“Non-destructive” is the server’s word, not a guarantee

The reference git MCP server, `mcp-server-git`, tags `git_create_branch` with `destructiveHint: false`, the annotation clients use to decide whether a tool call needs confirmation. Issue #5059 shows that in the code it cites (main as of 4 October), the handler called GitPython’s `create_head` without checking whether the branch already existed. GitPython refuses to overwrite a loose ref file but not a packed ref, which is what you have after `git gc`, `git pack-refs` or a fresh clone. So asking for `feature` from `main` replied “Created branch”, moved `feature` to the tip of `main`, left its own commits unreachable and wrote no reflog entry. `git branch feature` on the command line would have refused.

The repro is the reporter’s own, and a second contributor reproduced the mechanism on GitPython 3.1.50. We checked the current code: main and the published `mcp-server-git` 2026.10.10 (on PyPI since 11 October) now refuse to create a branch whose name already exists, packed or loose, while 2026.8.18 has no such check. The issue is still open, and the thread notes that no test covers the packed case yet.

A tool annotation is a claim by the server’s author about intent, not something your client can verify. Don’t let a hint alone auto-approve a tool that writes, update `mcp-server-git` to 2026.10.10 or later, and push or tag work you care about before an agent touches your branches.