
GitLab MCP Server by zereight: Setup for Claude, Cursor and Other Apps
Not the official GitLab MCP server. This one is built by the community. GitLab makes its own: GitLab MCP Server →
Lets Claude, Cursor and Codex review merge requests, manage issues and read code on GitLab.
This community server lets your assistant work with GitLab projects, merge requests, issues, pipelines, wikis and more. It starts with a short list of 40 tools and the assistant can switch on more groups when it needs them, up to 288 in total. You sign in with a GitLab personal access token or with your browser, and it works with GitLab.com and self-managed GitLab.
GitLab also has its own built-in server. This one is not from GitLab, and the project's README says it is aimed at agent workflows such as a two-step merge request review.
Good for
- Developers who review GitLab merge requests with an assistant
- Teams on self-managed GitLab who need a local server that points at their own instance
- Engineers who triage issues and check pipeline output without leaving chat
- Anyone who wants a read-only GitLab helper
Works in
12 should work
Tap an app to see how to set it up and any known problems.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Client does not support this transport.
Client does not support this transport.
Install gitlab MCP
Claude Code
- 1
Copy this prompt.
Add the gitlab MCP server to Claude Code. Run this command: claude mcp add gitlab -e GITLAB_PERSONAL_ACCESS_TOKEN=<GITLAB_PERSONAL_ACCESS_TOKEN> -- npx -y @zereight/mcp-gitlab Ask me for GITLAB_PERSONAL_ACCESS_TOKEN and only put the values in that config, nowhere else. Then check that it loaded and tell me if I need to sign in or restart.
- 2
Paste it into Claude Code. It shows the change and asks before running it.
Requires Node.js.
Built from the package data we hold. Not yet tested by us.
Tools
Lists merge requests for you or for a project
Without a project it lists your own merge requests. With a project it lists that project's.
Try: “List my open merge requests.”
Network ·
list_merge_requestsOpens one merge request with its details
Gets a merge request by its number or source branch, with optional deployment, commit and approval summaries.
Try: “Show me merge request 123 in group/project.”
Network ·
get_merge_requestLists the files a merge request changes
Lists changed file paths without the diff text, so the assistant can pick which files to read.
Try: “Which files does MR 123 change?”
Network ·
list_merge_request_changed_filesShows the changes to chosen files in a merge request
Gets the diffs for specific files in a merge request. The README pairs it with the changed-files list for a two-step review.
Try: “Show the diff for src/api.ts in MR 123.”
Network ·
get_merge_request_file_diffLists a merge request's diffs a page at a time
Returns merge request diffs with paging, for big merge requests.
Try: “Page through the diffs of MR 123.”
Network ·
list_merge_request_diffsGets all the changes in a merge request
Gets the changes and diffs of a merge request in one call.
Try: “Review all the changes in MR 123.”
Network ·
get_merge_request_diffsShows who approved a merge request
Gets approval details including the approvers.
Try: “Has MR 123 been approved, and by whom?”
Network ·
get_merge_request_approval_stateLists the comment threads on a merge request
Lists the discussion items for a merge request.
Try: “Show the review threads on MR 123.”
Network ·
mr_discussionsOpens one comment thread on a merge request
Gets a single discussion item for a merge request.
Try: “Show that review thread in full.”
Network ·
get_merge_request_discussionReads one comment on a merge request
Gets a specific note for a merge request.
Try: “Show comment 4567 on MR 123.”
Network ·
get_merge_request_noteLists comments on a merge request
Lists notes for a merge request.
Try: “List the comments on MR 123.”
Network ·
get_merge_request_notesOpens a new merge request
Creates a merge request from a source branch to a target branch.
Try: “Open a merge request from feature/login to main.”
Write ·
create_merge_requestStarts a review thread on a merge request
Creates a new thread on a merge request, for example on a line of code.
Try: “Add a review comment on line 40 of api.ts in MR 123.”
Write ·
create_merge_request_threadMarks a review thread as resolved
Resolves a thread on a merge request.
Try: “Resolve the thread about the naming change.”
Write ·
resolve_merge_request_threadEdits a merge request
Updates a merge request, such as its title, description or state.
Try: “Change the title of MR 123 to 'Fix login redirect'.”
Write ·
update_merge_requestLists issues
Lists issues. By default it shows the ones you created, and you can ask for all.
Try: “List open issues in group/project.”
Network ·
list_issuesLists issues assigned to you
Lists issues assigned to the signed-in user.
Try: “What issues are assigned to me?”
Network ·
my_issuesOpens one issue
Gets details of an issue. It returns a short milestone by default and the full one if asked.
Try: “Show issue 45 in group/project.”
Network ·
get_issueCreates an issue
Creates a new issue in a project.
Try: “Create an issue titled 'Login fails on Safari'.”
Write ·
create_issueEdits an issue
Updates an issue and returns a short confirmation by default.
Try: “Close issue 45 and add the label 'fixed'.”
Write ·
update_issueAdds a comment to an issue
Adds a note to an issue, optionally as a reply in a discussion thread.
Try: “Comment on issue 45 that a fix is in review.”
Write ·
create_issue_noteLists the comment threads on an issue
Lists discussions for an issue.
Try: “Show the discussion on issue 45.”
Network ·
list_issue_discussionsChanges part of an issue description
Applies a search-and-replace or unified diff to an issue description, with a dry run to preview and an option to add a summary note.
Try: “Change the checklist item in issue 45 without rewriting the rest.”
Write ·
update_issue_description_patchReads a file or folder from a project
Gets the contents of a file or directory in a GitLab project.
Try: “Show README.md from group/project on main.”
Network ·
get_file_contentsLists files and folders in a repository
Lists files and directories in a repository.
Try: “List the top-level folders in group/project.”
Network ·
get_repository_treeSearches for projects
Searches GitLab projects.
Try: “Find projects named 'billing'.”
Network ·
search_repositoriesShows a branch's latest commit and protection
Gets branch details including its commit and protection status.
Try: “Is main protected in group/project?”
Network ·
get_branchLists branches in a project
Lists branches, with a search filter.
Try: “List branches that start with feature/.”
Network ·
list_branchesLists commits
Lists repository commits with filtering options.
Try: “Show the last 10 commits on main.”
Network ·
list_commitsOpens one commit
Gets details of a specific commit.
Try: “Show commit a1b2c3d.”
Network ·
get_commitShows what a commit changed
Gets the changes in a specific commit.
Try: “What did commit a1b2c3d change?”
Network ·
get_commit_diffShows who last changed each line of a file
Gets git blame for a file at a given ref, optionally for a line range.
Try: “Who last changed lines 10 to 30 of api.ts?”
Network ·
get_file_blameOpens one project's details
Gets details of a specific project.
Try: “Show the details of group/project.”
Network ·
get_projectLists projects you can access
Lists projects accessible to the current user.
Try: “What projects can I see?”
Network ·
list_projectsLists who is on a project
Lists members of a project.
Try: “Who are the members of group/project?”
Network ·
list_project_membersLists a project's labels
Lists labels for a project.
Try: “What labels does group/project use?”
Network ·
list_labelsShows which GitLab user you are signed in as
Gets details of the authenticated user.
Try: “Which GitLab account is this?”
Network ·
whoamiSends any GitLab REST call
Sends one GitLab REST call under /api/v4. It is on only if you list the api group, and the README says it bypasses project allowlists and the per-tool safety checks.
Try: “Call the GitLab API to list this project's deploy keys.”
Delete ·
gitlab_api_requestUsed by the assistant behind the scenes
Checks the server and your sign-in
Verifies the server status and authentication, and reports the server version and the GitLab version.
Try: “Check that GitLab is connected.”
Network ·
health_checkTurns on more tool groups for this session
Lists tool categories and activates the ones you name for the session, such as pipelines or wiki. The always-on way to reach the other tools.
Try: “Turn on the pipelines tools.”
Read ·
discover_toolsGives a short guide to GitLab workflows
Returns a short workflow guide, with an optional topic.
Try: “Give me the GitLab workflow help.”
Read ·
help
Read from the source code
Permissions
high risk · 3 things to watch · 27 advisories
High risk
By default it can create and edit merge requests, issues and files, and it can switch on tools that delete things. Set the permission mode to readonly, or to modify, and use a token with narrow scopes.
What it can do
- Read your data
- Create and change things
- Delete things
- Read-only modeHow to turn it on
Watch out for
It can switch on delete tools by itself
The default mode is full, so the assistant can turn on groups with delete tools. Set the permission mode to readonly or modify to block that. github.com
An optional tool bypasses the safety checks
The api group sends any REST call and skips project allowlists and per-tool checks. It is never turned on by default or by the all setting, so leave it off. github.com
A token can reach everything its scopes allow
The token acts as you on GitLab. Create it with the fewest scopes you need and limit projects with the allowed-projects setting. github.com
Security advisories
27 known advisories, all fixed in a newer version.
- @zereight/mcp-gitlab: Unauthenticated arbitrary file read via upload_markdown enables PAT exfiltration and full account takeovercritical · Fixed in 2.1.27 · GHSA-cv3r-c5h8-f4g5
- @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgerycritical · Fixed in 2.1.27 · GHSA-2h44-8472-frjj
- @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transportcritical · Fixed in 2.1.30 · GHSA-vmp7-252j-cwp7
- Startup version check sends GitLab credentials from the environment to a registry chosen by the working directory's .npmrchigh · Fixed in 2.3.12 · GHSA-rr94-3mff-76gg
- download_attachment overwrites files in the working directory, including in readonly modehigh · Fixed in 2.3.0 · GHSA-vhp9-2xfv-rrfv
Show all 27Show fewer
- OAuth callback proxy lets any registered client receive a victim's GitLab tokenshigh · Fixed in 2.3.0 · GHSA-5w3p-qj7g-79v5
- Project Scope Authorization Bypasshigh · Fixed in 2.2.6 · GHSA-qcj2-qcc2-5fg4
- GITLAB_PERMISSION_MODE=modify delete-ban bypassed: destructive GraphQL mutations with non-delete verb names (environmentStop, clusterAgentTokenRevoke, pipelineCancel) pass…high · Fixed in 2.1.65 · GHSA-f492-qxqp-m79r
- SSRF: download proxy follows an attacker-set GitLab redirect to internal hosts without re-validating the targethigh · Fixed in 2.1.65 · GHSA-frxm-jmmc-j2xh
- Server GitLab credential exfiltration: Private-Token/JOB-TOKEN forwarded across an unvalidated download redirecthigh · Fixed in 2.1.65 · GHSA-cjfw-chc3-4r4v
- encodeGitLabPath never blocks '../': GHSA-4rm9 patch bypass leads to path traversal (4 call sites)high · Fixed in 2.1.65 · GHSA-m682-5gg2-5rc9
- GITLAB_PERMISSION_MODE=modify exposes destructive stop/cancel pipeline and environment tools missing from the deleteTools registry (REST-tool layer sibling of GHSA-f492)high · Fixed in 2.1.65 · GHSA-v279-9wq4-63rm
- Unauthenticated session exhaustion denies service to legitimate clientshigh · Fixed in 2.1.30 · GHSA-24vp-rch2-gjqq
- execute_graphql defeats read-only mode and GITLAB_ALLOWED_PROJECT_IDShigh · Fixed in 2.1.30 · GHSA-64mg-3vx9-g74j
- Path escape in download_release_asset via direct_asset_path enables same-host project-scope bypasshigh · Fixed in 2.1.41 · GHSA-4rm9-rfp2-j39q
- Path traversal in job_id turns a job tool into an arbitrary GitLab API request under the operator tokenhigh · Fixed in 2.1.32 · GHSA-7c3w-fxgh-frc7
- @zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoShigh · Fixed in 2.1.30 · GHSA-5648-rgj9-v224
- Missing session owner binding in REMOTE_AUTHORIZATION mode and GITLAB_DOWNLOAD_DIR confinement/exclusive-write bypass in download_job_artifactsmedium · Fixed in 2.3.10 · GHSA-2p72-j379-vmm3
- Remote download capability URLs bypass the per-session project allowlist (ENABLE_DYNAMIC_PROJECT_SCOPE)medium · Fixed in 2.3.8 · GHSA-q96h-922g-m3h3
- gitlab_api_request: project allowlist is silently skipped for any GitLab API path that has no parseable project IDmedium · Fixed in 2.3.7 · GHSA-5xhm-p3jx-2fmc
- GITLAB_OAUTH_ALLOWED_GROUPS is only checked at OAuth code exchangemedium · Fixed in 2.3.0 · GHSA-2jv7-p2g4-9f2h
- GITLAB_TOOL_POLICY_HIDDEN makes tools from disabled toolsets callablemedium · Fixed in 2.3.0 · GHSA-3gfg-wh5g-cf74
- Local OAuth callback server returns GitLab tokens to any local callermedium · Fixed in 2.3.0 · GHSA-64g9-hrwx-9g6m
- Project allowlist bypass through target_project_id and work item note emoji toolsmedium · Fixed in 2.3.0 · GHSA-ffr3-5f57-gf93
- GITLAB_PERMISSION_MODE=modify delete-ban bypassed: comma-separated GraphQL operations make mutations invisible to graphqlQueryContainsDeleteOperation (distinct mechanism from GHSA-f492)medium · Fixed in 2.1.65 · GHSA-7cr4-55f8-p36f
- Session-exhaustion DoS in @zereight/mcp-gitlab SSE transport: /sse lacks the session cap, rate limit, and idle timeoutmedium · Fixed in 2.1.65 · GHSA-ph8m-54rc-77fp
- Session IDs are logged in plaintext and MCP OAuth sessions are not bound to their ownerlow · Fixed in 2.3.0 · GHSA-g4cw-m236-q72h
Technical details
| Turning on read-only | Set GITLAB_PERMISSION_MODE=readonly (or --permission-mode=readonly). Use modify to allow edits but block deletes. |
|---|---|
| Talks to | Your GitLab server (gitlab.com or self-managed) |
| Sign-in and keys | The token is an environment variable in your client's config, or a file you point to. OAuth stores tokens through the OAuth flow. |
| Data retention | Not documented. |
| Scopes |
|
Questions
Is this the official GitLab MCP server?
No. GitLab has its own built-in server, and this one is a community project by zereight. The README says the official server is built into GitLab and uses OAuth, while this one runs on your machine or on a server you host.
Why do I only see 40 tools?
The default list is a core set of 38 tools plus two helpers. The assistant can switch on more groups, such as pipelines or wiki, with the discover tool. The tool list above shows the default set, so it is partial.
Do I need a personal access token?
Yes for the simplest setup. You can instead use OAuth with browser sign-in, a CI job token, or per-request tokens on a shared server. The install box uses a token.
Does it work with self-managed GitLab?
Yes. Set the GitLab API address setting to your own server's /api/v4 address. It defaults to GitLab.com in the README examples.
Can I make it read-only?
Yes. Set the permission mode to readonly to keep only read tools. The modify mode allows edits but blocks deletes and teardown actions.
Can I run it as a shared server?
Yes. It supports Streamable HTTP with per-user tokens or OAuth, so a team can share one server. Claude.ai needs a public HTTPS address with the MCP OAuth setting.
Is it free?
Yes. It is open source under the MIT license. You need a GitLab account.
Information
updated Nov 2, 2026
- Publisher
- Community
- Package
@zereight/mcp-gitlab- Registry
- npm
- Transport
- stdio, Streamable HTTP, SSE
- Auth
- API key
- Version
- 2.3.17
- License
- MIT
- Last commit
- Oct 31, 2026
- Open issues
- 8
- Listed in
- Official MCP registry
Other GitLab MCP servers
Sources
Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.
Show all 3Hide
- GitLab MCP README · github.com
- Environment variables reference · github.com
- Default toolset list · github.com