Provides tools for interacting with local Git repositories, including tree listing, ripgrep search, bounded file reads, git status/diff, branch management, explicit-file commits, and pushes to origin, subject to repository-specific policy and safety restrictions.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Cross Repo Ops MCP Show the git status and recent diff in the myrepo repository."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A repo-neutral MCP (Model Context Protocol) capability layer for controlled local repository operations.
Cross Repo Ops MCP provides a security-hardened stdio JSON-RPC server that exposes bounded, policy-controlled operations on local git repositories:
Read: tree listing, ripgrep search, bounded file reads, git status/diff
Write: context-checked patches with create/modify support (writable repos only)
Tasks: approved named task execution (allowlist-only, no arbitrary shell)
Git: branch list/create/switch, commit (explicit files only), push (origin only, pushable repos only)
Related MCP server: git-remote-mcp
Cross Repo Ops MCP is a repo-neutral capability layer for controlled local repository operations. It is designed to sit beside an XcodeIDEapp project, borrowing ideas from IDE dashboard scaffolding patterns, but remains generic and does not depend on any specific IDE or project structure.
Cross Repo Ops MCP = controlled local repository actions (read, patch, git, tasks)The server is policy-driven: repos, capabilities, excluded paths, and approved tasks are all declared in a JSON config. No project-specific logic is hardcoded in the core.
Module | Responsibility |
| Centralized repository capability policy (allowlist, writable/pushable flags, excluded paths, task allowlist, limits, timeouts) |
| Single authoritative path-validation boundary (traversal, symlink, absolute-path, containment checks) |
| Tree listing, ripgrep search, bounded file read, git status/diff |
| Context-checked patch application with create/modify support |
| Branch, commit, and push operations with safety guards |
| Named task allowlist resolution and execution |
| stdio JSON-RPC MCP server |
| Error types |
Repository allowlist: Only repos explicitly listed in the policy are accessible.
Capability flags: writable and pushable are per-repo, default false.
Path containment: All paths are resolved and checked against the repo root. Traversal (..), absolute paths, and symlinks are rejected.
Sensitive file exclusion: .env, *.pem, API keys, tokens, credentials, and binary files are blocked from read and write.
Patch safety: old_text must match exactly; multiple matches require context to disambiguate. create=true refuses to overwrite existing files.
Task allowlist: Tasks are resolved by name from a server-side allowlist, not from user input. No arbitrary shell commands.
Git safety: Bulk staging (git add -A) is rejected. Commits are limited to explicitly listed files. Sensitive files cannot be committed. Branch names are validated against injection. Push is limited to origin for pushable repos only.
Output limits: All operations have configurable output caps (read chars, search results, tree entries, diff chars, task output).
# No external dependencies required — Python 3.10+ standard library only.
cd cross-repo-ops
pip install -e . # optional, for package installpython3 -m cross_repo_opsThe server listens on stdin/stdout for JSON-RPC 2.0 messages.
CROSS_REPO_OPS_CONFIG=/path/to/policy.json python3 -m cross_repo_ops{
"repos": {
"myrepo": {
"root": "/path/to/repo",
"writable": true,
"pushable": false
}
},
"tasks": {
"myrepo": {
"build": {
"command": ["xcodebuild", "-scheme", "MyApp", "build"],
"cwd": "{root}",
"timeout": 180
},
"test": {
"command": ["xcodebuild", "test", "-scheme", "MyApp"],
"cwd": "{root}",
"timeout": 300
}
}
}
}Tool | Description |
| List files/directories with safety exclusions |
| Ripgrep search with bounded output |
| Read a bounded slice of a non-sensitive text file |
| Inspect git status |
| View unstaged/staged/commit diffs |
| Apply a context-checked patch (writable repos only) |
| Run an approved named task (allowlist only) |
| List/create/switch branches (writable repos for create/switch) |
| Stage and commit explicit files (writable repos only) |
| Push to origin (pushable repos only) |
python3 -m unittest tests.test_security tests.test_adversarial -v32 tests covering:
Allowed and blocked reads
Path traversal, absolute path, and symlink escape rejection
Sensitive file read/write/commit blocking
Writable vs read-only repo enforcement
Patch with correct/stale context
Patch targeting excluded files
Named task allowlist (success, unknown name, shell injection attempt)
Task timeout and output truncation
Git status/diff
Branch name injection safeguards
Commit safeguards (empty message, sensitive files, bulk staging, pre-staged files)
Push rejection for non-pushable repos
Server missing-argument handling
MIT
Apply a bounded, context-checked patch to a file in a writable repository. If old_text is empty and create=true, creates the file.
Inputs: path (required), repo (required), new_text (required), old_text (required), +2 more.
List or safely create a branch in a repository.
Inputs: repo (required), action (required), branch_name.
Stage and commit files in a writable repository.
Inputs: repo (required), files (required), message (required).
View the diff of unstaged or staged changes in a repository.
Inputs: repo (required), path, commit, staged, +1 more.
Push the current or specified branch to origin in a pushable repository.
Inputs: repo (required), branch, remote.
Inspect the current Git repository status.
Inputs: repo (required).
Read a bounded slice of a non-sensitive text file from an allowed repository.
Inputs: path (required), repo (required), max_lines, start_line.
Search an allowed repository using ripgrep with bounded output and safety exclusions.
Inputs: repo (required), pattern (required), path, file_glob, +6 more.
List files and directories in an allowed repository with safety exclusions.
Inputs: repo (required), path, max_entries, include_hidden.
Run an approved named task for a repository. No arbitrary shell commands are accepted.
Inputs: name (required), repo (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 10 tools
Each tool maps cleanly to a distinct action: repo_* covers content browsing/search, git_* covers repository state operations, and apply_patch/run_task cover modifications. Adjacent tools like git_status and git_diff are clearly separated by purpose. No two tools appear to do the same thing.
Most tools follow a clear domain-prefix pattern: repo_* for content operations and git_* for VCS operations. The exceptions are apply_patch and run_task, which use bare verb_noun names but remain readable and consistent with the overall snake_case style.
Ten tools is an ideal size for this scope; each tool covers a distinct operation without redundancy. The set feels intentionally scoped rather than padded.
The read/search → patch → branch → commit → push workflow provides a complete edit-and-publish lifecycle. Minor gaps include no repository enumeration, no git pull/fetch, and no way to list approved run_task tasks, but these do not block the primary workflow.
MCP gateway with runtime security policy, tool-call-level control, and audit of agent actions.
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Remote MCP for Android CLI agent build gate, structured receipts, audit logs, and reviewer-ready evi
Security & DLP proxy for MCP: tool-poisoning scans, PII redaction on tool args/results. Beta.
