GitLab MCP Server
This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
GitLab MCP Server
MCP server that turns the GitLab REST API v4 into tools for AI clients. It targets older self-hosted GitLab instances that the official GitLab MCP server does not support, and is verified against GitLab 10.1.1 CE.
Features
157 tools covering projects, groups, members, access requests, issues, merge requests, notes, repository files and blobs, branches, protected branches, commits, tags, labels, milestones, snippets, users, SSH keys, todos, events, and instance metadata
Zero runtime dependencies — Node.js 20+ built-ins only
Read-only by default — write and delete operations require explicit environment opt-in
Bounded pagination and response size limits with structured error codes
Token safety — the token is only read from the environment, never logged, and redacted from errors; stdout carries only MCP JSON-RPC messages
Native 10.1.1 behavior — tools call real 10.1.1 endpoints only; APIs that this version does not implement are not exposed
Related MCP server: GitLab MCP Server
Requirements
Node.js 20 or later
A GitLab personal access token with the
apiscope (older GitLab versions call this a Private Token)Network access from the machine running the server to the GitLab instance
Installation
npx from this repository
{
"mcpServers": {
"gitlab": {
"command": "npx",
"args": ["-y", "--package=github:kevinclouds/gitlab-mcp#v0.1.0", "gitlab-mcp"],
"env": {
"GITLAB_URL": "https://gitlab.example.com",
"GITLAB_PRIVATE_TOKEN": "<your token>",
"GITLAB_ALLOW_WRITE": "true",
"GITLAB_ALLOW_DELETE": "true"
}
}
}
}npx downloads the repository over Git, so the machine needs Git access to GitHub. This example pins the v0.1.0 release and enables write and delete tools.
From a local checkout
export GITLAB_URL='https://gitlab.example.com'
export GITLAB_PRIVATE_TOKEN='<your token>'
node src/index.mjsConfiguration
Variable | Required | Default | Description |
| yes | — | GitLab instance root URL, without |
| yes | — | Personal access token |
| no |
| Enable create and update tools |
| no |
| Enable delete tools (also requires write) |
| no |
| Per-request timeout in milliseconds |
| no |
| Text response size limit; binary responses are limited by bytes |
The server also requires a GITLAB_URL and GITLAB_PRIVATE_TOKEN. The token is never accepted as a tool argument and never printed; error messages replace it with [REDACTED].
Pagination and output
List tools accept limit (1–100, default 20) and offset. Offset must be a multiple of limit; use the nextOffset returned in the result and keep the same limit while paging. Text results default to Markdown; pass response_format: "json" for JSON.
Tools
157 tools grouped by GitLab API domain.
Instance & Metadata (8)
Tool | Type | Description |
| Read | Get the GitLab version and revision of the target instance. |
| Read | List activity events visible to the authenticated user; filter by action, target type, or date range. |
| Read | Get notification settings of the authenticated user. |
| Read | Get notification settings of the authenticated user for a project; defaults to the global level. |
| Write | Update notification settings of the authenticated user for a project: level and per-event email switches. |
| Read | Get notification settings of the authenticated user for a group; defaults to the global level. |
| Write | Update notification settings of the authenticated user for a group: level and per-event email switches. |
| Write | Update notification settings of the authenticated user: global level, notification email, and per-event email switches. |
Projects & Namespaces (11)
Tool | Type | Description |
| Read | List projects accessible to the authenticated user with visibility, ownership, and feature filters. |
| Read | Get a project by ID or URL-encoded path, for example group%2Fproject. |
| Write | Create a project; namespace_id selects the target namespace, import_url imports a repository, and avatar accepts base64 image data. |
| Write | Update a project name, path, default branch, description, visibility, feature switches, merge settings, or avatar (base64 image data). |
| Delete | Delete a project with its repository and related resources; GitLab 10.1.1 processes deletion asynchronously, so a successful response does not mean background cleanup has finished. |
| Write | Star a project for the authenticated user. |
| Write | Unstar a project for the authenticated user. |
| Delete | Archive a project to make it read-only. |
| Write | Unarchive a project. |
| Read | List users of a project, optionally filtered by name or username. |
| Read | List namespaces available to the authenticated user, for example for creating projects. |
Groups (7)
Tool | Type | Description |
| Read | List groups accessible to the authenticated user; filter by search, ownership, and skip lists. |
| Read | Get a group by ID or URL-encoded path. |
| Read | List projects in a group with visibility, ownership, and order filters. |
| Read | List issues across projects in a group. |
| Write | Create a group; pass parent_id to create a subgroup. |
| Write | Update a group name, path, description, visibility, LFS, access request setting, or share lock. GitLab 10.1.1 resets visibility to the instance default when visibility is omitted, so pass the current visibility explicitly when the group contains projects with higher visibility. |
| Delete | Delete a group. |
Members (10)
Tool | Type | Description |
| Read | List direct members of a project with their access levels. |
| Read | Get a single project member with access level and expiry. |
| Write | Add a member to a project with an access level. |
| Write | Update a project member access level or expiry. |
| Delete | Remove a member from a project. |
| Read | List direct members of a group with their access levels. |
| Read | Get a single group member with access level and expiry. |
| Write | Add a member to a group with an access level. |
| Write | Update a group member access level or expiry. |
| Delete | Remove a member from a group. GitLab returns an empty body on success; null represents no response data, not a failure. |
Access Requests (8)
Tool | Type | Description |
| Write | Request membership in a project for the authenticated user; the project must allow access requests and the user must not already be a member. |
| Read | List pending access requests of a project. |
| Write | Approve a project access request; pass access_level to set the member role (default 30). |
| Delete | Deny and remove a project access request. |
| Write | Request membership in a group for the authenticated user; the group must allow access requests and the user must not already be a member. |
| Read | List pending access requests of a group. |
| Write | Approve a group access request; pass access_level to set the member role (default 30). |
| Delete | Deny and remove a group access request. |
Issues (17)
Tool | Type | Description |
| Read | List issues of a project with filters for state, labels, milestone, author, assignee, and dates. |
| Read | Get an issue of a project. |
| Write | Create an issue in a project. |
| Write | Update an issue title, description, state, assignees, milestone, labels, due date, or confidentiality. |
| Write | Close an issue of a project. |
| Write | Reopen a closed issue of a project. |
| Delete | Delete an issue of a project; requires project owner or admin permission. |
| Write | Move an issue to another project; requires access to both projects. |
| Read | List issues across all projects visible to the authenticated user, scope defaults to all. |
| Read | List merge requests that will close an issue when merged. |
| Read | Get time tracking statistics of an issue. |
| Write | Set the time estimate of an issue. |
| Write | Reset the time estimate of an issue. |
| Write | Record time spent on an issue. |
| Write | Reset the total time spent on an issue. |
| Write | Subscribe to issue notifications. |
| Write | Unsubscribe from issue notifications. |
Merge Requests (22)
Tool | Type | Description |
| Read | List merge requests of a project with filters for state, labels, milestone, author, assignee, and dates. |
| Read | Get a merge request of a project. |
| Write | Create a merge request from a source branch to a target branch. |
| Write | Update a merge request title, description, target branch, state, assignee, labels, milestone, source branch removal, or discussion lock. |
| Delete | Merge a merge request; the request must be in a mergeable state. Pass sha to require the current HEAD of the source branch. |
| Write | Close a merge request without merging it. |
| Write | Reopen a closed merge request. |
| Write | Cancel merge when pipeline succeeds for a merge request; the merge request must currently be in that state (GitLab 10.1.1 returns a server error otherwise). |
| Delete | Delete a merge request; requires sufficient project permissions. |
| Read | List merge requests across all projects visible to the authenticated user, scope defaults to all. |
| Read | Get the file changes of a merge request; GitLab 10.1.1 returns the merge request with its changes array inline. |
| Read | List the commits of a merge request. |
| Read | List the diff versions of a merge request, one per push. |
| Read | Get a specific diff version of a merge request. |
| Read | List issues that will close automatically when the merge request is merged. |
| Read | Get time tracking statistics of a merge request. |
| Write | Set the time estimate of a merge request. |
| Write | Reset the time estimate of a merge request. |
| Write | Record time spent on a merge request. |
| Write | Reset the total time spent on a merge request. |
| Write | Subscribe to merge request notifications. |
| Write | Unsubscribe from merge request notifications. |
Notes (10)
Tool | Type | Description |
| Write | Add a note to an issue. |
| Read | List notes of an issue. |
| Read | Get a single note of an issue. |
| Write | Update a note of an issue. |
| Delete | Delete a note of an issue. |
| Write | Add a note to a merge request. |
| Read | List notes of a merge request. |
| Read | Get a single note of a merge request. |
| Write | Update a note of a merge request. |
| Delete | Delete a note of a merge request. |
Repository Files & Blobs (10)
Tool | Type | Description |
| Read | List repository files and directories; ref selects a branch or tag, recursive lists all nested entries. |
| Read | Get file content and metadata from a repository at a given ref. |
| Read | Get raw file content from a repository as plain text. |
| Write | Create a file in a repository; start_branch creates a new branch, encoding base64 handles binary content. |
| Write | Update an existing repository file; last_commit_id guards against overwriting concurrent changes, encoding base64 handles binary content. |
| Delete | Delete a file from a repository branch. |
| Read | Download a repository archive and return it as Base64. Supported formats: tar.gz, tar, tar.bz2, tb2, tbz, tbz2, bz2, zip. |
| Read | Get a repository blob by SHA with Base64 content and metadata. |
| Read | Get raw blob bytes by SHA and return them as Base64; supports binary files. |
| Read | List repository contributors with commit counts. |
Branches & Protected Branches (8)
Tool | Type | Description |
| Read | List repository branches. |
| Read | Get a repository branch with its latest commit. |
| Write | Create a branch from a branch, tag, or commit SHA. |
| Delete | Delete a repository branch. |
| Read | List protected branches of a project. |
| Read | Get a single protected branch. |
| Write | Protect a project branch; push and merge access levels accept 0 (no access), 30 (developer), or 40 (master). |
| Delete | Remove protection from a project branch. |
Commits (8)
Tool | Type | Description |
| Read | List repository commits; ref_name selects a branch or tag, path filters by file. |
| Write | Create a commit with one or more file actions (create, create_dir, update, move, delete) on a branch; content is required for create, update, and move; start_branch creates the branch when it does not exist. |
| Read | Get a single commit with author, message, and stats. |
| Read | Get the file diffs of a commit. |
| Read | List comments of a commit. |
| Write | Add a comment to a commit; pass path, line, and line_type to comment on a specific diff line. |
| Write | Cherry-pick a commit onto a target branch; the branch must exist and the change must apply cleanly. |
| Read | Compare two branches, tags, or commit SHAs and return commits and file diffs. |
Tags (4)
Tool | Type | Description |
| Read | List repository tags. |
| Read | Get a single repository tag. |
| Write | Create a tag from a branch, tag, or commit SHA; message creates an annotated tag and release_description stores release notes. |
| Delete | Delete a repository tag. |
Labels (4)
Tool | Type | Description |
| Read | List labels of a project. |
| Write | Create a project label. |
| Write | Update a project label; name identifies the label and new_name renames it. |
| Delete | Delete a project label by name. |
Milestones (12)
Tool | Type | Description |
| Read | List milestones of a project; filter by state, IIDs, or search text. |
| Read | Get a single project milestone. |
| Write | Create a project milestone. |
| Write | Update a project milestone; state_event closes or activates it. |
| Read | List milestones of a group; filter by state, IIDs, or search text. |
| Read | Get a single group milestone. |
| Write | Create a group milestone. |
| Write | Update a group milestone; state_event closes or activates it. |
| Read | List issues assigned to a project milestone. |
| Read | List merge requests assigned to a project milestone. |
| Read | List issues assigned to a group milestone. |
| Read | List merge requests assigned to a group milestone. |
Snippets (6)
Tool | Type | Description |
| Read | List snippets of a project. |
| Read | Get a single project snippet. |
| Read | Get the raw content of a project snippet as plain text. |
| Write | Create a project snippet; visibility is required in GitLab 10.1.1. |
| Write | Update a project snippet; the API requires at least one of title, file_name, or code to be provided. |
| Delete | Delete a project snippet. |
Users & SSH Keys (7)
Tool | Type | Description |
| Read | Get the authenticated GitLab user. |
| Read | Get a GitLab user by ID. |
| Read | List GitLab users; filter by username, search, state flags, or creation date. |
| Read | List SSH keys of the authenticated user. |
| Read | Get an SSH key of the authenticated user by ID. |
| Write | Add an SSH key to the authenticated user. |
| Delete | Delete an SSH key of the authenticated user. |
Todos (5)
Tool | Type | Description |
| Read | List todos of the authenticated user. |
| Write | Add a Issue to the todo list of the authenticated user; returns unchanged when a todo already exists. |
| Write | Add a MR to the todo list of the authenticated user; returns unchanged when a todo already exists. |
| Write | Mark a todo as done; this does not close the related issue or merge request. |
| Write | Mark all todos of the authenticated user as done; this does not close the related issues or merge requests. |
Security
All tools are read-only until
GITLAB_ALLOW_WRITE=trueis set. Deletes additionally requireGITLAB_ALLOW_DELETE=true. These switches only gate tool availability; they never grant permissions beyond those of the configured token.The token is read from
GITLAB_PRIVATE_TOKENonly. It is not accepted as a tool argument, not written to logs, and replaced with[REDACTED]in error messages.Responses that exceed
GITLAB_MAX_RESPONSE_CHARSare cut off with an explicit truncation notice; oversized streaming responses are aborted while reading.See SECURITY.md for reporting.
Project Structure
src/
├── index.mjs # stdio entry point: wiring only
├── version.mjs # server name and version
├── server/ # MCP protocol layer
│ ├── server.mjs # initialize / tools/list / tools/call dispatch
│ ├── protocol.mjs # newline-delimited JSON-RPC over stdio
│ └── schemas.mjs # argument validation
├── core/ # GitLab integration
│ ├── client.mjs # REST client: auth, timeout, pagination, size limits
│ ├── config.mjs # environment configuration
│ ├── constants.mjs # protocol and API constants
│ ├── errors.mjs # error types and token redaction
│ ├── formatters.mjs # markdown / json / text output
│ └── guard.mjs # read / write / delete permission checks
└── tools/ # one module per GitLab API domain
├── shared.mjs # tool helpers (schemas, pagination, registration)
├── registry.mjs # tool registry
└── <domain>.mjs # projects, groups, issues, merge-requests, ...Development
npm run build # syntax-check every source file
npm start # start the stdio serverThe MCP server communicates over stdio, so it is normally launched by an MCP client rather than run by hand.
Compatibility
Built and verified against GitLab 10.1.1 CE. Tools map one-to-one to endpoints that this version implements; features introduced in later GitLab versions (for example merge request approvals, deploy tokens, or protected tags) are not exposed as tools. The server does not retry failed writes automatically.
License
This server cannot be deployed
Maintenance
Related MCP Connectors
Read and write KukGit repositories, files, issues and pull requests from an AI assistant.
Operate GitHub from your AI assistant: repos, PRs, issues, Actions. Previews and read-only mode.
Access the GitHub API, enabling file operations, repository management, search functionality, and…
Read-only AI coding tools for change verification, release readiness, capacity, and guidance.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables project management and repository operations on GitLab through the GitLab API, including file operations, branch management, issue creation, merge requests, and repository forking with support for both GitLab.com and self-hosted instances.5,398 npmApache 2.0
- AlicenseNot gradedqualityCmaintenanceEnables AI assistants to interact with GitLab by wrapping the REST API v4 into executable tools for repository and branch management. It supports operations like creating projects, managing branches, and retrieving user information through the Model Context Protocol.6 npm1ISC
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to interact with GitLab for managing projects, branches, issues, and merge requests. It provides tools for searching code and performing file operations like reading and writing directly within repositories.10 npmMIT
- AlicenseCqualityDmaintenanceEnables AI agents to interact with GitLab repositories, issues, merge requests, pipelines, wikis, milestones, and more through the GitLab API.11519 npmMIT