GitHits CLI MCP
A CLI and MCP server that search package and repository source, read exact files and return examples with cited sources.
- 124 ★ on the repository
- Last commit
Extended access
Why this level
- Queries and questions go to an external service, and `init` writes configuration into clients and keeps credentials in the system keychain.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/githits-cliDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Queries and questions go to an external service, and `init` writes configuration into clients and keeps credentials in the system keychain.
This is third-party code. Review the repository files before installing.
What it does
GitHits connects an agent to open-source code when model knowledge and the local repository are not enough. The local MCP server searches indexed packages and repositories, reads exact files and documentation sections, greps by pattern and shows examples from real projects. There are package tools too: info, vulnerabilities, dependencies, changelog and upgrade review. `code diff` compares package versions or repository refs, and `research` answers a question about a package with cited sources. The command `npx githits@latest init` signs in, detects installed tools and configures them. Claude Code, Cursor, Windsurf, VS Code with Copilot, Cline, Claude Desktop, Codex CLI, Gemini CLI and OpenCode are supported, among others.
Who it is for. Developers debugging calls into third-party libraries who want an agent to read the dependency's source instead of guessing its behaviour.
Good fit when
- A stack trace goes into a third-party package and you need to read the right file without cloning.
- An agent looks for how open-source projects implement request retries with exponential backoff.
- Before upgrading a dependency you compare versions and read the changelog through `pkg upgrade-review`.
- You need to check a package for vulnerabilities, licenses and dependencies before adding it.
Not a fit when
- The code is private: the tool works with open-source packages and public repositories.
- The question contains secrets or personal data: questions are sent to GitHits.
- You only need local search inside your own repository.
Example request
Use GitHits to read how npm:express handles middleware errors, show the relevant file and explain the fix before editing code.MCP
- Transport
- stdio, http
- Authentication
- OAuth
Limitations
A GitHits account sign-in is required (browser OAuth, credentials kept in the system keychain). Questions, including `research`, are sent to GitHits, so keep keys, personal data and private code out of them. `research` has a daily limit that resets at 00:00 UTC, and an answer takes from 30 seconds to a few minutes. Advisory data is unavailable for vcpkg and Zig. For Cursor the direct setup uses the hosted remote MCP. Some new capabilities reach the hosted MCP only after the package is released.
How to disable. Remove the GitHits entry from each client's MCP configuration and sign out with the CLI. Remove a global package with `npm uninstall -g githits`.
FAQ
How do I connect GitHits to Claude Code or Cursor?
Run `npx githits@latest init`: it signs in, detects installed clients and configures the ones you pick. Cursor gets the hosted remote MCP, the others a local stdio server.
How do I read dependency code without cloning?
Use `githits code files npm:express lib` and `githits code read npm:express lib/router/index.js --lines 120-200`. For pattern search there is `githits grep`.
How do I compare package versions?
`githits code diff npm:express 5.2.0..5.2.1 --stat` compares versions. For upgrade assessment use `githits pkg upgrade-review`; a raw diff does not prove an upgrade is safe.
Which licenses reach code examples?
By default `strict` mode filters out copyleft and undeclared-license repositories. `custom` uses your account blocklist and `yolo` disables the filter.
What data goes to GitHits?
Queries and questions, including `research`. Keep keys, personal data and private code out of them.
Discussion
No questions or reviews yet.
Related
MCP serversIndexes a codebase into a knowledge graph and gives the agent call chains, change blast radius and code search over MCP
An MCP server and CLI for code research: search and understand your project and all of GitHub with fewer tokens
Local code structure graph: builds a repository map with tree-sitter and serves the assistant only the context a change actually touches over MCP
An MCP server on your machine that lets ChatGPT and Claude edit code, run tests and check Git in a local repository
A local codebase index with ten MCP tools: dependency graph, git history, code health and architectural decisions without re-grepping on every step
An MCP server that indexes a local repository with tree-sitter and gives the agent code search, file lookup and a structure summary of a file
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| GitHits CLI (this card) | yes | OAuth | 124 | |
| Context7 | yes | API key | 64,240 | Context7 supplies documentation and examples for the right version; GitHits reads source and tests, compares versions and checks package health |
| Deepwiki MCP | no | not required | 1,389 | fetches deepwiki.com pages as Markdown; GitHits searches a code and documentation index and returns sources |
README in short
The documentation covers a quick start, a table mapping MCP tools to CLI commands, package address formats and license modes. Separate sections describe `research`, version diffs and sign-in.