
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@modelcontextprotocol/server-gitlab
Advanced tools
MCP Server for the GitLab API, enabling project management, file operations, and more.
create_or_update_file
project_id (string): Project ID or URL-encoded pathfile_path (string): Path where to create/update the filecontent (string): Content of the filecommit_message (string): Commit messagebranch (string): Branch to create/update the file inprevious_path (optional string): Path of the file to move/renamepush_files
project_id (string): Project ID or URL-encoded pathbranch (string): Branch to push tofiles (array): Files to push, each with file_path and contentcommit_message (string): Commit messagesearch_repositories
search (string): Search querypage (optional number): Page number for paginationper_page (optional number): Results per page (default 20)create_repository
name (string): Project namedescription (optional string): Project descriptionvisibility (optional string): 'private', 'internal', or 'public'initialize_with_readme (optional boolean): Initialize with READMEget_file_contents
project_id (string): Project ID or URL-encoded pathfile_path (string): Path to file/directoryref (optional string): Branch/tag/commit to get contents fromcreate_issue
project_id (string): Project ID or URL-encoded pathtitle (string): Issue titledescription (optional string): Issue descriptionassignee_ids (optional number[]): User IDs to assignlabels (optional string[]): Labels to addmilestone_id (optional number): Milestone IDcreate_merge_request
project_id (string): Project ID or URL-encoded pathtitle (string): MR titledescription (optional string): MR descriptionsource_branch (string): Branch containing changestarget_branch (string): Branch to merge intodraft (optional boolean): Create as draft MRallow_collaboration (optional boolean): Allow commits from upstream membersfork_repository
project_id (string): Project ID or URL-encoded pathnamespace (optional string): Namespace to fork tocreate_branch
project_id (string): Project ID or URL-encoded pathbranch (string): Name for new branchref (optional string): Source branch/commit for new branchCreate a GitLab Personal Access Token with appropriate permissions:
api for full API accessread_api for read-only accessread_repository and write_repository for repository operationsAdd the following to your claude_desktop_config.json:
{
"mcpServers": {
"gitlab": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-e",
"GITLAB_PERSONAL_ACCESS_TOKEN",
"-e",
"GITLAB_API_URL",
"mcp/gitlab"
],
"env": {
"GITLAB_PERSONAL_ACCESS_TOKEN": "<YOUR_TOKEN>",
"GITLAB_API_URL": "https://gitlab.com/api/v4" // Optional, for self-hosted instances
}
}
}
}
{
"mcpServers": {
"gitlab": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/server-gitlab"
],
"env": {
"GITLAB_PERSONAL_ACCESS_TOKEN": "<YOUR_TOKEN>",
"GITLAB_API_URL": "https://gitlab.com/api/v4" // Optional, for self-hosted instances
}
}
}
}
For quick installation, use one of the one-click installation buttons below...
For manual installation, add the following JSON block to your User Settings (JSON) file in VS Code. You can do this by pressing Ctrl + Shift + P and typing Preferences: Open User Settings (JSON).
Optionally, you can add it to a file called .vscode/mcp.json in your workspace. This will allow you to share the configuration with others.
Note that the
mcpkey is not needed in the.vscode/mcp.jsonfile.
{
"mcp": {
"inputs": [
{
"type": "promptString",
"id": "gitlab_token",
"description": "GitLab Personal Access Token",
"password": true
},
{
"type": "promptString",
"id": "gitlab_url",
"description": "GitLab API URL (optional)",
"default": "https://gitlab.com/api/v4"
}
],
"servers": {
"gitlab": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"mcp/gitlab"
],
"env": {
"GITLAB_PERSONAL_ACCESS_TOKEN": "${input:gitlab_token}",
"GITLAB_API_URL": "${input:gitlab_url}"
}
}
}
}
}
{
"mcp": {
"inputs": [
{
"type": "promptString",
"id": "gitlab_token",
"description": "GitLab Personal Access Token",
"password": true
},
{
"type": "promptString",
"id": "gitlab_url",
"description": "GitLab API URL (optional)",
"default": "https://gitlab.com/api/v4"
}
],
"servers": {
"gitlab": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/server-gitlab"
],
"env": {
"GITLAB_PERSONAL_ACCESS_TOKEN": "${input:gitlab_token}",
"GITLAB_API_URL": "${input:gitlab_url}"
}
}
}
}
}
Docker build:
docker build -t vonwig/gitlab:mcp -f src/gitlab/Dockerfile .
GITLAB_PERSONAL_ACCESS_TOKEN: Your GitLab personal access token (required)GITLAB_API_URL: Base URL for GitLab API (optional, defaults to https://gitlab.com/api/v4)This MCP server is licensed under the MIT License. This means you are free to use, modify, and distribute the software, subject to the terms and conditions of the MIT License. For more details, please see the LICENSE file in the project repository.
FAQs
MCP server for using the GitLab API
The npm package @modelcontextprotocol/server-gitlab receives a total of 5,158 weekly downloads. As such, @modelcontextprotocol/server-gitlab popularity was classified as popular.
We found that @modelcontextprotocol/server-gitlab demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.