- tools/list advertises every inputSchema and outputSchema as JSON Schema 2020-12; clients whose validator knows only that dialect no longer reject the server (#57)
- Tool inputs reject leading-dash refs, paths, and URLs across 14 tools, via the new GitUrlSchema and GitFilePathSchema plus tightened branch/ref/tag/remote schemas
- validateGitArgs enforces a strict git flag allow-list; the previous "any --flag=value passes" branch is closed
- git clone and git remote add/set-url emit --end-of-options before user-controlled positionals
- Dependency refresh, notably @modelcontextprotocol/sdk ^1.29.0 -> ^1.30.0 and bun 1.4.0; zod, typescript, and @cloudflare/workers-types deliberately held

Changelog: https://github.com/cyanheads/git-mcp-server/blob/main/CHANGELOG.md#v2152---2026-08-24