
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
@workforge/gitq-mcp
Advanced tools
MCP server that exposes GitQ's stacked branch engine as tools for AI agents (Claude Code, Cursor, etc.).
MCP server that exposes GitQ's stacked branch engine as tools for AI agents (Claude Code, Cursor, etc.).
Add to .claude/mcp.json:
{
"mcpServers": {
"gitq": {
"command": "bun",
"args": ["run", "/path/to/gitq/packages/mcp/bin/gitq-mcp.ts"]
}
}
}
Add to .cursor/mcp.json with the same format.
bun run packages/mcp/bin/gitq-mcp.ts # resolve repo from cwd
bun run packages/mcp/bin/gitq-mcp.ts /repo # explicit repo path
The server communicates over stdio using the Model Context Protocol.
| URI | Description |
|---|---|
stack://active | Full stack topology — nodes, parents, statuses, MR data |
stack://diagnostics | Classified state per branch — situations, actions, badges |
stack://preflight | Conflict predictions and drift warnings before rebase |
| Tool | Description |
|---|---|
diagnose | Classified state of every branch — read this first |
preflight | Predict conflicts before rebasing |
get-diff | Diff between two refs |
get-log | Commit history for a branch |
get-cherry | Unique vs. duplicate commits (patch-ID) |
list-conflicts | Conflicted files during a paused rebase |
discover-stacks | Scan repo for branch stacks |
preview-absorb | Preview how uncommitted changes distribute across branches |
| Tool | Description |
|---|---|
sync-stack | Fetch + rebase all branches onto latest trunk |
cascade-merged | Rebase children of merged parents onto trunk |
restack-from | Rebase a branch and descendants after mid-stack edits |
continue-rebase | Continue after resolving conflicts (auto-loads pause state) |
abort-rebase | Abort a paused rebase |
| Tool | Description |
|---|---|
propose-resolution | Analyze conflicts and propose strategies |
resolve-conflicts | AI-resolve conflicts, write to disk, and stage |
stage-files | Stage files after manual resolution |
| Tool | Description |
|---|---|
add-branch | Add a branch to the stack (captures fork point) |
remove-branch | Remove a branch (enforces removal policy) |
rename-branch | Rename in git + update stack refs |
reparent-branch | Move to a new parent (rebases + cascades) |
fold-branch | Merge commits into parent and remove |
split-branch | Split at a commit point |
split-by-file | Split by file glob patterns |
absorb | Distribute uncommitted changes to correct branches |
reset-to-remote | Reset local branch to remote |
toggle-unmanaged | Skip/unskip a branch during rebases |
| Tool | Description |
|---|---|
publish-stack | Push branches + create draft MRs/PRs |
retarget-mr | Fix MR target branch to match stack parent |
sync-forge | Refresh MR statuses from GitHub/GitLab |
import-from-forge | Reconstruct a stack from existing MRs |
Forge tools require a GitHub/GitLab token configured in GitQ Settings or via
GITHUB_TOKEN/GITLAB_TOKENenv vars.
The server resolves the repository from cwd at startup and caches it for the session. Tools follow the same load store → call core → save store pattern as the Electron shell's IPC handlers.
Rebase operations that pause on conflict persist state to .git/gitq-pause.json. The continue-rebase tool auto-loads this — agents don't need to track pause state themselves.
bun install # install deps
bun run --filter @gitq/mcp check # type-check
FAQs
MCP server that exposes GitQ's stacked branch engine as tools for AI agents (Claude Code, Cursor, etc.).
We found that @workforge/gitq-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.