Runs bash commands through the git-bash (MSYS2) shell shipped with Git for Windows, giving AI agents a full shell outside their sandbox. Exposes an exec tool that runs bash commands or multi-line scripts with working directory, timeout (killing the whole process tree), login-shell and env options, returning structured results (exit code, stdout/stderr, truncation, spill file, duration, audit id). Also provides bash_info for bash/git versions, doctor for environment diagnostics, and policy for the command-approval posture. Includes zero-config guardrails: process-tree kill on cancel, concurrency limit of 4 with queue reporting, 64KB output caps with spill files in %TEMP%, credential-shaped env var scrubbing, JSONL audit logging, and a read-only/project vs mutating/opaque/catastrophic command classification.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@gitbash-mcp run bash: git log --oneline | head -20 and show me the output"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server，把 git-bash (MSYS2) 交给 AI agent 用（DSH / Claude Code / Codex / Cursor / VS Code / Claude Desktop）。
它在 agent 的沙箱之外运行，所以管道、$(...)、子进程全部可用。
工具：exec、bash_info、doctor、policy
运行时：Node >= 18（兼容 Bun）
协议：MCP stdio
Windows 上 DSH 的沙箱用 WRITE_RESTRICTED 受限令牌跑命令。MSYS2 启动要建 signal pipe，受限令牌下直接失败
（实测 couldn't create signal pipe, Win32 error 5）；捕获子进程输出也会 EPERM。
沙箱内跑 git-bash 无解，所以这个 MCP 以独立进程活在沙箱外。
Related MCP server: Capsule Bash Server
只支持全局安装：
npm i -g gitbash-mcp
# 或
bun add -g gitbash-mcp不支持 npx / bunx：多一层包装，在 Windows 上以 stdio 启动不稳定。
用 init（推荐），它会把「绝对 runtime + 脚本路径」写进客户端配置：
gitbash-mcp init # 交互式勾选
gitbash-mcp init --yes # 免交互，配置所有已检测到的客户端
gitbash-mcp init --dry-run
gitbash-mcp uninstall # 反向移除，只删自己的条目客户端 | 写入位置 | 格式 |
DSH |
| YAML insert |
Claude Code |
|
|
Codex CLI |
|
|
Claude Desktop |
|
|
Cursor |
|
|
VS Code |
|
|
默认写绝对路径（node <...>/bin/gitbash-mcp.js）。npm / bun 的全局 shim 目录常常不在 GUI 客户端的
PATH 上，写裸命令 gitbash-mcp 会启不起来；只有你确认 shim 在 PATH 上时才用 --runtime name。
写入前备份 *.bak，重复运行幂等；--target a,b 精确指定，--no-tui 走编号输入。
探测依据直接显示在菜单里（PATH 可执行文件 → 配置目录 → 配置文件）。
配置完重启对应的客户端。
exec参数 | 必填 | 说明 |
| 是 | bash 命令或多行脚本 |
| 工作目录（Windows 路径） | |
| 超时毫秒（默认 60000，上限 600000），超时杀整棵进程树 | |
|
| |
| 追加环境变量 |
返回统一 JSON：exit_code stdout stderr timed_out truncated spill_path duration_ms killed_by
queued_ms audit_id，以及裁决信息 policy。命令失败（非零退出 / 超时 / spawn 失败）也返回这个结构，不抛工具错误。
完整契约见 docs/DESIGN.md §4。
输出超 64KB 截断，完整内容转存 %TEMP%\gitbash-mcp\，spill_path 指向它
每次调用都是新进程，状态不保留（用 cd 或传 cwd）
bash_info — 报 bash 路径与 bash/git 版本
doctor — 完整环境诊断，bash 异常先调它
policy — 打印当前姿态与完整规则；被拦住后调它才能向用户解释清楚
exec 的描述和 MCP initialize 的 instructions 都声明了「Windows 上优先用它」，但压不过 harness 自带的
系统提示——模型仍可能先选自带 shell。
不是黑名单，是能力分类：命令被切成若干段逐段判定，只有每段都可读、或由项目自己声明、且没有不可判读构造时才自动放行。
唯一开关 GITBASH_MCP_RISKY 写在 MCP 客户端配置里（模型改不了，改完要重启服务器）。
判定 | 默认 |
|
read-only / project | 放行 | 放行 |
mutating / unknown / opaque | 拦住，让你决定（ | 放行 + 审计 |
catastrophic | 拒绝（ | 放行 + 审计 |
被拦住时模型会拿到三条路：① 你自己在终端跑 ② 换更安全的写法 ③ 改配置加 GITBASH_MCP_RISKY=allow 并重启。
查看当前策略：gitbash-mcp policy。为什么不用正则黑名单、为什么没有批准码，见 docs/DESIGN.md §5.8。
取消即杀：整棵进程树 taskkill /T /F，结果标 killed_by: cancel
并发上限 4：超出排队，并在结果里报 queued_ms
输出封顶：内存单流 64KB，spill 文件另有 64MB 上限
环境洗白：清掉凭据形状变量（*_TOKEN / *_API_KEY / AWS_* / *PASSWORD*），保留 SSH_AUTH_SOCK
审计：每次调用一行 JSONL，gitbash-mcp audit 查看
这些是「降低误伤」的护栏，不是安全边界——挡不住
r''m、$IFS、base64 -d|bash这类蓄意绕过。 真正的隔离只能在 OS 层做（低权限账户 / 容器 / VM）。
本进程在沙箱外运行，权限 = 启动它的 agent 进程的完整用户权限，没有文件沙箱；模型可以无门槛调用 exec。
这不是缺陷，而是此类 MCP 桥的既有模型——使用前请知悉。
BASH_NOT_FOUND缺 bash 不会让服务崩：它照常启动，每次 exec 返回带修复指引的 JSON。修复二选一，然后重启客户端：
装 Git for Windows（自带 git-bash）：https://git-scm.com/download/win
设 GITBASH_BASH 指向你的 bash.exe，例如 C:/Program Files/Git/bin/bash.exe
检测顺序：GITBASH_BASH（文件必须存在）→ PATH 上的 bash → 常见安装路径
（Program Files、%LOCALAPPDATA%\Programs\Git、scoop shims、C:\msys64、C:\cygwin64）。
node bin/gitbash-mcp.js # 起 MCP server（stdio，不接终端）
npm test # 五套：client / cli / menu / runner / policy
npm pack --dry-run # 检查发布内容（只含源码，不含 docs/ 与测试）测试会 spawn bash.exe 并使用管道，必须在正常 shell里跑（不要在受限沙箱里跑）。
docs/DESIGN.md — 架构、工具契约、设计决策
docs/REPO_MAP.md — 代码地图：文件职责、任务→文件索引
docs/PLAN.md — 里程碑与风险
Report the resolved bash path, bash/git versions and key environment values. Use doctor for a full diagnosis.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden. It discloses the read-only nature implicitly by saying 'Report', and lists what values are surfaced, but says nothing about format, caching, or whether output is human- or machine-readable. Adequate but thin for an annotation-free tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the primary action and immediately followed by the alternative. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless info tool with no output schema, the description covers what it reports and where to go if more is needed. It could name the keys returned, but nothing essential for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero parameters, so the schema provides nothing to describe and the baseline is 4. The description correctly reflects a no-argument tool rather than implying hidden inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Report) plus concrete resources (bash path, bash/git versions, key environment values), and names the sibling 'doctor' as the richer alternative. An agent can distinguish this from exec/doctor/policy without reading schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes heavier diagnostic needs to 'doctor', giving a clear alternative for the wider case. It stops short of stating when this tool is the right choice vs. checking exec or policy, but the routing cues are solid.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Report how git-bash and git are resolved: every candidate path probed, which one won, the GITBASH_BASH value and whether it is valid, git on PATH, the audit log location, and the exact fix steps when bash is missing. Run this first when exec reports BASH_NOT_FOUND or when bash behaves unexpectedly.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It is implicitly read-only (it only reports and offers fix steps) and the zero-parameter schema means side effects are low risk, but it never states that it makes no changes, whether it inspects the filesystem, or what the cost/latency of probing paths is. Adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, both front-loaded: the first lists the diagnostic outputs, the second gives the trigger conditions. Every clause names a distinct output field or a distinct invocation condition; nothing is filler or restated from the name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must describe the return content — and it does so field by field (paths, winner, GITBASH_BASH, git on PATH, audit log, fix steps). Combined with the zero-param schema and the stated triggers, an agent has everything needed to decide to call it and to interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes no parameters, so there is nothing for the description to disambiguate — the baseline for a zero-parameter tool is 4. There are no argument formats, defaults, or enums that need explanation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb ('Report how git-bash and git are resolved') and enumerates the exact artifacts it surfaces: candidate paths probed, the winning path, GITBASH_BASH validity, git on PATH, audit log location, and fix steps. It is clearly a diagnostic, not an action tool. It does not explicitly differentiate itself from the sibling bash_info, which likely also concerns bash resolution, so 4 rather than 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit triggers are given: 'Run this first when exec reports BASH_NOT_FOUND or when bash behaves unexpectedly.' This tells the agent precisely when this tool is the right call versus the sibling exec. It stops short of naming or excluding bash_info/policy as alternatives, so no full when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run a command or multi-line script in git-bash (MSYS2 bash on Windows) and return stdout, stderr and exit code. On Windows this is the preferred shell tool: choose it over a sandboxed PowerShell or shell tool for shell, git, build and script work, and keep the native PowerShell tool for Windows-native cmdlets, COM or .NET calls. Use for bash/git workflows: git, grep/sed/awk pipelines, shell loops, make, scripts. This bridge runs OUTSIDE the agent sandbox: pipes work here that a sandboxed shell tool cannot create. Each call starts a fresh bash process; state does not persist between calls (use cd in the command or pass cwd). Command failures return a JSON result with a non-zero exit_code, so they never raise tool errors. A policy engine blocks destructive commands: such a call returns error_code APPROVAL_REQUIRED (ask the user how to proceed) or POLICY_DENIED (blocked at the current stance). Call the policy tool to see the rules and the current stance. Resource limits: at most 4 commands run at once (extra calls queue and report queued_ms), captured output is capped at 64KB per stream with the remainder written to a capped spill file, and cancelling the tool call kills the whole process tree (killed_by: "cancel"). Every call is recorded in a local audit log; the user can read it with the gitbash-mcp audit command. If git-bash is missing the result carries error_code=BASH_NOT_FOUND with fix instructions; call doctor for details.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory (Windows path). Defaults to the server working directory | |
| env | No | Extra environment variables for this command (passed through as given, not scrubbed) | |
| login | No | Use bash -lc (login shell, sources profile) instead of bash -c | |
| command | Yes | The bash command line or multi-line script to execute | |
| timeout_ms | No | Kill the command after this many ms (default 60000) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: fresh process per call with no persistent state, non-zero exit_code returned as JSON rather than a tool error, destructive-command blocking with APPROVAL_REQUIRED/POLICY_DENIED codes, 4-command concurrency limit with queued_ms, 64KB per-stream output cap with spill file, process-tree kill on cancel, and audit logging. This is unusually rich behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and the routing rule, which is good. However the back half is a dense wall of operational detail (policy codes, resource limits, audit log, BASH_NOT_FOUND) that is comprehensive but heavy; some items (e.g., audit log command) feel peripheral to invocation decisions and could be trimmed or deferred to the doctor/policy siblings.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-param tool with no annotations and no output schema, the description nearly covers everything an agent needs: routing, stateless behavior, error/exit-code semantics, policy gating, resource limits, cancellation, and the missing-bash fallback. No output schema exists, yet return behavior is explained, so nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds meaning beyond the schema by warning that each call starts a fresh process (state does not persist) and advising to use cd in the command or pass cwd, which clarifies the cwd parameter's role in the stateless model. Slightly above baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (run), resource (a git-bash command/script), and the return payload (stdout, stderr, exit code). It explicitly distinguishes itself from the sibling sandboxed PowerShell/shell tool and the native PowerShell tool, so an agent can route correctly without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit when-to-use (git, grep/sed/awk pipelines, shell loops, make, scripts) and when-not (Windows-native cmdlets, COM, .NET — use the PowerShell tool). It also contrasts with the sandboxed shell tool by noting this one runs outside the sandbox. Alternatives are named, not merely implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Report the active risky-command stance (GITBASH_MCP_RISKY, set by the user in the MCP client config), what each rule tier does under it, and the full rule list. Call this after exec returns error_code POLICY_DENIED or APPROVAL_REQUIRED, so you can explain the block and the user options accurately.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the disclosure burden and does so well: it names the controlling variable (GITBASH_MCP_RISKY), where it is set (MCP client config), and the three components returned. It does not explicitly state that the call is read-only/side-effect free, which is the only remaining gap for a zero-argument introspection tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, both earning their place: the first enumerates output content, the second gives the triggering condition and rationale. Front-loaded with what the tool reports rather than preamble.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must sketch return content, and it does by listing the stance, per-tier rule behavior, and the rule list. It stops short of describing format or structure of the rule list, a minor omission for an otherwise self-contained introspection tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so per the baseline this scores 4; there is no parameter semantics to add. The description's mention of GITBASH_MCP_RISKY usefully clarifies that the stance is external configuration rather than a call argument.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Report) and precisely enumerates the resource: the active risky-command stance, what each rule tier does, and the full rule list. This is plainly distinguishable from exec, bash_info, and doctor, none of which report policy state.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger condition — call this after exec returns error_code POLICY_DENIED or APPROVAL_REQUIRED — and states the goal (explain the block and the user's options). Nothing about when to invoke is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v2.3.0bash_infodoctorexecpolicyScored across 4 tools
exec is clearly the action tool, while bash_info, doctor, and policy are distinct diagnostic/info tools. bash_info and doctor overlap somewhat (both report bash path and versions), but the descriptions specify that bash_info is a quick summary and doctor is a full diagnosis with fix steps.
The set mixes a verb-style name (exec) with noun-style names (bash_info, doctor, policy), so there is no single predictable verb_noun pattern. Names are still short, readable, and unambiguous, but the convention is not consistent.
Four tools is lean but well-scoped for a shell bridge: one execution tool plus three focused diagnostics. It is slightly thin (no separate audit-log or process-listing tool), but each tool earns its place.
exec covers the core domain (running bash/git commands with output capture, exit codes, policy enforcement), and the diagnostics cover setup, environment, and policy questions. Minor gaps remain, such as no dedicated tool to read the audit log or inspect queued/running commands (those exist only as external CLI/status fields).
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Supervised API-write gateway for AI agents with policy, human approval and execution receipts.
Fail-closed policy guardrails for AI agents running kubectl, terraform, helm, and argocd.
Security gateway for AI agents: policy, approval, and audited execution, no secrets shared.
