
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@evalin8/mcp-gitlab-server
Advanced tools
MCP server that offers Git (branch/commit/push via git CLI) + GitLab issue creation.
An MCP server that provides Git workflow automation and GitLab integration for AI assistants.
Transport: stdio
Runtime: Node.js 18+
npx @evalin8/mcp-gitlab-server
npm install -g @evalin8/mcp-gitlab-server
# or: pnpm add -g @evalin8/mcp-gitlab-server
npm install @evalin8/mcp-gitlab-server
npx @evalin8/mcp-gitlab-server
api - Full API accessread_user - Read user informationread_repository - Read repository contentglpat_)Create a .env file in your project root or set environment variables:
GITLAB_HOST=https://gitlab.com/api/v4
GITLAB_TOKEN=glpat_xxxxxxxxxxxxxxxxx
Note:
GITLAB_HOSTshould include the full API path ending with/api/v4. For self-hosted GitLab, usehttps://your-gitlab.company.com/api/v4.
Add the following configuration to your MCP client:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Add to your MCP settings configuration
{
"mcpServers": {
"gitlab": {
"command": "npx",
"args": ["-y", "@evalin8/mcp-gitlab-server"],
"env": {
"GITLAB_HOST": "https://gitlab.com/api/v4",
"GITLAB_TOKEN": "glpat_your_token_here"
}
}
}
}
Note: Restart your MCP client after saving the configuration.
git_create_branchCreate and checkout a new branch
repoPath: string (optional; defaults to current directory)branchName: string (required)fromRef: string (optional; e.g., "origin/main")setUpstream: boolean (optional; default: true)git_commit_pushCommit all changes and push to branch
repoPath: string (required)message: string (required)branch: string (required)gitlab_create_issueCreate a new issue in GitLab project
project: string (required; numeric ID recommended)title: string (required)description: string (optional)labels: string[] (optional)assigneeIds: number[] (optional)milestoneId: number (optional)confidential: boolean (optional)To find your GitLab project ID:
12345) not the project pathimport { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
import { McpClient } from "@modelcontextprotocol/sdk/client/mcp.js";
async function example() {
const transport = new StdioClientTransport({
command: "npx",
args: ["-y", "@evalin8/mcp-gitlab-server"],
});
const client = new McpClient(transport);
await client.connect();
// Create a feature branch
await client.callTool("git_create_branch", {
repoPath: "/path/to/repo",
branchName: "feat/ai-integration",
fromRef: "origin/main",
});
// Make changes, then commit and push
await client.callTool("git_commit_push", {
repoPath: "/path/to/repo",
message: "feat: add AI integration",
branch: "feat/ai-integration",
});
// Create a GitLab issue
await client.callTool("gitlab_create_issue", {
project: "12345",
title: "Review AI integration feature",
description: "Please review the new AI integration implementation",
});
await client.close();
}
GITLAB_HOST includes the full API path (e.g., https://gitlab.com/api/v4) and use numeric project IDapi scope and is correctly setsetUpstream: false or configure Git credentials/SSHGIT_TERMINAL_PROMPT=0 to avoid interactive prompts.env file is in the correct locationnpm run build
npm run dev
npm run start
GITLAB_HOST: GitLab API URL including /api/v4 path (e.g., https://gitlab.com/api/v4 or https://gitlab.company.com/api/v4) - defaults to https://gitlab.com/api/v4GITLAB_TOKEN: Your GitLab personal access token (required)MIT License - Copyright (c) 2025 Eva
This MCP server is licensed under the MIT License. Feel free to use, modify, and distribute according to the license terms.
FAQs
MCP server that offers Git (branch/commit/push via git CLI) + GitLab issue creation.
We found that @evalin8/mcp-gitlab-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.