GitNexus — Watchlist | MCP100 Index

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track this specific mcp_server implementation and its adoption, setup drift, privilege model, and source activity.

Reviewed Oct 9, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Graph-based code impact analysis for coding agents

What we know

Local codebase graph indexing and MCP queries across references, dependencies and change impact, with editor setup tooling.

Maintenance / activity evidence

211635 npm downloads during 2026-09-08 through 2026-10-07 for gitnexus

Tracking evidence observed Oct 9, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Write local index/setup artifacts; read code graph Reported action classes: Write local index/setup artifacts; read code graph. Complete write authority is not verified.
Local repository access; no hosted account required for basic use
Sensitive access: Repository source, Agent config

Analyze command may modify project agent config and hooks; MCP itself primarily queries graph
Repository scanning and agent configuration hooks may touch local filesystem; distinguish read-oriented MCP tools from CLI setup side effects.
GitNexus indexes local repositories and can modify agent config, hooks and generated indexes; default tooling not exclusively read-only. Package license PolyForm Noncommercial, not MIT.
Unknown vulnerabilities, deployment environment and client privileges not exhaustively reviewed.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

· 211.6k package downloads / 30 days

Downloads observed Oct 9, 2026.

Exact npm package gitnexus; provider interval 2026-09-08–2026-10-07 (inclusive); observed 2026-10-09.

All limitations / Review context

What changed in documented permissions, distribution and MCP integration of GitNexus before the next review?

No substantiated blocker to accurately qualified PUBLIC RADAR TRACKING observed in the scoped cited documentation; material caveats are required on the public page.

Analyze command may modify project agent config and hooks; MCP itself primarily queries graph
Repository scanning and agent configuration hooks may touch local filesystem; distinguish read-oriented MCP tools from CLI setup side effects.
GitNexus indexes local repositories and can modify agent config, hooks and generated indexes; default tooling not exclusively read-only. Package license PolyForm Noncommercial, not MIT.
Write local index/setup artifacts; read code graph
Local repository access; no hosted account required for basic use
Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Reviewed write actions: Write local index/setup artifacts; read code graph
Sensitive access: Repository source, Agent config
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Unknown vulnerabilities, deployment environment and client privileges not exhaustively reviewed.
Exact dated attributable activity evidence
metrics, runtime/compatibility details for specific version
Write actions/tool inventory not confirmed against exact tool documentation; listed action classes remain illustrative or context-dependent. Empty inventory does not establish read-only.
Index/setup writes generated local state and agent configuration
Parsing native build dependencies may require install approval
License: PolyForm Noncommercial; commercial use requires separate permission/licensing review.
No independent release lifecycle audit; do not claim precise activity date.

Original activity observations

211635 npm downloads during 2026-09-08 through 2026-10-07 for gitnexus

Technical identity

npm/gitnexus

Exact implementation source: https://www.npmjs.com/package/gitnexus ↗
Reviewed resource type: MCP Server
Package identity: npm:gitnexus

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 9, 2026 · Latest source observation Oct 9, 2026

Package registry ↗
gitnexus
Recorded package identity, distribution or download evidence.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Warning

Not runtime tested, no third-party installation, network authorization, paid calls, or mutation executed.
Do not claim production service is available based on README alone.
Run `npx gitnexus analyze` to index repo; `mcp` subcommand required; indexing reads project source
Official npm publisher package page README inspected for this exact npm identity; static research only. Some setup statements are conservatively summarized; no source code or live client execution checked. V2 review did not run any live client.
Check actual host syntax and supply credentials in secure client environment; do not paste placeholders verbatim.
Avoid write, payment, token transfer, publishing, sending, booking and remote account changes as tests.
Replace credential, action and registration placeholders; follow the matching publisher/client prerequisites. No execution performed.
Use the matching host, actual registration name and original installation environment; this does not revoke credentials.

Install / connect
Publisher instructions
Run `npx gitnexus analyze` to index repo; `mcp` subcommand required; indexing reads project source | Publisher npm README revisited on 2026-10-14; exact identity retained.
Reviewed setup example · Claude Code only · Publisher instructions
claude mcp add gitnexus -- npx -y gitnexus@latest mcp
Configure / authenticate
MCP100 setup guide
Run `npx gitnexus analyze` first for local index; `npx gitnexus setup` is broader and may install hooks/skills, so use explicit path when preferred.
Check connection
Suggested check
Check MCP tools and read-only local graph query; avoid reindexing unrelated files just for smoke test.
Remove / uninstall / revoke
MCP100 setup guide
If registered by the publisher Claude Code example under `gitnexus`, run the provided unregister command; for a different MCP client or name, delete the actual client registration. Removing a local client entry is distinct from deleting a vendor account/token.
Remove named client registration · Claude Code only · MCP100 composed guide
claude mcp remove gitnexus

Official Documentation & Sources

What it does

Local codebase graph indexing and MCP queries across references, dependencies and change impact, with editor setup tooling.

Capability: Developer Tools
Resource type: MCP Server
Best fit: Graph-based code impact analysis for coding agents

Representative uses

Index repository
Find function dependencies
Explore impact radius
Query graph from Codex

Limitations

Index/setup writes generated local state and agent configuration
Parsing native build dependencies may require install approval
License: PolyForm Noncommercial; commercial use requires separate permission/licensing review.
Analyze command may modify project agent config and hooks; MCP itself primarily queries graph
No independent release lifecycle audit; do not claim precise activity date.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Local repository access; no hosted account required for basic use
Permissions: Write local index/setup artifacts; read code graph
Data handling: Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Cost: unknown
Risk and cautions: Analyze command may modify project agent config and hooks; MCP itself primarily queries graph

Access scope and cautions

Write actions: Not verified Write local index/setup artifacts; read code graph
Sensitive access: Repository source Agent config
Risk level: moderate
Security notes: Repository scanning and agent configuration hooks may touch local filesystem; distinguish read-oriented MCP tools from CLI setup side effects. GitNexus indexes local repositories and can modify agent config, hooks and generated indexes; default tooling not exclusively read-only. Package license PolyForm Noncommercial, not MIT.

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Index repository; Find function dependencies; Explore impact radius; Query graph from Codex.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y gitnexus@latest mcp. Recorded transport: stdio. Prerequisites: Compatible MCP client. Client notes: Source docs and package may evolve; install according to confirmed release. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Local repository access; no hosted account required for basic use

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. The partial inventory lists: Write local index/setup artifacts; read code graph. Recorded permission context: Write local index/setup artifacts; read code graph

What data-handling boundary should I consider?

Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component. Recorded sensitive-access context: Repository source; Agent config.

What limitations and risks should I check before use?

Analyze command may modify project agent config and hooks; MCP itself primarily queries graph. Index/setup writes generated local state and agent configuration. Parsing native build dependencies may require install approval. License: PolyForm Noncommercial; commercial use requires separate permission/licensing review. No independent release lifecycle audit; do not claim precise activity date. Repository scanning and agent configuration hooks may touch local filesystem; distinguish read-oriented MCP tools from CLI setup side effects. GitNexus indexes local repositories and can modify agent config, hooks and generated indexes; default tooling not exclusively read-only. Package license PolyForm Noncommercial, not MIT. Unknown vulnerabilities, deployment environment and client privileges not exhaustively reviewed.