New Research: Supply Chain Attack on Axios Pulls Malicious Dependency from npm.Details
Socket
Book a DemoSign in
Socket

@structured-world/gitlab-mcp

Package Overview
Dependencies
Maintainers
1
Versions
126
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@structured-world/gitlab-mcp

Advanced GitLab MCP server

latest
Source
npmnpm
Version
7.1.0
Version published
Weekly downloads
2K
66.61%
Maintainers
1
Weekly downloads
 
Created
Source

Advanced GitLab MCP server

npm version npm downloads License Release Coverage Coverage Report

Advanced GitLab MCP server — 44 tools across 18 entity types with CQRS architecture, OAuth 2.1, and multiple transport modes.

Install in Claude Desktop Install in VS Code Install in VS Code Insiders

Quick Start

{
  "mcpServers": {
    "gitlab": {
      "command": "npx",
      "args": ["-y", "@structured-world/gitlab-mcp"],
      "env": {
        "GITLAB_TOKEN": "your_gitlab_token",
        "GITLAB_API_URL": "https://gitlab.com"
      }
    }
  }
}

Requirements: Node.js >= 24

Highlights

  • 44 tools across 18 entity types — projects, merge requests, pipelines, work items, wiki, and more
  • CQRS architecturebrowse_* for queries, manage_* for commands
  • Connection resilience — Bounded startup, auto-reconnect with exponential backoff, disconnected mode when GitLab is unreachable
  • Multi-instance support — Connect to multiple GitLab instances with per-instance OAuth and rate limiting
  • Multiple transports — stdio, SSE, StreamableHTTP
  • OAuth 2.1 — Per-user authentication via Claude Custom Connector
  • Read-only mode — Safe operation for production environments
  • Auto-discovery — Detects GitLab config from git remotes
  • Fine-grained control — Enable/disable tool groups, filter actions, customize descriptions
  • Docker supportghcr.io/structured-world/gitlab-mcp:latest

Documentation

Full documentation is available at gitlab-mcp.sw.foundation

SectionDescription
Installationnpm, Docker, VS Code, Codex
ConfigurationEnvironment variables, feature flags
Multi-InstanceConnect to multiple GitLab instances
Tool ReferenceAll 44 tools with parameters
OAuth SetupTeam authentication with Claude
TLS/HTTPSProduction deployment with SSL
CustomizationTool descriptions, action filtering
CLI ToolsBrowse and export tool documentation

Auto-generated Tool Reference

For the complete tool reference with parameters:

# View locally
yarn list-tools --detail

# Generate documentation
yarn list-tools --export --toc > docs/tools/api-reference.md

See the Full API Reference for the auto-generated tool documentation.

Docker

# HTTP mode
docker run -e PORT=3002 -e GITLAB_TOKEN=your_token -p 3333:3002 \
  ghcr.io/structured-world/gitlab-mcp:latest

# stdio mode
docker run -i --rm -e GITLAB_TOKEN=your_token \
  ghcr.io/structured-world/gitlab-mcp:latest

Connection Resilience

The server handles GitLab connectivity issues gracefully:

  • Bounded startup — Server starts within GITLAB_INIT_TIMEOUT_MS (default 5s) regardless of GitLab availability
  • Disconnected mode — When GitLab is unreachable (disconnected/failed state), only the manage_context tool is exposed, with local actions such as whoami, switch_profile, and set_scope for diagnostics. During active reconnect (connecting state), the full tool list remains available so MCP clients don't lose their tool catalog during brief outages. MCP clients are notified of tool availability changes via tools/list_changed
  • Auto-reconnect — Exponential backoff reconnection (5s → 60s) with ±10% jitter
  • Error classification — Transient errors (network, 5xx, timeouts) trigger auto-reconnect. Auth/config errors at startup transition to failed state (no auto-reconnect). Runtime auth errors from tool calls are forwarded to HealthMonitor.reportError() via classifyError(); the remaining gap is token-revocation/403 detection (#370)
  • Instance health monitor — Each monitored instance URL has its own XState state machine. Untracked OAuth URLs currently pass through as reachable.
VariableDefaultDescription
GITLAB_INIT_TIMEOUT_MS5000Max time to wait for GitLab during startup
GITLAB_RECONNECT_BASE_DELAY_MS5000Initial reconnect delay (doubles each attempt)
GITLAB_RECONNECT_MAX_DELAY_MS60000Maximum reconnect delay
GITLAB_HEALTH_CHECK_INTERVAL_MS60000Health check interval when connected
GITLAB_FAILURE_THRESHOLD3Consecutive transient failures before disconnecting
GITLAB_TOOL_TIMEOUT_MS120000Max time for tool/bootstrap execution before timeout
GITLAB_RESPONSE_WRITE_TIMEOUT_MS10000Max time to flush a non-SSE response before destroying zombie connection (0 to disable; SSE uses heartbeat)
GITLAB_INSTANCE_CACHE_MAX100Max number of per-URL instance states kept in memory (OAuth multi-tenant; LRU eviction when exceeded)
GITLAB_INSTANCE_TTL_MS3600000TTL for idle per-URL instance states in ms; evicted on next insert (OAuth multi-tenant)

Feature Flags

FlagDefaultTools Enabled
USE_LABELStrueLabel management
USE_MRStrueMerge requests
USE_FILEStrueFile operations
USE_VARIABLEStrueCI/CD variables
USE_WORKITEMStrueIssues, epics, tasks
USE_WEBHOOKStrueWebhook management
USE_SNIPPETStrueCode snippets
USE_INTEGRATIONStrue50+ integrations
USE_GITLAB_WIKItrueWiki pages
USE_MILESTONEtrueMilestones
USE_PIPELINEtruePipelines & CI/CD
USE_RELEASEStrueRelease management
USE_REFStrueBranch & tag management
USE_MEMBERStrueTeam members
USE_SEARCHtrueCross-project search
USE_ITERATIONStrueIteration planning (sprints)

Contributing

See CONTRIBUTING.md for development setup, testing, and PR guidelines.

Support the Project

USDT TRC-20 Donation QR Code

USDT (TRC-20): TFDsezHa1cBkoeZT5q2T49Wp66K8t2DmdA

License

Apache License 2.0 — see LICENSE for details.

Based on zereight/gitlab-mcp (MIT). See LICENSE.MIT.

Keywords

mcp

FAQs

Package last updated on 07 Apr 2026

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts