
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@jmrpio/gitlab-mcp-server
Advanced tools
Model Context Protocol (MCP) server exposing GitLab REST v4 and GraphQL as tools for AI assistants. Runs as a local binary over stdio or HTTP.
A Model Context Protocol server that exposes the GitLab REST v4 and GraphQL APIs as tools for AI assistants. It runs as a local binary over stdio (default) or HTTP.
This package is a thin launcher. The actual server is a prebuilt Go binary that ships inside a per-platform package; npm installs only the one matching your operating system and CPU, so there is nothing to compile and nothing is downloaded at install time.
npx @jmrpio/gitlab-mcp-server
Most MCP clients are configured to launch the server this way. For example:
{
"mcpServers": {
"gitlab": {
"command": "npx",
"args": ["-y", "@jmrpio/gitlab-mcp-server"],
"env": {
"GITLAB_URL": "https://gitlab.com",
"GITLAB_TOKEN": "glpat-…"
}
}
}
}
npm install -g @jmrpio/gitlab-mcp-server
gitlab-mcp-server --help
GITLAB_URL and GITLAB_TOKEN are the two required environment variables in
stdio mode. Every flag and variable — HTTP mode, OAuth, read-only and safe
modes, tool surfaces, tiers — is documented in the
configuration reference.
The server can update itself in place, but that is disabled here: npm owns the
binary, and letting it replace itself would desynchronize what npm has
recorded. Update with your package manager instead (npm update -g @jmrpio/gitlab-mcp-server). Setting AUTO_UPDATE explicitly still takes
effect if you have a reason to override it.
Linux, macOS and Windows, on x64 and arm64. On any other platform the launcher exits with a message pointing to the release binaries and the option to build from source.
FAQs
Model Context Protocol (MCP) server exposing GitLab REST v4 and GraphQL as tools for AI assistants. Runs as a local binary over stdio or HTTP.
We found that @jmrpio/gitlab-mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.