The supplied sources describe a non-official GitLab MCP server maintained by zereight, version 2.1.43, under the MIT license. It provides broad GitLab administration, collaboration, code, and CI/CD coverage. Users should restrict token scopes and exposed tools to the actual workflow and configure appropriate HTTP authentication and security controls for remote deployments.
Strongest · Documentation 16/20 Weakest · Reliability 9/20
Static review · not runListed 2026-07-29
Read the FMRS scoring method →Runtime：Node.js · Docker · Prebuilt binary · Hosted (no local runtime)
GITLAB_PERSONAL_ACCESS_TOKEN
GitLab personal access token created in GitLab user settings → Access Tokens with scopes such as api or read_api.
GITLAB_JOB_TOKEN
Optional GitLab CI job token used instead of a PAT when running inside GitLab CI.
SSE_AUTH_TOKEN
Authentication token for MCP clients over SSE transport.
GITLAB_API_URL
GitLab API base URL — https://gitlab.com/api/v4 for GitLab.com or your self-managed instance URL.
GITLAB_AUTH_COOKIE_PATH
Optional path to a GitLab auth cookie file for cookie-based authentication.
GITLAB_ALLOWED_PROJECT_IDS
Optional comma-separated list of project IDs the server is allowed to access.
GITLAB_READ_ONLY_MODE
Set to true to expose only read-only tools and block write operations.
USE_GITLAB_WIKI
Set to true to enable wiki tools (legacy flag; prefer GITLAB_TOOLSETS=wiki).
GITLAB_TOOLSETS
Optional comma-separated toolset list such as projects, issues, merge_requests, pipelines, wiki.
GITLAB_TOOLS
Optional comma-separated individual tool names enabled on top of toolsets.
GITLAB_DENIED_TOOLS_REGEX
Optional regex used to hide matching tools from the server.
GITLAB_TOOL_POLICY_APPROVE
Optional comma-separated tool names requiring explicit approval before execution.
GITLAB_TOOL_POLICY_HIDDEN
Optional comma-separated tool names hidden from tools/list.
NODE_TLS_REJECT_UNAUTHORIZED
Set to 0 only when connecting to a GitLab instance with invalid or self-signed TLS certificates.
GITLAB_CA_CERT_PATH
Optional custom CA certificate file path for self-managed GitLab instances.
GITLAB_PERMISSION_MODE
Permission level: readonly, modify (no delete tools), or full.
GITLAB_USE_OAUTH
Set to true to enable the local browser OAuth2 flow.
GITLAB_OAUTH_CLIENT_ID
Client ID of the GitLab OAuth application used for local OAuth.
GITLAB_OAUTH_REDIRECT_URI
Local OAuth callback URL, e.g. http://127.0.0.1:8888/callback.
GITLAB_MCP_OAUTH
Set to true so the server acts as an MCP OAuth proxy for remote clients like Claude.ai.
GITLAB_OAUTH_APP_ID
Client ID of a pre-registered GitLab OAuth application.
GITLAB_OAUTH_CALLBACK_PROXY
Set to true to use the server's fixed /callback URL as the OAuth callback.
GITLAB_OAUTH_SCOPES
Comma-separated OAuth scopes to request; defaults to api,read_api,read_user.
MCP_SERVER_URL
Public HTTPS URL of the MCP server, used for OAuth and Host checks.
STREAMABLE_HTTP
Set to true to enable Streamable HTTP transport.
REMOTE_AUTHORIZATION
Set to true for multi-user remote authorization where each caller supplies their own GitLab token in HTTP headers.
GITLAB_DISABLE_VERSION_CHECK
Set to true to disable the startup new-version notice.
SSE
Set to true to enable SSE transport.
Install @zereight/mcp-gitlab with npm or use the Homebrew method shown in the repository documentation. Set GITLAB_PERSONAL_ACCESS_TOKEN to a token with the GitLab scopes required by the tools you will use, and set GITLAB_API_URL when needed. Configure the MCP client to launch zereight-mcp-gitlab over stdio. For remote deployments, SSE or Streamable HTTP can be used; REMOTE_AUTHORIZATION requires Streamable HTTP.
{"mcpServers":{"gitlab":{"command":"zereight-mcp-gitlab","args":[],"env":{"GITLAB_PERSONAL_ACCESS_TOKEN":"YOUR_GITLAB_TOKEN","GITLAB_API_URL":"https://gitlab.com/api/v4"}}}}
Shown for Claude Code. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.
{
"servers": {
"gitlab": {
"command": "zereight-mcp-gitlab",
"args": [],
"env": {
"GITLAB_PERSONAL_ACCESS_TOKEN": "YOUR_GITLAB_TOKEN",
"GITLAB_API_URL": "https://gitlab.com/api/v4"
}
}
}
}
Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).
claude mcp add gitlab -e GITLAB_PERSONAL_ACCESS_TOKEN=YOUR_GITLAB_TOKEN -e GITLAB_API_URL=https://gitlab.com/api/v4 -- zereight-mcp-gitlab
Run it in a terminal; replace any <…> placeholders with your own values first.
The client's tool list should show the gitlab server's tools (e.g. get_project, list_issues, health_check); calling health_check confirms authentication succeeded and reports the GitLab instance version.
Once connected, you can ask your AI assistant things like:
No matching tools
Listed from the project's documentation, not tested by this site.
A GitLab MCP server that exposes project management, repository browsing, merge requests, issues, pipelines, wiki, releases, tags, milestones, users, groups, work items, webhooks, variables, dependency proxy, and vulnerability operations through MCP. It supports stdio, SSE, and Streamable HTTP for GitLab.com and self-managed GitLab.
Upstash's official server providing up-to-date third-party library docs for AI coding assistants
AI-powered NPM package analysis MCP server
An independent control layer that gives AI coding agents budgets, brakes, and receipts
GitHub's official MCP server for managing repos, issues, PRs, and workflows via natural language
Source revision 9569a836d64c Data synced 2026-10-19 Read the FMRS scoring method