SkillFoxx

Type a name, a task or a service

GitLab MCP Server

An MCP server for GitLab and self-hosted instances: projects, merge requests, issues, pipelines, wiki and releases

MCP serverEditors’ pickHigh risk

zereight/gitlab-mcpAuthor: zereight

Install

npm install -g @zereight/mcp-gitlab

Or brew install zereight/gitlab-mcp/zereight-mcp-gitlab after brew tap.

This is third-party code. Review the repository files before installing.

What it does

The server connects the agent to GitLab through its API and exposes hundreds of granular tools for projects, merge requests, issues, pipelines, wiki, tags, releases and milestones. MR review uses a two-step flow: list changed files first, then fetch diffs in batches. Tools can be narrowed by group, allow-list or regex, and the readonly and modify modes block writes or deletes. The repository also ships a skill with workflow guidance.

Who it is for. For teams on GitLab.com or a self-hosted GitLab who want to handle MRs, issues and CI through an agent.

Good fit when

  • You need to review a merge request diff
  • You need to find out why a pipeline failed
  • You need to create and update issues on a corporate GitLab

Not a fit when

  • Your code lives on GitHub or another platform
  • Company policy forbids giving tokens to third-party tools

Example request

Review MR !42 in backend/api and leave comments on the changed files

Limitations

Requires a Personal Access Token or a GitLab OAuth app. The default mode is full, including deletes, so set GITLAB_PERMISSION_MODE=readonly or modify. GITLAB_API_URL must point to /api/v4, not the site root. GitLab.com access from Russia can be unreliable; a self-hosted instance has no such issue. Not an official GitLab project.

How to disable. Run claude mcp remove gitlab or delete the gitlab block from the MCP config. Revoke the token in GitLab settings.

MCP

Transport
stdio, sse, http
Authentication
API key
Environment variables
GITLAB_PERSONAL_ACCESS_TOKEN
required, secret		GitLab Personal Access Token unless OAuth is used.
GITLAB_API_URL
API address, for example https://gitlab.com/api/v4.
GITLAB_PERMISSION_MODE
readonly, modify or full (default).
GITLAB_USE_OAUTH
Enables local browser OAuth instead of a token.

Security check

  • Writes to repositories, MRs and issues and can delete data in full mode
  • Uses a GitLab access token

README in short

The README covers four auth options: PAT, local browser OAuth, an OAuth proxy for remote clients and per-request authorization. The server installs via Homebrew, npm or Nix and runs over stdio, SSE and Streamable HTTP, including from a Docker image. Separate guides cover Claude Code, VS Code, Copilot, Codex and Cursor; tool filters and environment variables are documented on the docs site. MIT licensed.

FAQ

Does it work with self-hosted GitLab?

Yes, set GITLAB_API_URL to your instance address ending in /api/v4.

How do I block deletes?

GITLAB_PERMISSION_MODE=modify keeps create and update but removes every delete tool. readonly blocks writes entirely.

Editors’ pick

A skills library that gives coding agents a development process: brainstorming, planning, TDD, subagents and code review

PluginMedium risk286.6K
Editors’ pick

Small composable skills for engineering with agents: plan grilling, TDD, bug diagnosis, code review and architecture

SkillLow risk262K

Reference MCP servers

Model Context Protocol servers

Editors’ pick

Official reference MCP servers: Filesystem, Fetch, Git, Memory, Sequential Thinking, Time and Everything

MCP serverMedium risk90.3K
Editors’ pick

Up-to-date, version-specific library docs and code examples in your agent's context, via MCP or a CLI plus skill

MCP serverMedium risk62K