# Is `npm:@modelcontextprotocol/server-gitlab` safe to install? (snapshot)

**This page is a snapshot, not clearance, and not a safety guarantee.**
Advisories, registry data and KarmaDue answers change.
**Recheck live immediately before you install.** Do not treat `no_known_issues` or a missing record as approval.

- Captured at: 2026-11-12 2:31:28 AM EST (`2026-11-12T02:31:28.114011-05:00`)
- Target: `npm:@modelcontextprotocol/server-gitlab`
- Ecosystem: `npm`
- Package: `@modelcontextprotocol/server-gitlab`
- Decision: `warn`
- Enforce: `proceed_with_care`
- Headline: Caution before you install @modelcontextprotocol/server-gitlab@2025.4.25: The publisher deprecated @modelcontextprotocol/server-gitlab (npm): "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.". Its upstream repository is archived (no fixes). Go ahead with normal care; nothing here is a safety guarantee.

## Sources in this snapshot

- passport: https://karmadue.expo.app/passport/kd:res:github:modelcontextprotocol/servers-archived
- checked: npm registry: package exists
- checked: npm usage and publisher: 5,998 downloads last week, publisher "jspahrsummers"
- checked: OSV advisories and OpenSSF malicious-package reports for @modelcontextprotocol/server-gitlab@2025.4.25
- checked: KarmaDue record kd:res:github:modelcontextprotocol/servers-archived
- checked: npm status of @modelcontextprotocol/server-gitlab@2025.4.25: deprecated version; published 2025-04-25
- checked: OSV advisory history for @modelcontextprotocol/server-gitlab (all versions)

## Gaps (what was not checked)

- no safety-grade check (security review, sandbox run, malware scan or dependency audit) on file
- behaviour at run time is never observed by this check

## Recheck live before install

Safety MCP (streamable HTTP, no account):

`https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp/safety`

One-line MCP call:

    check {"target":"npm:@modelcontextprotocol/server-gitlab","action":"install"}

curl:

```bash
curl -s -X POST https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp/safety \
  -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \
  -H 'X-KD-Via: kd-founder-test' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check","arguments":{"target":"npm:@modelcontextprotocol/server-gitlab","action":"install"}}}'
```

This snapshot was produced with the header `X-KD-Via: kd-founder-test` so KarmaDue can exclude founder test traffic from usage counts when that tagging is in place. You do not need that header.

Index of snapshot pages: [docs/safe/index.md](../../safe/index.md) · KarmaDue: [AGENTS.md](https://karmadue.expo.app/AGENTS.md)