Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/vish288/mcp-gitlab/gemini-mdgit clone --depth 1 https://github.com/vish288/mcp-gitlabWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00562 | $0.00562 |
| Opus 5 | $0.00281 | $0.00281 |
| Sonnet 5 | $0.00112 | $0.00112 |
| Haiku 4.5 | $0.00056 | $0.00056 |
Grade A, and why
mcp-gitlab GEMINI.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 34 lines — stays where its author put it; the contents beside it link to each section on GitHub.
mcp-gitlab — Gemini CLI Extension Context
MCP server providing 83 tools, 7 resources, and 6 prompts for interacting with the GitLab API. Covers the full lifecycle of GitLab projects: code, reviews, CI/CD, releases, and issue tracking.
Tool Categories
- Projects — get, create, delete, update merge settings, share/unshare with groups
- Merge Requests — list, get, create, update, merge, rebase, view changes and diffs, approve, unapprove, get approvals, list pipelines, list commits, subscribe, unsubscribe
- MR Reviews — list/add/update/delete notes, list/create discussions, reply to and resolve discussions, award/remove emoji
- MR Approvals — project-level and MR-level approval rules (list, create, update, delete)
- Pipelines & Jobs — list/get/create/retry/cancel pipelines, retry/play/cancel jobs, get job logs
- Branches — list, create, delete
- Commits — list, get, create, compare refs
- Tags & Releases — list/get/create/delete tags, list/get/create/update/delete releases
- CI/CD Variables — project and group variables (list, create, update, delete)
- Issues — list, get, create, update, add comments
- Groups — list, get, share/unshare groups
Common Workflows
- Code review:
list_mrs->mr_changes->list_mr_discussions->add_mr_noteorcreate_mr_discussion->resolve_discussion - Pipeline debugging:
list_pipelines->get_pipeline->get_job_log->retry_job - Release process:
list_commits->compare->create_tag->create_release - Branch protection:
list_project_approval_rules->create_project_approval_rule->update_project_merge_settings - Issue triage:
list_issues->get_issue->update_issue->add_issue_comment
Notes
- Set
GITLAB_READ_ONLY=trueto restrict all operations to read-only (no writes, no deletes). - Token requires appropriate GitLab scopes:
apifor full access,read_apifor read-only. - Default request timeout is 30 seconds; override with
GITLAB_TIMEOUT. - SSL verification is on by default; disable with
GITLAB_SSL_VERIFY=falsefor self-signed certs. - Works with GitLab.com and self-hosted GitLab instances.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 34 lines · 562 tokens per session scan A 14488688687d
mcp-gitlab GEMINI.md is an instructions file published in the GitHub repository vish288/mcp-gitlab (6 stars, last pushed 11d ago), licensed MIT. It adds 562 tokens to every session, about $0.0028 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
gitlab-mcp-server copilot-instructions.md
Instructions for jmrplens/gitlab-mcp-server, covering gitlab-mcp-server — gitlab mcp server in go, project overview, architecture, project structure and development conventions.
gitlab-mcp-server go-mcp-server.instructions.md
Best practices and patterns for building Model Context Protocol (MCP) servers in Go using the official github.com/modelcontextprotocol/go-sdk package (v1.7.0+).
gitlab-mcp-server go.instructions.md
Instructions for writing Go code following idiomatic Go practices and community standards.
gitlab-mcp-server code-review-generic.instructions.md
Generic code review instructions that can be customized for any project using GitHub Copilot.
gitlab-mcp-server AGENTS.md
Instructions for jmrplens/gitlab-mcp-server, covering gitlab-mcp-server — agent quick reference, read first, hard invariants, common commands and build.
gitlab-mcp-server mcp-best-practices.instructions.md
MCP protocol-level best practices for tool design, annotations, response formats, pagination, and security. Applies to all Go MCP server code.