modelcontextprotocol/servers · error · ValueError

Invalid end_timestamp: '${end_timestamp}' - cannot start wit

Error message

Invalid end_timestamp: '${end_timestamp}' - cannot start with '-'

What it means

Companion check to error 3, applied to end_timestamp: a value starting with '-' could be parsed by the underlying git process as a command-line flag instead of the 'until' date, enabling option injection. git_log() rejects it with ValueError before running Git.

Source

Thrown at src/git/src/mcp_server_git/server.py:164

                resolved.relative_to(repo_root)
            except ValueError:
                raise ValueError(
                    f"Path '{f}' is outside the repository '{repo_root}'"
                )
        # Use '--' to prevent files starting with '-' from being interpreted as options
        repo.git.add("--", *files)
    return "Files staged successfully"

def git_reset(repo: git.Repo) -> str:
    repo.index.reset()
    return "All staged changes reset"

def git_log(repo: git.Repo, max_count: int = 10, start_timestamp: Optional[str] = None, end_timestamp: Optional[str] = None) -> list[str]:
    # Defense in depth: reject timestamps starting with '-' to prevent flag injection
    if start_timestamp and start_timestamp.startswith("-"):
        raise ValueError(f"Invalid start_timestamp: '{start_timestamp}' - cannot start with '-'")
    if end_timestamp and end_timestamp.startswith("-"):
        raise ValueError(f"Invalid end_timestamp: '{end_timestamp}' - cannot start with '-'")

    kwargs: dict[str, Any] = {"max_count": max_count}
    if start_timestamp:
        kwargs["since"] = start_timestamp
    if end_timestamp:
        kwargs["until"] = end_timestamp

    commits = list(repo.iter_commits(**kwargs))
    log = []
    for commit in commits:
        log.append(
            f"Commit: {commit.hexsha}\n"
            f"Author: {commit.author}\n"
            f"Date: {commit.authored_datetime}\n"
            f"Message: {commit.message}\n"
        )
    return log

View on GitHub (pinned to d73f99efbf)

Solutions

1. Provide an absolute date string without a leading dash, e.g. '2024-06-30T23:59:59'.
2. Express relative windows positively, e.g. end_timestamp='yesterday' or '1 week ago'.
3. Validate/trim leading '-' characters from end_timestamp in the calling client.
4. Handle the ValueError gracefully and prompt the user/model for a corrected timestamp.

Example fix

// before
await call_git_log({ "end_timestamp": "--until=now" });
// after
await call_git_log({ "end_timestamp": "now" });

def safe_end(ts: str | None) -> str | None:
    if ts and ts.startswith("-"):
        raise ValueError(f"end_timestamp cannot start with '-': {ts}")
    return ts

end_timestamp = safe_end(end_timestamp)

def is_safe_end_timestamp(ts: str | None) -> bool:
    return ts is None or not ts.startswith("-")

try:
    log = await call_tool("git_log", {"repo_path": path, "end_timestamp": ts})
except ValueError as e:
    if "end_timestamp" in str(e) or "cannot start with" in str(e):
        return "Please provide an absolute date like '2024-06-30' instead."
    raise

When it happens

Trigger: Passing end_timestamp values like '--patches' or '-1 day' to the git_log tool; any client (especially LLM-driven) that emits dash-prefixed strings in the end_timestamp argument.

Common situations: Relative-date confusion ('-1 week'); prompt-injection attempts smuggling git options; copy-pasted CLI examples where the dash belonged to a flag rather than the date.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Invalid start_timestamp: '{start_timestamp}' - cannot start
• Invalid end_timestamp: '{end_timestamp}' - cannot start with
• Invalid target: '{target}' - cannot start with '-'
• Invalid branch name: '{branch_name}' - cannot start with '-'
• Invalid base branch: '{base_branch}' - cannot start with '-'

AI-assisted analysis of modelcontextprotocol/servers@d73f99efbf (2026-09-07). Data as JSON: /api/errors/8977fd2b37dd32a5. Report an issue: GitHub.