GitLab MCP Server
GitLab project, issue, and merge request management via Model Context Protocol.
Data last scanned today · Reviewed today
Overview
This TypeScript-based MCP server allows AI assistants to interact directly with GitLab instances. It provides comprehensive capabilities for managing development workflows, including listing projects, handling issues, and performing complex merge request operations such as threaded discussions and review management. Beyond basic task management, the server supports advanced pipeline and job control, including the ability to trigger, cancel, or retry pipelines and fetch job logs. It is compatible with both public GitLab and self-hosted instances by configuring a custom base URL.
Our verdict
This server carries a high risk level with a security score of 29/100. It lacks read-only mode, meaning every installation is granted full write access to your GitLab resources. Given that it is a community-maintained project not reviewed by GitLab, users should exercise extreme caution and consider the implications of providing full write-access tokens to their AI models.
- Comprehensive merge request and review workflow support.
- Native support for self-hosted GitLab instances.
- Minimal supply chain footprint with only three dependencies.
- Fully typed TypeScript implementation with detailed documentation.
- No read-only mode available for safer integration.
- High risk score due to lack of OAuth support.
- Community-maintained without official vendor oversight.
- Low bus factor with only three contributors.
Setup
{
"mcpServers": {
"gitlab-mcp-server": {
"args": [
"-y",
"@alosies/gitlab-mcp-server"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| list_projects | List GitLab projects with minimal info by default. | low |
| get_project | Get detailed information about a specific project. | low |
| list_issues | List issues in a project. | low |
| get_issue | Get detailed information about a specific issue. | low |
| create_issue | Create a new issue. | medium |
| list_merge_requests | List merge requests in a project. | low |
| get_merge_request | Get detailed information about a specific merge request. | low |
| get_merge_request_diffs | Get the changes/diffs of a merge request. | low |
| list_merge_request_diffs | List merge request diffs with pagination support. | low |
| get_branch_diffs | Get the changes/diffs between two branches or commits. | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›What permissions are required for the GitLab Personal Access Token?
You must create a token with the api, read_user, and read_repository scopes enabled.
›Can this server be used with self-hosted GitLab instances?
Yes, you can configure the server for a self-hosted instance by adding the GITLAB_BASE_URL environment variable to your configuration.
›How do I configure the server for Claude Desktop?
Add the server to your claude_desktop_config.json file using the npx command, providing your GitLab token via the NPM_CONFIG_TOKEN environment variable.
Badge
Maintain this server? Add the live badge to your README.