# io.github.devlint/gitwand (npm · @gitwand/mcp)

Auto-resolves Git merge conflicts so agents only touch the complex hunks.

- Trust score: 77/100 (medium)
- Change this week: +25
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@gitwand/mcp`: 77/100 (this document), [markdown](https://verifymcp.io/servers/devlint-gitwand/gitwand-mcp.md), [page](https://verifymcp.io/servers/devlint-gitwand/gitwand-mcp)

## Channel facts

- Registry: `npm`
- Package: `@gitwand/mcp`
- Version: `3.6.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (97 of 101), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (97 of 101), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to devlint/GitWand).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 13 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 83/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1334 tokens (~148/item across 9 items; 7 tools + 2 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add devlint-gitwand -- npx -y @gitwand/mcp
```

### Codex

```bash
codex mcp add devlint-gitwand -- npx -y @gitwand/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "devlint-gitwand": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@gitwand/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add devlint-gitwand --command npx --arg -y --arg @gitwand/mcp
```

### Hermes

```yaml
mcp_servers:
  devlint-gitwand:
    command: "npx"
    args: ["-y", "@gitwand/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "devlint-gitwand": {
      "command": "npx",
      "args": [
        "-y",
        "@gitwand/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 77, +57)

- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [security] The attested source repository moved: devlint/GitWand
- [functional regression] Security disclosure: unverified → fail
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: MIT

### 2026-08-02 (score 20, −1)

- [functional regression] Security disclosure: fail → unverified
- [functional regression] Dependency health: partial → unverified

### 2026-08-01 (score 21, −13)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 34, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 52)

First indexed and scored.

## MCP tools (7)

### `gitwand_status` (~59 tokens)

List conflicted files in the current Git repo with their complexity and auto-resolvability. Returns a structured JSON report with conflict counts, types, and confidence scores.

Input parameters:

- `cwd` (string): Working directory (repo root). Defaults to server cwd.

### `gitwand_resolve_conflicts` (~139 tokens)

Auto-resolve trivial Git merge conflicts using GitWand's pattern-based engine. Returns resolved files, DecisionTrace for each hunk, and pendingHunks for conflicts that need human/LLM review. Writes resolved files to disk unless dry_run is true.

Input parameters:

- `cwd` (string): Working directory (repo root). Defaults to server cwd.
- `dry_run` (boolean): If true, analyze without writing files. Default: false.
- `files` (array): Specific files to resolve. If omitted, discovers all conflicted files from git.
- `policy` (string): Merge policy to use. Default: prefer-theirs.

### `gitwand_preview_merge` (~256 tokens)

Side-effect-free Conflict Predictor. Simulates a merge, rebase, or cherry-pick and reports how many conflicts GitWand can auto-resolve vs. how many need manual/LLM attention, plus an overall risk level (low/medium/high). Does NOT modify the working tree, index, or HEAD.

\- operation 'merge' (default): analyzes conflicts already materialized in the working tree (files with conflict markers).
\- operation 'rebase': simulates rebasing HEAD onto `onto` (3-way against merge-base(HEAD, onto); HEAD's work is replayed on top of `onto`).
\- operation 'cherry-pick': simulates cherry-picking `commit` onto HEAD (3-way with `commit^` as ancestor, HEAD as ours, `commit` as theirs).

Input parameters:

- `commit` (string): Required when operation is 'cherry-pick': the commit to simulate cherry-picking onto HEAD.
- `cwd` (string): Working directory (repo root). Defaults to server cwd.
- `onto` (string): Required when operation is 'rebase': the branch/ref to rebase HEAD onto.
- `operation` (string): Operation to simulate. Default: 'merge'.

### `gitwand_explain_hunk` (~92 tokens)

Explain why a specific conflict hunk was classified as its type. Returns the DecisionTrace with each evaluation step and the ours/theirs/base content for context.

Input parameters:

- `cwd` (string): Working directory (repo root). Defaults to server cwd.
- `file` (string, required): Path to the conflicted file (relative to cwd).
- `line` (number, required): Start line of the hunk to explain.

### `gitwand_apply_resolution` (~132 tokens)

Apply a custom resolution (provided by the LLM or user) to a specific conflict hunk. Replaces the conflict markers at the given line range with the provided content. Use this for 'complex' hunks that GitWand couldn't auto-resolve.

Input parameters:

- `content` (string, required): The resolved content to replace the conflict block with.
- `cwd` (string): Working directory (repo root). Defaults to server cwd.
- `file` (string, required): Path to the conflicted file (relative to cwd).
- `line` (number, required): Start line of the conflict hunk (the <<<<<<< line).

### `gitwand_resolve_hunk` (~320 tokens)

Ask the connected AI agent (the caller of this MCP server) to propose a resolution for a single Git merge conflict hunk. Returns a fully-formed prompt with the base/ours/theirs versions and asks the agent to reply with a JSON object { "resolution": "<merged code>", "reasoning": "<short explanation>" }. This tool does NOT call any external LLM — the agent that called the tool IS the LLM. Use it when GitWand (desktop/cli) wants to delegate the resolution of a `complex` hunk to the agent driving the session, instead of calling Anthropic/OpenAI directly. Pair the agent's answer with `gitwand_apply_resolution` to write it to disk.

Input parameters:

- `base` (string, required): Content of the hunk in the merge base (common ancestor). May be empty for hunks with no shared ancestor.
- `context` (string): Optional surrounding code (a few lines above and below the hunk) so the agent can reason about intent.
- `filePath` (string, required): Path of the file containing the hunk (used by the agent to infer language and apply format-aware reasoning).
- `language` (string): Optional language hint (e.g. "typescript", "python", "rust"). If omitted, the agent infers it from `filePath`.
- `ours` (string, required): Content of the hunk from the current branch (HEAD / ours side).
- `theirs` (string, required): Content of the hunk from the incoming branch (theirs side).

### `gitwand_resolve_hunk_llm` (~261 tokens)

Validate and apply an LLM-proposed resolution for a specific conflict hunk. Reads the hunk at the given file+line, replaces it with the proposed resolution, validates the result (no residual markers, syntax check for JSON/YAML), and writes the file if the validation score meets the threshold. Returns the full audit trail (validation score, accepted/rejected, reason). Workflow: (1) call gitwand_status or gitwand_explain_hunk to see pending complex hunks, (2) propose a resolution, (3) call this tool to validate + apply it.

Input parameters:

- `cwd` (string): Working directory (repo root). Defaults to server cwd.
- `dry_run` (boolean): If true, validate but do NOT write the file. Default: false.
- `file` (string, required): Path to the conflicted file (relative to cwd).
- `line` (number, required): Start line of the conflict hunk (the <<<<<<< line, 1-indexed).
- `min_score` (number): Minimum validation score (0–100) to accept and write the resolution. Default: 80.
- `resolution` (string, required): LLM-proposed resolution content — the lines that replace the conflict block.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/devlint-gitwand/gitwand-mcp#diagnostics

## Score history

- 2026-08-03: 77
- 2026-08-02: 20
- 2026-08-01: 21
- 2026-07-31: 34
- 2026-07-30: 52
- 2026-07-28: 52
- 2026-07-27: 52

## Links

- npm package: https://www.npmjs.com/package/@gitwand/mcp
- Socket report: https://socket.dev/npm/package/@gitwand/mcp
- Repository: https://github.com/devlint/GitWand
- Changelog RSS feed: https://verifymcp.io/servers/devlint-gitwand/gitwand-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/devlint-gitwand/gitwand-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/devlint-gitwand/gitwand-mcp