structured-world/gitlab-mcp (structured-world/gitlab-mcp) is an MCP server listed on the M8ven Trust Index. M8ven has not graded it yet. No publisher has claimed this listing.

—

Not scored

structured-world/gitlab-mcp

Item: structured-world/gitlab-mcp
Author: M8ven

Advanced GitLab MCP server

→ structured-world/gitlab-mcp· npm: @structured-world/gitlab-mcp· listed on npm

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

structured-world

Source: npm · also listed on Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

npmscored separately Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

⏳ This MCP is queued for scoring. Check back in a few minutes.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 1 credential: GITLAB_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configDASHBOARD_ENABLED

configDEFAULT_NULL

configGATEWAY_DOWNSTREAM_ARGS

configGATEWAY_DOWNSTREAM_COMMAND

configGATEWAY_POLL_MS

configGITLAB_ALLOWED_PROJECT_IDS

configGITLAB_ALLOWED_TOOLS_REGEX

configGITLAB_API_BODY_TIMEOUT_MS

configGITLAB_API_CONNECT_TIMEOUT_MS

configGITLAB_API_HEADERS_TIMEOUT_MS

configGITLAB_API_RETRY_BASE_DELAY_MS

configGITLAB_API_RETRY_ENABLED

configGITLAB_API_RETRY_MAX_ATTEMPTS

configGITLAB_API_RETRY_MAX_DELAY_MS

configGITLAB_API_URL"": "https://gitlab.com"

configGITLAB_AUTH_COOKIE_PATH

configGITLAB_CA_CERT_PATH

configGITLAB_CROSS_REFS

configGITLAB_DEFAULT_NAMESPACE

configGITLAB_DEFAULT_PROJECT

configGITLAB_DENIED_ACTIONS

configGITLAB_DENIED_TOOLS_REGEX

configGITLAB_FAILURE_THRESHOLD3 Consecutive transient failures before disconnecting

configGITLAB_HEALTH_CHECK_INTERVAL_MS60000 Health check interval when connected

configGITLAB_HTTP_KEEPALIVE_TIMEOUT_MS

configGITLAB_INIT_TIMEOUT_MSBounded startup — Server starts within (default 5s) regardless of GitLab availability

configGITLAB_INSTANCES

configGITLAB_INSTANCES_FILE

configGITLAB_INSTANCE_CACHE_MAX100 Max number of per-URL instance states kept in memory (OAuth multi-tenant; LRU eviction when exceeded)

configGITLAB_INSTANCE_TTL_MS3600000 TTL for idle per-URL instance states in ms; evicted on next insert (OAuth multi-tenant)

configGITLAB_IS_OLD

configGITLAB_MCP_PRESET

configGITLAB_POOL_MAX_CONNECTIONS

configGITLAB_PROJECT_ID

configGITLAB_READONLY

configGITLAB_READ_ONLY_MODE

configGITLAB_RECONNECT_BASE_DELAY_MS5000 Initial reconnect delay (doubles each attempt)

configGITLAB_RECONNECT_MAX_DELAY_MS60000 Maximum reconnect delay

configGITLAB_RESPONSE_WRITE_TIMEOUT_MS10000 Max time to flush a non-SSE response before destroying zombie connection (0 to disable; SSE uses heartbeat)

configGITLAB_SCHEMA_MODE

configGITLAB_SSE_HEARTBEAT_MS

🔐 secretGITLAB_TOKEN"": "your_gitlab_token",

configGITLAB_TOOL_TIMEOUT_MS120000 Max time for tool/bootstrap execution before timeout

configGITLAB_URL

configHOST

configHTTPS_PROXY

configHTTP_PROXY

configJEST_UNIT_ONLY

configLOG_FILTER

configLOG_FORMAT

configOAUTH_ENABLED

configRATE_LIMIT_IP_ENABLED

configRATE_LIMIT_IP_MAX_REQUESTS

configRATE_LIMIT_IP_WINDOW_MS

configRATE_LIMIT_SESSION_ENABLED

configRATE_LIMIT_SESSION_MAX_REQUESTS

configRATE_LIMIT_SESSION_WINDOW_MS

configRELEASE_VERSION

configSKIP_TLS_VERIFY

configSSL_CA_PATH

configSSL_CERT_PATH

configSSL_KEY_PATH

configSSL_PASSPHRASE

configTRUST_PROXY

configUSE_ACCESS_TOKENStrue Project/group/personal access token management

configUSE_AUDIT_EVENTStrue Audit events (Premium+)

configUSE_CI_TOKENStrue CI access credentials: job token scope and deploy keys

configUSE_ENVIRONMENTStrue Environments and deployments

configUSE_FILEStrue File operations

configUSE_GITLAB_WIKItrue Wiki pages

configUSE_INTEGRATIONStrue 50+ integrations

configUSE_ITERATIONStrue Iteration planning (sprints)

configUSE_LABELStrue Label management

configUSE_MEMBERStrue Team members

configUSE_MILESTONEtrue Milestones

configUSE_MRStrue Merge requests

configUSE_PIPELINEtrue Pipelines & CI/CD

configUSE_REFStrue Branch & tag management

configUSE_REGISTRYtrue Container registry repositories and tags

configUSE_RELEASEStrue Release management

configUSE_RUNNERStrue CI runner management

configUSE_SEARCHtrue Cross-project search

configUSE_SNIPPETStrue Code snippets

configUSE_VARIABLEStrue CI/CD variables

configUSE_VULNERABILITIEStrue Vulnerability management (Ultimate)

configUSE_WEBHOOKStrue Webhook management

configUSE_WORKITEMStrue Issues, epics, tasks

Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.

deployPORT

// quality suggestions

Tools detected

No tools extracted — insufficient content to verify at Tier 2

Shell command execution

2 child_process calls — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Secrets not logged

1 secret value sent to console.log

Redact or omit secret values from log output.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/structured-world/gitlab-mcp)](https://m8ven.ai/mcp/structured-world/gitlab-mcp)

Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.

commit: e536be09fd8205abb48d7e74d5597401889f598d

code hash: e944e548162a0f473c028f228c25196b6992e80b13abf45694e77e89d99b1e34

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client