inspectread-only
Read-only tools
Expose repository status, fleet signals, diff context and recovery surfaces without granting mutation endpoints.
ai agents and git, governed
MCP context without handing over the controls.
FluxGit's MCP layer gives AI agents repository context through 23 read-only tools, and 11 write operations that run only through a human handshake. The agent sends an operation and a reason, the desktop app shows you the preview with its risk level and restore point, and nothing executes until you approve.
The problem: agents need context, but Git writes are high-risk.
AI coding agents can help explain diffs, summarize branch state and plan next steps. They should not get silent end-to-end control over reset, rebase, patch application or branch mutation just because they can read a repo.
Honest beta limit
The propose-approve loop is live and was verified end to end against a real MCP client, but it is beta software: interactive rebase is not yet supported in the handshake, and the result channel is a poll, not a push. What is shipped is tested; what is not is listed on this page.
How FluxGit helps.
boundaryapp-controlled
Write boundary
Risky Git actions stay in the FluxGit desktop cockpit where previews, safety rails and human confirmation can apply.
trustaudit
Audit trail
Beta workflows can review what context agents requested, helping teams debug and set trust boundaries.
Free shell vs FluxGit-powered.
The protocol is open and so is the shell: fluxgit-hq/fluxgit-mcp-server on GitHub, Apache-2.0. It speaks MCP and works without the app for standard Git inspection. The tools that need FluxGit return an explicit upgrade hint, not a fake answer.
free shellopen source
Standard Git inspection
repo.brief, repo.scope, conflict.read (an active conflict as structured data: base, ours, theirs and marker regions), repo.status, repo.refs, repo.history, repo.reflog, commit.details, worktree.changes, submodule.status, diff.text. Works with local git alone.
hybridgraceful fallback
Capability-negotiated tools
fleet.radar, diff.semantic, diff.semanticFallbacks, repo.conflictPreflight. Each returns documented fallback metadata instead of guessing. With the FluxGit app running, diff.semantic returns the real structural payload: per-file hunks with the changed tokens, plus an honest per-file fallback with the reason and text-diff arguments for files the engine cannot parse. Standalone, it answers with the honest fallback contract instead of pretending.
FluxGit-poweredrequires the app
Safety-grade tools
safety.timeline, safety.eventDetails, flux.latestRestorePoint, flux.restorePoints, flux.restorePointDetails. Return error code 10001 without FluxGit because synthesizing them from local refs would mislead the agent.
Built and live today.
Version control is shifting from a human authoring tool to a human governance layer over change written by machines. These are not plans; they are in the current build.
provenance
See what the machine wrote
Every agent-authored commit is flagged in the history with an AI badge and the detected signature — from commit trailers and author identity, never guessed. Approvals and executions land in an audit log you can sign with Ed25519.
governance
Approve intent, not clicks
Single operations and multi-step plans go through one approval card with risk copy. A plan captures one restore point before its first step and the completed card offers "Undo entire plan" through the guarded reset flow. A declarative policy can also reject out-of-policy proposals (wrong branch, forbidden operation) before a card even opens.
parallel work
Watch every parallel workspace
Linked worktrees — including agent worktrees — show up as badges on commits, as playhead rings on the graph, and as a cockpit strip with compare, reveal and open actions plus divergence against your checkout.
review at volume
Triage by risk, not by time
The Review Inbox in Review mode ranks pending agent proposals by destructiveness — a hard reset outranks a merge no matter which arrived first — with inline reject, and lists machine-authored commits with reveal-in-graph.
What comes next.
One thing is planned and not built yet. Saying so plainly beats a roadmap of chips.
orchestrationshipped
Merge the winning attempt
This one graduated from the roadmap: when several agents try the same task in parallel worktrees, you compare the attempts from the cockpit strip, merge the winner through the guarded flow with a restore point, and the guarded cleanup removes the rest while never touching a worktree with uncommitted work.
anywhere
Approve from your phone
The approval queue does not care where you are. A companion view for reviewing and approving agent proposals away from your desk is next on the roadmap.
Built for your agent's context window.
An agent's scarce resource is context, not speed. Understanding a repo through raw CLI is expensive: on a 44-commit test repo, the typical orientation sweep took 10 git calls and 1,886 tokens of human-shaped output; one repo.brief call answered the same questions in 607 tokens. Measured, not estimated. These tools return compact, structured answers designed to be read by a model.
one callrepo.brief
Situational awareness in one call
Branch, ahead/behind, in-progress operation, working-tree summary, stashes, aggregated submodule drift, recent commits and next-step hints — the first call of an agent session, instead of eight.
diffdiff.semantic
Review behavior, not lines
With FluxGit running, the agent gets the structural change instead of burning its window on a 5,000-line patch — and the tool says so honestly, per file, when anything falls back to text.
preflightrepo.conflictPreflight
Know the conflict before proposing
Merge-tree based what-if without fetch or mutation. The agent finds out whether a merge conflicts before it asks you to approve one.
multi-repofleet.radar
Watch a fleet without a fetch
One call summarizes which of your repositories need attention, including predicted upstream conflicts from cached refs. No remote is touched.
Tool surface.
Twenty-three read-only tools and eleven write operations: ten proposals (branch, commit, push, merge, rebase, discard, reset, patch, worktrees and multi-step plans) plus cancel, all labelled by tier. Writes never leave the desktop app — the agent proposes, you approve in FluxGit.
repo contextfree
Read the repo
repo.brief· one-call situational awareness: branch, ahead/behind, in-progress operation, working-tree summary, stashes, submodule drift, recent commits and next-step hintsrepo.scope· monorepo scoping: one subtree's changes, recent commits, churn and CODEOWNERS owners in a single callrepo.status· working tree, current branch, dirty pathsrepo.refs· branches, tags, remotes, stashesrepo.branchStack· current vs upstream/base/relatedrepo.history· paginated commit historyrepo.reflog· movement timeline with recovery hintscommit.details,worktree.changes,worktree.list,submodule.status
difffree + enhanced
Explain changes
diff.text· standardgit diffcompatible patchdiff.semantic· negotiated. Real structural payload (per-file hunks, changed tokens, truncation flags) when the FluxGit app is running; supported=false plus text-diff arguments standalonediff.semanticFallbacks· per-path fallback metadata, enriched with the same per-file reasons when the app is running
multi-repofree + enhanced
Cross-repo signals
fleet.radar· prioritized attention stack across selected repos. Cached refs only without FluxGit; predictive when gateway is wiredrepo.conflictPreflight· advisory merge/rebase outcome before running, never mutatingconflict.read· an active conflict as structured data instead of raw markers
safetyFluxGit-powered
Recovery context
safety.timeline· synthesized risk events from restore points + reflogsafety.eventDetails· drill-down into one eventflux.latestRestorePoint,flux.restorePoints,flux.restorePointDetails· audit-grade undo/redo points
write-with-UI-handshake (NEW)Requested by AI
Agent proposes, you approve.
operation.preview.commit· message plus the exact file list that will be staged and committed, shown before anything is writtenoperation.preview.push· remote, branch and upstream intent surfaced; force-with-lease is flagged high risk before you approveoperation.preview.branch· create a branch (optionally checked out) — non-destructive, and the card says so honestlyoperation.preview.merge· agent proposes a merge; FluxGit renders the approval cardoperation.preview.rebase· rewrites-history warning surfaced in the cardoperation.preview.discard· irrecoverable-warning card with path listoperation.preview.reset· mode-aware (hard mode forces strong confirmation)operation.preview.patch· monospace patch preview with applyToIndex toggleoperation.preview.worktree· add a parallel worktree so agent work never disturbs your checkoutoperation.preview.plan· a 1-10 step sequence reviewed and approved as one unit; execution stops at the first failure and reports per-step resultsoperation.cancel· the agent withdraws its own pending proposal;operation.status(read-only) polls the outcome
The agent dispatches a proposal through the gateway; FluxGit shows a "🤖 Requested by AI agent" card in the desktop cockpit with the agent's plain-language reason. You approve or reject; FluxGit executes through the existing safety pipeline with restore points and reports the captured restore point back to the agent, so it can tell you the change is reversible from Safety Timeline. The agent never holds write power.
Semantic diff with explicit fallback.
Agents lie when they describe a patch as "semantic" without a semantic payload behind it. The contract makes that impossible: diff.semantic only returns supported: true when the FluxGit engine produced structural output. With the desktop app running it does exactly that: per-file hunks with the changed tokens, an honest per-file fallbackToText with the reason and ready-to-use text-diff arguments for files the engine cannot parse, and explicit truncation flags on large diffs. Standalone, it returns the arguments the agent should pass to diff.text as a text-diff fallback, and a precise reason.
Agents connected to FluxGit MCP must say "FluxGit reported a text-diff fallback for this file" when supported=false, never "this is a semantic diff". The wording is published as a contract; we treat over-claiming as a bug.
Honest by protocol
No silent fallback. No fake structure inferred from a text patch. If the file fell back, the agent surfaces which path and why. Senior engineers notice this; it's why we wrote it down.
Connect any MCP-compatible agent.
FluxGit MCP is protocol-aligned, not vendor-aligned. Paste this block into any MCP host config. The desktop app pre-fills the absolute sidecar path and gateway address from the running process.
{
"mcpServers": {
"fluxgit": {
"command": "<absolute path to fluxgit-mcp-sidecar bundled with FluxGit>",
"env": {
"FLUXGIT_GATEWAY_ADDR": "<auto-filled, e.g. 127.0.0.1:14660>",
"FLUXGIT_MCP_AUDIT_LOG": "<optional path to a JSONL audit file>"
}
}
}
}Works with any MCP-compatible code agent. No client-specific install required.
Shipped 2026-05-28
Write with UI handshake.
FluxGit MCP closes the loop: agents propose writes, FluxGit shows the preview, the user approves in the app, FluxGit executes through its existing safety pipeline. The agent never has write power; the user reviews everything in the UI they already trust.
All ten proposal operations are live, plus operation.cancel: 11 write operations in total, covering the agent's full cycle from branch, commit and push to multi-step plans. The proposals are the ten operation.preview.* tools listed in the tool surface above; operation.cancel lets an agent withdraw its own pending proposal, and read-only operation.status polls the outcome. Every preview gets a previewId; the audit chain links agent intent → user approval → execution.
The moat
Cloud-hosted MCP servers without an app cannot do this. FluxGit can because the approval UI lives in the desktop cockpit. It's the structural reason FluxGit-powered tools require FluxGit.
Privacy and security posture.
MCP can expose sensitive repository facts to a connected agent, so the boundary must be explicit. FluxGit gives agents no direct write capability: every mutation is a proposal that a human approves in the app. Semantic diff fallback is labeled, fleet status never fetches aggressively on an agent's behalf, and AI/provider data sharing is a separate user-controlled decision. The audit log hashes arguments rather than storing them verbatim.
Related features.
- Fleet Radar gives agents a read-only attention stack across selected local repos.
- Semantic diff gives structural context when supported and fallback labels when not.
- Safety rails keep write decisions in the guarded desktop workflow.
- Using Claude Code? The 60-second setup walks the propose-approve loop from install to first approval.
- From the blog: AI agents and Git, without handing over the keys, Your agent's context window is the new CPU and Submodules are where agents go to die.