← Back to search

io.github.mshegolev/gitlab-ci-mcp

mshegolev Scanned 12d ago

GitLab CI/CD MCP — pipelines, jobs, schedules, MRs, files. Any GitLab (SaaS or self-hosted).

C
66.3 / 100

Versions

0.5.1latest
first seen Jun 5, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 23

gitlab_get_file
annotations: none low

Read a text file from the repository, truncated to 500 lines. For binaries, gets decoded as UTF-8 with errors replaced — you will likely get garbage; use for text content only. Examples: - "Show me .gitlab-ci.yml on master" → ``file_path='.gitlab-ci.yml'`` - "Read src/app.py from the release-1.2 tag" → ``file_path='src/app.py'``, ``ref='release-1.2'`` - Don't use for listings — use ``gitlab_list_repository_tree``.

ref string file_path string project_path ProjectPath
gitlab_list_repository_tree
annotations: none low

List files and directories at a given path in the repository. Examples: - "Show top-level files" → default call - "All .py files recursively" → ``recursive=True`` then filter on ``.py`` in path - Don't use for full-text content — use ``gitlab_get_file`` for that.

ref string page string path string per_page string recursive string project_path ProjectPath
gitlab_project_info
annotations: none low

Return basic metadata about a project: ID, default branch, visibility, counts. Examples: - "What's the project ID and default branch" → default call - "Is this repo public or private" → look at ``visibility``

project_path ProjectPath
gitlab_list_branches
annotations: none low

List branches of a project, optionally filtered by substring. Includes ``default``, ``protected`` and ``merged`` flags, and the short id of the tip commit with its title and date. Examples: - "List all branches with 'release' in name" → ``search='release'`` - "Next page of branches" → ``page=2`` - Don't use when you want to check if a specific branch exists by exact name — use ``gitlab_get_file`` on that ref and look at the error instead.

page string search string per_page string project_path ProjectPath
gitlab_list_tags
annotations: none low

List tags of a project, newest first. Useful for release-note generation or checking the last shipped version. Examples: - "What was the last release tag" → default call, take the first item - "All v2.x releases" → ``search='v2.'``

page string search string per_page string project_path ProjectPath
gitlab_compare_branches
annotations: none low

Compare two branches — returns up to 30 commits and the list of changed files. Use for "what's in ``release/x.y`` vs ``master``?" or for release-note drafting. Examples: - "What's new in release/1.5 vs master" → ``source='release/1.5'``, ``target='master'`` - Don't use to fetch full diffs of an MR — use ``gitlab_get_merge_request_changes``.

source string target string project_path ProjectPath
gitlab_list_pipelines
annotations: none low

List recent pipelines of a project, newest first. Use for triage ("show failed pipelines on master"), release readiness checks, or feeding pipeline IDs into follow-up calls. Read-only and idempotent. Returns ``PipelinesListOutput``: ``project``, ``count``, ``pagination`` and ``pipelines[]`` (each ``PipelineSummary``). The tool result additionally carries a markdown table in its text content. Examples: - "Show failed pipelines on master" → ``status='failed'``, ``ref='master'`` - "Last nightly schedule runs" → ``source='schedule'`` - "Second page of pipelines" → ``page=2`` - Don't use when you have a specific pipeline ID — use ``gitlab_get_pipeline`` instead.

ref string page string source string status string per_page string project_path ProjectPath
gitlab_get_pipeline
annotations: none low

Get a single pipeline with full timing details. Useful right after ``gitlab_list_pipelines`` — lists only return summaries. Returns status, ref, source, durations (queued/total), and started/finished timestamps. Examples: - "Why was pipeline 123 slow" → check ``queued_duration`` and ``duration`` fields - "Is pipeline 456 still running" → look at ``status`` - Don't use to see individual jobs — use ``gitlab_get_pipeline_jobs``.

pipeline_id string project_path ProjectPath
gitlab_get_pipeline_jobs
annotations: none low

List jobs of a pipeline with stage, status, duration and web URL. Use after noticing a failed pipeline to drill down into which specific job broke and fetch its log via ``gitlab_get_job_log``. Examples: - "What jobs are in pipeline 123" → ``pipeline_id=123`` - "Which job failed in pipeline 456" → filter result by ``status='failed'`` client-side - Don't use for overall pipeline status — use ``gitlab_get_pipeline`` instead.

pipeline_id string project_path ProjectPath
gitlab_get_job_log
annotations: none low

Fetch the trace/log of a job, with optional regex filter. Two modes: * Default: return the last ``tail`` lines (token-efficient, good for "why did this just fail?"). * With ``grep_pattern``: return only matching lines with ``grep_context`` surrounding lines on each side — ideal for finding "ERROR" / "Traceback" in megabyte-scale CI logs without pulling the whole trace into context. Examples: - "Why did job 789 fail" → default tail=100, look at the end of the log - "Show me the first stage output of job 789" → ``tail=5000`` and scan for stage separator - "Find every Traceback in job 789" → ``grep_pattern='Traceback'``, ``grep_context=5`` - "All ERROR lines from job 789" → ``grep_pattern='ERROR|FAIL'``

ctx string tail string job_id string grep_context string grep_pattern string project_path ProjectPath
gitlab_trigger_pipeline
annotations: none low

Create a new pipeline on the given ref, optionally with CI variables. **Not idempotent**: each call creates a new pipeline. Consumes minutes on your runners — avoid calling in loops. Examples: - "Run the pipeline on master" → default (``ref='master'``) - "Run the pipeline on feature/x with DEBUG=1" → ``ref='feature/x'``, ``variables={'DEBUG': '1'}`` - Don't call to retry — use ``gitlab_retry_pipeline`` which keeps the same pipeline ID.

ref string variables string project_path ProjectPath
gitlab_retry_pipeline
annotations: none low

Retry all failed jobs of an existing pipeline. Creates new job runs (new history entries). Safe to call when the pipeline has at least one failed/canceled job; has no effect if everything already passed. Examples: - "Retry the failed jobs in pipeline 123" → ``pipeline_id=123`` - Don't use to rerun a successful pipeline — use ``gitlab_trigger_pipeline`` instead.

pipeline_id string project_path ProjectPath
gitlab_cancel_pipeline
annotations: none low

Cancel a running pipeline. In-flight jobs will be interrupted. Destructive for *in-progress* work. Cancelling an already-finished pipeline is a no-op. Examples: - "Pipeline 123 is stuck, cancel it" → ``pipeline_id=123`` - Don't use on finished pipelines — no effect; use ``gitlab_retry_pipeline`` if you want to rerun it.

pipeline_id string project_path ProjectPath
gitlab_pipeline_health
annotations: none low

Aggregate success rate over 7 and 30 days with a trend indicator. Great for stand-ups and on-call hand-offs. Returns success rate %, totals, last-10 statuses and a trend (``up``/``down``/``flat``). Emits progress via the MCP Context (``info`` log + ``report_progress``) — useful in IDEs that show per-tool progress bars. Examples: - "How stable is master" → default (``ref='master'``, ``source='schedule'``) - "Push-driven pipeline health" → ``source='push'`` - Don't use for a single pipeline — use ``gitlab_get_pipeline``.

ctx string ref string source string project_path ProjectPath
gitlab_list_merge_requests
annotations: none low

List merge requests of a project, optionally filtered by state. Examples: - "What MRs are open right now" → default (state='opened') - "What merged last week" → ``state='merged'`` then filter by ``updated_at`` client-side - "Everything regardless of state" → ``state='all'`` - Don't use when you have an MR IID — use ``gitlab_get_merge_request`` for detail.

page string state string per_page string project_path ProjectPath
gitlab_get_merge_request
annotations: none low

Get full information about a merge request by internal ID (``iid``). Includes state, branches, author, assignees, reviewers, labels, conflict status, description and timestamps. Examples: - "Show me the description and state of !42" → ``mr_iid=42`` - Don't use to see changed files — use ``gitlab_get_merge_request_changes``.

mr_iid string project_path ProjectPath
gitlab_get_merge_request_changes
annotations: none low

List changed files in a merge request with truncated diffs (2KB per file). Useful for code-review-style queries ("what changed in !42?"). Diffs beyond 2KB are truncated — fetch the raw file via ``gitlab_get_file`` for full content. Examples: - "What did MR !42 change" → ``mr_iid=42`` - If you need full content of a changed file, use ``gitlab_get_file`` with the MR's source branch.

mr_iid string project_path ProjectPath
gitlab_create_merge_request
annotations: none low

Create a merge request from ``source_branch`` into ``target_branch``. **Not idempotent**: creates a new MR each call. Check existing MRs first via ``gitlab_list_merge_requests`` if you want to avoid duplicates. Examples: - "Open an MR from feature/login to master" → ``source_branch='feature/login'`` - "Open a WIP MR with a label" → ``title='Draft: ...'``, ``labels=['wip']`` - Don't use to merge an already-open MR — use ``gitlab_merge_mr``.

title string labels string description string project_path ProjectPath source_branch string target_branch string remove_source_branch string
gitlab_merge_mr
annotations: none low

Perform the actual merge if GitLab reports the MR can be merged. **Destructive**: writes to the target branch. Checks ``merge_status`` first and returns ``status='cannot_merge'`` if conflicts exist or pipelines are required. Examples: - "Merge !42" → ``mr_iid=42`` - Don't call without checking ``gitlab_get_merge_request`` first when you suspect conflicts.

mr_iid string project_path ProjectPath
gitlab_list_schedules
annotations: none low

List all CI/CD schedules of a project. Variable keys whose name hints at a secret (``TOKEN``, ``PASSWORD``, ``SECRET``, ``CREDENTIAL``, ``PRIVATE_KEY``, ``API_KEY``) keep the key but have the value replaced by ``***`` so the agent still sees which variables exist. Examples: - "What schedules do we have and are they all active" → default call - Don't use to *run* a schedule now — use ``gitlab_trigger_pipeline`` with the schedule's variables instead.

project_path ProjectPath
gitlab_create_schedule
annotations: none low

Create a new CI/CD schedule with the given cron and variables. **Not idempotent**: duplicate calls create duplicate schedules with auto-incrementing IDs. Examples: - "Schedule a nightly build on master at 02:00 Europe/Berlin" → ``description='Nightly build'``, ``cron='0 2 * * *'``, ``ref='master'``, ``timezone='Europe/Berlin'``, ``variables={'NIGHTLY': '1'}`` - Don't use to update existing schedules — use ``gitlab_update_schedule``.

ref string cron string active string timezone string variables string description string project_path ProjectPath
gitlab_update_schedule
annotations: none low

Update an existing schedule. Only provided fields change. Destructive when ``variables`` is set: the entire variable set is replaced, so ensure the caller sends a full list. Examples: - "Deactivate schedule 42" → ``schedule_id=42``, ``active=False`` - "Change cron of schedule 42 to hourly" → ``schedule_id=42``, ``cron='0 * * * *'`` - Don't pass ``variables`` unless you want to *replace* them entirely.

ref string cron string active string variables string description string schedule_id string project_path ProjectPath
gitlab_delete_schedule
annotations: none low

Delete a schedule by ID. Cannot be undone. Examples: - "Delete schedule 42" → ``schedule_id=42`` - If you only want to pause it temporarily, call ``gitlab_update_schedule`` with ``active=False`` instead.

schedule_id string project_path ProjectPath

Permissions 4

network medium
Server uses network capabilities via: urllib
filesystem low
Server uses filesystem capabilities via: os
shell high
Server uses shell capabilities via: subprocess
env_vars low
Server uses env_vars capabilities via: os.environ

Scan Findings 82

medium
Vulnerable dependency: urllib3@2.0 (GHSA-38jv-5279-wg99) dependency_analyzer · 95%
low
Tool 'gitlab_get_file' has no annotations annotation_checker · 100%
low
Tool 'gitlab_list_repository_tree' has no annotations annotation_checker · 100%
low
Tool 'gitlab_project_info' has no annotations annotation_checker · 100%
low
Tool 'gitlab_list_branches' has no annotations annotation_checker · 100%
low
Tool 'gitlab_list_tags' has no annotations annotation_checker · 100%
low
Tool 'gitlab_compare_branches' has no annotations annotation_checker · 100%
low
Tool 'gitlab_list_pipelines' has no annotations annotation_checker · 100%
low
Tool 'gitlab_get_pipeline' has no annotations annotation_checker · 100%
low
Tool 'gitlab_get_pipeline_jobs' has no annotations annotation_checker · 100%
low
Tool 'gitlab_get_job_log' has no annotations annotation_checker · 100%
low
Tool 'gitlab_trigger_pipeline' has no annotations annotation_checker · 100%
low
Tool 'gitlab_retry_pipeline' has no annotations annotation_checker · 100%
low
Tool 'gitlab_cancel_pipeline' has no annotations annotation_checker · 100%
low
Tool 'gitlab_pipeline_health' has no annotations annotation_checker · 100%
low
Tool 'gitlab_list_merge_requests' has no annotations annotation_checker · 100%
low
Tool 'gitlab_get_merge_request' has no annotations annotation_checker · 100%
low
Tool 'gitlab_get_merge_request_changes' has no annotations annotation_checker · 100%
low
Tool 'gitlab_create_merge_request' has no annotations annotation_checker · 100%
low
Tool 'gitlab_merge_mr' has no annotations annotation_checker · 100%
low
Tool 'gitlab_list_schedules' has no annotations annotation_checker · 100%
low
Tool 'gitlab_create_schedule' has no annotations annotation_checker · 100%
low
Tool 'gitlab_update_schedule' has no annotations annotation_checker · 100%
low
Tool 'gitlab_delete_schedule' has no annotations annotation_checker · 100%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: mcp@1.2,<2 (GHSA-3qhf-m339-9g5v) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.2,<2 (GHSA-9h52-p55h-vw2f) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.2,<2 (GHSA-j975-95f5-7wqh) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.2,<2 (GHSA-jpw9-pfvf-9f58) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.2,<2 (GHSA-vj7q-gjh5-988w) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.2,<2 (PYSEC-2026-1616) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.2,<2 (PYSEC-2026-1617) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.2,<2 (PYSEC-2026-1618) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.2,<2 (PYSEC-2026-3482) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.2,<2 (PYSEC-2026-3483) dependency_analyzer · 95%
medium
Vulnerable dependency: urllib3@2.0 (GHSA-2xpw-w6gg-jr37) dependency_analyzer · 95%
medium
Vulnerable dependency: urllib3@2.0 (GHSA-34jh-p97f-mpxf) dependency_analyzer · 95%
medium
Vulnerable dependency: urllib3@2.0 (GHSA-g4mx-q9vg-27p4) dependency_analyzer · 95%
medium
Vulnerable dependency: urllib3@2.0 (GHSA-gm62-xv2j-4w53) dependency_analyzer · 95%
medium
Vulnerable dependency: urllib3@2.0 (GHSA-pq67-6m6q-mj2v) dependency_analyzer · 95%
medium
Vulnerable dependency: urllib3@2.0 (GHSA-qccp-gfcp-xxvc) dependency_analyzer · 95%
medium
Vulnerable dependency: urllib3@2.0 (GHSA-v845-jxx5-vc9f) dependency_analyzer · 95%
medium
Vulnerable dependency: urllib3@2.0 (PYSEC-2023-192) dependency_analyzer · 95%
medium
Vulnerable dependency: urllib3@2.0 (PYSEC-2023-212) dependency_analyzer · 95%
medium
Vulnerable dependency: urllib3@2.0 (PYSEC-2026-141) dependency_analyzer · 95%
medium
Vulnerable dependency: urllib3@2.0 (PYSEC-2026-1994) dependency_analyzer · 95%
medium
Vulnerable dependency: urllib3@2.0 (PYSEC-2026-1995) dependency_analyzer · 95%
medium
Vulnerable dependency: urllib3@2.0 (PYSEC-2026-1996) dependency_analyzer · 95%
medium
Vulnerable dependency: urllib3@2.0 (PYSEC-2026-1998) dependency_analyzer · 95%
medium
Vulnerable dependency: urllib3@2.0 (PYSEC-2026-1999) dependency_analyzer · 95%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: gitlab_get_file manifest_parser · 90%
info
Tool: gitlab_list_repository_tree manifest_parser · 90%
info
Tool: gitlab_project_info manifest_parser · 90%
info
Tool: gitlab_list_branches manifest_parser · 90%
info
Tool: gitlab_list_tags manifest_parser · 90%
info
Tool: gitlab_compare_branches manifest_parser · 90%
info
Tool: gitlab_list_pipelines manifest_parser · 90%
info
Tool: gitlab_get_pipeline manifest_parser · 90%
info
Tool: gitlab_get_pipeline_jobs manifest_parser · 90%
info
Tool: gitlab_get_job_log manifest_parser · 90%
info
Tool: gitlab_trigger_pipeline manifest_parser · 90%
info
Tool: gitlab_retry_pipeline manifest_parser · 90%
info
Tool: gitlab_cancel_pipeline manifest_parser · 90%
info
Tool: gitlab_pipeline_health manifest_parser · 90%
info
Tool: gitlab_list_merge_requests manifest_parser · 90%
info
Tool: gitlab_get_merge_request manifest_parser · 90%
info
Tool: gitlab_get_merge_request_changes manifest_parser · 90%
info
Tool: gitlab_create_merge_request manifest_parser · 90%
info
Tool: gitlab_merge_mr manifest_parser · 90%
info
Tool: gitlab_list_schedules manifest_parser · 90%
info
Tool: gitlab_create_schedule manifest_parser · 90%
info
Tool: gitlab_update_schedule manifest_parser · 90%
info
Tool: gitlab_delete_schedule manifest_parser · 90%
info
Required env vars (7) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 80%
low
Permission: filesystem access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
No dependency files found for SBOM generation sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%