GPG Commit

An MCP server that exposes tools for GPG-signed commits and SSH-authenticated pushes. It delegates to the user's local gpg-agent and ssh-agent via the controlling TTY, so no key material is ever exposed to the AI client.

How it works

Both tools run git as a subprocess with the full user environment and stdin connected to the TTY:

• git_commit — runs git commit -S, delegating signing to gpg-agent. pinentry can prompt for a passphrase if needed.
• git_push — runs git push, delegating authentication to ssh-agent. Works with any remote that your shell session can already push to.
• git_pull — runs git pull, delegating authentication to ssh-agent.

Stdout and stderr are captured and returned to Claude as the tool result.

Requirements

• Go 1.25+
• git in PATH
• GPG configured for commit signing (git config user.signingkey)
• ssh-agent running with your key loaded (for git_push over SSH)

Install

go install github.com/iwarapter/gpg-commit-mcp@latest

Or build from source:

git clone https://github.com/iwarapter/gpg-commit-mcp
cd gpg-commit-mcp
go build -o gpg-commit-mcp .

Register with Claude Code

claude mcp add gpg-commit $(go env GOPATH)/bin/gpg-commit-mcp

Or if built from source, use the full path to the binary:

claude mcp add gpg-commit /path/to/gpg-commit-mcp

Tool reference

git_commit

Parameter	Type	Required	Description
message	string	yes	Commit message
repo_dir	string	no	Path to git repository (defaults to current working directory)

Prerequisites: changes must already be staged with git add before calling the tool.

git_push

Parameter	Type	Required	Description
repo_dir	string	no	Path to git repository (defaults to current working directory)
remote	string	no	Remote name (defaults to origin)
branch	string	no	Branch to push (defaults to the remote's configured upstream)

git_pull

Parameter	Type	Required	Description
repo_dir	string	no	Path to git repository (defaults to current working directory)
remote	string	no	Remote name (defaults to origin)
branch	string	no	Branch to pull (defaults to the current branch's upstream)
rebase	bool	no	Rebase local commits on top of the fetched branch instead of merging

Example usage in Claude

Stage your changes first, then ask Claude:

  "Commit the staged changes with the message 'Fix null pointer in auth handler'"

Claude will call git_commit and GPG will sign the commit using your local gpg-agent.

To also push:

  "Push the changes to origin"

Claude will call git_push and ssh-agent will authenticate transparently.

Make Claude always prefer this tool

Add the following to ~/.claude/CLAUDE.md (create it if it doesn't exist):

## Committing changes

When asked to commit changes, always use the `git_commit` MCP tool (server: `gpg-commit`)
instead of running `git commit` via the Bash tool. This ensures commits are GPG-signed
via the local gpg-agent.

Only fall back to `git commit` via Bash if the `gpg-commit` MCP server is not connected.

Claude Code loads this file globally at the start of every session.

Verifying signed commits

git log --show-signature -1
git verify-commit HEAD