Cross Repo Ops MCP

A repo-neutral MCP (Model Context Protocol) capability layer for controlled local repository operations.

What It Does

Cross Repo Ops MCP provides a security-hardened stdio JSON-RPC server that exposes bounded, policy-controlled operations on local git repositories:

• Read: tree listing, ripgrep search, bounded file reads, git status/diff

• Write: context-checked patches with create/modify support (writable repos only)

• Tasks: approved named task execution (allowlist-only, no arbitrary shell)

• Git: branch list/create/switch, commit (explicit files only), push (origin only, pushable repos only)

Related MCP server: void-bridge

Architecture

Cross Repo Ops MCP is a repo-neutral capability layer for controlled local repository operations. It is designed to sit beside an XcodeIDEapp project, borrowing ideas from IDE dashboard scaffolding patterns, but remains generic and does not depend on any specific IDE or project structure.

Cross Repo Ops MCP = controlled local repository actions (read, patch, git, tasks)

The server is policy-driven: repos, capabilities, excluded paths, and approved tasks are all declared in a JSON config. No project-specific logic is hardcoded in the core.

Modules

Security Model

• Repository allowlist: Only repos explicitly listed in the policy are accessible.

• Capability flags: writable and pushable are per-repo, default false.

• Path containment: All paths are resolved and checked against the repo root. Traversal (..), absolute paths, and symlinks are rejected.

• Sensitive file exclusion: .env, *.pem, API keys, tokens, credentials, and binary files are blocked from read and write.

• Patch safety: old_text must match exactly; multiple matches require context to disambiguate. create=true refuses to overwrite existing files.

• Task allowlist: Tasks are resolved by name from a server-side allowlist, not from user input. No arbitrary shell commands.

• Git safety: Bulk staging (git add -A) is rejected. Commits are limited to explicitly listed files. Sensitive files cannot be committed. Branch names are validated against injection. Push is limited to origin for pushable repos only.

• Output limits: All operations have configurable output caps (read chars, search results, tree entries, diff chars, task output).

Installation

# No external dependencies required — Python 3.10+ standard library only.
cd cross-repo-ops
pip install -e .  # optional, for package install

Usage

Run the MCP server

python3 -m cross_repo_ops

The server listens on stdin/stdout for JSON-RPC 2.0 messages.

Custom policy

CROSS_REPO_OPS_CONFIG=/path/to/policy.json python3 -m cross_repo_ops

Policy file format

{
  "repos": {
    "myrepo": {
      "root": "/path/to/repo",
      "writable": true,
      "pushable": false
    }
  },
  "tasks": {
    "myrepo": {
      "build": {
        "command": ["xcodebuild", "-scheme", "MyApp", "build"],
        "cwd": "{root}",
        "timeout": 180
      },
      "test": {
        "command": ["xcodebuild", "test", "-scheme", "MyApp"],
        "cwd": "{root}",
        "timeout": 300
      }
    }
  }
}

MCP Tools

Testing

python3 -m unittest tests.test_security tests.test_adversarial -v

32 tests covering:

• Allowed and blocked reads

• Path traversal, absolute path, and symlink escape rejection

• Sensitive file read/write/commit blocking

• Writable vs read-only repo enforcement

• Patch with correct/stale context

• Patch targeting excluded files

• Named task allowlist (success, unknown name, shell injection attempt)

• Task timeout and output truncation

• Git status/diff

• Branch name injection safeguards

• Commit safeguards (empty message, sensitive files, bulk staging, pre-staged files)

• Push rejection for non-pushable repos

• Server missing-argument handling

License

MIT