GitLab from
Your Terminal

# Store OAuth client ID for a self-hosted instance
glab config set client_id <app-id> --host gitlab.example.com

# Store custom redirect URI
glab config set redirect_uri http://localhost:8080/callback --host gitlab.example.com

# Store custom OAuth scopes
glab config set oauth_scopes "api read_user write_repository" --host gitlab.example.com

# Start HTTP server (auto-generates a bearer token, printed to stderr)
glab mcp serve --transport http

# Custom host, port, and token
glab mcp serve --transport http --host 0.0.0.0 --port 9090 --token my-secret

# Stateless mode (simpler, no session tracking)
glab mcp serve --transport http --stateless

# Register the remote server with Claude Code
glab mcp install --transport http --host myserver.example.com --port 8080 --token my-secret

# 1. Create a GitLab OAuth application with redirect URI:
#    http://<server-host>:<port>/auth/redirect

# 2. Start the server with your OAuth app ID
glab mcp serve --transport http \
  --client-id my-oauth-app-id \
  --gitlab-host gitlab.example.com

# 3. Behind a reverse proxy? Set the external URL for correct callbacks
glab mcp serve --transport http \
  --client-id my-oauth-app-id \
  --gitlab-host gitlab.example.com \
  --external-url https://mcp.example.com

# Each user's GitLab API calls use their own OAuth token and permissions

# Build the Docker image
docker build -t glab-mcp .

# Run with shared token auth (-v persists credentials across restarts)
docker run -p 8080:8080 -v glab-mcp-data:/config \
  -e GITLAB_TOKEN=glpat-xxxxxxxxxxxx \
  glab-mcp --token my-secret

# Run with per-user OAuth
docker run -p 8080:8080 -v glab-mcp-data:/config \
  glab-mcp \
  --client-id my-oauth-app-id \
  --gitlab-host gitlab.example.com \
  --external-url https://mcp.example.com

# Proxy all MCP traffic (including SSE streams and OAuth endpoints)
location /mcp {
    proxy_pass http://127.0.0.1:8080/mcp;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_buffering off;           # required for SSE
    proxy_cache off;
    proxy_read_timeout 86400s;     # long timeout for SSE streams
}

# Forward OAuth endpoints when using --client-id
location /oauth {
    proxy_pass http://127.0.0.1:8080/oauth;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}
location /auth {
    proxy_pass http://127.0.0.1:8080/auth;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}
location /.well-known {
    proxy_pass http://127.0.0.1:8080/.well-known;
    proxy_set_header Host $host;
}