io.github.neprel/git-a2a is an MCP server that git module dependencies and owning-agent routing for coding agents. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 63/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"io-github-neprel-git-a2a": {
"args": [
"-y",
"git-a2a"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Import a Git repository together with the agents that own it.
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y 'git-a2a' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories — click any category to see the underlying evidence.
No known CVEs.
Checked git-a2a against OSV.dev.
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in maps
A Model Context Protocol (MCP) server implementation that connects Large Language Models (LLMs) to GIS operations using GIS libraries, enabling AI assistants to perform geospatial operations and transformations.
MCP server from Kynth Studios — eleven read-only lookups over live public data: AI model pricing and routing, dependency maintenance, service pricing and stack cost, agent skills and configs, shadcn component registries, starter-kit grades, AI app-builder App Store readiness, ADA Title II reports, nonprofit good-standing. No key, no signup.
18 Google Maps tools for AI agents — geocode, search, directions, weather, and more.
Multi-city flight routing intelligence — plan RTW trips, validate alliances, get carrier picks.
MCP Security Weekly
Get CVE alerts and security updates for io.github.neprel/git-a2a and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
Import a Git repository together with the agents that own it.
git-a2a is an open standard plus a static Go CLI for micro-agent architectures. A repository
publishes one a2amodule.yml: what the module exports, which agents own it, how to contact them,
and which other modules it consumes. The CLI resolves one Git commit, wires every detected
ecosystem, maintains a2amodule.lock, and projects the useful ownership context into agent tools.
Read the human specification, the command reference, or the
normative spec/_.hint with hint spec.
See the feature end to end in the public
acme-lib-utils library and
consumer-app consumer repositories. The
demo walkthrough explains what to inspect and which commands to run.
| Capability | Commands and result |
|---|---|
| Dependency wiring | add, wire, update, remove edit native npm/Python/Go/Rust/Swift/Dart/Ruby/PHP/Elixir/Haskell/Zig/Clojure/Nix files at one resolved commit. |
| Source changes | set, pin, and unpin transactionally change URL, ref, monorepo path, tracking, or identity. |
| Owners and contacts | who routes an intent and path to the declared role, scoped agent, and ordered contacts. |
| Agent roster | sync maintains a bounded dependency/owner block in AGENTS.md or another target. |
| Contact delivery | contact sends through A2A, email, or GitHub/GitLab/Gitea-family issues; any tracker can use exact instructions or a consumer plugin. |
| Vendoring and build systems | --vendor submodule or --vendor copy plus CMake/Gradle/MSBuild/Maven/Meson generated includes keep source at the lock commit. |
| Fresh-checkout restore | fetch reconstructs cache and vendored trees from the lock without resolving a new commit. |
| Cards, catalog, and trust | card, catalog, and trust show verify A2A cards, key/origin pins, signed commits, and ARD catalogs. |
| Liveness and drift | status compares upstream refs, manifest/cache hashes, native wiring, cards, trust, and synced context. |
| Agent UX | usage, the portable skill, setup, and explain brief and configure supported agent harnesses. |
| MCP | mcp exposes the same commands over bounded multi-repository stdio tools; write access is opt-in. |
| Prerequisites | doctor reports Git and native ecosystem tools with versions and install hints; it never installs them. |
git-a2a init --id acme-app
git-a2a add https://github.com/acme/lib-utils.git
git-a2a sync
git-a2a who acme-lib-utils --intent change
git-a2a status
git-a2a update --review
Owners start with git-a2a init --example lib, add an agent with git-a2a agent add, then run
git-a2a validate and git-a2a card export.
A consumer can materialize a locked dependency inside its repository with add --vendor submodule or add --vendor copy; set --vendor changes that choice later. The lock still names
one Git com