GitLab MCP

gitlab-mcp

An MCP server for gitlab.com. One binary over stdio, signed in as you, with your own OAuth application and the token in your OS keyring.

It is for a person with a gitlab.com account who wants an assistant to find and read issues, review merge requests, follow CI and make the changes they ask for, as them. It works inside projects: issues, merge requests, reviews, the repository and CI. It does not administer an instance or a group, and it does not serve self-managed instances.

Unofficial, and not affiliated with GitLab Inc. See NOTICE.

Goals and non-goals

Goals:

• Content never steers the assistant through the server. Issues, reviews, files and job logs come back marked as untrusted data, hidden text is counted, nothing they link to is fetched, and token shapes in CI output are masked.
• Nothing it writes runs a command. A quick action such as /merge in a comment is refused or escaped, never executed.
• Nothing ships, deletes or reaches further unless you turn it on. Merging, approving, running CI and deleting are not registered by default, code reaches a protected branch only through a merge request, and writes can be confined to the groups you name.
• A write changes only what you read and named. Writes carry what they read and are refused when it moved, a lost create is settled by reading, and every write takes dry_run.
• Reads are bounded. Every read has a budget and says what it left out and how to continue.
• Act as you, and log nothing about your work. Every call runs as the signed-in account, and the logs never carry paths, titles or bodies.

Non-goals:

• Self-managed instances. It talks to gitlab.com and nothing else.
• Administration. Instance and group settings, users, runners, access tokens, deploy keys, webhooks and integrations are out.
• CI variables and secure files. Reading them would put secrets in a model's context.
• Deleting projects or groups, force pushes and protected-branch settings, not even behind a switch.
• A raw API tool. Every call is a tool with its own guards; nothing sends an arbitrary REST or GraphQL request.
• Events pushed to it. Webhooks need a listener, and a stdio process has none.
• A hosted service. It speaks stdio only, so Claude on the web and on mobile cannot reach it.
• Asking you before a call. Your client approves each call; the server asks nothing.

What makes this one different

• A curated surface, gated by registration. A tool for each thing a person does in a project, rather than an API mirror, and a tool that is switched off is not registered, so it cannot be called at all.
• Nothing it writes runs a quick action. GitLab runs /merge and the rest from any comment or description sent through its API.
• Content is marked as untrusted. Issues, reviews, files and job logs come back inside boundaries the content cannot close.
• Reviews the way people review. Draft comments, published together, and the server, not the model, computes where an inline comment lands.
• Signs in like a desktop app. Your own OAuth application, a browser tab, the token in the OS keyring. GitLab's own MCP server runs on the instance over HTTP, and a stdio client reaches it through a Node.js proxy.
• Verifiable releases. Signed checksums, build provenance and SBOMs.

Tools

| delete_label | Delete a project label (`