Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add structured-world/gitlab-mcp --skill gitlab-setupgit clone --depth 1 https://github.com/structured-world/gitlab-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/structured-world/gitlab-mcp/gitlab-setup)<a href="https://agentmods.dev/skills/structured-world/gitlab-mcp/gitlab-setup"><img src="https://agentmods.dev/badge/skills/structured-world/gitlab-mcp/gitlab-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/structured-world/gitlab-mcp/gitlab-setup"><img src="https://agentmods.dev/badge/skills/structured-world/gitlab-mcp/gitlab-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.00424 |
| Opus 5.5 | $0.00017 | $0.00170 |
| Sonnet 5.5 | $0.00009 | $0.00085 |
| Haiku 4.5 | $0.00004 | $0.00042 |
Grade A, and why
gitlab-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
GitLab connection and access
Use the installed GitLab MCP tools; their prefix depends on the host and connection name. Discover the available catalog rather than assuming a fixed prefix. Keep the user's selected account and namespace. Do not request tokens, passwords, cookies, or client secrets in conversation.
- Call
manage_contextwith{"action":"show"}to identify the host, read-only mode, preset and namespace scope. This works while GitLab is disconnected. - Call
manage_contextwith{"action":"whoami"}when available to inspect the connected identity, token permissions, expiry, instance version/tier and warnings. Report only what the response proves. An unavailable diagnostic is not proof of an invalid credential. - Explain the concrete cause: connection failure, insufficient permission, read-only policy, disabled feature, denied action, or unsupported instance capability. Distinguish these from an empty successful query.
- If the installed catalog exposes settings or account-linking tools, use their declared interface for the requested setup. Otherwise direct the user to this connection's host-managed authentication/settings entry point. Do not invent a settings tool, edit global instructions, or place credentials in commands/files.
- To change a requested preset or account, list the available choices first with
list_presetsorlist_profiles; use the returned name. Change only the requested setting, then verify withshowand refresh tool discovery. Context mutations can affect other sessions on existing shared servers; report this before a requested shared setting change.
Native structured context results use { "action": "...", "data": ... }. The text content remains the previous JSON domain result for clients that consume text. Respect isError, including authentication metadata; a failed result is never successful setup. After a mutation times out, inspect the current context before considering another attempt.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 17 lines · 43 tokens per session scan A 5520a865f0e3
gitlab-setup is a skill published in the GitHub repository structured-world/gitlab-mcp (8 stars, last pushed today), licensed Apache-2.0. It adds 43 tokens to every session and 424 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-10.
Other skills, from other repositories
feedback-nudge
Use when the user wants to report a bug, request a feature, or send feedback to the Zooza engineering team. Also offer proactively after a successful commit operation (max once per week).
release-and-publish
Ship a release end-to-end across every registry the project targets (npm, MCP Registry, GitHub Releases for .mcpb bundles, GHCR). Runs the final verification gate, fast-forwards main when the release rode a release PR, creates the annotated tag on the commit main now points at, pushes commits and tags, then publishes…
release-and-publish
Ship a release end-to-end across every registry the project targets (npm, MCP Registry, GitHub Releases for .mcpb bundles, GHCR). Runs the final verification gate, fast-forwards main when the release rode a release PR, creates the annotated tag on the commit main now points at, pushes commits and tags, then publishes…
git-wrapup
Land working-tree changes as logical commits — the work grouped by concern, topped by a release commit (version bump, changelog, regenerated artifacts). The work commits land first, then the version bump, verification, and the release commit on top. Stops at "committed locally on main" — or, when the project releases…
orchestrations
Pick and run a multi-phase workflow that chains foundational task skills (git-wrapup, release-and-publish, maintenance, field-test, setup, etc.) end-to-end. Routes user intent to a workflow file under workflows/ — greenfield builds, maintenance + release, field-test + fix, or known-work + release. Single source for…
git-wrapup
Land working-tree changes as logical commits — the work grouped by concern, topped by a release commit (version bump, changelog, regenerated artifacts). The work commits land first, then the version bump, verification, and the release commit on top. Stops at "committed locally on main" — or, when the project releases…