GitHits

Name: GitHits
Author: githits-com

by githits-comversion 0.40.1i★ –iComputer or cloud

Registry namecom.githits/githits

Install

Overview

Description from the maker (original English)

Search public open-source code, documentation, metadata, vulnerabilities, changelogs, and examples.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi3 of 3 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Computer or cloud
Transport: stdio, Streamable HTTP
Category: Search & AI memory

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 3 of 3 passed
Runs on the maker’s server: what you ask it goes through their server.
The registry lists no key to fill in.

You need

Runs in the cloudNothing to install; it connects over the internet
npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Works in Claude on the web, desktop and mobile:

Open Settings → Connectors
Press Add custom connector
Paste the address below and press Add
If it asks you to sign in, sign in with the maker

https://mcp.githits.com

Or run it on your computer

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "githits": {
      "command": "npx",
      "args": [
        "-y",
        "githits",
        "mcp",
        "start"
      ]
    }
  }
}

Run this in your terminal

claude mcp add --transport http githits https://mcp.githits.com

Or run it on your computer

claude mcp add githits -- npx -y githits mcp start

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "githits": {
      "url": "https://mcp.githits.com"
    }
  }
}

Or run it on your computer

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "githits": {
      "command": "npx",
      "args": [
        "-y",
        "githits",
        "mcp",
        "start"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "githits": {
      "type": "http",
      "url": "https://mcp.githits.com"
    }
  }
}

Or run it on your computer

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "githits": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "githits",
        "mcp",
        "start"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

ChatGPT connects only to servers on the internet:

Open ChatGPT on the web → Settings → Connectors (Apps)
Press Create or Add (some plans need Developer mode under Advanced first)
Paste the address below, give it a name and save
If it asks you to sign in, sign in with the maker

https://mcp.githits.com

Menu names can differ slightly by plan and over time.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

The server asks you to sign in before it lists its tools.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 6, 2026

✓ Pass
Maker matches the repo
The registry name was verified against the domain githits.com (the registry checks domain ownership)
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
✓ Pass
Endpoint responds
Responded in 307 ms (HTTP 401)
✓ Pass
Sign-in with OAuth
Declares OAuth sign-in, so your AI app can take you to log in
… Not checked yet
No hidden instructions in tool descriptions
Not checked yet; we read the tool list when we check the endpoint

Compared with others in Search & AI memoryi

More stars than 0% of the other 7240 servers in this category
Published to the registry more recently than 97% of the other 7240 servers in this category
Basic checks equal to or better than 100% of the other 7240 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is GitHits safe?

It passed 3 of 3 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

Either way works: install it on your computer or connect to the cloud version.

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.40.1) reached the registry yesterday.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: Context7, Codebase Memory, Exa

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Context7

by upstash

Feeds AI the latest docs for libraries and frameworks before it answers, so code it writes does not use outdated, removed functions.

Computer or cloud★ 64,224MITUpdated 3 days ago

Install

Codebase Memory

by DeusData

Codebase knowledge graph for AI agents — 162 languages, sub-ms queries, 99% fewer tokens.

Runs on your computer★ 48,148MITUpdated 20 days ago

Install

Exa

by exa-labs

Connect AI agents to Exa for web search, content fetching, and multi-step research.

Runs in the cloud★ 5,213MITUpdated 44 days ago

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

GitHits CLI

The infrastructure layer connecting agents to the open-source ecosystem.

Website · Documentation · Issues

GitHits connects AI coding agents to public open-source evidence across the full software development lifecycle: discovery, planning, research, implementation, debugging, and maintenance.

The CLI runs a local MCP server that your coding tool starts on demand. Agents can then search indexed package and repository source, read exact files and documentation pages, inspect package health, compare dependency upgrades, and find source-cited examples from real open-source projects when model knowledge and local repository context are not enough.

Want to use GitHits as part of your agent harness or software factory? Check out our public API documentation.

Quick Start

npx githits@latest init

init signs you in, detects supported coding tools, and configures GitHits for the tools you select. It uses the local stdio MCP except for Cursor, whose direct setup uses the hosted remote MCP.

Automatic setup currently supports Claude Code, Cursor, Windsurf, VS Code / Copilot, Cline, Claude Desktop, Codex CLI, Pi, Gemini CLI, Google Antigravity, OpenCode, Hermes Agent, Zed, Junie, Qwen Code, Kiro, Kilo Code, Factory Droid, and Amazon Q CLI.

After setup, open your coding agent and work normally. Many agents call GitHits when they need source-backed context. If your agent starts guessing, prompt it directly:

Use GitHits Code Navigation to inspect npm:express. Find how middleware

errors are handled, read the relevant source, and explain the fix before editing code.

What GitHits Adds

GitHits is designed for the point where an agent needs evidence from the broader open-source ecosystem, not just model memory or local repo context:

Capability	MCP tools	CLI commands
Tool orientation	`quick_start`	—
Code examples	`get_example`	`githits example`
Inventory browsing	`list`	`githits list`
Code and documentation search	`search`, `search_status`, `grep`	`githits search`, `githits search-status`, `githits grep`
Read source files or documentation sections	`read`	`githits read [path]`
Package inspection	`pkg_info`, `pkg_vulns`, `pkg_deps`, `pkg_changelog`, `pkg_upgrade_review`	`githits pkg ...`

Use GitHits when your agent needs to:

discover, plan, or research how OSS projects solve a vague issue or unfamiliar error
find broad prior art or rare needle-in-the-haystack examples across repositories
inspect source, tests, symbols, or docs for a known package or repository
verify how a dependency actually behaves before changing code
debug stack traces that point into third-party code
review package health, licenses, vulnerabilities, dependencies, and changelogs
compare dependency upgrades using factual evidence

Examples

Find prior art across open source:

npx githits@latest example "HTTP retries with exponential backoff in Python"

Search indexed code, docs, and symbols for a dependency:

npx githits@latest search "router middleware" --in npm:express

npx githits@latest search '"body parser" OR multer' --in npm:express --source docs npx githits@latest search "debounce" --in npm:lodash --source symbol

Read and grep dependency source without cloning:

npx githits@latest code files npm:express lib

npx githits@latest code read npm:express lib/router/index.js --lines 120-200 npx githits@latest grep 'router\.use' npm:express --path-prefix lib/

Inspect package health and upgrade evidence:

npx githits@latest pkg info npm:express

npx githits@latest pkg vulns npm:lodash@4.17.20 --severity high

Look up advisory IDs across affected packages

npx githits@latest vulns CVE-2026-26996 GHSA-3ppc-4f35-3m26 npx githits@latest pkg deps npm:express@4.18.2 --depth 2 npx githits@latest pkg changelog npm:express --from 4.18.2 --to 5.2.1 npx githits@latest pkg upgrade-review npm:zod@4.3.6 --to 4.4.3

Browse and read package documentation:

npx githits@latest docs list npm:express

npx githits@latest docs read --lines 20-80

Source Diffs

githits code diff and the public MCP code_diff tool are available by default. Compare exact package versions or public repository refs, for example:

githits code diff npm:express 5.2.0..5.2.1 --stat

githits code diff npm:express 5.2.0..5.2.1 --patch -- 'lib/**/*.js'

Package diffs are repository-wide unless narrowed by an explicit path glob. Raw diffs do not prove upgrade safety. See source diff for bounds, patch safety, and supported addressing. Hosted MCP availability requires adoption of the released @githits/mcp package and deployment.

Target Resolution

resolve_target / githits resolve turns a fuzzy, misspelled or ambiguous public package, repository or documentation-site name into ranked canonical targets. It is available by default in the CLI, local MCP and public MCP package. Canonical targets skip resolution; uncertain identity needs an explicit choice. See target resolution for continuation rules and limits. Hosted MCP and plugins receive it after the released package is adopted and deployed.

Research

research / githits research answers a question about one public package or repository with a verified answer that cites its sources. It is available by default in the CLI, local MCP and public MCP package:

githits research "How does FastAPI dependency injection resolve nested dependencies?"

githits research npm:express "Where is router dispatch implemented?" githits research --thread "How does that interact with route parameters?"

Omit the target to let GitHits identify it from the question; reuse a returned thread ID for follow-ups. Answers usually take 30 seconds to a few minutes. Questions are sent to GitHits, so never include credentials, personal data or private code. Research may return a rate-limit or daily-limit error; the message says when to retry, and the daily limit resets at 00:00 UTC. See research for sources, threads and limits. Hosted MCP and plugins receive it after the released package is adopted and deployed.

Supported Sources

GitHits works with package and repository targets such as:

package specs: npm:react, npm:react@18.2.0, pypi:requests, crates:serde, pub:path
GitHub repos: https://github.com/expressjs/express, github:expressjs/express@main

Package inspection supports npm, PyPI, Hex, Crates, NuGet, Maven, Packagist, RubyGems, Go, Swift, Pub, vcpkg, and Zig. Advisory data is unavailable for vcpkg and Zig; dependency graph support varies by registry. cargo: is an input alias for crates: (public crates.io); canonical registry identities remain crates.

License Filtering

Code example search supports license filtering:

strict is the default and filters repositories with copyleft or undeclared licenses
custom uses your account blocklist configured at githits.com
yolo disables license filtering

npx githits@latest example "async file reading" --lang python --license strict

Authentication

Normal local setup is handled by:

npx githits@latest init

For manual login:

npx githits@latest login

Browser OAuth is recommended for local development. Credentials are stored in the system keychain by default and refreshed automatically. Useful flags:

init --no-browser or login --no-browser prints the login URL instead of launching a browser
init --port or login --port fixes the loopback callback port
login --force re-authenticates even if you are already logged in

The OAuth callback always listens on the machine where GitHits is running. When GitHits runs over SSH and the browser runs locally, forward the selected port from the browser machine:

ssh -N -L 8765:127.0.0.1:8765 user@remote-host

With that tunnel open, run GitHits on the remote machine using the same port:

npx githits@latest init --no-browser --port 8765

Open the URL printed by GitHits in the local browser. Replace user@remote-host with the SSH destination you normally use. The same flags work with githits login after setup.

Browser OAuth is interactive. For CI and other unattended environments, supply GITHITS_API_TOKEN through the environment's secret manager.

Keychain Prompts and File Storage

GitHits uses the system keychain by default because OAuth credentials include a refresh token. On macOS this means Keychain Access; on Windows it means Credential Manager; on Linux it means the available Secret Service or keyring backend.

If macOS shows a prompt such as "githits wants to access ... in your keychain", choose Always Allow when you trust the installed githits CLI. GitHits cannot customize that operating-system prompt; it is generated by macOS.

GitHits also writes a small non-secret metadata file so recent startup checks do not need to read the keychain. The keychain is only read when GitHits needs the token, for example during a tool call, token refresh, githits auth status, or a login check after metadata is stale or expired.

If your agent keeps showing keychain prompts even after Always Allow, switch OAuth storage to file mode:

# macOS/Linux: ~/.config/githits/config.toml, or $XDG_CONFIG_HOME/githits/config.toml

Windows: %APPDATA%\githits\config.toml

[auth] storage = "file"

The config directory may be empty until you create config.toml or GitHits writes auth metadata. Older macOS installs may have used ~/Library/Application Support/githits; GitHits still reads that location for migration, but new auth config and file storage use ~/.config/githits.

You can also opt in for one process:

GITHITS_AUTH_STORAGE=file githits login --force

File mode stores OAuth credenti

Only the beginning is shown; read the rest in the repo

GitHits

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Or run it on your computer

Or run it on your computer

Or run it on your computer

Or run it on your computer

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Search & AI memoryi

Common questions

Alternatives

Context7

Codebase Memory

Exa

README from the maker

Quick Start

What GitHits Adds

Examples

Look up advisory IDs across affected packages

Source Diffs

Target Resolution

Research

Supported Sources

License Filtering

Authentication

Keychain Prompts and File Storage

Windows: %APPDATA%\githits\config.toml