Developer workflow: 5 MCP servers for docs, GitLab and code review, scored

Up-to-date code docs for any prompt.

The evidence: 62,989 GitHub stars · MIT licence · has a security policy · last push Oct 13, 2026 · repo created Mar 2025 · no hygiene flags. (Maintenance 40/40 · security hygiene 35/35 · adoption 15/25)

npx -y @upstash/context7-mcp

Before you install: The README recommends a free API key (from context7.com/dashboard) for higher rate limits, passed as an Authorization: Bearer header when you use the hosted endpoint https://mcp.context7.com/mcp. Documentation lookups are answered by Context7's service, so the library names and questions your agent asks go to it.

Who should skip it: If your agent mostly works on private or in-house code that no public documentation covers.

Sources: Socketlist page · GitHub

GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more.

The evidence: 2,037 GitHub stars · MIT licence · has a security policy · last push Oct 13, 2026 · repo created Feb 2025 · no hygiene flags. (Maintenance 40/40 · security hygiene 35/35 · adoption 15/25)

npx -y @zereight/mcp-gitlab

Before you install: It needs a GitLab personal access token (GITLAB_PERSONAL_ACCESS_TOKEN) or OAuth. Start with GITLAB_PERMISSION_MODE=readonly, which the README documents; GITLAB_TOOLS lets you add only the specific write tools you need. The older --read-only flag is deprecated.

Who should skip it: If your code is on GitHub rather than GitLab.

Sources: Socketlist page · GitHub

Local, deterministic review of Git changes: weakened tests and CI gates, risky flows, blast radius.

The evidence: 24 GitHub stars · 331 npm downloads last week · Apache-2.0 licence · has a security policy · last push Oct 12, 2026 · repo created May 2026 · no hygiene flags. (Maintenance 40/40 · security hygiene 35/35 · adoption 13/25)

npx -y repopilot mcp --root .

Before you install: Its README says analysis runs on the machine or CI runner that invokes it, sends no source to a hosted service and uses no embedded language model. Run it from the repository you want reviewed (--root .). It is a young project with a pre-1.0 version, so expect rough edges.

Who should skip it: If you want a written review summary. It reports structural findings in the diff, such as skipped tests or a loosened CI check, and leaves the judgement to you.

Sources: Socketlist page · GitHub

AI code research platform. Search, analyze, and extract insights from any GitHub repository.

The evidence: 950 GitHub stars · 1,815 npm downloads last week · MIT licence · no security policy · last push Oct 9, 2026 · repo created Jun 2025. (Maintenance 39/40 · security hygiene 25/35 · adoption 23/25)

npx -y octocode-mcp

Before you install: It needs Node 20.12 or newer. Signing in with GitHub (npx octocode auth login) is optional, but unlocks private repositories and higher API rate limits. The README says it redacts secrets in tool output and blocks reads of known secret files such as .env, .npmrc and cloud credentials by default.

Who should skip it: If your agent only ever works inside one local checkout and never needs to read other repositories.

Sources: Socketlist page · GitHub

Token efficient search for coding agents over public and private documentation.

The evidence: 1,180 GitHub stars · 1,057 npm downloads last week · MIT licence · no security policy · last push Oct 1, 2026 · repo created Apr 2025. (Maintenance 38/40 · security hygiene 25/35 · adoption 23/25)

npx -y ref-tools-mcp

Before you install: It needs an API key (REF_API_KEY) from ref.tools; check its current plan limits before you rely on it. The README says its tools are built to use as little of your agent's context as possible.

Who should skip it: If Context7-style public library docs already cover what you need, or you do not want to create another account.

Sources: Socketlist page · GitHub