PlugWiki
gitlab-mcp logo

GitLab MCP Server by zereight: Setup for Claude, Cursor and Other Apps

CommunityLocal
Getnpm@zereight/mcp-gitlabzereight/gitlab-mcp

Not the official GitLab MCP server. This one is built by the community. GitLab makes its own: GitLab MCP Server →

Lets Claude, Cursor and Codex review merge requests, manage issues and read code on GitLab.

This community server lets your assistant work with GitLab projects, merge requests, issues, pipelines, wikis and more. It starts with a short list of 40 tools and the assistant can switch on more groups when it needs them, up to 288 in total. You sign in with a GitLab personal access token or with your browser, and it works with GitLab.com and self-managed GitLab.

GitLab also has its own built-in server. This one is not from GitLab, and the project's README says it is aimed at agent workflows such as a two-step merge request review.

Good for

  • Developers who review GitLab merge requests with an assistant
  • Teams on self-managed GitLab who need a local server that points at their own instance
  • Engineers who triage issues and check pipeline output without leaving chat
  • Anyone who wants a read-only GitLab helper

Works in

12 should work

Tap an app to see how to set it up and any known problems.

Install gitlab MCP

Claude Code

  1. 1

    Copy this prompt.

    Add the gitlab MCP server to Claude Code. Run this command:
    
    claude mcp add gitlab -e GITLAB_PERSONAL_ACCESS_TOKEN=<GITLAB_PERSONAL_ACCESS_TOKEN> -- npx -y @zereight/mcp-gitlab
    
    Ask me for GITLAB_PERSONAL_ACCESS_TOKEN and only put the values in that config, nowhere else.
    
    Then check that it loaded and tell me if I need to sign in or restart.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

Built from the package data we hold. Not yet tested by us.

Tools

  • Lists merge requests for you or for a project

    Without a project it lists your own merge requests. With a project it lists that project's.

    Try: “List my open merge requests.”

    Network · list_merge_requests

  • Opens one merge request with its details

    Gets a merge request by its number or source branch, with optional deployment, commit and approval summaries.

    Try: “Show me merge request 123 in group/project.”

    Network · get_merge_request

  • Lists the files a merge request changes

    Lists changed file paths without the diff text, so the assistant can pick which files to read.

    Try: “Which files does MR 123 change?”

    Network · list_merge_request_changed_files

  • Shows the changes to chosen files in a merge request

    Gets the diffs for specific files in a merge request. The README pairs it with the changed-files list for a two-step review.

    Try: “Show the diff for src/api.ts in MR 123.”

    Network · get_merge_request_file_diff

  • Lists a merge request's diffs a page at a time

    Returns merge request diffs with paging, for big merge requests.

    Try: “Page through the diffs of MR 123.”

    Network · list_merge_request_diffs

  • Gets all the changes in a merge request

    Gets the changes and diffs of a merge request in one call.

    Try: “Review all the changes in MR 123.”

    Network · get_merge_request_diffs

  • Shows who approved a merge request

    Gets approval details including the approvers.

    Try: “Has MR 123 been approved, and by whom?”

    Network · get_merge_request_approval_state

  • Lists the comment threads on a merge request

    Lists the discussion items for a merge request.

    Try: “Show the review threads on MR 123.”

    Network · mr_discussions

  • Opens one comment thread on a merge request

    Gets a single discussion item for a merge request.

    Try: “Show that review thread in full.”

    Network · get_merge_request_discussion

  • Reads one comment on a merge request

    Gets a specific note for a merge request.

    Try: “Show comment 4567 on MR 123.”

    Network · get_merge_request_note

  • Lists comments on a merge request

    Lists notes for a merge request.

    Try: “List the comments on MR 123.”

    Network · get_merge_request_notes

  • Opens a new merge request

    Creates a merge request from a source branch to a target branch.

    Try: “Open a merge request from feature/login to main.”

    Write · create_merge_request

Read from the source code

Permissions

high risk · 3 things to watch · 27 advisories

High risk

By default it can create and edit merge requests, issues and files, and it can switch on tools that delete things. Set the permission mode to readonly, or to modify, and use a token with narrow scopes.

What it can do

Watch out for

  • It can switch on delete tools by itself

    The default mode is full, so the assistant can turn on groups with delete tools. Set the permission mode to readonly or modify to block that. github.com

  • An optional tool bypasses the safety checks

    The api group sends any REST call and skips project allowlists and per-tool checks. It is never turned on by default or by the all setting, so leave it off. github.com

  • A token can reach everything its scopes allow

    The token acts as you on GitLab. Create it with the fewest scopes you need and limit projects with the allowed-projects setting. github.com

Security advisories

27 known advisories, all fixed in a newer version.

Show all 27
Technical details
Turning on read-onlySet GITLAB_PERMISSION_MODE=readonly (or --permission-mode=readonly). Use modify to allow edits but block deletes.
Talks toYour GitLab server (gitlab.com or self-managed)
Sign-in and keysThe token is an environment variable in your client's config, or a file you point to. OAuth stores tokens through the OAuth flow.
Data retentionNot documented.
Scopes
  • GitLab personal access token scopes you choose, or OAuth

Questions

Is this the official GitLab MCP server?

No. GitLab has its own built-in server, and this one is a community project by zereight. The README says the official server is built into GitLab and uses OAuth, while this one runs on your machine or on a server you host.

Why do I only see 40 tools?

The default list is a core set of 38 tools plus two helpers. The assistant can switch on more groups, such as pipelines or wiki, with the discover tool. The tool list above shows the default set, so it is partial.

Do I need a personal access token?

Yes for the simplest setup. You can instead use OAuth with browser sign-in, a CI job token, or per-request tokens on a shared server. The install box uses a token.

Does it work with self-managed GitLab?

Yes. Set the GitLab API address setting to your own server's /api/v4 address. It defaults to GitLab.com in the README examples.

Can I make it read-only?

Yes. Set the permission mode to readonly to keep only read tools. The modify mode allows edits but blocks deletes and teardown actions.

Can I run it as a shared server?

Yes. It supports Streamable HTTP with per-user tokens or OAuth, so a team can share one server. Claude.ai needs a public HTTPS address with the MCP OAuth setting.

Is it free?

Yes. It is open source under the MIT license. You need a GitLab account.

Information

updated Nov 2, 2026

Publisher
Community
Package
@zereight/mcp-gitlab
Registry
npm
Transport
stdio, Streamable HTTP, SSE
Auth
API key
Version
2.3.17
License
MIT
Last commit
Oct 31, 2026
Open issues
8
Listed in
Official MCP registry

WebsiteGitHubnpmOfficial MCP RegistryChangelogIssues

Other GitLab MCP servers

Sources

Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.

Show all 3
  1. GitLab MCP README · github.com
  2. Environment variables reference · github.com
  3. Default toolset list · github.com

Facts from the official MCP registry, GitHub, npm, PyPI and the Docker catalog. Updated Nov 2, 2026.