Complete reference for all git-doc-mcp command-line options.

# Direct invocation
git-doc-mcp --manifest <path-or-url> [options]

# With subcommand
git-doc-mcp serve --manifest <path-or-url> [options]

# Via npx (no install)
npx git-doc-mcp --manifest <path-or-url> [options]

Both forms (git-doc-mcp --manifest ... and git-doc-mcp serve --manifest ...) are equivalent.

Path to a local manifest file or URL to a remote manifest.

# Local file
git-doc-mcp --manifest ./manifest.yml
git-doc-mcp --manifest /absolute/path/manifest.yml

# Remote URL (HTTPS)
git-doc-mcp --manifest https://raw.githubusercontent.com/owner/repo/main/manifest.yml

Custom headers for fetching the manifest. Useful for private repos or authenticated endpoints.

git-doc-mcp --manifest https://private.example.com/manifest.yml \
  --manifest-header "Authorization: Bearer token123" \
  --manifest-header "X-Custom: value"

Pin the manifest to a specific hash. If the manifest content doesn't match, the server refuses to start. Use this in CI/CD for security.

git-doc-mcp --manifest https://example.com/manifest.yml \
  --manifest-hash "sha256:a1b2c3d4e5f6..."

Custom headers for downloading action scripts. Applied to all action code fetches.

git-doc-mcp --manifest ./manifest.yml \
  --action-code-header "Authorization: token ghp_abc123"

Custom headers for fetching resources. Applied to all resource reads.

git-doc-mcp --manifest ./manifest.yml \
  --resource-header "Authorization: token ghp_abc123"

Provide a secret value. Required secrets must be provided via this flag or environment variables.

git-doc-mcp --manifest ./manifest.yml \
  --secret GITHUB_TOKEN=ghp_abc123 \
  --secret API_KEY=sk-xyz789

Secrets can also be set via environment variables:

export GIT_MCP_SECRET_GITHUB_TOKEN=ghp_abc123
git-doc-mcp --manifest ./manifest.yml

If a required secret is not provided via either method, the server exits with an error.

Worker timeout in milliseconds. Affects how long an action can run. Default: 60000 (60 seconds).

git-doc-mcp --manifest ./manifest.yml --timeout 120000

Memory limit for the sandbox in bytes. Range: 8MB (8388608) to 1GB (1073741824). Default: 134217728 (128MB).

# 256MB
git-doc-mcp --manifest ./manifest.yml --memory-limit 268435456

# 64MB (for constrained environments)
git-doc-mcp --manifest ./manifest.yml --memory-limit 67108864

Allow insecure HTTP URLs for manifests, action scripts, and resources. By default, only HTTPS is allowed for HTTP(S) URLs. Note: this flag applies to manifest loading, action code fetching, and resource reads — ctx.fetch inside action scripts always requires HTTPS regardless of this flag.

Local file paths (for action and resource.uri) work regardless of this flag -- they are read directly from disk and are not subject to HTTP(S) restrictions.

# For local development with HTTP servers
git-doc-mcp --manifest http://localhost:8080/manifest.yml --allow-http

Warning: Using --allow-http disables transport encryption. Only use for local development.

Accept manifest changes when TOFU (Trust-on-First-Use) detects a hash mismatch. Without this flag, the server fails if the manifest hash changes from what was stored on first use.

git-doc-mcp --manifest https://example.com/manifest.yml --trust-changed

Maximum tool calls per minute. Uses a sliding window. Default: 60. Set to 0 for unlimited.

# 30 calls per minute
git-doc-mcp --manifest ./manifest.yml --rate-limit 30

# Unlimited
git-doc-mcp --manifest ./manifest.yml --rate-limit 0

On the first run with a manifest (local or remote), git-doc-mcp stores a hash of the manifest content. On subsequent runs:

1. Hash matches — server starts normally
2. Hash doesn't match — server refuses to start (fail-closed)
3. --trust-changed flag — accepts the new hash and updates the stored value
4. --manifest-hash flag — overrides TOFU with an explicit pin

This prevents silent manifest tampering.

Add to ~/.claude/claude_desktop_config.json:

{
  "mcpServers": {
    "my-server": {
      "command": "npx",
      "args": [
        "git-doc-mcp",
        "--manifest",
        "https://raw.githubusercontent.com/owner/repo/main/manifest.yml"
      ],
      "env": {
        "GIT_MCP_SECRET_GITHUB_TOKEN": "ghp_abc123"
      }
    }
  }
}

Add to your project's .mcp.json:

{
  "mcpServers": {
    "my-server": {
      "command": "npx",
      "args": [
        "git-doc-mcp",
        "--manifest",
        "https://raw.githubusercontent.com/owner/repo/main/manifest.yml",
        "--secret",
        "API_KEY=sk-xyz789"
      ]
    }
  }
}

npx git-doc-mcp \
  --manifest https://example.com/manifest.yml \
  --manifest-hash "sha256:a1b2c3d4e5f6..." \
  --secret "API_KEY=${API_KEY}"

FROM node:18-slim
RUN npm install -g git-doc-mcp
CMD ["git-doc-mcp", "--manifest", "/app/manifest.yml"]

All fetch requests and secret access are logged to ~/.git-doc-mcp/logs/audit.jsonl. Logs include:

• URL requested
• HTTP status code
• Response time
• Redirect chain
• Secret access attempts (granted/denied)
• Manifest name

Logs are automatically rotated.