Is Gk CLI safe and trustworthy?

tashan scores Gk CLI on public evidence — tashan score 67.0/100, it is currently active, note: a single primary maintainer (bus-factor risk), no known advisories against the current release, it runs a script at install time. Audit scope: OSV advisories, install-time scripts, build provenance and declared permission surface. We do not review source code or execute the capability.

How do I install Gk CLI?

In Claude Code: run `claude mcp add gk-cli -- npx -y @gitkraken/gk`. In Cursor / Claude Desktop, add it to mcp.json / claude_desktop_config.json.

‹ The Index

Gk CLI

npm

The GitKraken MCP Server for managing repos, PRs, issues across GitHub, GitLab, Bitbucket and more.

Works with: Claude Code, Cursor, Claude Desktop, Codex CLI, Gemini CLI, Cline, Windsurf, VS Code

Category: Productivity — see all ranked ›

Install (Claude Code):

claude mcp add k -- npx -y @gitkraken/gk

solid

“The MCP server gets three sentences and a link; the CLI workflow is concrete”

tashan score: 67.0
Expertise: 68.0 (solid)
Adoption: 1.7k/wk
Health: active

Security audit

Every finding is shown in full. A licence adds the detail needed to act on it — which advisory, what the install script does, the version that fixes it.

No known advisoriesclearchecked against OSV for 3.1.70

Runs a script at install timecodeunlock detail

No permission surface detecteddeclares no dependency that reaches files, shell or network

No build provenanceno attestation — the published artifact cannot be traced to its source

1 finding here has detail behind a licence. You can see it exists above, free, permanently — Pro tells you the exact command it runs at install time.

Unlock the fix — $6/mo ›or check your whole config free with npx tashan-cli doctor

npm ↗ · source ↗ · pkg:@gitkraken/gk

Already running this? npx tashan-cli doctor checks your whole config against the Index — how it works ›