gpg-commit-mcp

An MCP server that exposes a git_commit tool for creating GPG-signed commits. It delegates signing to the user's local gpg-agent via the controlling TTY, so no key material is ever exposed to the AI client.

How it works

When Claude calls git_commit, the server runs git commit -S as a subprocess with the full user environment and stdin connected to the TTY. GPG signing happens exactly as it would if you ran the command yourself — pinentry can prompt for a passphrase if needed. Stdout and stderr are captured and returned to Claude as the tool result.

Requirements

• Go 1.25+
• git in PATH
• GPG configured for commit signing (git config user.signingkey)

Install

go install github.com/iwarapter/gpg-commit-mcp@latest

Or build from source:

git clone https://github.com/iwarapter/gpg-commit-mcp
cd gpg-commit-mcp
go build -o gpg-commit-mcp .

Register with Claude Code

claude mcp add gpg-commit $(go env GOPATH)/bin/gpg-commit-mcp

Or if built from source, use the full path to the binary:

claude mcp add gpg-commit /path/to/gpg-commit-mcp

Tool reference

git_commit

| Parameter | Type | Required | Description | |-----------|------|----------|-------------| | message | string | yes | Commit message | | repo_dir | string | no | Path to git repository (defaults to current working directory) |

Prerequisites: changes must already be staged with git add before calling the tool.

Example usage in Claude

Stage your changes first, then ask Claude:

  "Commit the staged changes with the message 'Fix null pointer in auth handler'"

Claude will call git_commit and GPG will sign the commit using your local gpg-agent.

Make Claude always prefer this tool

Add the following to ~/.claude/CLAUDE.md (create it if it doesn't exist):

## Committing changes

When asked to commit changes, always use the `git_commit` MCP tool (server: `gpg-commit`)
instead of running `git commit` via the Bash tool. This ensures commits are GPG-signed
via the local gpg-agent.

Only fall back to `git commit` via Bash if the `gpg-commit` MCP server is not connected.

Claude Code loads this file globally at the start of every session.

Verifying signed commits

git log --show-signature -1
git verify-commit HEAD