MCP server for GitLab CI/CD pipeline analysis, validation, and inspection. Exposes lab's analysis, validation, and inspection tools as MCP tools that AI agents can call.
Lab provides 10 well-named tools with consistent verb_noun patterns (lab_analyze, lab_validate, lab_list, etc.). All tools have descriptions (avg ~150 chars, within 10-1024 baseline). Input schemas are present with type definitions and parameter descriptions. However, output schemas are not documented in the visible code, LLMs cannot predict return structure. Parameter descriptions are adequate but lack format constraints (e.g., 'event' enum values are listed in description but not as JSON Schema enum). Error handling is minimal, no recovery guidance or actionable error messages visible. Tool composition is sound (each does one thing), but some tools could be more granular (e.g., lab_secrets_pull and lab_secrets_init are separate, which is good). No tool annotations (readOnlyHint/destructiveHint) despite clear risk classifications in metadata.
Analyze a GitLab CI/CD pipeline for security, performance, and best practice issues. Returns structured findings with severity, category, and actionable suggestions.
Show the execution plan for a pipeline without actually running containers. Shows stages, jobs, images, dependencies, and secret availability. Supports event simulation and multi-job filtering.
Explain what a specific job does — its image, scripts, dependencies, services, artifacts, rules, and variables. Returns structured job configuration.
Show the job dependency graph of a pipeline. Lists which jobs depend on which others.
List all jobs and stages in a GitLab CI/CD pipeline with their images, dependencies, and configuration.
Check which CI/CD secrets are available vs missing for the pipeline. Shows which jobs need which secrets.
Output schemas not documented. LLMs cannot predict return structure (fields, types, nesting). Visible code shows input schemas but no @returns or output type hints.
Parameter 'event' in lab_dry_run lists enum values in description ('push, merge_request_event, schedule, web, api, trigger') but not as JSON Schema enum constraint. LLMs may hallucinate invalid values.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk classifications in metadata (READ_ONLY vs WRITE). MCP clients cannot auto-gate dangerous operations.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | 2026-07-28+ | v2 |
Generate secrets.env.example template in project root from pipeline variable references.
Pull CI/CD secrets from GitLab project and group variables via glab. Saves to centralized secrets store (~/.local/share/lab/). Reports protected/hidden/masked variable status.
Given an analyze finding rule name, return the specific YAML fix to apply. Use after lab_analyze to get actionable code changes.
Parse and validate a .gitlab-ci.yml file. Returns the number of stages and jobs, or an error message if invalid.
Error handling not visible in source. No recovery guidance (e.g., 'If file not found, check path with lab_list'). Agents cannot self-correct on failures.
lab_secrets_pull has empty input schema (no parameters). Description says 'via glab' but no way to specify project/group context. Unclear how tool determines which secrets to pull.