gpg-commit-mcp

An MCP server that exposes tools for GPG-signed commits and SSH-authenticated pushes. It delegates to the user's local gpg-agent and ssh-agent via the controlling TTY, so no key material is ever exposed to the AI client.

How it works

Both tools run git as a subprocess with the full user environment and stdin connected to the TTY:

git_commit — runs git commit -S, delegating signing to gpg-agent. pinentry can prompt for a passphrase if needed.
git_push — runs git push, delegating authentication to ssh-agent. Works with any remote that your shell session can already push to.
git_pull — runs git pull, delegating authentication to ssh-agent.

Stdout and stderr are captured and returned to Claude as the tool result.

Requirements

Go 1.25+
git in PATH
GPG configured for commit signing (git config user.signingkey)
ssh-agent running with your key loaded (for git_push over SSH)

Install

go install github.com/iwarapter/gpg-commit-mcp@latest

Or build from source:

git clone https://github.com/iwarapter/gpg-commit-mcp
cd gpg-commit-mcp
go build -o gpg-commit-mcp .

Register with Claude Code

claude mcp add gpg-commit $(go env GOPATH)/bin/gpg-commit-mcp

Or if built from source, use the full path to the binary:

claude mcp add gpg-commit /path/to/gpg-commit-mcp

Tool reference

`git_commit`

| Parameter | Type | Required | Description | |-----------|------|----------|-------------| | message | string | yes | Commit message | | repo_dir | string | no | Path to git repository (defaults to current working directory) |

Prerequisites: changes must already be staged with git add before calling the tool.

`git_push`

| Parameter | Type | Required | Description | |-----------|------|----------|-------------| | repo_dir | string | no | Path to git repository (defaults to current working directory) | | remote | string | no | Remote name (defaults to origin) | | branch | string | no | Branch to push (defaults to the remote's configured upstream) |

`git_pull`

| Parameter | Type | Required | Description | |-----------|------|----------|-------------| | repo_dir | string | no | Path to git repository (defaults to current working directory) | | remote | string | no | Remote name (defaults to origin) | | branch | string | no | Branch to pull (defaults to the current branch's upstream) | | rebase | bool | no | Rebase local commits on top of the fetched branch instead of merging |

Example usage in Claude

Stage your changes first, then ask Claude:

  "Commit the staged changes with the message 'Fix null pointer in auth handler'"

Claude will call git_commit and GPG will sign the commit using your local gpg-agent.

To also push:

  "Push the changes to origin"

Claude will call git_push and ssh-agent will authenticate transparently.

Make Claude always prefer this tool

Add the following to ~/.claude/CLAUDE.md (create it if it doesn't exist):

## Committing changes

When asked to commit changes, always use the `git_commit` MCP tool (server: `gpg-commit`)
instead of running `git commit` via the Bash tool. This ensures commits are GPG-signed
via the local gpg-agent.

Only fall back to `git commit` via Bash if the `gpg-commit` MCP server is not connected.

Claude Code loads this file globally at the start of every session.

Verifying signed commits

git log --show-signature -1
git verify-commit HEAD

MCP Servers