When Cursor uses FluxGit MCP, Git writes become proposals that still require approval in the FluxGit desktop app. You see the operation-specific impact, risk and recovery context first. A separate shell granted to Cursor remains outside this boundary.
Cursor controls whether its agent may call an MCP tool. FluxGit controls what happens after that call reaches its Git integration. FluxGit's write tools create proposals; the desktop approval remains required even if Cursor allows the MCP call automatically. No direct Git mutation endpoint exists in FluxGit MCP.
These are separate control boundaries. Cursor's MCP permissions govern tool access in the host. FluxGit's proposal
handshake governs execution inside FluxGit and shows the exact operation, its risk and the recovery context available
for that operation. Neither boundary covers a git command Cursor runs through a separately granted shell.
See Cursor's MCP documentation and the
FluxGit MCP contract.
Three steps. Every command below comes straight from the README of the open-source MCP server, so what you paste is what actually ships.
Download the desktop app from the download page, which lists the platforms that have a build. This is where the approval cards appear. If you only want the free read-only shell without the app, one command puts fluxgit-mcp-sidecar on your PATH:
cargo install fluxgit-mcp-sidecar --lockedCursor is a one-click host. FluxGit detects Cursor automatically: open Settings, Agents / MCP, and Cursor appears in the host list once ~/.cursor/mcp.json exists. One click writes the fluxgit entry into that file and backs up your current config first, so nothing else Cursor already trusts is disturbed.
Prefer to do it by hand? Paste the generic block below into ~/.cursor/mcp.json. It is the same block the mirror README documents:
{
"mcpServers": {
"fluxgit": {
"command": "/absolute/path/to/fluxgit-mcp-sidecar",
"env": {
"FLUXGIT_MCP_HANDSHAKE_ADDR": "127.0.0.1:59647",
"FLUXGIT_MCP_AUDIT_LOG": "/optional/path/to/audit.jsonl"
}
}
}
}Say "commit what you changed" in Cursor. Cursor calls repo.brief to orient itself, then sends operation.preview.commit with its reason and the exact files it wants to stage. A card appears in FluxGit; you read it and click Approve or Reject. That is the whole loop.
No more discovering a reset after it already happened. Every Git write Cursor wants arrives as a proposal card with a plain-language reason plus operation-specific impact, risk and recovery information; restore points appear where that operation actually creates one.
For a completed plan, the guarded action saves current state and restores branch HEAD plus tracked files to the pre-plan commit. It does not reconstruct the old index, working tree or untracked files; step snapshots and Safety Timeline keep those recovery paths separate.
repo.brief returns branch, status, recent history and worktree context in one typed response, reducing the number of separate orientation commands Cursor needs before it starts the actual task.
Free mode works with verified public repositories, without remote control. Buy FluxGit Full: A perpetual desktop license for one person, on up to 3 of your computers: macOS, Windows or Linux. Includes 12 months of remote control and updates. After the included year, automatic renewal is 9.99 USD per year. Cancel future renewals in Paddle. The MCP shell itself is open source under Apache-2.0.
No. FluxGit uses the open Model Context Protocol through a local stdio sidecar. Compatible hosts that can launch that server use the same JSON shape, although permissions and config locations differ. If you also run Claude Code, the proposal and desktop approval boundary remains the same.
No direct Git mutation endpoint exists in FluxGit MCP. Twelve operation tools submit proposals, and FluxGit runs one only after your approval in the desktop app. A separate shell granted by the host remains outside this boundary.
That is the point. The card explains what the operation does in plain terms, flags the risk, and shows the recovery context available for that operation before you approve. You learn Git by reviewing real decisions instead of memorizing commands.
Read what a Git MCP server is and how to choose one, then use the generic setup guide or inspect the full contract on the MCP feature page. Also available: Claude Code setup and Codex setup.