gitlab-mcp-skill

What the source does

• FilesystemDeclared3 observations
• NetworkDeclared9 observations
• ShellNone observedNo commands run in the source
• DependenciesNot pinnedSome versions float
• SecretsFoundSee the findings; values are never shown

Five audit layers

Gates applied: no behavioural pass.

logger.error(`Token exchange failed (${response.status}): ${body}`);

logger.error(`Token refresh failed (${response.status}): ${body}`);

logger.error(`Callback token exchange failed (${tokenResponse.status}): ${body}`);

logger.info(`Token saved to ${this.tokenStoragePath}`);

# GITLAB_OAUTH_REDIRECT_URI=http://127.0.0.1:8888/callback

serve: install ## Preview docs at http://127.0.0.1:8000 (auto-reload)

token: "…",

token: "…",

token: "…",

token: "…",

const TOKEN = "…";

.envrc

.gitlab-mcp-managed-policy.example.json

.gitlab-mcp-mask.example.json

.prettierignore

.gitlab-mcp-mask.json

console.log(`  ✓ Valid token accepted (status: ${res.status})`);

assert.throws(() => validateMode("../../etc"), /Invalid mode name/);

assert.throws(() => getStatePath("../../etc"), /Invalid mode name/);

path.resolve(__dirname, "../../package.json"),

"https://claude.ai/api/mcp/auth_callback/../../steal",

import { allTools } from "../../tools/registry.js";

const CALLBACK_URL = "https://mcp.example.com/callback";

const { stateless = null, callbackProxy = true, allowed, callbackUrl = CALLBACK_URL } = options;

const CALLBACK_URL = "https://mcp.example.com/callback";

Audit 0.4.1 · source sha 42b8d1d892d9 · 21 Oct 2026Report an issue or request a re-scan

• Publisherzereight GitHub userOwner of the repository this skill is read from
• Source folderzereight/gitlab-mcpThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict42b8d1d892d9A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Use this skill when working with the GitLab MCP server tools for merge requests, issues, repositories, pipelines, work items, variables, dependency proxy, vulnerabilities, webhooks, search, CI catalog, and related…

---
name: gitlab-mcp-skill
description: Use this skill when working with the GitLab MCP server tools for merge requests, issues, repositories, pipelines, work items, variables, dependency proxy, vulnerabilities, webhooks, search, CI catalog, and related GitLab workflows.
---

# gitlab-mcp

GitLab MCP server providing 276 tools: 274 tools across 24 toolsets, plus `execute_graphql` and the always-available `discover_tools` meta-tool.

For exact generated parameter tables, see `docs/tools/`. Use this file for workflow shape and high-signal parameter hints.

## Toolsets

| Toolset | Default | Enable with |
|---|---|---|
| core (38 tools) | yes | default lean starter set |
| merge_requests (46 tools) | no | `GITLAB_TOOLSETS=merge_requests` |
| issues (24 tools) | no | `GITLAB_TOOLSETS=issues` |
| repositories (7 tools) | no | `GITLAB_TOOLSETS=repositories` |
| branches (15 tools) | no | `GITLAB_TOOLSETS=branches` |
| projects (11 tools) | no | `GITLAB_TOOLSETS=projects` |
| labels (5 tools) | no | `GITLAB_TOOLSETS=labels` |
| ci (4 tools) | no | `GITLAB_TOOLSETS=ci` |
| groups (1 tool) | no | `GITLAB_TOOLSETS=groups` |
| users (7 tools) | no | `GITLAB_TOOLSETS=users` |
| pipelines (58 tools) | no | `GITLAB_TOOLSETS=core,pipelines` (deprecated `USE_PIPELINE`; if `GITLAB_TOOLS` is unset, set `GITLAB_TOOLS=validate_ci_lint,validate_project_ci_lint`, otherwise append those tools instead of replacing the list) |
| milestones (17 tools) | no | `GITLAB_TOOLSETS=core,milestones` (deprecated `USE_MILESTONE`) |
| wiki (10 tools) | no | `GITLAB_TOOLSETS=core,wiki` (deprecated `USE_GITLAB_WIKI`) |
| releases (7 tools) | no | `GITLAB_TOOLSETS=releases` |
| tags (9 tools) | no | `GITLAB_TOOLSETS=tags` |
| snippets (5 tools) | no | `GITLAB_TOOLSETS=snippets` |
| workitems (18 tools) | no | `GITLAB_TOOLSETS=workitems` |
| webhooks (6 tools) | no | `GITLAB_TOOLSETS=webhooks` |
| search (3 tools) | no | `GITLAB_TOOLSETS=search` |
| variables (10 tools) | no | `GITLAB_TOOLSETS=variables` |
| dependency_proxy (4 tools) | no | `GITLAB_TOOLSETS=dependency_proxy` |
| vulnerabilities (4 tools) | no | `GITLAB_TOOLSETS=vulnerabilities` |
| orbit (4 tools) | no | `GITLAB_TOOLSETS=orbit` |
| api (1 tool) | no | `GITLAB_TOOLSETS=api` only (not `all`, not `discover_tools`, not `GITLAB_TOOLS`) |

Enable all discoverable toolsets: `GITLAB_TOOLSETS=all` (does **not** enable `api`). Restore the pre-lean default with `GITLAB_TOOLSETS=merge_requests,issues,repositories,branches,projects,labels,ci,groups,users`. Use `GITLAB_TOOLS` to enable individual tools outside their toolset, except explicit-only tools such as `gitlab_api_request`. `discover_tools` can list and activate opt-in categories for the current session, except `api`. `execute_graphql` is not in a toolset; enable it explicitly with `GITLAB_TOOLS=execute_graphql`. `USE_GITLAB_WIKI`, `USE_MILESTONE`, and `USE_PIPELINE` are deprecated (removed in next major (v3.0.0)). If you already set `GITLAB_TOOLSETS`, append the toolset to your existing list instead of replacing it. If `GITLAB_TOOLS` is unset, set `GITLAB_TOOLS=validate_ci_lint,validate_project_ci_lint`. If it is already set, append those two tools instead of replacing that list.

`gitlab_api_request` bypasses `GITLAB_ALLOWED_GROUPS` and other group restrictions, project allowlists, tool-level restrictions (`GITLAB_TOOLS`, `GITLAB_DENIED_TOOLS_REGEX` on other tools), and individual tool safety checks. The full token permission scope is exposed. Prompt injection can drive this tool. Operators who rely on these restrictions must NOT enable it. `GITLAB_ALLOWED_PROJECT_IDS` is checked only for `/projects/:id` paths; `/search`, `/users`, `/groups/:id`, and `/runners` are not constrained. `GITLAB_PROJECT_ID` and OAuth group allowlists are not enforced.

The per-toolset counts above sum to 314 because the 38 `core` tools are each also listed
in their full category (`get_branch` and `list_branches` additionally appear in both
`merge_requests` and `branches`); the unique tool count across all toolsets is 274.

## Key Workflows

### Code Review (see reference/code-review.md)

1. `list_merge_request_changed_files` - get file paths only (no diffs)
2. `get_merge_request_file_diff` - get diffs for 3-5 files per call (batch)
3. `create_merge_request_thread` or `create_draft_note` - leave review comments
4. `bulk_publish_draft_notes` - publish all drafts at once

### MR Lifecycle (see reference/merge-requests.md)

`create_merge_request` -> review -> `approve_merge_request` -> `merge_merge_request`

### Issue Management (see reference/issues.md)

`create_issue` -> `create_issue_link` -> `create_issue_note` -> `update_issue`

Use `update_issue_description_patch` for small edits to long issue descriptions instead of resending the full body.

### Projects & Namespaces

- `get_project`, `list_projects`, `update_project` - inspect or change project settings
- `list_project_members`, `list_group_members` - search members by name or username within a project or group
- `list_namespaces`, `get_namespace`, `verify_namespace` - find target namespaces before creating projects/groups
- `verify_namespace.parent_id` scopes nested namespace checks
- `create_repository.namespace_id` creates a project under a group namespace

### Branches & Commits

- `create_branch`, `list_branches`, `get_branch`, `delete_branch`
- Protected branches: `list_protected_branches`, `get_protected_branch`, `protect_branch`, `unprotect_branch`, `update_default_branch`
- Commits: `list_commits`, `get_commit`, `get_commit_diff`, `get_file_blame`, `list_commit_statuses`, `create_commit_status`

### Tags

- `list_tags`, `get_tag`, `create_tag`, `delete_tag`, `get_tag_signature`
- Protected tags: `list_protected_tags`, `get_protected_tag`, `protect_tag`, `unprotect_tag` (`create_access_level` is 0, 30, or 40; wildcards such as `v*` are supported)

### CI

- Lint configs: `validate_ci_lint`, `validate_project_ci_lint`
- Catalog: `list_ci_catalog_resources`, `get_ci_catalog_res

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-21
   !CAUTION F 48 / 100

   first audit · source 42b8d1d892d9

Questions about gitlab-mcp-skill

• github.com/zereight/gitlab-mcp — the audited source at commit 42b8d1d892d9 and every finding aboveObserved · 21 Oct 2026

Spotted something wrong? Report a correction · Methodology