Build an MCP server that analyzes a local Git repository and identifies risky commits. Provide tools to fetch recent commits with diff stats, score commits based on message quality, diff size, and changes to sensitive files (.env, package.json, migrations, config files), and generate a repository risk report highlighting the highest-risk commits. Works offline on local repositories with no external APIs or authentication.

Elevator pitch Analyze local Git repositories to identify and score risky commits based on message quality, diff size, and sensitive file changes.

Industry DevOps / Code Security / Repository Management

Problem

• Risky commits slip through review undetected in local repositories.
• No visibility into commit patterns affecting sensitive configuration files.

Solution

• Scores commits by message quality, diff magnitude, and sensitive file modifications.
• Generates risk reports highlighting high-impact commits for immediate review.

Tools

• fetch_recent_commits: Returns commit hashes, messages, and diff statistics from local repo.
• score_commit: Analyzes message quality, file changes, and sensitive patterns; returns risk score.
• identify_sensitive_files: Detects .env, package.json, migrations, config files in diffs.
• generate_risk_report: Aggregates commit scores into ranked repository risk summary.

Widgets

• /risk-dashboard: Displays top-risk commits, scores, and affected sensitive files.

Conversation starters

• "What are the riskiest commits in my repository this week?"
• "Show me all commits that modified environment or database files."