Mcp Gitlab — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Gitlab (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP (Model Context Protocol) server for a self-hosted GitLab instance, focused on browsing projects and repositories. It exposes read-only tools so an MCP client (Claude desktop, Claude Code, etc.) can list projects, inspect branches and commits, browse the file tree, and read file contents.
| Tool | Purpose |
|---|---|
gitlab_list_projects | List / search projects, filter by owned or membership |
gitlab_get_project | Detailed info for one project (default branch, clone URLs, etc.) |
gitlab_list_branches | List repository branches with their tip commit |
gitlab_list_commits | List commits, filter by ref / path / date range |
gitlab_get_commit | Full details and line-change stats for one commit |
gitlab_list_repository_tree | Browse files & directories at a path (optionally recursive) |
gitlab_get_file | Read decoded contents of a single file |
All tools are read-only and support pagination (page, per_page) and a response_format of markdown (default) or json.
npm install
npm run buildIn GitLab: User Settings → Access Tokens. Create a token with these scopes:
read_api — required for listing projects, branches and commitsread_repository — required for the repository tree and file contentsKeep the token secret. It is read from an environment variable, never stored in code.
| Variable | Required | Description |
|---|---|---|
GITLAB_BASE_URL | yes | Base URL of your instance, e.g. https://gitlab.example.com (no /api/v4 suffix needed) |
GITLAB_TOKEN | yes | Your Personal Access Token |
TRANSPORT | no | stdio (default) or http |
PORT | no | Port for http transport (default 3000) |
# stdio (default — for local MCP clients)
GITLAB_BASE_URL=https://gitlab.example.com GITLAB_TOKEN=glpat-xxxx npm start
# HTTP transport (binds to 127.0.0.1)
TRANSPORT=http PORT=3000 GITLAB_BASE_URL=https://gitlab.example.com GITLAB_TOKEN=glpat-xxxx npm startMost desktop clients use a JSON config block. Point it at the built entry point and supply the environment variables:
{
"mcpServers": {
"gitlab": {
"command": "node",
"args": ["/absolute/path/to/gitlab-mcp-server/dist/index.js"],
"env": {
"GITLAB_BASE_URL": "https://gitlab.example.com",
"GITLAB_TOKEN": "glpat-xxxxxxxxxxxxxxxxxxxx"
}
}
}
}Replace the path with the absolute path to dist/index.js on your machine, and fill in your instance URL and token. Restart the client to pick up the new server.
gitlab-mcp-server/
├── package.json
├── tsconfig.json
├── README.md
└── src/
├── index.ts # Entry point, transport selection, env validation
├── constants.ts # Config readers and limits
├── types.ts # GitLab resource interfaces
├── schemas/common.ts # Shared Zod schema fragments
├── services/client.ts # Authenticated API client, pagination, errors
└── tools/projects.ts # Tool definitions and registrationWherever a project_id is required, you can pass either:
42, ormygroup/myrepo (the server URL-encodes it for you).npm run dev.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.