dangerusslee/mcp-gitlab-server

GitLab MCP Server - A Model Context Protocol server for GitLab integration

→ dangerusslee/mcp-gitlab-server· npm: @dangerusslee/gitlab-mcp-server· listed on npm

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

npm

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

1 flow detected: GITLAB_PERSONAL_ACCESS_TOKEN. We can’t prove the destination matches the brand the credential belongs to.

⚠️

Tests do not pass

Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.

🔐

You'll be asked for 1 credential: GITLAB_PERSONAL_ACCESS_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configGITLAB_API_URL— No https://gitlab.com/api/v4 GitLab API URL

🔐 secretGITLAB_PERSONAL_ACCESS_TOKEN— Yes - Your GitLab personal access token

configGITLAB_READ_ONLY_MODE— No false Set to 'true' to enable read-only mode (see below)

configPORT— No 3000 Port for SSE transport

configUSE_SSE— No false Set to 'true' to use SSE transport

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/dangerusslee-gitlab-mcp-server-e9c050)](https://m8ven.ai/mcp/dangerusslee-gitlab-mcp-server-e9c050)

commit: 28bde8b36e84656ef0295a6cd2a5bc7512b67788

code hash: 74e4d495151b8f5935c17f1ccecb7c78504e23e09b2d2a38d6b6c49167728ad2

verified: 6/16/2026, 12:47:48 PM

view raw JSON →