Back to Home
Knuckles-Team icon

gitlab-api

by Knuckles-Team

Overview

This project provides a Python wrapper for GitLab, serving as an MCP (Model Context Protocol) server to expose GitLab APIs as tools for LLMs, and an A2A (Agent-to-Agent) multi-agent system for delegated GitLab task management with a knowledge graph.

Installation

Run Command
docker run -d --name gitlab-mcp -p 8004:8004 -e HOST=0.0.0.0 -e PORT=8004 -e TRANSPORT=http -e AUTH_TYPE=none -e EUNOMIA_TYPE=none -e GITLAB_INSTANCE="${GITLAB_INSTANCE}" -e GITLAB_ACCESS_TOKEN="${GITLAB_ACCESS_TOKEN}" knucklessg1/gitlab:latest gitlab-mcp

Environment Variables

  • HOST
  • PORT
  • TRANSPORT
  • GITLAB_INSTANCE
  • GITLAB_ACCESS_TOKEN
  • GITLAB_VERIFY
  • AUTH_TYPE
  • OIDC_CONFIG_URL
  • OIDC_CLIENT_ID
  • OIDC_CLIENT_SECRET
  • OIDC_BASE_URL
  • ALLOWED_CLIENT_REDIRECT_URIS
  • ENABLE_DELEGATION
  • AUDIENCE
  • DELEGATED_SCOPES
  • EUNOMIA_TYPE
  • EUNOMIA_POLICY_FILE
  • FASTMCP_SERVER_AUTH_JWT_ALGORITHM
  • FASTMCP_SERVER_AUTH_JWT_PUBLIC_KEY
  • FASTMCP_SERVER_AUTH_JWT_REQUIRED_SCOPES
  • MCP_CONFIG
  • MCP_URL
  • PROVIDER
  • OPENAI_BASE_URL
  • OPENAI_API_KEY
  • MODEL_ID
  • DEBUG
  • ENABLE_WEB_UI
  • SKILLS_DIRECTORY
  • OPENAPI_USERNAME
  • OPENAPI_PASSWORD
  • OPENAPI_CLIENT_ID
  • OPENAPI_CLIENT_SECRET

Security Notes

The `compose.yml` file contains a hardcoded default `GITLAB_ACCESS_TOKEN` (`glpat-asdfa;sldkfj`) which is a critical security vulnerability if not explicitly overridden by the user. Running with `GITLAB_VERIFY=False` (disabled SSL verification) is optional but poses a man-in-the-middle risk if used in production environments. While authentication mechanisms (JWT, OIDC) are supported, the default token significantly lowers the overall security posture for quick starts.

Similar Servers

Stats

Interest Score36
Security Score3
Cost ClassMedium
Avg Tokens2500
Stars9
Forks0
Last Update2026-01-19

Tags

GitLabAPI WrapperMCP ServerAgent-to-Agent (A2A)LLM ToolsCI/CD AutomationDevOps