Evidence · DiggingBeagle record
Independent reproduction of Git MCP repository-config execution
Lab comparison of old and patched Git MCP builds; test seven distinct Git-configured helper execution sinks.
- Source role
- independent technical reproduction
Evidence record
Lab comparison of old and patched Git MCP builds; test seven distinct Git-configured helper execution sinks.
Claim-level citations (1)
- supportsRead-only Git MCP calls executed commands supplied by repository configuration: A separate laboratory comparison reported execution in all seven exercised repository-controlled Git helper paths on mcp-server-git 2026.11.4 and in none of those seven paths on 2026.11.11; this is a controlled patch regression, not evidence of exploitation in the wild.
Independent seven-sink reproduction, tested affected and patched package versions