What causes "Invalid end_timestamp: '{end_timestamp}' - cannot start with '-'" in modelcontextprotocol/servers?

Pass a timestamp that does not start with '-' (e.g. '2024-12-31').

modelcontextprotocol/servers · error · ValueError

Invalid end_timestamp: '{end_timestamp}' - cannot start with

Error message

Invalid end_timestamp: '{end_timestamp}' - cannot start with '-'

What it means

git_log() rejects an end_timestamp that starts with '-' to prevent flag injection into `git log --until <value>`. Same guard family as start_timestamp. Raises ValueError (propagates raw to the MCP client).

Source

Thrown at src/git/src/mcp_server_git/server.py:165

            except ValueError:
                raise ValueError(
                    f"Path '{f}' is outside the repository '{repo_root}'"
                )
        # Use '--' to prevent files starting with '-' from being interpreted as options
        repo.git.add("--", *files)
    return "Files staged successfully"

def git_reset(repo: git.Repo) -> str:
    repo.index.reset()
    return "All staged changes reset"

def git_log(repo: git.Repo, max_count: int = 10, start_timestamp: Optional[str] = None, end_timestamp: Optional[str] = None) -> list[str]:
    if start_timestamp or end_timestamp:
        # Defense in depth: reject timestamps starting with '-' to prevent flag injection
        if start_timestamp and start_timestamp.startswith("-"):
            raise ValueError(f"Invalid start_timestamp: '{start_timestamp}' - cannot start with '-'")
        if end_timestamp and end_timestamp.startswith("-"):
            raise ValueError(f"Invalid end_timestamp: '{end_timestamp}' - cannot start with '-'")
        # Use git log command with date filtering
        args = []
        if start_timestamp:
            args.extend(['--since', start_timestamp])
        if end_timestamp:
            args.extend(['--until', end_timestamp])
        args.extend(['--format=%H%n%an%n%ad%n%s%n'])

        log_output = repo.git.log(*args).split('\n')

        log = []
        # Process commits in groups of 4 (hash, author, date, message)
        for i in range(0, len(log_output), 4):
            if i + 3 < len(log_output) and len(log) < max_count:
                log.append(
                    f"Commit: {log_output[i]}\n"
                    f"Author: {log_output[i+1]}\n"
                    f"Date: {log_output[i+2]}\n"

View on GitHub (pinned to 76d64c822f)

Solutions

Pass a timestamp that does not start with '-' (e.g. '2024-12-31').
Reject leading '-' before calling.

Example fix

# before
git_log(repo, end_timestamp='-uMalicious')  # -> ValueError

# after
ts = end_timestamp or ''
if ts.startswith('-'):
    raise ValueError('end_timestamp must not start with -')
git_log(repo, end_timestamp=ts or None)

Defensive patterns

Strategy: validation

Validate before calling

def safe_timestamp(ts: str | None) -> str | None:
    if ts is not None and ts.startswith('-'):
        raise ValueError('end_timestamp must not start with -')
    return ts

Try / catch

try:
    git_log(repo, end_timestamp=ts)
except ValueError as e:
    if 'cannot start with' in e.args[0]:
        # normalize/strip the offending timestamp
    raise

Prevention

Reject timestamps beginning with '-' before passing to git_log.
Use canonical date formats to avoid colliding with git options.

When it happens

Trigger: Passing end_timestamp beginning with '-'; malicious or malformed timestamp input.

Common situations: Adversarial input; date strings that collide with git options.

Related errors

AI-assisted analysis of modelcontextprotocol/servers@76d64c822f (2026-08-12). Data as JSON: /api/errors/f7caeb317f84b075. Report an issue: GitHub.