← Back to search

@ttpears/gitlab-mcp-server

GitHub Actions Scanned 27d ago

GitLab MCP Server with GraphQL discovery

C
73.6 / 100

Versions

2.2.4latest
Jul 23, 2026
2.2.0
Jun 29, 2026
2.1.0
Jun 28, 2026
2.0.1
Jun 28, 2026
2.0.0
Jun 28, 2026
+ show 24 moreshow less
1.19.0
May 22, 2026
1.18.1
May 22, 2026
1.18.0
May 22, 2026
1.17.0
May 21, 2026
1.16.0
May 21, 2026
1.15.2
May 13, 2026
1.15.1
May 13, 2026
1.15.0
Apr 27, 2026
1.14.1
Apr 27, 2026
1.14.0
Apr 27, 2026
1.13.1
Apr 27, 2026
1.13.0
Apr 14, 2026
1.12.4
Apr 14, 2026
1.12.3
Apr 14, 2026
1.12.0
Apr 14, 2026
1.11.1
Apr 14, 2026
1.11.0
Apr 13, 2026
1.10.0
Apr 13, 2026
1.9.0
Apr 13, 2026
1.8.0
Apr 13, 2026
1.7.3
Feb 22, 2026
1.7.2
Feb 22, 2026
1.7.1
Feb 22, 2026
1.7.0
Feb 22, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 63

delete_issue
annotations: none low

Delete a GitLab issue. Requires a user token with permission to delete issues in the project (typically the issue author or a maintainer).

update_merge_request
annotations: none low

Update a merge request (title, description, assignees, reviewers, labels) with schema-aware mutations

get_current_user
annotations: none low

Get information about the current authenticated GitLab user

get_project
annotations: none low

Get detailed information about a specific GitLab project (read-only)

get_projects
annotations: none low

List projects accessible to the user (requires authentication to see private projects)

get_issues
annotations: none low

Get issues from a specific GitLab project (read-only)

get_merge_requests
annotations: none low

Get merge requests from a specific GitLab project (read-only)

create_issue
annotations: none low

Create a new issue in a GitLab project (requires user authentication with write permissions)

create_merge_request
annotations: none low

Create a new merge request in a GitLab project (requires user authentication with write permissions)

execute_custom_query
annotations: none low

Execute custom GraphQL queries for complex filtering (e.g., issues with assigneeUsernames: ["user"], labelName: ["bug"]). Use this for structured filtering by assignee/author/labels when search tools return 0 results. Use pagination and limit complexity to avoid timeouts.

execute_rest_read
annotations: none low

Execute an arbitrary GET request against the GitLab REST API at /api/v4. Open-ended escape hatch for read endpoints not covered by a dedicated tool — e.g. /projects/:id/repository/files, /projects/:id/pipelines/:pipeline_id/test_report, /admin/*. Provide the path beginning with "/" (no host, no /api/v4 prefix) and an optional query object. For writes, use execute_rest_write.

execute_rest_write
annotations: none low

Execute an arbitrary POST/PUT/PATCH/DELETE request against the GitLab REST API at /api/v4. Open-ended escape hatch for write endpoints not covered by a dedicated tool. Destructive — DELETE is permitted, so check the path before invoking. For reads, use execute_rest_read.

get_available_queries
annotations: none low

Get list of available GraphQL queries and mutations from the GitLab schema

update_issue
annotations: none low

Update an issue (title, description, assignees, labels, due date) with schema-aware mutations

resolve_path
annotations: none low

Resolve a GitLab path to either a project or group and list group projects when applicable

get_group_projects
annotations: none low

List projects inside a GitLab group (optionally filter by search term)

get_type_fields
annotations: none low

List available fields on a GraphQL type using introspected schema (requires schema to be introspected)

search_gitlab
annotations: none low

Text search across GitLab projects and issues (Note: Does not support filtering by assignee/labels - use search_issues for that. MRs cannot be searched globally - use search_merge_requests with username)

search_projects
annotations: none low

Search for GitLab projects by name or description

search_issues
annotations: none low

Search for issues with text search and/or structured filtering (assignee, author, labels, state). For filtering by assignee/author/labels without text search, leave searchTerm empty.

search_merge_requests
annotations: none low

Search merge requests by username (supports "username", "author:username", "assignee:username") or search within a specific project. Note: GitLab does not support global text search for MRs - use projectPath for text searches.

search_users
annotations: none low

Search for GitLab users by username or name - useful for finding team members or contributors

search_groups
annotations: none low

Search for GitLab groups and organizations

browse_repository
annotations: none low

Browse repository files and folders - essential for exploring codebase structure

get_file_content
annotations: none low

Get the content of a specific file from a GitLab repository - crucial for code analysis

get_merge_request_pipelines
annotations: none low

Get CI/CD pipelines for a merge request, including status, duration, and stages

get_pipeline_jobs
annotations: none low

Get jobs for a specific pipeline, including status, stage, duration, and retry/cancel info

manage_pipeline
annotations: none low

Retry or cancel a CI/CD pipeline (requires user authentication with write permissions)

get_merge_request_diffs
annotations: none low

Get diff statistics for a merge request, including per-file additions/deletions and diff refs

get_merge_request_commits
annotations: none low

Get commits for a merge request (excluding merge commits), with commit count and details

get_notes
annotations: none low

Get notes (comments) on an issue or merge request, including system notes and inline MR comments

get_issue_context
annotations: none low

Bundle issue body, all notes (paginated up to maxNotes), related merge requests (mentioning), closing merge requests, linked issues (relates_to/blocks/is_blocked_by) into a single call. Use this instead of fanning out across get_issues + get_notes + search_merge_requests when investigating an issue.

get_merge_request_context
annotations: none low

Bundle MR body, all notes (paginated up to maxNotes, filtered to non-system by default), commits, pipeline summary, reviewers with approval state, and issues this MR will close into a single call. Use this instead of fanning out across get_merge_requests + get_notes + get_merge_request_commits + get_merge_request_pipelines when investigating an MR.

search_notes
annotations: none low

Full-text search across issue and merge request comments. Scope can be global, a project, or a group. NOTE: on self-hosted GitLab, the "notes" search scope requires Advanced Search (Elasticsearch) to be enabled — without it, this endpoint returns an error. search_gitlab does NOT search note bodies; this tool does.

create_note
annotations: none low

Add a comment/note to an issue or merge request (requires user authentication)

delete_note
annotations: none low

Delete a comment (note) on a GitLab issue or merge request. Requires a user token belonging to the note author or a maintainer.

update_note
annotations: none low

Edit the body of an existing comment (note) on a GitLab issue or merge request. Requires a user token belonging to the note author.

list_milestones
annotations: none low

List milestones for a project or group with progress statistics (total/closed issue counts)

list_iterations
annotations: none low

List iterations (sprints) for a group with cadence info. Requires GitLab Premium/Ultimate.

get_time_tracking
annotations: none low

Get time tracking data (estimate, spent, timelogs) for an issue or merge request

get_merge_request_reviewers
annotations: none low

Get approval and reviewer status for a merge request, including who approved and review states

get_project_statistics
annotations: none low

Get aggregate project statistics: open issues/MRs, star/fork counts, storage sizes, commit count, last pipeline status, release count, and language breakdown

list_group_members
annotations: none low

List group members with access levels, optionally filtered by search term

search_labels
annotations: none low

Search for labels in a project or group, with optional text filtering

get_user_issues
annotations: none low

Get all issues assigned to a specific user - uses proper GraphQL filtering for reliable results

get_user_merge_requests
annotations: none low

Get merge requests for a specific user (as author or assignee) - uses proper GraphQL filtering

list_broadcast_messages
annotations: none low

List all GitLab broadcast messages (instance-wide announcements). Read-only.

get_broadcast_message
annotations: none low

Get a specific GitLab broadcast message by ID.

create_broadcast_message
annotations: none low

Create a GitLab broadcast message. Requires administrator privileges on the GitLab instance.

update_broadcast_message
annotations: none low

Update an existing GitLab broadcast message. Requires administrator privileges.

delete_broadcast_message
annotations: none low

Delete a GitLab broadcast message by ID. Requires administrator privileges.

get_work_item
annotations: none low

Fetch a GitLab work item (issue, task, epic, incident, OKR) by global ID. Returns the raw widgets array so epic hierarchy, health status, iteration, milestone, and dates are all visible. Accepts either a numeric id or a full gid (gid://gitlab/WorkItem/123).

list_work_items
annotations: none low

List work items within a namespace (group or project fullPath). Supports filtering by type (ISSUE, TASK, EPIC, INCIDENT, OBJECTIVE, KEY_RESULT) and state, plus cursor pagination and fetchAll.

list_my_todos
annotations: none low

List the authenticated user\'s GitLab to-do items (notifications about issues, MRs, mentions, reviews requested, etc.). Filter by state, action, target type, or group/project. Requires user authentication.

mark_todo_done
annotations: none low

Mark a single to-do item as done for the authenticated user. Requires the todo\'s ID (numeric or full gid://gitlab/Todo/N form) from list_my_todos.

mark_all_todos_done
annotations: none low

Mark pending to-do items as done for the authenticated user. With no arguments, marks every pending todo. Optional scoping args (groupPath, projectPath, action, type, authorIds, targetId) narrow which todos are marked. Irreversible without per-item restore_todo calls. Returns the actual list of updated todos.

restore_todo
annotations: none low

Restore a previously-marked-done to-do item back to pending state. Accepts the todo\'s ID (numeric or full gid://gitlab/Todo/N form).

list_my_events
annotations: none low

List the authenticated user\'s GitLab activity feed — pushes, MRs, comments, approvals, issue actions. Primary tool for "what did I just do". Requires user authentication.

list_user_events
annotations: none low

List a specific user\'s public GitLab activity feed by username or numeric ID. Use for tracking what a teammate has been working on.

list_project_events
annotations: none low

List activity events for a single GitLab project — commits pushed, MRs opened/merged, issues touched, notes added. Accepts project full path or numeric ID.

analytics_user_summary
annotations: none low

Aggregated activity summary for a user over a time window — totals by action type (pushes, MRs opened/merged, comments, approvals), breakdown by project and by day. Use this instead of list_user_events when you want counts rather than a raw event feed.

analytics_group_summary
annotations: none low

Aggregated activity summary for an entire group (optionally including subgroups) over a time window — totals by action type (pushes, MRs opened/merged, comments, approvals), with breakdowns by project, by contributor, and by day. Use this to answer "what did this team do" without fanning out across list_project_events yourself.

analytics_review_bottlenecks
annotations: none low

Aggregate open (non-draft) merge requests across a group or project to surface review bottlenecks. Returns per-reviewer queue stats, age-bucket histogram, and the stalest MRs by updatedAt. MRs with no reviewer assigned are bucketed under "(unassigned)".

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, execSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 137

low
Tool 'get_current_user' has no annotations annotation_checker · 100%
low
Tool 'get_project' has no annotations annotation_checker · 100%
low
Tool 'get_projects' has no annotations annotation_checker · 100%
low
Tool 'get_issues' has no annotations annotation_checker · 100%
low
Tool 'get_merge_requests' has no annotations annotation_checker · 100%
low
Tool 'create_issue' has no annotations annotation_checker · 100%
low
Tool 'create_merge_request' has no annotations annotation_checker · 100%
low
Tool 'execute_custom_query' has no annotations annotation_checker · 100%
low
Tool 'execute_rest_read' has no annotations annotation_checker · 100%
low
Tool 'execute_rest_write' has no annotations annotation_checker · 100%
low
Tool 'get_available_queries' has no annotations annotation_checker · 100%
low
Tool 'update_issue' has no annotations annotation_checker · 100%
low
Tool 'delete_issue' has no annotations annotation_checker · 100%
low
Tool 'update_merge_request' has no annotations annotation_checker · 100%
low
Tool 'resolve_path' has no annotations annotation_checker · 100%
low
Tool 'get_group_projects' has no annotations annotation_checker · 100%
low
Tool 'get_type_fields' has no annotations annotation_checker · 100%
low
Tool 'search_gitlab' has no annotations annotation_checker · 100%
low
Tool 'search_projects' has no annotations annotation_checker · 100%
low
Tool 'search_issues' has no annotations annotation_checker · 100%
low
Tool 'search_merge_requests' has no annotations annotation_checker · 100%
low
Tool 'search_users' has no annotations annotation_checker · 100%
low
Tool 'search_groups' has no annotations annotation_checker · 100%
low
Tool 'browse_repository' has no annotations annotation_checker · 100%
low
Tool 'get_file_content' has no annotations annotation_checker · 100%
low
Tool 'get_merge_request_pipelines' has no annotations annotation_checker · 100%
low
Tool 'get_pipeline_jobs' has no annotations annotation_checker · 100%
low
Tool 'manage_pipeline' has no annotations annotation_checker · 100%
low
Tool 'get_merge_request_diffs' has no annotations annotation_checker · 100%
low
Tool 'get_merge_request_commits' has no annotations annotation_checker · 100%
low
Tool 'get_notes' has no annotations annotation_checker · 100%
low
Tool 'get_issue_context' has no annotations annotation_checker · 100%
low
Tool 'get_merge_request_context' has no annotations annotation_checker · 100%
low
Tool 'search_notes' has no annotations annotation_checker · 100%
low
Tool 'create_note' has no annotations annotation_checker · 100%
low
Tool 'delete_note' has no annotations annotation_checker · 100%
low
Tool 'update_note' has no annotations annotation_checker · 100%
low
Tool 'list_milestones' has no annotations annotation_checker · 100%
low
Tool 'list_iterations' has no annotations annotation_checker · 100%
low
Tool 'get_time_tracking' has no annotations annotation_checker · 100%
low
Tool 'get_merge_request_reviewers' has no annotations annotation_checker · 100%
low
Tool 'get_project_statistics' has no annotations annotation_checker · 100%
low
Tool 'list_group_members' has no annotations annotation_checker · 100%
low
Tool 'search_labels' has no annotations annotation_checker · 100%
low
Tool 'get_user_issues' has no annotations annotation_checker · 100%
low
Tool 'get_user_merge_requests' has no annotations annotation_checker · 100%
low
Tool 'list_broadcast_messages' has no annotations annotation_checker · 100%
low
Tool 'get_broadcast_message' has no annotations annotation_checker · 100%
low
Tool 'create_broadcast_message' has no annotations annotation_checker · 100%
low
Tool 'update_broadcast_message' has no annotations annotation_checker · 100%
low
Tool 'delete_broadcast_message' has no annotations annotation_checker · 100%
low
Tool 'get_work_item' has no annotations annotation_checker · 100%
low
Tool 'list_work_items' has no annotations annotation_checker · 100%
low
Tool 'list_my_todos' has no annotations annotation_checker · 100%
low
Tool 'mark_todo_done' has no annotations annotation_checker · 100%
low
Tool 'mark_all_todos_done' has no annotations annotation_checker · 100%
low
Tool 'restore_todo' has no annotations annotation_checker · 100%
low
Tool 'list_my_events' has no annotations annotation_checker · 100%
low
Tool 'list_user_events' has no annotations annotation_checker · 100%
low
Tool 'list_project_events' has no annotations annotation_checker · 100%
low
Tool 'analytics_user_summary' has no annotations annotation_checker · 100%
low
Tool 'analytics_group_summary' has no annotations annotation_checker · 100%
low
Tool 'analytics_review_bottlenecks' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client secret in ttpears-gitlab-mcp-88e36b7/src/oauth.test.ts auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
info
package.json metadata manifest_parser · 100%
info
Tool: get_current_user manifest_parser · 90%
info
Tool: get_project manifest_parser · 90%
info
Tool: get_projects manifest_parser · 90%
info
Tool: get_issues manifest_parser · 90%
info
Tool: get_merge_requests manifest_parser · 90%
info
Tool: create_issue manifest_parser · 90%
info
Tool: create_merge_request manifest_parser · 90%
info
Tool: execute_custom_query manifest_parser · 90%
info
Tool: execute_rest_read manifest_parser · 90%
info
Tool: manage_pipeline manifest_parser · 90%
info
Tool: execute_rest_write manifest_parser · 90%
info
Tool: get_available_queries manifest_parser · 90%
info
Tool: update_issue manifest_parser · 90%
info
Tool: delete_issue manifest_parser · 90%
info
Tool: update_merge_request manifest_parser · 90%
info
Tool: resolve_path manifest_parser · 90%
info
Tool: get_group_projects manifest_parser · 90%
info
Tool: get_type_fields manifest_parser · 90%
info
Tool: search_gitlab manifest_parser · 90%
info
Tool: search_projects manifest_parser · 90%
info
Tool: search_issues manifest_parser · 90%
info
Tool: search_merge_requests manifest_parser · 90%
info
Tool: search_users manifest_parser · 90%
info
Tool: search_groups manifest_parser · 90%
info
Tool: browse_repository manifest_parser · 90%
info
Tool: get_file_content manifest_parser · 90%
info
Tool: get_merge_request_pipelines manifest_parser · 90%
info
Tool: get_pipeline_jobs manifest_parser · 90%
info
Tool: get_merge_request_diffs manifest_parser · 90%
info
Tool: get_merge_request_commits manifest_parser · 90%
info
Tool: get_notes manifest_parser · 90%
info
Tool: get_issue_context manifest_parser · 90%
info
Tool: get_merge_request_context manifest_parser · 90%
info
Tool: search_notes manifest_parser · 90%
info
Tool: create_note manifest_parser · 90%
info
Tool: delete_note manifest_parser · 90%
info
Tool: update_note manifest_parser · 90%
info
Tool: list_milestones manifest_parser · 90%
info
Tool: list_iterations manifest_parser · 90%
info
Tool: get_time_tracking manifest_parser · 90%
info
Tool: get_merge_request_reviewers manifest_parser · 90%
info
Tool: get_project_statistics manifest_parser · 90%
info
Tool: list_group_members manifest_parser · 90%
info
Tool: search_labels manifest_parser · 90%
info
Tool: get_user_issues manifest_parser · 90%
info
Tool: get_user_merge_requests manifest_parser · 90%
info
Tool: list_broadcast_messages manifest_parser · 90%
info
Tool: get_broadcast_message manifest_parser · 90%
info
Tool: create_broadcast_message manifest_parser · 90%
info
Tool: update_broadcast_message manifest_parser · 90%
info
Tool: delete_broadcast_message manifest_parser · 90%
info
Tool: get_work_item manifest_parser · 90%
info
Tool: list_work_items manifest_parser · 90%
info
Tool: list_my_todos manifest_parser · 90%
info
Tool: mark_todo_done manifest_parser · 90%
info
Tool: mark_all_todos_done manifest_parser · 90%
info
Tool: restore_todo manifest_parser · 90%
info
Tool: list_my_events manifest_parser · 90%
info
Tool: list_user_events manifest_parser · 90%
info
Tool: list_project_events manifest_parser · 90%
info
Tool: analytics_user_summary manifest_parser · 90%
info
Tool: analytics_group_summary manifest_parser · 90%
info
Tool: analytics_review_bottlenecks manifest_parser · 90%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (23) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 411 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%