gitlab-mcp
Provides tools to interact with GitLab merge requests, including retrieving basic info, commits, diffs, discussions, approvals, pipelines, and full merge request details.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@gitlab-mcpShow me the details of merge request 42"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
GitLab MCP Server
A Model Context Protocol (MCP) server that provides tools to interact with GitLab merge requests. This server runs as a local tool using stdio transport, allowing MCP clients (like Claude Desktop) to retrieve comprehensive information about GitLab merge requests.
Features
Get merge request basic information
Retrieve all commits in a merge request
Get file changes and diffs
Access discussions and comments
View approval status
Check CI/CD pipeline status
Get all information at once with a single command
Related MCP server: GitLab MCP Code Review
Prerequisites
Node.js 18 or higher
GitLab account with API access
GitLab personal access token with
apiorread_apiscope
Installation
Clone or download this repository
Install dependencies:
npm installBuild the project:
npm run buildCreate a
.envfile based on.env.example:
cp .env.example .envEdit
.envand add your GitLab credentials:
GITLAB_INSTANCE_URL=https://gitlab.com
GITLAB_API_TOKEN=your-personal-access-token
GITLAB_PROJECT_ID=your-project-idGetting Your GitLab Configuration
GitLab Instance URL:
For gitlab.com:
https://gitlab.comFor self-hosted: Your GitLab instance URL (e.g.,
https://gitlab.example.com)
API Token:
Go to GitLab → User Settings → Access Tokens
Create a personal access token with
apiorread_apiscopeCopy the token (you won't be able to see it again!)
Project ID:
Found on your project's main page under the project name
Or in Settings → General
Configuration for Claude Desktop
Add the following to your Claude Desktop MCP settings file:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"gitlab": {
"command": "node",
"args": ["/absolute/path/to/gitlab-mcp/dist/index.js"],
"env": {
"GITLAB_INSTANCE_URL": "https://gitlab.com",
"GITLAB_API_TOKEN": "your-api-token",
"GITLAB_PROJECT_ID": "12345678"
}
}
}
}Replace /absolute/path/to/gitlab-mcp with the actual path to this project.
Alternatively, if you want to use the .env file, you can omit the env section, but make sure the .env file is in the project root.
Available Tools
get_merge_request
Get basic information about a merge request.
Parameters:
merge_request_iid(number): The IID (internal ID) of the merge request
Returns: Basic MR info including title, description, state, branches, author, assignees, reviewers, labels, and merge status.
get_merge_request_commits
Get all commits in a merge request.
Parameters:
merge_request_iid(number): The IID of the merge request
Returns: Array of commits with messages, authors, timestamps, and SHAs.
get_merge_request_diffs
Get all file changes and diffs in a merge request.
Parameters:
merge_request_iid(number): The IID of the merge request
Returns: Array of file changes with line-by-line diffs.
get_merge_request_discussions
Get all discussions and comments on a merge request.
Parameters:
merge_request_iid(number): The IID of the merge request
Returns: Array of discussion threads with notes, including review comments and system notes.
get_merge_request_approvals
Get approval status and information for a merge request.
Parameters:
merge_request_iid(number): The IID of the merge request
Returns: Approval state including required approvals, approvals left, and who approved.
get_merge_request_pipelines
Get CI/CD pipeline information for a merge request.
Parameters:
merge_request_iid(number): The IID of the merge request
Returns: Array of pipelines with status, ref, SHA, and timestamps.
get_merge_request_full
Get complete information about a merge request (all data in one call).
Parameters:
merge_request_iid(number): The IID of the merge request
Returns: Complete merge request data including MR info, commits, diffs, discussions, approvals, pipelines, and latest pipeline jobs.
Usage Example
Once configured in Claude Desktop, you can use natural language to interact with your GitLab merge requests:
"Show me the details of merge request 42"
"What commits are in MR 15?"
"Get the diffs for merge request 8"
"Show me all comments on MR 23"
"What's the approval status of merge request 10?"
"Get everything about merge request 5"Development
Build
npm run buildWatch mode (auto-rebuild on changes)
npm run watchTroubleshooting
Authentication Errors
Verify your
GITLAB_API_TOKENis correct and has the necessary scopesCheck that the token hasn't expired
Resource Not Found
Verify the
GITLAB_PROJECT_IDis correctEnsure the merge request IID exists in the project
Check that you have access to the project
Permission Denied
Verify your GitLab account has at least Reporter access to the project
Check that your API token has the
apiorread_apiscope
GitLab API Permissions
The API token needs one of the following scopes:
api- Full API access (recommended)read_api- Read-only API access (minimum required)
Additionally, your GitLab account needs at least Reporter level access to the project to view merge request information.
License
ISC
Available Tools
7 toolsget_merge_requestC
Get basic information about a merge request
| Name | Required | Description | Default |
|---|---|---|---|
| merge_request_iid | Yes | The IID (internal ID) of the merge request |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. 'Get' implies a read-only operation, but the description does not disclose return format, permissions, pagination, or confirm absence of side effects. It is not misleading, so it avoids a 1.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no wasted words and the verb/resource are front-loaded. However, it is so minimal that some conciseness comes at the cost of omitted useful context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, and 'basic information' is too vague for an agent to know what fields to expect or how this differs from get_merge_request_full. The single-parameter call is easy to invoke, but post-call interpretation is underspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents the only parameter with 100% coverage, including the meaning of 'IID'. The description adds no parameter-level detail, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get') and resource ('merge request'), and 'basic information' signals a scoped read operation. It distinguishes from get_merge_request_full only implicitly, not by name, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus siblings such as get_merge_request_full or get_merge_request_commits. The phrase 'basic information' implies a lightweight use case, but no explicit exclusions or alternatives are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_merge_request_approvalsB
Get approval status and information for a merge request
| Name | Required | Description | Default |
|---|---|---|---|
| merge_request_iid | Yes | The IID (internal ID) of the merge request |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It does communicate that this is a read-only retrieval operation via 'Get', but it does not mention response shape, pagination, authentication, or whether approvals are embedded elsewhere.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single clear sentence with no filler or repetition. It is appropriately sized for a simple one-parameter retrieval tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and the schema documents its only parameter, but there is no output schema and no mention of what the approval information includes (e.g., approvers, status, rules). The description is minimally adequate but leaves room for ambiguity about the returned data.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the only parameter, merge_request_iid, is already described in the schema. The description adds no additional meaning beyond what the schema provides, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get') and the resource ('approval status and information for a merge request'), which distinguishes it from siblings like get_merge_request_commits or get_merge_request_diffs. It is specific and not a tautology, though 'information' is a bit vague.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus siblings such as get_merge_request_full or get_merge_request. The agent must infer from the name alone that this is specifically for approvals, and it is not told whether another tool already includes approval data.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_merge_request_commitsA
Get all commits in a merge request
| Name | Required | Description | Default |
|---|---|---|---|
| merge_request_iid | Yes | The IID (internal ID) of the merge request |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It clearly signals a read-only operation with no side effects, which is useful, but it does not mention result format, ordering, pagination, or whether 'all commits' may be subject to API limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. Every word contributes to identifying the operation and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is sufficient for a simple one-parameter read operation, but it lacks usage differentiation from sibling tools and does not describe the return shape. Since there is no output schema, a brief note about the response would have made it more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the single parameter merge_request_iid is already documented as 'The IID (internal ID) of the merge request.' The tool description adds no further semantic detail, matching the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Get all commits in a merge request.' It clearly distinguishes from sibling tools like get_merge_request_diffs or get_merge_request_discussions by naming the exact entity being retrieved.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus alternatives. It does not mention that get_merge_request_diffs should be used for changed files, nor does it state any context such as needing the merge request IID from a prior call.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_merge_request_diffsA
Get all file changes and diffs in a merge request
| Name | Required | Description | Default |
|---|---|---|---|
| merge_request_iid | Yes | The IID (internal ID) of the merge request |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the behavioral disclosure burden. 'Get all file changes and diffs' clearly signals a read-only retrieval operation and the full scope of the result, which is the main behavior an agent needs to know. It does not mention pagination or auth, but for a simple read tool these are not critical.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, no redundant words, and the key resource is front-loaded. Every word contributes to the agent's understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter tool with no output schema, the description tells the agent enough to call it correctly: what input is expected and what data will come back. A short note distinguishing it from get_merge_request_full would make it complete, but the gap is minor.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents merge_request_iid as the merge request's internal ID with 100% coverage. The description adds no parameter-level detail such as required format, examples, or constraints, so it earns the schema-coverage baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get'), names the resource ('merge request'), and specifies the returned payload ('all file changes and diffs'). It reads distinctly from sibling tools such as get_merge_request_commits or get_merge_request_discussions, so an agent can identify the right tool without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool instead of siblings or mention any alternatives. The intended use case is inferable from the phrase 'file changes and diffs' and the sibling names, but no direct routing guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_merge_request_discussionsA
Get all discussions and comments on a merge request
| Name | Required | Description | Default |
|---|---|---|---|
| merge_request_iid | Yes | The IID (internal ID) of the merge request |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. 'Get' clearly signals a read-only operation, and 'all discussions and comments' indicates the scope, but the description does not disclose pagination behavior, ordering, authentication requirements, or whether resolved/outdated comments are included.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, information-dense sentence with no filler or redundant content. It front-loads the action and the resource, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple getter with one well-documented parameter and no output schema, the description is largely sufficient: it names the resource and the input. It could be more complete by noting return shape or pagination, but given the low complexity, the current coverage is strong.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the single parameter merge_request_iid is already fully described in the schema as 'The IID (internal ID) of the merge request'. The description adds no additional parameter-level meaning, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies a specific verb ('Get'), a specific resource ('discussions and comments on a merge request'), and the input context. It is readily distinguishable from sibling tools like get_merge_request_commits and get_merge_request_diffs, which target different aspects of a merge request.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool should be used when the agent needs merge request discussions or comments, but it does not explicitly state when to use it versus alternatives or mention any exclusions. With sibling tools all focused on different merge request data, the intended usage is discernible but not directly articulated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_merge_request_fullB
Get complete information about a merge request (all data in one call)
| Name | Required | Description | Default |
|---|---|---|---|
| merge_request_iid | Yes | The IID (internal ID) of the merge request |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It does disclose that the tool returns complete information in a single call, which is a meaningful behavioral trait. However, it does not describe what 'complete' includes, the response shape, or any payload/performance considerations, so transparency is adequate but shallow.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the action and resource, making it easy to scan. 'Complete information' and 'all data in one call' are slightly redundant, but there is no filler or unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity tool with one required parameter and no output schema, the description is sufficient for basic invocation. It is incomplete regarding exactly which data the 'full' response includes and how it relates to get_merge_request, which an agent would need to know to choose and trust the tool confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema fully documents the only parameter, merge_request_iid, including its type and meaning, so schema coverage is 100%. The description adds no additional parameter-level detail, which aligns with the baseline for fully covered schemas.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific operation and resource ('Get complete information about a merge request') and signals comprehensiveness with 'all data in one call', which distinguishes it from the narrower sibling endpoints for commits, diffs, discussions, etc. However, it does not explicitly clarify how 'full' differs from get_merge_request, leaving some ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'all data in one call' implies this tool is for callers who want a complete merge request without invoking multiple sibling endpoints. There is no explicit when-to-use, when-not-to-use, or named alternative guidance, so usage is only implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_merge_request_pipelinesA
Get CI/CD pipeline information for a merge request
| Name | Required | Description | Default |
|---|---|---|---|
| merge_request_iid | Yes | The IID (internal ID) of the merge request |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a read operation through 'Get' but does not disclose return format, pagination, failure behavior, or any CI/CD-specific quirks. The description adds little beyond what the tool name already conveys.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact sentence with no filler. It is front-loaded with the action and resource, making it easy to scan and parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter getter, this is minimally viable: an agent can select the tool and know the required argument. However, without an output schema or any detail about what pipeline information is returned or how it is structured, the description leaves some uncertainty about the response.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter merge_request_iid is fully documented in the input schema (100% coverage), so the schema carries the parameter meaning. The description does not add parameter-level detail, which is acceptable given the high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the specific resource ('CI/CD pipeline information') and the action ('Get') for a merge request. This distinguishes it from sibling tools like get_merge_request_commits or get_merge_request_diffs even without naming them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage context is implied by the phrase 'for a merge request' and the pipeline-specific naming, but there is no explicit guidance on when to choose this tool over the other get_merge_request_* siblings, and no exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v1.0.0- First observed
get_merge_request - First observed
get_merge_request_approvals - First observed
get_merge_request_commits - First observed
get_merge_request_diffs - First observed
get_merge_request_discussions - First observed
get_merge_request_full - First observed
get_merge_request_pipelines
TDQS
Scored across 7 tools
Each tool targets a distinct facet of a merge request (basic info, commits, diffs, discussions, approvals, pipelines, full aggregate), so there is no overlap or ambiguity between them. The 'full' tool is comprehensive but clearly distinguished as a combined superset.
All tools follow the exact same 'get_merge_request_*' pattern, making the naming highly predictable and consistent. The resource and action are clearly identified in every name.
Seven tools is a well-scoped set for a read-only merge request inspection server. Each tool covers a meaningful data aspect without adding unnecessary clutter, and the aggregate 'full' tool reduces the need for more granular additions.
The server thoroughly covers all major data dimensions of an individual merge request, including a 'full' option. The only notable gap is the absence of a list/search tool to discover merge requests, which may require external context to work with.
Maintenance
Related MCP Connectors
Code intelligence for LLMs. Analyze, search, and retrieve code from any public git repository.
GitLab MCP — wraps the GitLab REST API v4 (BYO API key)
Plan Salesforce deploys, open pull requests and trigger pipelines from your AI client.
A Model Context Protocol (MCP) application for automated GitHub PR analysis and issue management.…
Related MCP Servers
- AlicenseAqualityCmaintenanceConnects AI assistants to GitLab, allowing users to manage merge requests, view reviews, and interact with discussions through natural language queries.1225MIT
- AlicenseAqualityDmaintenanceEnables AI assistants to review GitLab merge requests by fetching changes, analyzing diffs, adding comments, and managing approvals through the GitLab API. Supports complete merge request analysis, file-specific reviews, and version comparisons.124MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to review GitLab merge requests by fetching diffs, analyzing code changes, adding comments, and managing approvals through the GitLab API. Supports comprehensive merge request analysis and version comparison for automated code review workflows.3MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI agents to interact with GitLab repositories, allowing them to manage merge requests and issues including listing projects, fetching MR details and diffs, adding comments, and updating MR titles and descriptions.28 npm94MIT