Wraps GitLab Duo CLI as an MCP tool for code review, enabling agents to get structured Duo reviews via duo_review
Detailed security scan evidence is not public for this MCP yet. Public identity, registry metadata, and independently observed protocol inventory remain available.
Installation and connection instructions are shown only when supported by retained package, repository, or endpoint evidence.
Version 0.3.0 declares 1 executable entrypoint.
npm install --save-exact gitlab-duo-mcp-bridge@0.3.0npx -y -p gitlab-duo-mcp-bridge@0.3.0 gitlab-duo-mcp-bridge{
"mcpServers": {
"gitlab-duo-mcp-bridge": {
"command": "npx",
"args": [
"-y",
"-p",
"gitlab-duo-mcp-bridge@0.3.0",
"gitlab-duo-mcp-bridge"
]
}
}
}| Canonical slug | gitlab-duo-mcp-bridge-f93f2076 | Deployment | Local Only |
|---|---|---|---|
| Canonical package | npm:gitlab-duo-mcp-bridge | Repository | Agostynah/gitlab-duo-mcp-bridge |
| First published | — | Latest release | — |
| Last security verification | — | Classification confidence | 90% |
| Publication | Draft | Official distribution | Not verified |
| Channel | Identifier | Current version | Versions | Source |
|---|---|---|---|---|
| npm | gitlab-duo-mcp-bridge | 0.3.0 | 1 | Repository |
| Package | Version | Published / observed | Inventory | Security scan |
|---|---|---|---|---|
| npmgitlab-duo-mcp-bridge | 0.3.0Current | Sep 5, 2026 | 1 toolsSucceeded · 0 resources · 0 prompts | Evidence restricted |
Independently scan the exact version your agents use, receive alerts when its risk changes, and investigate every finding with retained version evidence.
No public current-version evidence is available yet.
| Tool | Category | Annotations | Risk |
|---|---|---|---|
duo_reviewRun a code review with the GitLab Duo CLI and return a normalized, fault-tolerant result. Use this to get a 'second opinion' review of a diff or set of files: pass a unified `diff` (and/or `files`/`instructions`), and you get back a stable JSON structure with a `summary` and a list of `issues` (type, severity, file, line, message, suggestion). If Duo answers with prose instead of JSON, the result is still returned with `degraded: true` and the raw text in `summary`/`raw`. Your agent can then act on the issues (e.g. write fixes).Input schema{
"type": "object",
"properties": {
"diff": {
"type": "string",
"description": "Unified diff to review (e.g. output of `git diff`)."
},
"files": {
"type": "array",
"items": {
"type": "string"
},
"description": "File paths to focus the review on."
},
"instructions": {
"type": "string",
"description": "Extra free-form guidance for the reviewer."
},
"goal": {
"type": "string",
"description": "Override the entire prompt sent to Duo. When set, diff/files/instructions are ignored."
},
"cwd": {
"type": "string",
"description": "Working directory to run Duo in for this call."
},
"model": {
"type": "string",
"description": "Override the Duo model for this call."
},
"timeoutMs": {
"type": "integer",
"exclusiveMinimum": 0,
"description": "Override the run timeout (milliseconds) for this call."
}
},
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Output schema{
"type": "object",
"properties": {
"ok": {
"type": "boolean",
"description": "True when Duo exited successfully and did not time out."
},
"degraded": {
"type": "boolean",
"description": "True when output could not be parsed as JSON (raw text fallback)."
},
"summary": {
"type": "string",
"description": "Review summary, or raw text when degraded."
},
"issues": {
"type": "array",
"items": {
"type": "object",
"properties": {
"type": {
"type": "string"
},
"severity": {
"type": "string",
"enum": [
"critical",
"high",
"medium",
"low",
"info"
]
},
"file": {
"type": [
"string",
"null"
]
},
"line": {
"type": [
"number",
"null"
]
},
"message": {
"type": "string"
},
"suggestion": {
"type": [
"string",
"null"
]
}
},
"required": [
"type",
"severity",
"file",
"line",
"message",
"suggestion"
],
"additionalProperties": false
},
"description": "Normalized list of findings."
},
"raw": {
"type": "string",
"description": "Raw (truncated) Duo output for debugging."
},
"meta": {
"type": "object",
"properties": {
"commandLine": {
"type": "string"
},
"exitCode": {
"type": [
"number",
"null"
]
},
"timedOut": {
"type": "boolean"
},
"durationMs": {
"type": "number"
},
"mock": {
"type": "boolean"
},
"parseError": {
"type": [
"string",
"null"
]
},
"goalViaFile": {
"type": "boolean"
}
},
"required": [
"commandLine",
"exitCode",
"timedOut",
"durationMs",
"mock",
"parseError",
"goalViaFile"
],
"additionalProperties": false
}
},
"required": [
"ok",
"degraded",
"summary",
"issues",
"raw",
"meta"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
} | — | — |
| Endpoint | Transport | Authentication | Health | Observed |
|---|---|---|---|---|
| No verified remote endpoint is linked. | ||||
Install the selected package version with: npm install --save-exact gitlab-duo-mcp-bridge@0.3.0
gitlab-duo-mcp-bridge MCP Server exposed 1 tool during independent protocol observation, including duo_review.
The selected current version does not yet have completed public verification. Unknown does not mean clean or vulnerable.
These internal links are derived from strong identity fields such as the implementation name, package, repository, vendor, and listing name—not generic description prose.
Association is based on retained identity fields; it does not by itself prove first-party publication.
Curated product and capability guides containing this catalog record.