Commitcheck

io.github.CloudCorpRecordsPublished by GitHub account CloudCorpRecordsv0.1.0Updated Nov 7, 2026

Commit message convention and DCO sign-off checker over a git history range.

VerifiedSTDIODesktop onlyDeveloper Tools

Overview

AI-generated overview

Checks a git repository's recent commit messages for length, placeholder subjects, DCO sign-off and convention breaks, returning per-commit findings.

What you can do
  • Check commits in a git repo (most recent 50 by default) for subject lines over 72 characters, placeholder subjects, missing or malformed Signed-off-by trailers, and breaks from the repo's dominant message style.
  • Get per-commit findings that name the rule and the short sha, plus a CLEAN or FINDINGS verdict.
  • Rely on adaptive rules: sign-off and style are only flagged when the history itself shows a dominant pattern.
When to use it
Useful when you want an assistant to review recent commit hygiene in a repository before a push, release or contribution, or to explain why a history fails a DCO or message-style expectation.
Requirements
Runs as a local process over stdio, via npx or a Docker image. Needs Node 20 or newer and git on PATH. No accounts, API keys or environment variables are declared.
Before you install
Read-only checking of local git history; no writes, credentials or third-party data transfer are described. Results are limited to the last 50 commits, style detection is statistical, and sign-off presence is checked without verifying signature validity or that the signer is the author.

Installation

In SourceWeft

  1. Open Commitcheck in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

commitcheck

Commit hygiene checker for a git repository's recent history. It reads the most recent 50 commits and checks subject length, placeholder subjects, DCO Signed-off-by trailers, malformed trailers, and whether each commit follows the message convention the repo itself actually uses. Every finding names the rule and the short sha of the commit it came from.

Install

sh
npx @reneturcios/commitcheck check [path]

Or install it globally:

sh
npm install -g @reneturcios/commitcheck

Requires Node 20 or newer and git on PATH.

CLI

sh
commitcheck check [path] [--json]   # check a repo (default path: .)commitcheck mcp                     # run the MCP server on stdiocommitcheck --version               # print the version

Exit codes: 0 when the verdict is CLEAN, 1 when it is FINDINGS, 2 for a usage error or an unreadable target, and 141 when the reader closed the output pipe early (the shell-visible equivalent of death by SIGPIPE).

Findings are printed in git log order, newest first, and the order is deterministic for a given history.

MCP

The MCP server exposes one tool:

  • check_commits with argument path: runs the same check as the CLI and returns the full report as JSON.

Rules

RuleSeverityWhat it means
SUBJECT-TOO-LONGmediumThe subject line is over 72 characters.
SUBJECT-VAGUElowThe subject is empty or a placeholder such as wip, fix, update, changes, or .
NO-SIGNOFFmediumThe commit has no Signed-off-by trailer, in a repo whose history follows the DCO convention (see below).
CONVENTION-BREAKlowThe subject breaks the dominant message style of the range (see below).
MERGE-COMMITinfoA merge commit, reported for context. Merge commits are never a finding above info.
TRAILER-MALFORMEDlowA Signed-off-by line without an email shape, for example Signed-off-by: Jane Doe with no <[email protected]>.

The verdict is CLEAN when the range has no medium findings, and FINDINGS otherwise. Low and info findings are reported but do not change the verdict.

The adaptive rules, stated plainly

commitcheck does not impose a house style. Both convention checks are learned from the range being checked:

  • DCO / sign-off. A commit is flagged NO-SIGNOFF only when the repo demonstrably uses sign-off: at least half of the other commits in the range carry a well-formed Signed-off-by trailer. If the repo does not use sign-off, no commit is flagged for missing it. A malformed sign-off line does not count as a sign-off.
  • Message convention. Two styles are tracked: conventional subjects (type: summary or type(scope): summary) and capitalized imperative subjects (Add the thing). When one style is used by at least 70 percent of the non-merge commits in the range, it is the dominant style, and a commit that breaks it is flagged CONVENTION-BREAK. When no style reaches 70 percent, nothing is flagged for style.

Limits

  • Only the last 50 commits are checked.
  • Style detection is statistical. A short or mixed history may have no dominant style, in which case no convention findings are produced.
  • Sign-off presence is checked, not signature validity. commitcheck verifies that a Signed-off-by trailer with an email shape exists; it does not verify that the signer is the author or that any signature is genuine.
  • Merge commits are detected from the Merge ... subject line, which is the default git shape; a hand-written subject that starts with Merge will be reported as one.

Source: README.md at commit 2c8efad

Tools

1

check_commits

Check the commits in a git repo (most recent 50 by default): subject lines over 72 chars, missing DCO Signed-off-by trailers, messages that break the repo's dominant convention (detected from the history itself), and placeholder subjects. Returns per-commit findings and a CLEAN or FINDINGS verdict.

Parameterspathrequired

Version history

1
  1. v0.1.0LatestOct 30, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts