Skip to main content
Glama

GitLab MCP Server

GitHub Release npm PyPI NuGet License: MIT Platform CI Quality Gate Coverage Go Reference

Glama MCP Score

MCP Badge MCP Toplist Cursor Directory Hosted endpoint

All of GitLab for your AI assistant. Up to 1,098 actions over GitLab's REST and GraphQL APIs, from Free to Ultimate and on GitLab.com, in one self-contained binary that works with Claude, Cursor, VS Code, Codex and any other MCP client. You ask in plain language; it does the GitLab work.

11,343 tokens of startup context by default, the same on every GitLab tier (1,941 with GITLAB_MCP_CAPABILITY_SURFACE=minimal). Two tools reach the whole catalog, where listing every tool as its own costs from 575,259 to 732,207 tokens. Measured with the cl100k_base tokenizer and checked in CI. How it is measured

"Review merge request !15: is it safe to merge?" · "Why did the last pipeline fail?" · "List open issues assigned to me" · "Generate release notes from v1.0 to v2.0"

Why this server

  • Every tier and every instance. Free/CE, Premium and Ultimate, self-managed or GitLab.com with its Orbit knowledge graph. The tier is detected and the catalog follows it.

  • The token you already have. A personal, project or group access token with api, or read_api for the actions GitLab accepts from it; a fine-grained token, judged action by action from its grant; OAuth in HTTP mode. Each action's tool reference entry says which scope and which fine-grained permissions it needs.

  • Guard rails. Read-only mode, safe mode (a preview of each write instead of the write), tools excluded by name, and a confirmation before anything destructive.

  • Three surfaces, two transports. Two discovery tools by default, one tool per domain or one per action; stdio for a desktop client, or HTTP for a shared deployment that keeps each credential apart. 45 resources and 37 prompts besides.

  • Releases you can verify. Signed checksums, an SBOM per binary and build provenance for every artifact.

Related MCP server: GitLab MCP Server

Install

The buttons register the Docker image, so they need Docker; the Claude Desktop row downloads a native extension instead. Create a personal access token with the api scope (or read_api for the actions GitLab accepts from it; add GITLAB_MCP_READ_ONLY=true when nothing may be written).

Claude Code. The registration command never carries the token: -e GITLAB_TOKEN forwards it from the environment Claude Code hands docker.

export GITLAB_TOKEN=glpat-xxxx
claude mcp add gitlab --transport stdio \
  -- docker run -i --rm -e GITLAB_TOKEN ghcr.io/jmrplens/gitlab-mcp-server:latest

Any other client runs one of these as the server's command, with GITLAB_TOKEN in the environment it passes:

npx -y @jmrp.io/gitlab-mcp-server                   # npm, nothing installed first
uvx jmrplens-gitlab-mcp-server                      # PyPI, nothing installed first
dnx gitlab-mcp-server                               # NuGet (.NET 10 SDK), nothing installed first
brew install jmrplens/tap/gitlab-mcp-server         # Homebrew, macOS and Linux
winget install --id jmrplens.gitlab-mcp-server -e   # winget, Windows
docker run -i --rm -e GITLAB_TOKEN ghcr.io/jmrplens/gitlab-mcp-server:latest

For a self-managed instance, set GITLAB_URL=https://gitlab.example.com beside the token; with the Docker image, also forward it by adding -e GITLAB_URL to the docker arguments, since the container receives only the variables named there (Docker install). Every channel, per-client configuration and verification step is in the installation guide, and an assistant installing it for you will find the same in llms.txt.

To try it first, a public instance runs at https://mcp.jmrp.io/gitlab, and the browser inspector calls it read-only after an OAuth sign-in. Your token and every request pass through that machine, so run it yourself to keep using it; the hosted endpoint page says what it is and is not.

Documentation

Everything else is at docs.jmrp.io/gitlab-mcp-server, in English and Spanish: getting started, configuration, tool surfaces, HTTP server mode, security, privacy and troubleshooting.

Contributing, security and licence

Contributions are welcome here on GitHub; CONTRIBUTING.md describes the workflow, and CODE_OF_CONDUCT.md applies. Report a vulnerability privately, as SECURITY.md describes. The server is MIT licensed (LICENSE).


Maintained by José M. Requena Plens · Project page · Hosted instance: mcp.jmrp.io/gitlab

Available Tools

2 tools
gitlab_execute_actionGitLab Execute ActionA
Destructive
Inspect

Execute one GitLab catalog action by canonical ID or alias. Always pass params as an object. Destructive actions require top-level confirm=true. Use find first only when action or params are unclear.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesCanonical action ID returned by gitlab_find_action, or a supported compatibility alias, such as project.list, issue.update, or issue.close.
paramsYesRequired action-specific parameters object validated by the selected action schema. Use an empty object for actions with no parameters.
confirmNoSet top-level confirm=true to explicitly approve destructive actions. Do not put confirm inside params for gitlab_execute_action.

Output Schema

ParametersJSON Schema
NameRequiredDescription
next_stepsNoOptional. Suggested follow-up actions or tool calls for the LLM, contextual to the result.
paginationNoPresent on list actions. Use `has_more` and `next_page` to paginate through results.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveHint=true and readOnlyHint=false, but the description adds an important behavioral requirement: destructive actions require top-level confirm=true. It also signals that the tool is general-purpose by saying 'one GitLab catalog action,' which helps set expectations versus a specialized tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences: the first states the core function, the second gives a required parameter convention, and the third gives the key safety and routing rule. Every sentence contributes new, actionable information with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a generic action-executor with an open-world catalog, the description provides full operational context: how to identify actions, how to pass parameters, how to handle destructive actions, and when to fall back to the sibling discovery tool. The output schema covers return-value expectations, so nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents action, params, and confirm with clear descriptions. The description mostly restates these constraints ('Always pass params as an object', confirm requirement) rather than adding new parameter semantics, but it does reinforce the canonical-vs-alias action concept.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Execute one GitLab catalog action by canonical ID or alias.' It also names the sibling relationship indirectly by saying to use find first when actions are unclear, which distinguishes this execution tool from gitlab_find_action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage rules: pass params as an object, set top-level confirm=true for destructive actions, and use find first only when action or params are unclear. This gives an agent clear decision criteria for when to call this tool versus gitlab_find_action.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gitlab_find_actionGitLab Find ActionA
Read-onlyIdempotent
Inspect

Search the local GitLab action catalog. Read-only and no GitLab API call. Use when the action ID or params are unclear. Returns schemas, hints, destructive flags, and execute examples.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of matches to return. Defaults to 20 and is capped at 50.
queryYesSearch terms combining a GitLab domain or resource with a verb, filter, or object name, such as project create, merge request approve, pipeline retry, issue delete, or ci variable. At most 256 characters: a longer query is refused, not truncated.
explainNoWhen true, include deterministic scoring reasons for each returned action. Defaults to false to keep responses compact.

Output Schema

ParametersJSON Schema
NameRequiredDescription
countYesNumber of returned matches.
queryYesOriginal search query.
resultsYesMatching GitLab catalog actions with schemas and execute examples.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint, but the description adds valuable behavioral detail beyond that: it states 'no GitLab API call' (a specific limitation not in the annotations) and describes what the tool returns ('schemas, hints, destructive flags, and execute examples'). This gives the agent a concrete understanding of the tool's behavior and output without contradicting any annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact—three sentences, each serving a distinct purpose: the first states the core function and read-only nature, the second gives the use case trigger, and the third lists return content. It is front-loaded with the most important information and contains no filler or redundant details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (read-only, no API call, no side effects) and the presence of an output schema that covers return structure, the description fully equips an agent: it knows what the tool does, when to invoke it, and what to expect back. Nothing essential is missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and each parameter is already well-documented in the input schema, including examples for query. The description does not add any additional meaning beyond the schema; it just restates the query pattern. Per the rubric, baseline 3 is appropriate when the schema carries the full parameter documentation burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action (search) and resource (local GitLab action catalog), and explicitly notes it is read-only and makes no API call. It distinguishes itself from the sibling gitlab_execute_action by implying this tool is for lookup when the action ID or params are unclear, so an agent can easily tell them apart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit trigger: 'Use when the action ID or params are unclear.' This clearly indicates when to use the tool, and implicitly that if you have the action ID you would use the execute sibling instead. It stops short of naming the sibling or giving an explicit 'when not to use' rule, but the guidance is clear enough for most cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv3.0.0
    • Changedgitlab_execute_action1 field changed
      • changedInput schema / properties / confirm / description
        Previous value: -"Set top-level confirm=true to explicitly approve destructive actions; do not put confirm inside params for gitlab_execute_action."New value: +"Set top-level confirm=true to explicitly approve destructive actions. Do not put confirm inside params for gitlab_execute_action."
    • Changedgitlab_find_action2 fields changed
      • changedInput schema / properties / query / description
        Previous value: -"Search terms combining a GitLab domain or resource with a verb, filter, or object name, such as project create, merge request approve, pipeline retry, issue delete, or ci variable."New value: +"Search terms combining a GitLab domain or resource with a verb, filter, or object name, such as project create, merge request approve, pipeline retry, issue delete, or ci variable. At most 256 characters: a longer query is refused, not truncated."
      • addedInput schema / properties / query / maxLength
        Added value: +256
  2. 1 tool updatev2.7.5
    • Changedgitlab_execute_action1 field changed
      • changedInput schema / properties / action / x-mcp-header
        Previous value: -"Mcp-Param-Action"New value: +"Action"
  3. 1 tool updatev2.6.0
    • Addedgitlab_execute_action
  4. 1 tool updatev2.5.2
    • Removedgitlab_execute_action
  5. 3 tool updatesv2.1.3
    • Addedgitlab_execute_action
    • Removedgitlab_execute_tool
    • Changedgitlab_find_action4 fields changed
      • changedOutput schema / properties / results / items / properties / example / description
        Previous value: -"Example gitlab_execute_tool call."New value: +"Example gitlab_execute_action call."
      • changedOutput schema / properties / results / items / properties / example / properties / arguments / description
        Previous value: -"Example arguments for gitlab_execute_tool."New value: +"Example arguments for gitlab_execute_action."
      • changedOutput schema / properties / results / items / properties / id / description
        Previous value: -"Canonical action ID to pass to gitlab_execute_tool."New value: +"Canonical action ID to pass to gitlab_execute_action."
      • changedOutput schema / properties / results / items / properties / required_params / description
        Previous value: -"Required parameter names captured from the input schema."New value: +"Required action-specific parameter names to place inside gitlab_execute_action params."

TDQS

A4.5/5.0

Scored across 2 tools

Disambiguation5/5

gitlab_execute_action and gitlab_find_action have clearly distinct roles: one executes catalog actions, the other searches the local catalog without making API calls. There is no meaningful overlap or ambiguity between them.

Naming Consistency5/5

Both tools follow the same gitlab_<verb>_action pattern, creating a predictable and consistent naming convention. The verb prefixes accurately indicate the operation type.

Tool Count3/5

Two tools is a minimal surface and feels thin for a GitLab server, even though the find/execute split is functional. The generic executor and catalog search reduce the impact, but the count is still borderline.

Completeness5/5

The two tools form a complete discovery-and-execution loop: find_action provides schemas, hints, and examples, while execute_action runs the selected action. Assuming the underlying catalog covers the needed GitLab operations, there are no obvious dead ends.

Maintenance

ActivityActive
ResponsivenessResponsive

Related MCP Connectors

Related MCP Servers

  • -
    license
    Not graded
    quality
    Not graded
    maintenance
    A Model Context Protocol server that enables AI assistants to interact with GitLab repositories, allowing tasks like managing merge requests, searching projects, and creating comments through RESTful API integration.
    12 npm
    2
    -
  • A
    license
    B
    quality
    C
    maintenance
    A Model Context Protocol (MCP) server for GitLab and Jira integration. This server allows AI agents like gemini-cli to interact with your GitLab and Jira instances.
    32
    15 npm
    11
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Full-coverage GitLab MCP server with 44 tools across 18 resource types. Agent-optimized CQRS design — one tool call handles complete multi-step operations. Supports OAuth 2.1, read-only mode, stdio/SSE/StreamableHTTP transports, and GraphQL-native work items with full hierarchy (epics,issues,etc)
    1,922 npm
    8
    Apache 2.0