gitlab-ops-mcp

The operational layer for GitLab that the standard MCP doesn't cover. Webhooks, CI/CD variables, branch protection, project settings, groups, access tokens, and pipeline triggers — 21 tools across 7 domains, ready for automated project setup and delivery orchestration.

Why?

The existing GitLab MCP (@zereight/mcp-gitlab) covers the developer workspace: repos, branches, MRs, issues, pipelines. But when you need to set up and govern projects — configure webhooks, protect branches, manage CI variables across repos — you're back in the GitLab UI clicking buttons.

gitlab-ops-mcp fills that gap. Together with the standard MCP, you get complete GitLab API coverage for fully automated multi-repo project setup.

Quick Start

Local (stdio transport)

Run directly with npx — no install required:

npx gitlab-ops-mcp

Requires GITLAB_PERSONAL_ACCESS_TOKEN in your environment.

Remote (HTTP transport)

A hosted instance is available at:

https://gitlab-ops-mcp.fly.dev/mcp

The remote server uses per-session authentication via the X-GitLab-Token header — no server-side credentials stored.

MCP Client Configuration

Stdio (local)

{
  "mcpServers": {
    "gitlab-ops": {
      "command": "npx",
      "args": ["-y", "gitlab-ops-mcp"],
      "env": {
        "GITLAB_PERSONAL_ACCESS_TOKEN": "glpat-...",
        "GITLAB_API_URL": "https://gitlab.com/api/v4"
      }
    }
  }
}

Streamable HTTP (remote)

{
  "mcpServers": {
    "gitlab-ops": {
      "type": "streamable-http",
      "url": "https://gitlab-ops-mcp.fly.dev/mcp",
      "headers": {
        "X-GitLab-Token": "glpat-..."
      }
    }
  }
}

Environment Variables

Variable	Required	Default	Description
GITLAB_PERSONAL_ACCESS_TOKEN	Yes (stdio)	—	GitLab personal access token with appropriate scopes
GITLAB_API_URL	No	https://gitlab.com/api/v4	GitLab API v4 base URL

For the HTTP transport, the GitLab token is passed per-request via the X-GitLab-Token header instead.

Tool Catalogue

21 tools across 7 domains. Each tool is a thin REST wrapper around the GitLab API v4.

Webhooks

Manage project-level webhooks for event-driven automation.

Tool	Description
create_webhook	Create a webhook with configurable event flags
list_webhooks	List all webhooks for a project
update_webhook	Update a webhook's URL, token, or event flags
delete_webhook	Remove a webhook from a project
test_webhook	Trigger a test event for a webhook

CI/CD Variables

Manage project-level CI/CD variables for environment-specific configuration.

Tool	Description
create_ci_variable	Create a variable with optional protection, masking, and scoping
list_ci_variables	List all CI/CD variables for a project
update_ci_variable	Update a variable's value or flags
delete_ci_variable	Remove a CI/CD variable

Protected Branches

Manage branch protection rules to enforce merge-only workflows.

Tool	Description
protect_branch	Protect a branch with configurable access levels
list_protected_branches	List all protected branches
unprotect_branch	Remove protection from a branch

Project Settings

Update project-level configuration for consistent governance across repos.

Tool	Description
update_project_settings	Update merge method, pipeline requirements, squash options, and more

Groups / Subgroups

Manage GitLab groups for namespace isolation.

Tool	Description
create_group	Create a group or subgroup
list_groups	List groups with search and access level filters
delete_group	Delete a group (cascades to all projects within)

Project Access Tokens

Manage scoped, rotatable access tokens for cross-repo CI communication.

Tool	Description
create_project_access_token	Create a scoped token with configurable access level and expiry
list_project_access_tokens	List all access tokens for a project
revoke_project_access_token	Revoke an access token

Pipeline Trigger Tokens

Manage pipeline trigger tokens for cross-project pipeline triggering.

Tool	Description
create_pipeline_trigger	Create a pipeline trigger token
list_pipeline_triggers	List all trigger tokens for a project
delete_pipeline_trigger	Remove a trigger token

Auto-Approve Suggestions

Read-only tools are safe to auto-approve. Mutating tools (create, update, delete) should require confirmation.

"autoApprove": [
  "list_webhooks",
  "list_ci_variables",
  "list_protected_branches",
  "list_groups",
  "list_project_access_tokens",
  "list_pipeline_triggers"
]

Self-Hosting

The server ships with a Dockerfile and Fly.io configuration for self-hosting the HTTP transport.

fly apps create my-gitlab-ops-mcp
fly deploy

The HTTP server runs on port 3000 with a /health endpoint for liveness checks. Machines auto-stop when idle and auto-start on incoming requests.

Relationship to Existing GitLab MCP

The two servers are complementary, not competing:

• @zereight/mcp-gitlab — developer workspace (repos, branches, MRs, issues, pipelines)
• gitlab-ops-mcp — project operations (webhooks, variables, protection, settings, tokens)

Requirements

• Node.js >= 18.0.0

Licence

MIT