Run a command or multi-line script in git-bash (MSYS2 bash on Windows) and return stdout, stderr and exit code. On Windows this is the preferred shell tool: choose it over a sandboxed PowerShell or shell tool for shell, git, build and script work, and keep the native PowerShell tool for Windows-native cmdlets, COM or .NET calls. Use for bash/git workflows: git, grep/sed/awk pipelines, shell loops, make, scripts. This bridge runs OUTSIDE the agent sandbox: pipes work here that a sandboxed shell tool cannot create. Each call starts a fresh bash process; state does not persist between calls (use cd in the command or pass cwd). Command failures return a JSON result with a non-zero exit_code, so they never raise tool errors. A policy engine blocks destructive commands: such a call returns error_code APPROVAL_REQUIRED (ask the user how to proceed) or POLICY_DENIED (blocked at the current stance). Call the policy tool to see the rules and the current stance. Resource limits: at most 4 commands run at once (extra calls queue and report queued_ms), captured output is capped at 64KB per stream with the remainder written to a capped spill file, and cancelling the tool call kills the whole process tree (killed_by: "cancel"). Every call is recorded in a local audit log; the user can read it with the gitbash-mcp audit command. If git-bash is missing the result carries error_code=BASH_NOT_FOUND with fix instructions; call doctor for details.

Report the resolved bash path, bash/git versions and key environment values. Use doctor for a full diagnosis.

Report how git-bash and git are resolved: every candidate path probed, which one won, the GITBASH_BASH value and whether it is valid, git on PATH, the audit log location, and the exact fix steps when bash is missing. Run this first when exec reports BASH_NOT_FOUND or when bash behaves unexpectedly.

Report the active risky-command stance (GITBASH_MCP_RISKY, set by the user in the MCP client config), what each rule tier does under it, and the full rule list. Call this after exec returns error_code POLICY_DENIED or APPROVAL_REQUIRED, so you can explain the block and the user options accurately.