GitLab

Host a copy with our keys and logs.

• GITLAB_TOKEN — GitLab personal access token (token mode). Optional after `mcp-gitlab auth login`; also accepts GITLAB_PAT, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_API_TOKEN
• GITLAB_URL — GitLab instance URL (e.g. https://gitlab.com)
• GITLAB_READ_ONLY — Alias for MCP_READ_ONLY. Any value other than false/0/no/off/empty locks the server read-only; --read-only can only raise the lock
• MCP_READ_ONLY — Locks the server read-only: write tools and write-workflow prompts are not listed and nothing lifts the lock at runtime. Shared name across the mcp-* servers; set it in the deployer's env
• MCP_TOOLSETS — Comma list of tool groups to expose (code, review, ci, issues, release, admin); unset or 'all' lists every tool. Shrinks tools/list for clients with a tool budget; MCP_READ_ONLY still applies after the selection
• GITLAB_AUTH — Authentication mode: token (default) or oauth (OAuth 2.1 proxy; streamable-http only)
• GITLAB_OAUTH_CLIENT_ID — Application ID of the GitLab OAuth app (oauth mode, or local sign-in on a self-managed instance)
• GITLAB_OAUTH_CLIENT_SECRET — Secret of the GitLab OAuth app (oauth mode)
• GITLAB_OAUTH_BASE_URL — Public URL of this server, no trailing slash (oauth mode); redirect URI is <base>/auth/callback
• GITLAB_OAUTH_SCOPES — Space-separated GitLab scopes required on every request (oauth mode; default api)
• GITLAB_OAUTH_JWT_KEY — FastMCP JWT signing key, >=32 random chars (oauth mode; defaults to one derived from the client secret)
• GITLAB_HTTP_BEARER_TOKEN — Bearer token (min 16 chars) required to bind an HTTP transport to a non-loopback host; clients send it as 'Authorization: Bearer <token>' (token mode; --auth oauth has its own sign-in)