@zereight/mcp-gitlab — MCP Score: 58/100 | MCPScore

What it does

A comprehensive MCP server that bridges Claude, VS Code, Cursor, and other AI clients to GitLab. It exposes 15 tools for managing projects, merge requests, issues, pipelines, wiki, releases, tags, and milestones. Supports three transport modes (stdio for local clients, SSE and Streamable HTTP for remote deployments), four authentication methods (PAT, local OAuth, MCP OAuth proxy, and per-request tokens), and works with both gitlab.com and self-hosted GitLab instances.

Who it's for

Backend and DevOps engineers who want to browse, search, and manage GitLab repositories from Claude Code or similar AI clients. Teams running self-hosted GitLab instances and needing tight integration with AI workflows. Organizations that prefer read-only mode for security auditing or lightweight access.

Common use cases

Query project structure, file contents, and commit history from Claude Code without leaving the editor
Create and update merge requests and issues through natural language prompts in your AI client
Monitor CI/CD pipeline status and view logs for active projects
Retrieve and contribute to project wiki and release notes
Manage labels, milestones, and tags across repositories

Setup pitfalls

This package has 139 embedded secrets and high risk class; store GitLab tokens in environment variables or secure secret managers, never hardcode them. Review the token's scope — it should have minimal required permissions (e.g., read-only if you don't intend to create MRs).
Four authentication methods exist; pick one based on your deployment: use GITLAB_PERSONAL_ACCESS_TOKEN for local/desktop clients, GITLAB_USE_OAUTH for local OAuth2 flow, GITLAB_MCP_OAUTH for remote clients (e.g., Claude.ai), or REMOTE_AUTHORIZATION for multi-user setups.
Custom GitLab instances require GITLAB_API_URL set to your self-hosted endpoint (e.g., https://gitlab.internal/api/v4); trailing path and proxy settings must match your network topology.
Some MCP clients have issues with environment variables; if authentication fails, use CLI arguments (--token, --api-url) instead.

Tool name	Description	Destructive?
omg_next_phase		✓ no
omg_check_completion		✓ no
omg_get_phase_info		✓ no
omg_read_memory		✓ no
omg_write_memory⚠		⚠ yes

Tool name

Description

Destructive?

omg_next_phase

✓ no

omg_check_completion

✓ no

omg_get_phase_info

✓ no

omg_read_memory

✓ no

omg_write_memory⚠

⚠ yes

omg_delete_memory⚠		⚠ yes
omg_read_prd		✓ no
omg_create_prd		✓ no
omg_update_story		✓ no
omg_verify_story		✓ no
omg_read_state		✓ no
omg_write_state⚠		⚠ yes
omg_clear_state		✓ no
omg_list_active		✓ no
omg_select_model		✓ no