
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@amgisllc/gitlab-mcp
Advanced tools
MCP Server for the GitLab API, enabling comprehensive project management, file operations, CI/CD, and more.
Get a GitLab Personal Access Token
api, read_repository, write_repositoryInstall the Package
From GitLab Package Registry (Recommended):
# Configure npm to use GitLab registry for @amgis scope
npm config set @amgis:registry https://gitlab.com/api/v4/packages/npm/
# Install the package
npm install -g @amgisllc/gitlab-mcp
Or use directly with npx:
npx @amgisllc/gitlab-mcp
Configure in Claude Desktop
Add to claude_desktop_config.json:
{
"mcpServers": {
"gitlab": {
"command": "npx",
"args": ["-y", "@amgisllc/gitlab-mcp"],
"env": {
"GITLAB_PERSONAL_ACCESS_TOKEN": "your-token-here"
}
}
}
}
Start Using
Once configured, you can use natural language to interact with GitLab:
get_project - Get detailed project informationdelete_project - Delete a GitLab projectupdate_project - Update project settings (description, visibility, etc.)list_projects - List user's projects with filtering and paginationsearch_repositories - Search for GitLab projectscreate_repository - Create a new GitLab projectfork_repository - Fork a project to your account or namespaceget_file_contents - Get contents of a file or directorycreate_or_update_file - Create or update a single file in a projectpush_files - Push multiple files in a single commitget_repository_archive - Download repository archive as tar.gz or zipcreate_branch - Create a new branchlist_branches - List all branches in a projectdelete_branch - Delete a branchcreate_tag - Create a new taglist_tags - List all tags in a projectdelete_tag - Delete a tagcreate_issue - Create a new issuelist_issues - List issues with filtering optionsget_issue - Get specific issue detailsupdate_issue - Update an existing issueclose_issue - Close an issuelist_issue_comments - List comments on an issueadd_issue_comment - Add a comment to an issuecreate_merge_request - Create a new merge requestlist_merge_requests - List merge requests with filteringget_merge_request - Get specific merge request detailsupdate_merge_request - Update merge request (title, description, etc.)merge_merge_request - Accept/merge a merge requestclose_merge_request - Close a merge request without merginglist_merge_request_comments - List comments on a merge requestadd_merge_request_comment - Add a comment to a merge requestlist_pipelines - List project pipelines with filteringget_pipeline - Get pipeline detailstrigger_pipeline - Trigger a new pipelinecancel_pipeline - Cancel a running pipelinelist_jobs - List pipeline jobsget_job_log - Get job log outputlist_wiki_pages - List wiki pages in a projectget_wiki_page - Get wiki page contentcreate_wiki_page - Create a new wiki pageupdate_wiki_page - Update wiki page contentlist_project_members - List project membersadd_project_member - Add a member to the projectremove_project_member - Remove a member from the projectupdate_member_access - Update member's access levellist_releases - List project releasescreate_release - Create a new releaseupdate_release - Update release informationdelete_release - Delete a releaselist_snippets - List project snippetscreate_snippet - Create a new snippetget_snippet - Get snippet contentupdate_snippet - Update snippet contentlist_commits - List commits with filtering optionsget_commit - Get specific commit detailscompare_branches - Compare two branches or commitsCreate a GitLab Personal Access Token with appropriate permissions:
api for full API accessread_api for read-only accessread_repository and write_repository for repository operationsAdd the following to your claude_desktop_config.json:
{
"mcpServers": {
"gitlab": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-e",
"GITLAB_PERSONAL_ACCESS_TOKEN",
"-e",
"GITLAB_API_URL",
"mcp/gitlab"
],
"env": {
"GITLAB_PERSONAL_ACCESS_TOKEN": "<YOUR_TOKEN>",
"GITLAB_API_URL": "https://gitlab.com/api/v4" // Optional, for self-hosted instances
}
}
}
}
{
"mcpServers": {
"gitlab": {
"command": "npx",
"args": [
"-y",
"@amgisllc/gitlab-mcp"
],
"env": {
"GITLAB_PERSONAL_ACCESS_TOKEN": "<YOUR_TOKEN>",
"GITLAB_API_URL": "https://gitlab.com/api/v4" // Optional, for self-hosted instances
}
}
}
}
For system-wide configuration with Claude CLI, add to ~/.claude/settings.json:
{
"mcpServers": {
"gitlab": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-gitlab"],
"env": {
"GITLAB_PERSONAL_ACCESS_TOKEN": "your-token-here",
"GITLAB_API_URL": "https://gitlab.com/api/v4"
}
}
}
}
Or use Docker:
{
"mcpServers": {
"gitlab": {
"command": "docker",
"args": ["run", "--rm", "-i", "-e", "GITLAB_PERSONAL_ACCESS_TOKEN", "mcp/gitlab"],
"env": {
"GITLAB_PERSONAL_ACCESS_TOKEN": "your-token-here"
}
}
}
}
Then simply run:
claude
For quick installation, use one of the one-click installation buttons below...
For manual installation, add the following JSON block to your User Settings (JSON) file in VS Code. You can do this by pressing Ctrl + Shift + P and typing Preferences: Open User Settings (JSON).
Optionally, you can add it to a file called .vscode/mcp.json in your workspace. This will allow you to share the configuration with others.
Note that the
mcpkey is not needed in the.vscode/mcp.jsonfile.
{
"mcp": {
"inputs": [
{
"type": "promptString",
"id": "gitlab_token",
"description": "GitLab Personal Access Token",
"password": true
},
{
"type": "promptString",
"id": "gitlab_url",
"description": "GitLab API URL (optional)",
"default": "https://gitlab.com/api/v4"
}
],
"servers": {
"gitlab": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"mcp/gitlab"
],
"env": {
"GITLAB_PERSONAL_ACCESS_TOKEN": "${input:gitlab_token}",
"GITLAB_API_URL": "${input:gitlab_url}"
}
}
}
}
}
{
"mcp": {
"inputs": [
{
"type": "promptString",
"id": "gitlab_token",
"description": "GitLab Personal Access Token",
"password": true
},
{
"type": "promptString",
"id": "gitlab_url",
"description": "GitLab API URL (optional)",
"default": "https://gitlab.com/api/v4"
}
],
"servers": {
"gitlab": {
"command": "npx",
"args": [
"-y",
"@amgisllc/gitlab-mcp"
],
"env": {
"GITLAB_PERSONAL_ACCESS_TOKEN": "${input:gitlab_token}",
"GITLAB_API_URL": "${input:gitlab_url}"
}
}
}
}
}
To install packages from GitLab Package Registry, you need to authenticate. You have several options:
Personal Access Token (Recommended for development)
read_api scope (or api for full access)Deploy Token (Recommended for CI/CD)
read_package_registry scopeCI Job Token (For GitLab CI/CD)
$CI_JOB_TOKENFirst, configure npm to use the GitLab Package Registry for the @amgis scope:
npm install -g @amgisllc/gitlab-mcp
git clone https://github.com/modelcontextprotocol/servers.git
cd servers/src/gitlab
npm install
npm run build
npm install
npm run build
The project includes a comprehensive test suite covering all GitLab operations.
# Setup test environment
cp .env.example .env
# Edit .env with your GitLab token and test project
# Run all tests
npm test
# Run specific test suites
npm run test:issues # Issue operations
npm run test:files # File operations
npm run test:mr # Merge requests
npm run test:ci # CI/CD pipelines
See tests/README.md for detailed testing documentation.
docker build -t mcp/gitlab .
All tools accept project_id parameter in two formats:
"12345" (as a string)"namespace/project" or "group/subgroup/project"Example:
// Both are valid:
{ "project_id": "12345678" }
{ "project_id": "gitlab-org/gitlab" }
GITLAB_PERSONAL_ACCESS_TOKEN: Your GitLab personal access token (required)GITLAB_API_URL: Base URL for GitLab API (optional, defaults to https://gitlab.com/api/v4)Authentication Failed
api, read_repository, write_repositoryGITLAB_API_URL is correctProject Not Found
Rate Limiting
Self-Hosted GitLab
GITLAB_API_URL to your instance: https://gitlab.example.com/api/v4~/.claude/settings.json syntaxclaude --debug to see detailed logsclaude config get mcpServersThis project uses GitLab CI/CD to automatically build, test, and publish the package.
The package is automatically published to GitLab Package Registry when:
v1.0.1)To create a new release:
git tag v1.0.1
git push origin v1.0.1
To manually publish to npm:
npm login
npm publish --access public
The .gitlab-ci.yml file defines three stages:
Contributions are welcome! Please see the tests documentation for information on running the test suite.
index.ts and/or api-functions.tsschemas.tstests/features/This MCP server is licensed under the MIT License. This means you are free to use, modify, and distribute the software, subject to the terms and conditions of the MIT License. For more details, please see the LICENSE file in the project repository.
FAQs
MCP server for using the GitLab API
We found that @amgisllc/gitlab-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.