
Settings → Advanced → MCP has the toggle, port, status, endpoint, token and a note about the security model.
- Disabling stops the listener and expires any pending approvals.
- Changing the port restarts the listener on the new port.
- The MCP server is independent of the ACP assistant; you can use either, both or neither.
The trust boundary
The bearer token authenticates a local client. It does not make the client trustworthy, and loopback does not mean the client is yours: any process running as your user can connect if it has the token. Treat the token like a password, rotate it if you paste it somewhere, and disable the server when you are not using it.
Next
- ACP agents — the assistant that reads a selected scope.
- Settings — where the toggle lives.
- Privacy — what stays local.