MCP server for Mercurial repository interaction
SaferSkills independently audited Hg Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server for Mercurial repository interaction, written in Python 3.10+ with AsyncIO.
hg_init) or clone existing ones (hg_clone)hg_status) and line-by-line changes (hg_diff)hg_add), commit changes (hg_commit), remove files (hg_remove), and amend the last commit (hg_amend)hg_shelve) and restore them (hg_unshelve)hg_cat) and rename or move files (hg_rename)hg_update)hg_branch)hg_bookmark, hg_bookmarks)hg_topic, hg_topics, hg_topic_current)hg_phases)hg_tag, hg_tags)hg_push, hg_pull)hg_incoming, hg_outgoing)hg_paths)hg_heads)hg_rebase) or permanently remove them (hg_strip)hg_absorb), fold changesets (hg_fold), split changesets (hg_split), uncommit (hg_uncommit), prune (hg_prune), rewind for undo (hg_rewind), edit metadata (hg_metaedit)hg_next, hg_previous, hg_stack)hg_histedit)hg_graft) or patch-based (hg_transplant)hg_backout)hg_evolve)hg_merge)hg_resolve)hg_revert)hg_annotate)hg_bisect)hg_files)hg_summary)hg_verify) and identify the current revision (hg_identify)hg_export) or import patch files (hg_import)hg_git)hg_largefiles)hg_extensions), config (hg_config), and access built-in help (hg_help)# Clone the repository
git clone <repository-url>
cd hg-mcp
# Create and activate virtual environment
python -m venv .venv
source .venv/bin/activate # On Windows: .venv\Scripts\activate
# Install in editable mode
pip install -e .
# Optional: Install with performance enhancements
pip install uvloop # On Unix/macOS
pip install winloop # On Windows# Activate your virtual environment first
source .venv/bin/activate # On Windows: .venv\Scripts\activate
hg-mcpThis starts the MCP server using stdio transport, which can be used with MCP clients like Claude for Desktop, Qwen-Coder, Gemini-CLI, and OpenCode.
For web-based MCP clients like llama.cpp WebUI, you can run the server with HTTP transport:
# SSE only (compatible with llama.cpp WebUI)
hg-mcp --transport sse --port 8000
# Streamable HTTP only
hg-mcp --transport streamable-http --port 8000
# Both SSE and Streamable HTTP on the same server
hg-mcp --transport sse streamable-http --port 8000Endpoints:
http://localhost:8000/ssehttp://localhost:8000/mcpOptions:
--transport: One or more transport protocols (stdio, sse, streamable-http)stdio--transport sse streamable-http--port: Port to listen on (default: 8000)--host: Host to bind to (default: 0.0.0.0)--api-key: Optional. Enable mandatory API key authentication. When set, clients must provide this key in their request headers.--jail: Required for HTTP transports. Restrict repository access to this directory tree for security.--mercurial: Optional. Path to the Mercurial (hg) executable. Defaults to hg (resolved from PATH). Example: --mercurial /usr/local/bin/hgWhen exposing the MCP server over TCP/IP, two security mechanisms are available:
#### 1. Jail Path Restriction (--jail)
Required for all HTTP transports. This restricts repository access to a specific directory tree, preventing unauthorized access to paths outside the jail:
# Restrict access to /home/user/projects and its subdirectories
hg-mcp --transport streamable-http --port 8000 --jail /home/user/projects#### 2. API Key Authentication (--api-key)
Optional. You can require clients to authenticate by providing a valid API key. When this option is enabled, the server will reject any request that does not include a matching X-API-Key or API-Key header:
# Enable mandatory API key authentication
hg-mcp --transport streamable-http --port 8000 --jail /home/user/projects --api-key your-secret-keyTo use this MCP server with your AI coding assistant, point to the correct executable path in your virtual environment.
#### Claude Desktop / Qwen-Coder / Gemini-CLI
{
"mcpServers": {
"hg-mcp": {
"command": "/path/to/your/venv/bin/hg-mcp"
}
}
}#### OpenCode
{
"mcp": {
"hg-mcp": {
"type": "local",
"command": ["/path/to/your/venv/bin/hg-mcp"],
"enabled": true
}
}
}# Install development dependencies
pip install -e ".[dev]"
# Run all tests with coverage
./scripts/runtest.sh# Run linting
./scripts/lint-check-and-fix.sh
# Run type checking
./scripts/type-check.sh
# Run formatter
./scripts/code-format.shThis project is inspired by mcp-server-mercurial.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.