GitHits

Name: GitHits
Author: GitHits

Search, read and inspect public open-source packages and repositories from a coding agent

Official · GitHits TypeScript Remote (hosted) · Streamable HTTP Local · stdio Developer tools Web search

GitHub npm Website

66 popularity score ★ 124 ↓ 3.3k/wk

Connect your client

Remote (hosted)

Add in one click

Add to Cursor Add to LM Studio Add to Goose

Opens the app, which asks before it adds the server.

Or add it by command or config

Claude Codeterminal

claude mcp add --transport http --scope user githits https://mcp.githits.com

Codexterminal

codex mcp add githits --url https://mcp.githits.com

VS Codeterminal

code --add-mcp '{"name":"githits","type":"http","url":"https://mcp.githits.com"}'

Cursor~/.cursor/mcp.json or .cursor/mcp.json

{
  "mcpServers": {
    "githits": {
      "url": "https://mcp.githits.com"
    }
  }
}

Gemini CLIterminal

gemini mcp add --transport http --scope user githits https://mcp.githits.com

windsurf~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "githits": {
      "serverUrl": "https://mcp.githits.com"
    }
  }
}

opencodeopencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "githits": {
      "type": "remote",
      "url": "https://mcp.githits.com",
      "enabled": true
    }
  }
}

cline~/.cline/mcp.json

{
  "mcpServers": {
    "githits": {
      "type": "streamableHttp",
      "url": "https://mcp.githits.com",
      "disabled": false,
      "autoApprove": []
    }
  }
}

Local (npm)

Add in one click

Add to Cursor Add to VS Code Add to LM Studio Add to Goose

Opens the app, which asks before it adds the server.

Or add it by command or config

FirstTerminal

npx githits@latest login

Claude CodeTerminal

claude mcp add githits -- npx -y githits@latest mcp start

Claude Desktopclaude_desktop_config.json

{
  "mcpServers": {
    "githits": {
      "command": "npx",
      "args": [
        "-y",
        "githits@latest",
        "mcp",
        "start"
      ]
    }
  }
}

Cursor~/.cursor/mcp.json

{
  "mcpServers": {
    "githits": {
      "command": "npx",
      "args": [
        "-y",
        "githits@latest",
        "mcp",
        "start"
      ]
    }
  }
}

VS Code.vscode/mcp.json

{
  "servers": {
    "githits": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "githits@latest",
        "mcp",
        "start"
      ]
    }
  }
}

Codex~/.codex/config.toml

[mcp_servers.githits]
command = "npx"
args = ["-y", "githits@latest", "mcp", "start"]

Gemini CLITerminal

gemini mcp add --scope user githits npx -- -y githits@latest mcp start

Settings 4

`GITHITS_API_TOKEN` secret	Optional: API token for CI and headless use, in place of browser OAuth sign-in.
`GITHITS_AUTH_STORAGE`	Optional: Where OAuth credentials are kept: keychain or file (file mode stores them unencrypted). Default `keychain`.
`GITHITS_DISABLE_UPDATE_CHECK`	Optional: Turns off npm latest-version notices (also off when CI is set).
`GITHITS_TELEMETRY`	Optional: Set to 1, true, yes or on to print local timing diagnostics to stderr.

What it does

GitHits gives a coding agent a way to check how public open-source code actually works, so it stops guessing from memory. Every tool sends a query to the GitHits service, which indexes the source, documentation and metadata of public packages and repositories. Results come back as file contents, search hits or package facts, with the place each one came from.

You can use it to pull real code examples from other projects (filtered to permissive licences by default), to search or grep the code and docs of a named package or GitHub repository, and to read an exact file or docs section without cloning anything. The package tools report metadata, known vulnerabilities, dependency trees and changelogs between versions. There is also an upgrade review and a source diff between two versions or refs. When a package name is vague or misspelled, resolve_target maps it to canonical targets first. Package inspection covers npm, PyPI, Hex, Crates, NuGet, Maven, Packagist, RubyGems, Go, Swift, vcpkg and Zig.

The research tool answers one question about a package or repository and cites its sources. Follow-up questions can reuse the returned thread. It used to be experimental and hidden behind a config opt-in. In v0.36.0 it sits in the stable tool list, so it is on by default.

It runs as a local stdio server started by the githits npm CLI (`githits mcp start`), or at the hosted endpoint https://mcp.githits.com. Either way the queries go to GitHits. At v0.36.0 packages/mcp/src/mcp/server.ts registers 15 tools. The README's capability table names only 12 of them and leaves out resolve_target, code_diff and research. The local server's list of opt-in experimental tools is empty at this version (local-server.ts), so the `[experimental] tools` switch adds nothing.

What it needs

To run it yourself	Node.js 20.18.1+
Runs on	macOS, Windows, Linux
GitHits	Sign in with browser OAuth, or set GITHITS_API_TOKEN for CI and headless machines

A GitHits account. The local server signs in through browser OAuth (`npx githits@latest init` or `login`), or reads GITHITS_API_TOKEN on CI and headless machines. The npx launch needs Node.js ^20.18.1 or >=22.13.0. On Linux the default keychain storage needs a Secret Service or keyring backend, otherwise set `[auth] storage = "file"`. For the hosted endpoint in Codex CLI, run `codex mcp login githits` after adding it.

Limits

Early release Its docs call GitHits beta: tool names, setup flows and result formats may change
Not covered Reaches only public open-source packages and repositories that GitHits indexes, never your private code
Not covered Advisory data is unavailable for vcpkg and Zig, and dependency graph support varies by registry
Limit The README warns that a raw source diff does not prove an upgrade is safe
Rate limit research can hit a short-term rate limit or a daily allowance that resets at 00:00 UTC
Limit research answers take from about 30 seconds to a few minutes, with a 210-second deadline, so short client tool timeouts need raising
Not covered research takes packages or repositories as targets, not docs sites, and a thread holds up to ten turns
Limit The hosted endpoint gets resolve_target, code_diff and research only after a released package is deployed there, so it can lag the npm CLI

Its docs call GitHits beta: tool names, setup flows and result formats may change. It reaches only public open-source packages and repositories that the GitHits service indexes; it does not read your own private code. Advisory data is unavailable for vcpkg and Zig, and dependency graph support varies by registry. The README says raw source diffs do not prove an upgrade is safe. The research tool is experimental, off by default and only available in the local server. The README says the hosted endpoint gets resolve_target and code_diff only after a released package is deployed there, so its tool set can lag the local CLI.

Who it suits

Suits developers whose agent needs evidence about third-party dependencies: how a library behaves, what changed between versions, whether a version has known vulnerabilities, or how other projects solved a problem. The hosted endpoint suits clients that take a remote URL and sign in with OAuth; the local npx command suits tools that start stdio servers, and CI, where GITHITS_API_TOKEN replaces the browser sign-in. It is a poor fit for work on your own private repositories, or for anyone who cannot create a GitHits account or send queries to a third-party service.

Tools 15

15 only read. A ? marks an optional parameter.

quick_start: Loads the routing and usage guidance an agent reads once per session
get_example: Finds source-cited code examples from open-source projects for a described task, with licence filtering
search: Searches indexed code, documentation and symbols of a package or repository
search_status: Checks on an earlier search that is still being indexed
list: Lists the files of a package or repository, or its documentation pages
read: Reads a source file (optionally a line range) or a documentation section
grep: Runs a pattern match over a package's or repository's source
resolve_target: Maps a fuzzy or misspelled package, repository or docs-site name to ranked canonical targets
code_diff: Diffs source between two package versions or repository refs
pkg_info: Shows a package's metadata, licence and health summary
pkg_vulns: Lists known vulnerabilities for a package version
pkg_deps: Shows a package version's dependency tree
pkg_changelog: Gathers changelog entries between two versions
pkg_upgrade_review: Compares two versions of a package to give evidence for an upgrade
research: Answers one question about a package or repository with cited sources, with follow-ups through a thread IDtarget?: stringthread_id?: stringsource_format?: string

Popularity

66 popularity score, on our list (the bar is 36)

★ 124 ↓ 3.3k/wk

GitHub stars	124	25.2 points
Stars in 30 days	+9	5 points
npm downloads, last week	3,334	28.2 points
Official server	Yes	8 points

Measured 2026-11-07. How the score works.

Where it is published

Code	githits-com/githits-cli ★ 124
npm	githits 0.40.1, 2026-11-05
Hosted	`https://mcp.githits.com` Streamable HTTP · OAuth sign-in

What it can reach

Runs	On your machine, or on the maker's servers
Reaches	The internet
Changes things	No: it reads only
Sign-in	OAuth sign-in
Licence	Apache-2.0 (npm)
Last code change	2026-11-06

No tool touches your local files or repository. Each one sends its query to the GitHits service and returns public open-source data. Run locally, the server sits on your machine over stdio while the actual work happens on GitHits' servers. The hosted endpoint is the vendor's entirely and signs in with OAuth through a Supabase authorization server named in its metadata. Local sign-in is browser OAuth, and the credentials go to the system keychain by default. In file mode they are kept as unencrypted JSON under ~/.config/githits, where any process running as your user can read them. The research docs warn against putting credentials or private code in a question. Note that `init`, a CLI command and not a tool, writes MCP config and skill files into the coding tools you pick.

Over time

GitHub stars 124 +9 (+8 %)

124115

13 Oct 20267 Nov 2026

npm downloads a week 3.3k +3.1k (+1126 %)

3.8k18

2 Mar 20267 Nov 2026

Before the site measured it, read from npm's daily download counts.

Popularity score 66 +14 (+27 %)

6652

13 Oct 20267 Nov 2026

What is rising across the directory

Sources

Page checked 2026-10-27.

Badge for your README

Shows this server's rank in its category, and stars for a server that runs on your machine. It updates every hour.

MarkdownREADME.md

[![GitHits on EveryMCPServer](https://everymcpserver.com/badge/githits.svg)](https://everymcpserver.com/servers/githits)

Connect your client

Add in one click

Or add it by command or config

Add in one click

Or add it by command or config

Settings 4

What it does

What it needs

Limits

Who it suits

Tools 15

Similar servers

Repowise

Quill

GitNexus

ketch

SocratiCode

OpenLore