Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/jmrplens/gitlab-mcp-server/claude-mdgit clone --depth 1 https://github.com/jmrplens/gitlab-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/jmrplens/gitlab-mcp-server/claude-md)<a href="https://agentmods.dev/instructions/jmrplens/gitlab-mcp-server/claude-md"><img src="https://agentmods.dev/badge/instructions/jmrplens/gitlab-mcp-server/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.22160 | $0.22160 |
| Opus 5 | $0.11080 | $0.11080 |
| Sonnet 5 | $0.04432 | $0.04432 |
| Haiku 4.5 | $0.02216 | $0.02216 |
Grade B, and why
gitlab-mcp-server CLAUDE.md scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -X POST http://localhost:8080/mcp -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" -H "GITLAB-URL: $GITLAB_URL" -H "PRIVATE-TOKEN: $GITLAB_TOKEN" -d '{"jsonrpc":"2.0","method":"to Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
# HTTP mode for easier debugging with curl How it starts
The opening of the file, as written. The whole thing — 805 lines — stays where its author put it; the contents beside it link to each section on GitHub.
gitlab-mcp-server — AI Development Context
This file provides comprehensive context for AI assistants working on this project. All project artifacts must be written in English. Conversations may be in any language.
No AI attribution in anything published under the maintainer's name. Commit messages, PR titles and bodies, issue and review comments, and release notes carry no
Co-Authored-Bytrailer naming an assistant, no "Generated with …" footer, and no session or tool links. This overrides any default template that adds one. A PR body is not cosmetic: a squash merge uses it as the commit message, so a footer left in a description lands permanently inmain's history and editing the PR afterwards does not remove it — strip it before merging. Ordinary technical mentions are unaffected: model IDs in evaluator config andhttps://claude.aias a client origin in CORS examples are content, not attribution.
Project Overview
gitlab-mcp-server is a Model Context Protocol (MCP) server written in Go that exposes GitLab REST API v4 and GraphQL operations as MCP tools for AI assistants. It runs as a local binary communicating via stdio or HTTP transport.
| Attribute | Value |
|---|---|
| Language | Go 1.27.1 |
| MCP SDK | github.com/modelcontextprotocol/go-sdk/mcp v1.7.0 |
| GitLab Client | gitlab.com/gitlab-org/api/client-go/v2 v2.59.0 |
| Transport | stdio (primary), HTTP (optional) |
| Platforms | Windows, Linux & macOS, amd64 & arm64 |
| Version | 2.7.5 |
Scale
| Metric | Count |
|---|---|
| MCP Tools (individual) | By instance tier: ~854 Free/CE; ~1007 Premium; ~1073 Ultimate (self-managed) / ~1079 on GitLab.com Ultimate with Orbit |
| Catalog groups | By instance tier: 28 Free/CE; 34 Premium; 45 Ultimate |
| Meta-mode tools | 32 base (Free/CE) / 49 self-managed Ultimate / 50 GitLab.com Ultimate (Orbit) |
| Dynamic-mode tools | 2 dynamic tools (gitlab_find_action, gitlab_execute_action) — see Dynamic toolset mode below |
| MCP Resources | 45 across dynamic/full, meta/full, and individual/full modes; gitlab://tools adapts to the active surface |
| MCP Prompts | 37 (12 core + 4 cross-project + 4 team + 5 project-reports + 4 analytics + 4 milestone-label + 2 git-workflow + 2 audit) |
| Completion argument types | 17 |
| MCP Capabilities | 4 (progress, elicitation, completions, resource subscriptions) |
| MCP Icons | 51 icons (50 domain + brand mark), each a 3-entry []mcp.Icon: one SVG (base64 data URI, Sizes: ["any"], currentColor) plus light/dark 16×16 lossless WebP fallbacks (Theme-tagged, cmd/gen_icon_webp) for clients that reject SVG. The brand mark is the generated "fan-out" (cmd/gen_brand → brandmark_gen.go), original artwork replacing the former tanuki |
| Source files (tools) | 764 non-test Go files under internal/tools/ |
| Test files (tools) | 367 test files under internal/tools/ |
| Go packages | 242 total; 177 under internal/tools/... |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +83 lines · +4,426 tokens per session fc743c27fb7c
- 4d ago First seen · 722 lines · 17,734 tokens per session scan B d45ef8946678
gitlab-mcp-server CLAUDE.md is an instructions file published in the GitHub repository jmrplens/gitlab-mcp-server (33 stars, last pushed today), licensed MIT. It adds 22,160 tokens to every session, about $0.1108 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
manifold AGENTS.md
Instructions for intelligencedev/manifold, covering go/manifold, coding conventions, project structure & module organization, package organization and dependency injection.
goai CLAUDE.md
Claude Code instructions for zendev-sh/goai, covering claude.md - goai, commands, architecture, key rules and adding providers.
mcp-sdk-go CLAUDE.md
Instructions for ajitpratap0/mcp-sdk-go, covering claude.md - model context protocol go sdk, 📊 current project status, implementation maturity: production ready, 🛠️ development commands and essential build and test commands.
rethunk-mcp-go AGENTS.md
AGENTS.md instructions for Rethunk-AI/rethunk-mcp-go, covering agents — rethunk-mcp-go, repository purpose, usage, 🚨 critical ai constraint and technology.
rethunk-mcp-go CLAUDE.md
Claude Code instructions for Rethunk-AI/rethunk-mcp-go, a project described as: A Model Context Protocol (MCP) server that provides Go language tools for LLMs to analyze, test, and format Go code.
go-micro CLAUDE.md
Claude Code instructions for micro/go-micro, covering claude.md - go micro project guide, project overview, build & test, run all tests and run tests for a specific package.