What it can do: io.github.zereight/gitlab-mcp

MCP server · zereight

What io.github.zereight/gitlab-mcp declares, asks for and runs, according to the marketplaces we read. Runs on your machine: the AI tool starts this npm package locally: @zereight/mcp-gitlab. Environment variables it asks for: 20, secrets among them: 2. As of our marketplace pass on 2026-10-12.

This is not a security audit. We list what the marketplaces publish about this plugin: what it declares, what it asks for and what it runs. We do not run or inspect its code, and a verified mark is the marketplace's statement, not ours.

Where it runs

Runs on your machine: the AI tool starts this npm package locally: @zereight/mcp-gitlabAs declared on: Official MCP Registry.

What it declares

None of the marketplaces we read publishes a list of tools for it.

Prompts and resources: the marketplaces we read do not publish them.

What it asks for

Environment variables it asks for: 20, secrets among them: 2. As declared on: Official MCP Registry.

GITLAB_ALLOWED_PROJECT_IDS
GITLAB_API_URL
GITLAB_AUTH_COOKIE_PATH
GITLAB_CA_CERT_PATH
GITLAB_DENIED_TOOLS_REGEX
GITLAB_JOB_TOKEN secret
GITLAB_MASKING_CONFIG
GITLAB_MASKING_ENABLED
GITLAB_MASKING_POLICY_FILE
GITLAB_MASKING_WORKSPACE_DIR
GITLAB_OAUTH_CLIENT_ID
GITLAB_OAUTH_TOKEN_SCRIPT

Show the remaining 8

GITLAB_PERMISSION_MODE
GITLAB_PERSONAL_ACCESS_TOKEN secret
GITLAB_TOOLS
GITLAB_TOOLSETS
GITLAB_TOOL_POLICY_APPROVE
GITLAB_TOOL_POLICY_HIDDEN
GITLAB_USE_OAUTH
NODE_TLS_REJECT_UNAUTHORIZED

Names only: we keep no values, examples or descriptions of these variables. OAuth scopes and install-time settings are not published by the marketplaces we read.

What it runs besides MCP

None of the marketplaces we read lists hooks, commands, agents or language servers for it.

Who answers for it

zereight

No marketplace we read marks it or its publisher as verified.
No marketplace we read states its license.
Last release we saw: 2026-10-12.
The repository github.com/zereight/gitlab-mcp belongs to the account the publisher is listed under on Official MCP Registry.

How it has changed

2026-10-12Official MCP Registry: environment variables changed (now 20): added GITLAB_OAUTH_CLIENT_ID, GITLAB_OAUTH_TOKEN_SCRIPT, GITLAB_PERMISSION_MODE, GITLAB_USE_OAUTH; removed GITLAB_READ_ONLY_MODE, USE_GITLAB_WIKI; secret or required flag changed on GITLAB_PERSONAL_ACCESS_TOKEN

In context

Median number of secrets an MCP server asks for on the marketplaces we read: 0.0. This one asks for: 2.
Share of MCP servers that run on a remote server: 63%.

Where it is published and how its figures have moved

Compare it side by side with similar plugins

Data comes from the Official MCP Registry (registry.modelcontextprotocol.io), CC0 1.0. Figures come from our own regular passes over the marketplaces, last read on 2026-10-12. We publish no contact details for plugin publishers.