wanadev/gitlab-mcp (wanadev/gitlab-mcp) is an MCP server listed on the M8ven Trust Index. It scores 58 out of 100, grade D. It declares 102 tools. No publisher has claimed this listing.

Caution

58/100

wanadev/gitlab-mcp

Item: wanadev/gitlab-mcp
Rating: 58
Author: M8ven

Provides full control over GitLab epics, issues, merge requests, pipelines, and more via a conversational interface, with dry-run safety.

→ wanadev/gitlab-mcp · listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

wanadev

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

⚠️

Known vulnerabilities in dependencies: 3 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

102 tools verified — handlers match their declared behaviour

42 read-only tools verified — handlers contain no write/delete/exec

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 1 credential: GITLAB_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes101 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

gitlab_setup

GitLab MCP is not configured yet. Call this tool to show the user how to set up their GitLab token.

list_pipelines

List recent pipelines for a project. Filter by branch (ref) or status (running, pending, success, failed, canceled).

get_pipeline

Get details of a specific pipeline (status, duration, jobs).

get_job_log

Get the log output of a CI job (last 2000 chars).

retry_pipeline

Retry a failed pipeline. dry_run=true by default.

cancel_pipeline

Cancel a running pipeline. dry_run=true by default.

list_branches

List branches of a project. Filter by search term.

create_branch

Create a new branch from a ref. dry_run=true by default.

list_repository_tree

List files and directories in a project repository.

get_file

Get the content of a file from the repository.

list_protected_branches

List protected branches for a project, with their push/merge/unprotect access levels.

protect_branch

Protect a branch with given push/merge/unprotect access levels. Access levels: 0=NoAccess, 30=Developer, 40=Maintainer, 60=Admin. dry_run=true by default.

unprotect_branch

Remove branch protection rules from a branch. dry_run=true by default.

create_file

Create a new file in a repository. Rejects if the file already exists. dry_run=true by default.

update_file

Update an existing file in a repository. Supports optimistic concurrency via last_commit_id. dry_run=true by default.

delete_file

Delete a file from a repository. dry_run=true by default. This is destructive on the branch.

commit_files

Atomically commit multiple file actions (create/update/delete/move/chmod) in a single commit. dry_run=true by default.

list_commits

List recent commits for a project. Filter by branch or file path.

list_epics

Lister les epics d'un groupe GitLab. Filtrer par etat, recherche textuelle ou labels.

get_epic

Obtenir les details complets d'un epic par son numero (IID).

create_epic

Creer un nouvel epic dans un groupe GitLab. Par defaut dry_run=true : retourne un apercu sans creer. Passer dry_run=false apres confirmation.

update_epic

Mettre a jour un epic existant. Par defaut dry_run=true : retourne un apercu sans modifier. Passer dry_run=false apres confirmation.

close_epic

Fermer un epic. Par defaut dry_run=true : retourne un apercu sans fermer. Passer dry_run=false apres confirmation.

reopen_epic

Reopen a closed epic. dry_run=true by default.

list_epic_issues

Lister les issues rattachees a un epic. Affiche l'ID global et le IID projet de chaque issue.

add_issue_to_epic

Link an issue to an epic. dry_run=true by default. Requires project_id and issue_iid (not the global issue ID).

list_epic_notes

Lister les commentaires d'un epic.

add_epic_note

Ajouter un commentaire sur un epic. Par defaut dry_run=true.

update_epic_note

Edit the body of an existing epic note. Get note_id from list_epic_notes. dry_run=true by default.

delete_epic_note

Delete an existing epic note. This is destructive and cannot be undone. dry_run=true by default.

get_epic_widgets

Get Work Item widgets for an epic: health status, progress, milestone, iteration, and linked items.

set_epic_milestone

Associate a milestone with an epic (uses Work Items API). dry_run=true by default.

set_epic_health_status

Set the health status of an epic (onTrack, needsAttention, atRisk, or null to clear). dry_run=true by default.

set_issue_health_status

Set the health status of an issue (onTrack, needsAttention, atRisk, or null to clear). dry_run=true by default.

set_epic_iteration

Associate an iteration (sprint) with an epic (uses Work Items API). dry_run=true by default.

get_work_item_id

Resolve the WorkItem global ID (gid://gitlab/WorkItem/N) for an epic or issue. Required as parent_work_item_id / child_work_item_ids on link_work_items and unlink_work_items.

link_work_items

Attach one or more work items (issues or epics) as children of a parent work item (epic). Uses the Work Items hierarchy widget — the canonical GitLab 17+ replacement for add_issue_to_epic. Idempotent: existing children of the parent are preserved. Resolve GIDs via get_work_item_id. dry_run=true by d…

unlink_work_items

Detach one or more work items from their current parent. Per-child operation: each child is unset from whatever parent it currently has (parent_work_item_id is accepted for symmetry but the unlink does not assert it). dry_run=true by default.

add_linked_item

Create a link between two work items (epics or issues). Link types: RELATED, BLOCKS, BLOCKED_BY. dry_run=true by default.

list_issues

Lister les issues d'un groupe GitLab. Filtrer par etat, recherche, labels, milestone ou assignee.

get_issue

Obtenir les details d'une issue par son projet et son numero (IID).

create_issue

Creer une nouvelle issue dans un projet. Par defaut dry_run=true : retourne un apercu sans creer. Passer dry_run=false apres confirmation.

update_issue

Mettre a jour une issue existante. Par defaut dry_run=true : retourne un apercu sans modifier. Passer dry_run=false apres confirmation.

close_issue

Fermer une issue. Par defaut dry_run=true : retourne un apercu sans fermer. Passer dry_run=false apres confirmation.

reopen_issue

Reopen a closed issue. dry_run=true by default.

list_project_issues

List issues for a specific project (not group). Filter by state, labels, milestone, assignee, iteration.

list_issue_notes

Lister les commentaires d'une issue.

add_issue_note

Ajouter un commentaire sur une issue. Par defaut dry_run=true.

update_issue_note

Edit the body of an existing issue note. Get note_id from list_issue_notes. dry_run=true by default.

delete_issue_note

Delete an existing issue note. This is destructive and cannot be undone. dry_run=true by default.

list_merge_requests

Lister les merge requests d'un groupe GitLab. Filtrer par etat, auteur, reviewer, labels ou milestone.

get_merge_request

Obtenir les details d'une merge request par son projet et son numero (IID).

create_merge_request

Create a new merge request. dry_run=true by default.

update_merge_request

Update a merge request (title, description, labels, assignees, reviewers). dry_run=true by default.

merge_merge_request

Merge a merge request. dry_run=true by default.

approve_merge_request

Approve a merge request. dry_run=true by default.

rebase_merge_request

Trigger an asynchronous rebase of the MR's source branch on top of the target branch. Useful when CI requires a linear history before merge. dry_run=true by default.

list_mr_notes

List comments on a merge request.

add_mr_note

Add a comment to a merge request. dry_run=true by default.

update_mr_note

Edit the body of an existing MR note. Get note_id from list_mr_notes. dry_run=true by default.

delete_mr_note

Delete an existing MR note. This is destructive and cannot be undone. dry_run=true by default.

get_mr_diff

Get the file changes (diff summary) of a merge request. Returns diff_refs (base_sha/head_sha/start_sha) needed to create line-positioned discussions via create_mr_discussion.

list_mr_approval_rules

List the project-level MR approval rules: who must approve, how many approvals are required, applies-to-which-branches.

create_mr_approval_rule

Create a project-level MR approval rule. dry_run=true by default.

update_mr_approval_rule

Update an existing project-level MR approval rule. dry_run=true by default.

delete_mr_approval_rule

Delete a project-level MR approval rule. dry_run=true by default. This is destructive.

create_mr_discussion

Create a code-review comment on a specific line in an MR's diff (a 'discussion' in GitLab terminology). Requires the diff_refs (base_sha, head_sha, start_sha) returned by get_mr_diff. Provide exactly one of new_line / old_line. dry_run=true by default.

resolve_mr_discussion

Mark an MR discussion as resolved (or unresolved). dry_run=true by default.

list_milestones

Lister les milestones d'un groupe GitLab. Filtrer par etat ou recherche textuelle.

get_milestone

Obtenir les details d'un milestone par son ID.

create_milestone

Creer un nouveau milestone. Par defaut dry_run=true : retourne un apercu sans creer. Passer dry_run=false apres confirmation.

update_milestone

Mettre a jour un milestone existant. Par defaut dry_run=true.

close_milestone

Fermer un milestone. Par defaut dry_run=true.

list_project_milestones

List milestones at the project level. On GitLab CE/Free, milestones are project-scoped and this is the only way to list them.

get_project_milestone

Get details of a project-level milestone.

create_project_milestone

Create a milestone on a project. dry_run=true by default.

update_project_milestone

Update a project-level milestone. dry_run=true by default.

close_project_milestone

Close a project-level milestone. dry_run=true by default.

list_groups

Lister les groupes GitLab accessibles. IMPORTANT : appelez ce tool en premier quand l'utilisateur mentionne un groupe par son nom, pour obtenir le group_id (ID ou full_path) a passer aux autres tools.

list_projects

Lister les projets d'un groupe GitLab. Filtrer par recherche ou statut d'archivage.

list_group_members

Lister les membres d'un groupe GitLab avec leur niveau d'acces.

list_labels

Lister les labels d'un groupe GitLab avec le nombre d'issues et MRs associees.

list_boards

Lister les boards (tableaux kanban) d'un groupe GitLab avec leurs colonnes.

list_iterations

List iterations (sprints) for a GitLab group. Filter by state (upcoming, current, closed) or search by title. Requires GitLab Premium/Ultimate.

create_iteration

Create a new iteration (sprint) in a group. start_date and due_date are required (YYYY-MM-DD). dry_run=true by default.

update_iteration

Update an existing iteration (sprint). The REST path uses iteration_iid (per-group), not the global id. dry_run=true by default.

get_work_item_type_id

Discover the global ID of a Work Item type (e.g. EPIC, ISSUE, TASK) for a given namespace. Required as workItemTypeId on workItemCreate. IDs vary per GitLab instance and version, so call this once per (namespace, type) and cache the result.

list_workitem_statuses

List allowed Status widget values for a Work Item type in a group (GitLab 17+). Returns global IDs to pass as status_id to update_issue / update_epic.

create_label

Create a label in a group. dry_run=true by default.

update_label

Update a label in a group. dry_run=true by default.

delete_label

Delete a label from a group. dry_run=true by default. This is destructive and cannot be undone.

add_group_member

Add a user to a group with a given access level. dry_run=true by default.

add_project_member

Add a user to a project with a given access level. dry_run=true by default.

update_member_access_level

Change a member's access level on a group or project. dry_run=true by default.

remove_member

Remove a user from a group or project. dry_run=true by default. This is destructive.

search_issues

Search issues by full-text query within a project or group. Maps to GET /:scope/:id/search?scope=issues.

search_merge_requests

Search merge requests by full-text query within a project or group. Maps to GET /:scope/:id/search?scope=merge_requests.

search_blobs

Search code/file contents by full-text query within a project or group. Returns matching blobs with line context. Maps to GET /:scope/:id/search?scope=blobs.

upload_file

Upload a file to a project so it can be embedded in an issue, MR, or epic description. Returns the Markdown snippet GitLab expects (e.g. ![alt](/uploads/...)). Provide exactly one of file_path (read from local disk) or file_base64 (inline data). dry_run=true by default.

search_users

Search for GitLab users globally by name or username.

1 further tool is not listed here. The complete surface is in the source.

// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configGITLAB_BASE_URL"": "https://gitlab.com",

configGITLAB_READ_ONLY"": "false"

configGITLAB_TEST_GROUP

configGITLAB_TEST_PROJECT_ID

🔐 secretGITLAB_TOKENSet in your environment (.bashrc, .zshrc, or system variable). The plugin will guide you on first launch if it's missing.

// quality suggestions

All four hints declared on every tool

102/102 tools missing one or more hints — gitlab_setup (missing: destructiveHint, idempotentHint, openWorldHint); gitlab_setup (missing: destructiveHint, idempotentHint, openWorldHint); list_pipelines (missing: destructiveHint, idempotentHint, openWorldHint), +99 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

69/102 tool handlers declare input schemas (68%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

100/102 tool handlers wrap calls in try/catch (98%)

Wrap each tool handler body in try/catch and return a structured error response.

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/wanadev/gitlab-mcp?variant=verified)](https://m8ven.ai/mcp/wanadev/gitlab-mcp)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 3d03461a3428bdb463a699c09bfbdd5a8322166e

code hash: 0251ff1bc6ba78ded3d761dc5bd7e46a7b43663c126f6d776c8ae3efd8ebe908

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client