Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Knuckles-Team/gitlab-api --skill gitlab-merge-request-reviewgit clone --depth 1 https://github.com/Knuckles-Team/gitlab-apiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/knuckles-team/gitlab-api/gitlab-merge-request-review)<a href="https://agentmods.dev/skills/knuckles-team/gitlab-api/gitlab-merge-request-review"><img src="https://agentmods.dev/badge/skills/knuckles-team/gitlab-api/gitlab-merge-request-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/knuckles-team/gitlab-api/gitlab-merge-request-review"><img src="https://agentmods.dev/badge/skills/knuckles-team/gitlab-api/gitlab-merge-request-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 42 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00158 | $0.01577 |
| Opus 5.5 | $0.00063 | $0.00631 |
| Sonnet 5.5 | $0.00032 | $0.00315 |
| Haiku 4.5 | $0.00016 | $0.00158 |
Grade A, and why
gitlab-merge-request-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 129 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitLab Merge Request Review
Domain-typed review-to-merge for GitLab Merge Requests via the gitlab-api MCP server. Default focus: the MRs that are yours to act on (assigned to you or awaiting your review); widen to a project, group, or the whole instance on request.
When to use
- Review the MRs assigned to you or where you are a reviewer (the default).
- Scope MR review to a project, a group, or the instance.
- Read an MR and gate a merge on a green pipeline — pipeline → jobs → job log.
- Approve, accept (merge), or set merge-when-pipeline-succeeds (auto-merge); cancel a queued auto-merge.
When NOT to use
- Opening a new MR →
gitlab-merge-request-create. - Issue triage →
gitlab-issues. - Broad pipeline/CI review across a group/instance →
gitlab-pipelines.
Prerequisites & environment
Connect via the mcp-client skill against the gitlab-api MCP server.
| Variable | Required | Notes |
|---|---|---|
GITLAB_URL |
✅ | GitLab instance base URL |
GITLAB_TOKEN |
✅ | Access token with api scope (approve/merge need write) |
GITLAB_SSL_VERIFY |
optional | TLS verification toggle |
Full env/tag matrix: the mcp-client reference agent-tools/mcp-client/references/gitlab-api.md.
MCP_TOOL_MODE (condensed|verbose|both) selects the condensed surface (below).
Tools & actions
Prefer the condensed tools; each takes action + a params_json JSON string.
| Condensed tool | Actions |
|---|---|
gitlab_merge_requests |
get, get_project, accept, cancel_auto_merge |
gitlab_merge_rules |
get_mr_approvals, get_mr_approval_state, approve_mr, unapprove_mr |
gitlab_groups |
get_merge_requests (group-scoped MRs) |
gitlab_pipelines |
get |
gitlab_jobs |
get_pipeline_jobs, get_log |
Key parameters
- Default scope — instance-wide
gitlab_merge_requests getwith eitherscope=assigned_to_meorreviewer_username=<me>(run both and union). Project scope →get_projectwithproject_id; group scope →gitlab_groups get_merge_requestswithgroup_id. - Single MR →
gitlab_merge_requests getwithproject_id+merge_request_iid. - CI gate — the MR object carries
pipeline/head_pipeline; feed its id togitlab_pipelines get(pipeline_id), thengitlab_jobs get_pipeline_jobs(pipeline_id), thenget_log(job_id). - Approve/merge —
gitlab_merge_rules approve_mr(project_id + merge_request_iid);gitlab_merge_requests acceptmerges now, or passmerge_when_pipeline_succeeds=trueto set auto-merge;cancel_auto_mergecancels a queued auto-merge.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed b6d44efde38b
- 1mo ago First seen · 129 lines · 158 tokens per session scan A c7e430e3819a
gitlab-merge-request-review is a skill published in the GitHub repository Knuckles-Team/gitlab-api (10 stars, last pushed today), licensed MIT. It adds 158 tokens to every session and 1,577 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
servicenow-studio-gitlab-app
Wire a ServiceNow scoped app (App Engine Studio / Fluent) to a GitLab repository and drive its promotion two ways — Path A: native Studio source control (servicenowsourcecontrol → importrepository / applyremotesourcecontrolchanges, handing off to servicenowcicd for publish/install), or Path B: GitLab-CI-driven…
repository-manager-gate-execution
Run and inspect the two-tier (fast/heavy) pre-commit gate across repos via rmgates, and validate a fix without re-running the whole wave: run to populate the durable gate ledger, retest to narrow a re-run to only the hooks the ledger last recorded failing (with automatic full-wave escalation on an all-pass), and…
repository-manager-merge-and-reconcile
Land a branch into a shared base that dozens of other lanes are landing into at the same time, and reconcile it when it conflicts. Covers the serialized merge queue, per-repository gate declarations, differential gating against a base ref that is legitimately red, measuring the MERGED tree rather than the branch tip…
repository-manager-candidate-certification
Understand and verify a branch candidate's and a sealed generation's certification state — the Candidate/Generation lifecycle vocabulary, the validation-stage/evidence model, and the rmconcepts verifycandidate / verifygeneration marker-collision checks — before trusting a merge-queue outcome as landable. This is the…
gitlab-review
Review a GitLab merge request, inspect changes and discussions, or prepare and post explicitly requested review feedback. Use for GitLab MRs and review follow-ups, not GitHub pull requests or automatic approval/merge.
hs-ship
Reconcile an exact reviewed release candidate with live repository policy, then publish or merge only the outward actions the user has authorized. Use when opening or updating a PR, addressing PR review, waiting on required checks, merging, or finishing a landed change. It does not design CI/CD or cloud deployment…