scan_gitlab
Read GitLab projects, issues, and merge requests to detect leaked secrets. Returns redacted findings without modifying your repositories.
Instructions
Read GitLab project code, issues, and merge requests to detect leaked secrets. Never modifies GitLab — no commits, comments, or MRs are created. Auth: requires a personal access token with read_api scope; set GITLAB_TOKEN env var or pass api_key directly. Side effects: a redacted scan report is uploaded to the n0s1 backend; set allow_secret_upload=True to also upload AES-encrypted secret values for AI validation. Returns redacted findings — raw secret values are never included in the output. Subject to GitLab API rate limits.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | Yes | GitLab personal access token with read_api scope (or set GITLAB_TOKEN env var) | |
| server | No | GitLab server URL (default: https://gitlab.com or GITLAB_URL env var) | |
| owner | Yes | GitLab group or user name | |
| repo | No | Project name (optional — omit to scan all projects for owner) | |
| branch | No | Branch to scan (optional — defaults to default branch) | |
| report_format | No | Output report format | n0s1 |
| show_matched_secret_on_logs | No | Include redacted secret snippets in logs (default: false) | |
| ai_analysis | No | Queue async AI credential validation after the scan (requires n0s1 Pro) | |
| n0s1_api_key | No | n0s1 API key; overrides the N0S1_TOKEN env var | |
| allow_secret_upload | No | Upload AES-encrypted secret values to the n0s1 backend for AI validation (default: false) | |
| report_uuid | No | UUID to assign to the scan report; overrides the auto-generated one |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| report_uuid | Yes | ||
| status | Yes | ||
| summary | Yes | ||
| findings | No | ||
| next_cursor | No | ||
| usage | Yes | ||
| ai_analysis_status | No |