gitlab-mcp-server: Skill for Claude Code

.github/skills/create-mcp-tool/SKILL.md

create-mcp-tool is a skill for Claude Code, Codex from jmrplens/gitlab-mcp-server. It costs 52 tokens per session (5,584 once invoked), scanned A, original, MIT.

A development workflow for adding a new MCP tool, an interface that lets an AI client call a server function backed by a GitLab API endpoint.

In plain words
What is it for?
Use it when adding a new GitLab REST or GraphQL operation to a Go MCP server.
Why use it?
It provides the project-specific pieces needed for a complete tool, including the handler, metadata, output formatting, tests, and documentation.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

This is jmrplens/gitlab-mcp-server's own configuration. It tells Claude Code and Codex how to work on gitlab-mcp-server itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything gitlab-mcp-server configures →

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is go test -tags e2e -c -o /dev/null ./test/e2e/gitlab/....

Reuse

Borrowing it

Nothing to install: this file belongs to jmrplens/gitlab-mcp-server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/jmrplens/gitlab-mcp-server/main/.github/skills/create-mcp-tool/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/jmrplens/gitlab-mcp-server

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for create-mcp-tool

README.md
[![agentmods](https://agentmods.dev/badge/skills/jmrplens/gitlab-mcp-server/create-mcp-tool/github.svg)](https://agentmods.dev/skills/jmrplens/gitlab-mcp-server/create-mcp-tool)
Your own site
<a href="https://agentmods.dev/skills/jmrplens/gitlab-mcp-server/create-mcp-tool"><img src="https://agentmods.dev/badge/skills/jmrplens/gitlab-mcp-server/create-mcp-tool/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for create-mcp-tool

Your own site · 80×15
<a href="https://agentmods.dev/skills/jmrplens/gitlab-mcp-server/create-mcp-tool"><img src="https://agentmods.dev/badge/skills/jmrplens/gitlab-mcp-server/create-mcp-tool.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 52 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 5,584 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 1 finding, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium MCP Rug Pull · line 377
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00052 $0.05584
Opus 5.5 $0.00021 $0.02234
Sonnet 5.5 $0.00010 $0.01117
Haiku 4.5 $0.00005 $0.00558

Measured today against content hash 5d85b4c76623, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

create-mcp-tool scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.github/skills/create-mcp-tool/SKILL.md · 422 lines

How it starts

The opening of the file, as written. The whole thing — 422 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Create MCP Tool — GitLab

Step-by-step workflow for creating a new MCP tool that wraps a GitLab REST/GraphQL API endpoint.

Prerequisites

  • Identify the GitLab API endpoint(s) (REST v4 or GraphQL)
  • Confirm the client-go library supports the endpoint — if not, consider the upstream-contribution skill
  • Decide the domain name (e.g., tags, branches, pipelines)

File Structure

Create a new sub-package under internal/tools/{domain}/:

{domain}/
├── doc.go              # Package comment (the one `// Package {domain} ...` comment)
├── {domain}.go         # Input/Output structs + handler logic
├── action_specs.go     # Canonical ActionSpec route metadata
├── markdown.go         # Markdown formatters + init() registry
├── shapes.go           # Optional: nested output shapes mirrored from client-go sub-objects
└── {domain}_test.go    # Tests with httptest (plus action_specs_test.go, markdown_test.go as needed)

A multi-word domain separates the words with underscores in its file names only: merge_requests.go and merge_requests_test.go in package mergerequests. Go's convention and the stylecheck/revive naming rules refuse underscores in a package identifier, and the directory follows the package.

Step 1: Define Input/Output Structs

In {domain}.go:

package {domain}

import "github.com/jmrplens/gitlab-mcp-server/v3/internal/toolutil"

type ListInput struct {
    toolutil.PaginationInput
    toolutil.KeysetPaginationInput // only when the endpoint supports keyset pagination
    ProjectID toolutil.StringOrInt `json:"project_id" jsonschema:"Project ID or URL-encoded path,required"`
}

type Output struct {
    toolutil.HintableOutput
    ID     int    `json:"id"`
    Name   string `json:"name"`
    WebURL string `json:"web_url"`
}

type ListOutput struct {
    toolutil.HintableOutput
    Items      []Output                 `json:"items"`
    Pagination toolutil.PaginationOutput `json:"pagination"`
}

Rules:

  • Embed toolutil.HintableOutput as first field (enables next_steps in JSON)
  • Embed toolutil.PaginationInput for list operations, and toolutil.KeysetPaginationInput beside it when the GitLab endpoint supports keyset pagination; such a list also passes toolutil.KeysetContinuation(input.KeysetPaginationInput) on its SDK call, last, after gl.WithContext(ctx) (it makes the token the whole query, so an option after it would add to GitLab's link), or the next_page_token its keyset pages publish cannot be followed (testutil.KeysetListing and testutil.FollowKeyset test it)
  • Use toolutil.StringOrInt for project/group IDs
  • Tag fields that only exist at a higher GitLab tier with tier:"premium" or tier:"ultimate"; the catalog prunes them from the schema below that tier
  • Use jsonschema:"description,required" for a field GitLab requires on the route the action sends, and only for that: the marker is the one required list all three surfaces serve (omitempty no longer decides it), and make audit-1to1-required fails on a marker the live record disagrees with unless cmd/audit_1to1/internal/required/declarations.go says why. A choice between fields GitLab states as at_least_one_of or exactly_one_of is an anyOf through toolutil.SchemaAnyOfRequired in the spec's InputSchemaOverrides, with neither field marked
  • Use json:",omitempty" for optional fields
  • No domain prefix on type names — the package provides namespace

Read the full file on GitHub · 422 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · +1 lines 5d85b4c76623
  2. 9d ago Changed 99b8b9cfa0b6
  3. 11d ago Changed 41dde3b4a77e
  4. 16d ago Changed · +2 lines eca0e596ea2f
  5. 25d ago Changed · +1 lines d1b9286dd5a2
  6. 27d ago Changed · +5 lines 75083231ed2c
  7. 1mo ago Changed · +16 lines eaa7e2646567
  8. 1mo ago Changed 43ba3733aee7
  9. 1mo ago Changed · +47 lines 640286f42ec0
  10. 1mo ago First seen · 350 lines · 52 tokens per session scan A 60842c2d4263

Subscribe to this mod's changes

create-mcp-tool is a skill published in the GitHub repository jmrplens/gitlab-mcp-server (46 stars, last pushed today), licensed MIT. It adds 52 tokens to every session and 5,584 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

x402

Set up Browser Use Cloud payments with x402 — pay per request from a crypto wallet (USDC on Base mainnet), no signup or API key. Two setups it works out up front — "just use it" (set up a wallet so you or Claude Code can run cloud browser tasks paid from the wallet — Claude writes and runs throwaway scripts, nothing…

browser-use/browser-use · 175 tokens

cloud

Documentation reference for using Browser Use Cloud — the hosted API and SDK for browser automation. Use this skill whenever the user needs help with the Cloud REST API (v2, v3, or v4), browser-use-sdk (Python or TypeScript), X-Browser-Use-API-Key authentication, cloud sessions, browser profiles, profile sync, CDP…

browser-use/browser-use · 177 tokens

open-source

Documentation reference for writing Python code using the browser-use open-source library. Use this skill whenever the user needs help with Agent, Browser, or Tools configuration, is writing code that imports from browseruse, asks about @sandbox deployment, supported LLM models, Actor API, custom tools, lifecycle…

browser-use/browser-use · 137 tokens

manifold-api

Use when an agent needs to inspect or call the local Manifold HTTP API. Provides guidelines and scripts to filter specs before reading and handle payloads safely.

intelligencedev/manifold · 35 tokens

go-expert

Expert-level Go development with Go 1.22+ features, concurrency, standard library, and production-grade best practices. Use when the user mentions concurrency, microservices, or backend, or when the task involves idiomatic Go, goroutines and channels, context-based cancellation, or writing an HTTP server.

personamanagmentlayer/pcl · 65 tokens

nornweave-api

Give AI agents their own email inboxes using the NornWeave API. Use when building email agents, sending/receiving emails programmatically, managing inboxes, retrieving threads, searching messages, or integrating with email providers (Mailgun, SES, SendGrid, Resend). NornWeave provides LLM-ready markdown parsing and…

DataCovey/nornweave · 77 tokens