Gitlab Mr Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Gitlab Mr Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Connect your AI assistant to GitLab. Ask questions like _"List open merge requests"_, _"Show me reviews for MR #123"_, _"Get commit discussions for MR #456"_, or _"Find merge requests for the feature branch"_ directly in your chat.
# Using pipx (recommended)
pipx install gitlab-mr-mcp
# Or using uv
uv tool install gitlab-mr-mcp
# Or using pip
pip install gitlab-mr-mcpNote: Usingpipxoruv toolis recommended as they automatically add thegitlab-mcpcommand to your PATH. If usingpip install, ensure your Python scripts directory is in PATH, or use the full path to the command.
api scope if you want write access)#### Multi-Project Setup (Recommended)
For working with multiple GitLab projects, add to your global MCP config (~/.cursor/mcp.json for Cursor):
{
"mcpServers": {
"gitlab-mcp": {
"command": "gitlab-mcp",
"env": {
"GITLAB_URL": "https://gitlab.com",
"GITLAB_ACCESS_TOKEN": "glpat-xxxxxxxxxxxxxxxxxxxx"
}
}
}
}This single configuration works across all your projects. Use search_projects or list_my_projects to find project IDs, then specify project_id in your requests.
#### Single-Project Setup
For working with a single project, you can set a default project ID:
{
"mcpServers": {
"gitlab-mcp": {
"command": "gitlab-mcp",
"env": {
"GITLAB_URL": "https://gitlab.com",
"GITLAB_ACCESS_TOKEN": "glpat-xxxxxxxxxxxxxxxxxxxx",
"GITLAB_PROJECT_ID": "12345"
}
}
}
}Restart your MCP client and start asking GitLab questions!
Once connected, try these commands in your chat:
The enhanced review tools allow you to interact with merge request discussions:
"Show me reviews for MR #123" "Reply to discussion abc123 in MR #456 with 'I'll fix this in the next commit'" "Create a review comment in MR #789 asking 'Could you add error handling here?'" "Resolve discussion def456 in MR #123"Note: The get_merge_request_reviews tool now displays discussion IDs and note IDs in the output, making it easy to reference specific discussions when replying or resolving.
Complete the MR lifecycle with approval and merge tools:
"Approve MR #123" "Merge MR #456 with squash"
"Merge MR #789 and remove source branch"
"Merge MR #123 when pipeline succeeds" "Unapprove MR #456"Merge Options:
squash - Squash commits into a single commitshould_remove_source_branch - Delete source branch after mergemerge_when_pipeline_succeeds - Auto-merge when pipeline passessha - Ensure HEAD hasn't changed (safety check)Note: You cannot approve your own MRs. The merge will fail if the MR has conflicts, is in draft status, or doesn't meet approval requirements.
GitLab provides two tools for checking test results - use the summary for quick checks, and the full report for detailed debugging:
Use get_pipeline_test_summary for a quick overview:
"Show me the test summary for MR #123"
"How many tests passed in MR #456?"What You Get:
Use get_merge_request_test_report for detailed debugging:
"Show me the test report for MR #123"
"What tests failed in merge request #456?"What You Get:
How Both Work:
/pipelines/:pipeline_id/test_report or /test_report_summary API)Example Output:
## Summary
**Total**: 45 | **Passed**: 42 | **Failed**: 3 | **Errors**: 0
**Pass Rate**: 93.3%
## Failed Tests
### [FAIL] test_login_with_invalid_password
**Duration**: 0.300s
**Class**: `tests.auth_test.TestAuth`
**Error Output**:
AssertionError: Expected 401, got 200Why Use This Instead of Job Logs?
Requirements:
Your CI must upload test results using artifacts:reports:junit in .gitlab-ci.yml:
test:
script:
- pytest --junitxml=report.xml
artifacts:
reports:
junit: report.xmlThe pipeline tools provide a two-step workflow for debugging test failures:
Use get_merge_request_pipeline to see all jobs and their statuses:
"Show me the pipeline for MR #456"What You Get:
Use get_job_log with a job ID to fetch the actual output:
"Get the log for job 12345"
"Show me the output of job 67890"What You Get:
You: "Show me the pipeline for MR #123"
AI: "Pipeline failed. 2 jobs failed:
- test-unit (Job ID: 12345)
- test-integration (Job ID: 67890)"
You: "Get the log for job 12345"
AI: [Shows full test output with error details]
You: "Fix the failing test"
AI: [Analyzes the log and suggests fixes]Why Two Tools?
The get_commit_discussions tool provides comprehensive insights into discussions and comments on individual commits within a merge request:
"Show me commit discussions for MR #123" "Get all comments on commits in merge request #456"This tool is particularly useful for:
Technical Implementation:
/projects/:project_id/merge_requests/:merge_request_iid/commits to get all commits with proper pagination/projects/:project_id/merge_requests/:merge_request_iid/discussions with pagination supportThe output includes:
Configure environment variables directly in your MCP client config as shown in Quick Setup. This keeps project-specific settings with the project.
Alternatively, set environment variables in your shell:
export GITLAB_PROJECT_ID=12345
export GITLAB_ACCESS_TOKEN=glpat-xxxxxxxxxxxxxxxxxxxx
export GITLAB_URL=https://gitlab.comRoute all GitLab API requests through a SOCKS5 proxy by setting SOCKS_PROXY:
{
"mcpServers": {
"gitlab-mcp": {
"command": "gitlab-mcp",
"env": {
"GITLAB_URL": "https://gitlab.com",
"GITLAB_ACCESS_TOKEN": "glpat-xxxxxxxxxxxxxxxxxxxx",
"GITLAB_PROJECT_ID": "12345",
"SOCKS_PROXY": "socks5://127.0.0.1:1080"
}
}
}
}Or via environment variable:
export SOCKS_PROXY=socks5://127.0.0.1:1080When SOCKS_PROXY is not set, connections are made directly (no proxy).
https://gitlab.com/username/project (use the numeric ID)Authentication Error: Verify your token has read_api permissions and is not expired.
Project Not Found: Double-check your project ID is correct (it's a number, not the project name).
Connection Issues: Make sure your GitLab URL is accessible and correct.
Script Not Found: Ensure the path in your MCP config points to the actual server location and the script is executable.
| Tool | Description | Parameters |
|---|---|---|
search_projects | Primary - Fast search by name (use this first) | search, membership, limit |
list_my_projects | List all projects (slower, use for browsing) | owned, limit |
All project-scoped tools accept an optional project_id parameter. If not provided, falls back to GITLAB_PROJECT_ID env var.
| Tool | Description | Parameters |
|---|---|---|
list_merge_requests | List merge requests | project_id, state, target_branch, limit |
get_merge_request_details | Get MR details | project_id, merge_request_iid |
create_merge_request | Create a new merge request | project_id, source_branch, target_branch, title... |
update_merge_request | Update an existing merge request | project_id, merge_request_iid, title, assignees... |
merge_merge_request | Merge an MR | project_id, merge_request_iid, squash, sha... |
approve_merge_request | Approve an MR | project_id, merge_request_iid, sha |
unapprove_merge_request | Revoke approval from an MR | project_id, merge_request_iid |
get_pipeline_test_summary | Get test summary (fast overview) | project_id, merge_request_iid |
get_merge_request_test_report | Get detailed test failure reports | project_id, merge_request_iid |
get_merge_request_pipeline | Get pipeline with all jobs | project_id, merge_request_iid |
get_job_log | Get trace/output for specific job | project_id, job_id |
get_merge_request_reviews | Get reviews/discussions | project_id, merge_request_iid |
get_commit_discussions | Get discussions on commits | project_id, merge_request_iid |
get_branch_merge_requests | Find MRs for branch | project_id, branch_name |
reply_to_review_comment | Reply to existing discussion | project_id, merge_request_iid, discussion_id, body |
create_review_comment | Create new discussion thread | project_id, merge_request_iid, body |
resolve_review_discussion | Resolve/unresolve discussion | project_id, merge_request_iid, discussion_id |
list_project_members | List project members | project_id |
list_project_labels | List project labels | project_id |
Branch operations, file content fetching, and full diffs are intentionally not included - use git locally for these tasks, it's faster and more capable.
Have a feature request? Open an issue!
gitlab_mr_mcp/
├── __init__.py # Package version
├── __main__.py # Entry point for python -m
├── server.py # MCP server implementation
├── config.py # Configuration management
├── gitlab_api.py # GitLab API client
├── utils.py # Utility functions
├── logging_config.py # Logging configuration
└── tools/ # Tool implementations
├── __init__.py
├── list_merge_requests.py
├── get_merge_request_details.py
├── create_merge_request.py
├── update_merge_request.py
└── ... (more tools)gitlab_mr_mcp/tools/ directorygitlab_mr_mcp/tools/__init__.pylist_tools() in gitlab_mr_mcp/server.pycall_tool() in gitlab_mr_mcp/server.pyPrompts provide workflow guidance to AI assistants. Add new prompts in gitlab_mr_mcp/prompts.py:
PROMPTS dictionary with title, description, and contentNEW_PROMPT = """
Your prompt content here - focus on decision trees and when to use which tool.
"""
PROMPTS = {
# ... existing prompts ...
"new-prompt": {
"title": "Human Readable Title",
"description": "Short description for prompt list",
"content": NEW_PROMPT,
},
}make install
# or: uv pip install -e ".[dev]"make install # Install in editable mode with dev deps
make dev # Build and install wheel locally
make test # Run tests
make lint # Run linters
make format # Format code
make check # Lint + test
make clean # Remove build artifactspre-commit installThis will automatically check and format your code for:
make format
# or: black --line-length=120 . && isort --profile black --line-length=120 .pre-commit run --all-filesmake test
# or: uv run pytest tests/ -vread_api scope)MIT License - see LICENSE file for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.