GitLab MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SSE | No | Set to true to enable SSE transport. | |
| HOST | No | Host interface the server should bind to, for example 0.0.0.0. | |
| PORT | No | Port the server should listen on. | |
| GITLAB_TOOLS | No | Comma-separated allow-list of individual GitLab tools. | |
| MAX_SESSIONS | No | Maximum number of concurrent sessions. | 1000 |
| USE_PIPELINE | No | Legacy flag to enable pipeline API. Prefer GITLAB_TOOLSETS=pipelines. | |
| USE_MILESTONE | No | Legacy flag to enable milestone API. Prefer GITLAB_TOOLSETS=milestones. | |
| GITLAB_API_URL | No | GitLab API base URL, for example https://gitlab.com/api/v4. | |
| MCP_SERVER_URL | No | Public HTTPS URL of this MCP server; required for MCP OAuth and used for host/origin checks. | |
| SSE_AUTH_TOKEN | No | Bearer token expected by the SSE endpoint when SSE transport is enabled. | |
| GITLAB_TOOLSETS | No | Comma-separated toolset groups to enable, for example wiki,milestones,pipelines. | |
| MCP_SERVER_NAME | No | Distinct server name for multiple side-by-side deployments. | |
| MCP_TRUST_PROXY | No | Set to true when behind a trusted reverse proxy to trust Forwarded and X-Forwarded-* headers. | |
| STREAMABLE_HTTP | No | Set to true to enable Streamable HTTP transport. Required for REMOTE_AUTHORIZATION and GITLAB_MCP_OAUTH. | |
| USE_GITLAB_WIKI | No | Legacy flag to enable wiki API. Prefer GITLAB_TOOLSETS=wiki. | |
| GITLAB_JOB_TOKEN | No | GitLab CI job token credential. | |
| GITLAB_MCP_OAUTH | No | Set to true to enable remote MCP OAuth proxy authentication. | |
| GITLAB_USE_OAUTH | No | Set to true to enable local OAuth2 browser authentication. | |
| MCP_ALLOWED_HOSTS | No | Allowed Host header values for /mcp to protect against DNS rebinding. | |
| GITLAB_OAUTH_APP_ID | No | Client ID of the pre-registered GitLab OAuth application for MCP OAuth. | |
| GITLAB_OAUTH_SCOPES | No | Comma-separated GitLab OAuth scopes to request. | |
| MCP_ALLOWED_ORIGINS | No | Allowed Origin header values for /mcp. | |
| GITLAB_ALLOWED_HOSTS | No | Comma-separated allowed hosts for X-GitLab-API-URL when dynamic API URL is enabled. | |
| OAUTH_STATELESS_MODE | No | Set to true to enable stateless OAuth mode for multi-pod HPA deployments. | |
| REMOTE_AUTHORIZATION | No | Set to true to enable per-request remote GitLab authorization for multi-user HTTP deployments. | |
| GITLAB_READ_ONLY_MODE | No | Legacy read-only mode flag. Prefer GITLAB_PERMISSION_MODE=readonly. | |
| ENABLE_DYNAMIC_API_URL | No | Set to true to allow per-request GitLab API URL via the X-GitLab-API-URL header. | |
| GITLAB_OAUTH_CLIENT_ID | No | OAuth application client ID for local OAuth2 authentication. | |
| GITLAB_PERMISSION_MODE | No | Permission level: readonly, modify, or full. | full |
| OAUTH_STATELESS_SECRET | No | Shared secret used across all pods in stateless OAuth mode. | |
| GITLAB_AUTH_COOKIE_PATH | No | Path to a GitLab authentication cookie file. | |
| MAX_REQUESTS_PER_MINUTE | No | Rate limit for /mcp requests per client IP and per MCP session where applicable. | 60 |
| SESSION_TIMEOUT_SECONDS | No | Inactivity timeout for stored session authorization tokens. | 3600 |
| GITLAB_DENIED_TOOLS_REGEX | No | Regex pattern for tools to deny. | |
| GITLAB_OAUTH_REDIRECT_URI | No | Local OAuth callback URI, for example http://127.0.0.1:8888/callback. | |
| STREAMABLE_HTTP_AUTH_TOKEN | No | Authentication token for Streamable HTTP when not using REMOTE_AUTHORIZATION or GITLAB_MCP_OAUTH. | |
| GITLAB_OAUTH_ALLOWED_GROUPS | No | Comma-separated group full paths allowed to obtain a token in MCP OAuth mode. | |
| GITLAB_OAUTH_CALLBACK_PROXY | No | Set to true to use the MCP server's fixed /callback URL for remote MCP OAuth. | |
| GITLAB_DISABLE_VERSION_CHECK | No | Set to true to disable the startup new-version notice. | |
| GITLAB_PERSONAL_ACCESS_TOKEN | No | GitLab Personal Access Token used for PAT authentication. | |
| MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL | No | Set to true only for local HTTP development to allow an insecure issuer URL. | |
| GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY | No | Set to true to allow unauthenticated initialize and tools/list requests in remote authorization mode. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
This server cannot be deployed
Maintenance
ActivityInactive
ResponsivenessNo issues