refresh_repository · Git MCP: Risk & Policy

WHAT IT DOES

What refresh_repository does on Git MCP

AI agents invoke refresh_repository to trigger actions in Git MCP. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why refresh_repository needs a policy

This tool executes git checkout and git pull operations, which are not purely read operations. Checking out the main branch changes the working directory state, and pulling remotes fetches and merges/fast-forwards remote changes into the local repository. These are external operations with side effects on the local filesystem and repository state.

From the tool's definition 'Refresh repository by checking out main branch and pulling all remotes' — performs active git operations (checkout, pull) that modify the local working state

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

refresh_repository Rate-limited

refresh_repository stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "refresh_repository": {
      "limits": [
        {
          "counter": "refresh_repository_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Git MCP, so you can run agents against it safely.

FAQ

Questions about refresh_repository

What does the refresh_repository tool do? +

Refresh repository by checking out main branch and pulling all remotes. It is categorised as a Execute tool in the Git MCP MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on refresh_repository? +

Register the Git MCP server in PolicyLayer and add a rule for refresh_repository: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Git MCP. Nothing to install.

What risk level is refresh_repository? +

refresh_repository is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit refresh_repository? +

Yes. Add a rate_limit block to the refresh_repository rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block refresh_repository completely? +

Set action: deny in the PolicyLayer policy for refresh_repository. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides refresh_repository? +

refresh_repository is provided by the Git MCP server (kjozsa/git-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.