GitLab MCP, GitLab's built-in MCP server

• Searches across your GitLab instance

  Runs a GitLab search for a term across the whole instance, a group or a project. The scopes you can use depend on the search type.

  Try: “Search GitLab for "retry backoff" in the payments project.”

  Read · search

• Searches a project by meaning

  Finds relevant content in a project by meaning instead of exact keywords. Use it when you do not know the right words. Behind a feature flag.

  Try: “Find code in this project that handles failed payments.”

  Read · semantic_search

• Shows details of one project

  Returns a project's ID, full path, default branch, visibility and web URL, given a URL or an ID.

  Try: “What is the default branch of gitlab-org/gitlab?”

  Read · get_project

• Lists projects you can access

  Lists projects where you have at least Guest access, or every project in a group and its subgroups when you give a group.

  Try: “List the projects in the platform group.”

  Read · list_projects

• Lists groups and subgroups

  Browses the group hierarchy so you can find group IDs and paths to use with other tools.

  Try: “Show the subgroups of the platform group.”

  Read · list_groups

• Reads a merge request and its details

  Fetches a merge request, and on request one extra part such as diffs, commits, notes, pipelines, discussions, approvals or conflicts.

  Try: “Show merge request 42 in gitlab-org/gitlab with its diffs.”

  Read · get_merge_request

• Lists or searches merge requests

  Returns compact merge request details for a project or group. Group searches include every project beneath it.

  Try: “List open merge requests assigned to me in the web group.”

  Read · list_merge_requests

• Creates or updates a merge request

  Creates a merge request, or updates one when you give its number. Handles title, branches, labels, assignees, reviewers, milestone and closing or reopening.

  Try: “Open a merge request from fix/specs into master and turn on squash.”

  Write · save_merge_request

• Writes review comments on a merge request

  Adds review output as you, one action per call, such as a top-level comment or a reply in a discussion.

  Try: “Leave a review comment on merge request 42 about the missing test.”

  Write · save_merge_request_review

• Merges a merge request

  Merges a merge request now, or schedules it to merge automatically once its checks pass.

  Try: “Merge request 42 once the pipeline passes.”

  Write · accept_merge_request

• Comments on a merge request or work item

  Adds a comment, replies in a discussion thread, or resolves or reopens a thread, as the signed-in user.

  Try: “Comment on issue 18 that the fix is in review.”

  Write · save_note

• Reads an issue, epic, task or similar

  Fetches one work item with type, dates, assignees, labels, milestone and parent, optionally with notes, discussions or related merge requests.

  Try: “Show issue 42 in gitlab-org/gitlab with its comments.”

  Read · get_work_item

• Lists or searches issues and other work items

  Lists work items such as issues, epics, tasks and incidents in a project or group, including descendants of a group.

  Try: “List open bugs in the checkout project.”

  Read · list_work_items

• Creates or updates a work item

  Creates an issue, task or epic, or updates one if you give its number. Errors clearly if a label or milestone name is not found.

  Try: “Create an issue titled "Fix login bug" in project 123.”

  Write · save_work_item

• Lists work item types in a namespace

  Shows the types available in a group or project, including custom ones, with their names and supported fields.

  Try: “What work item types does this group have?”

  Read · get_work_item_types

• Links work items together

  Connects a work item to others with a relationship type.

  Try: “Link issue 42 as blocking issue 57.”

  Write · link_work_items

• Loads a saved view's work items

  Retrieves a saved view and the work items it returns, applying its filters and sort order.

  Try: “Show the work items in my "Sprint" saved view.”

  Read · get_saved_view_work_items

• Lists a project's branches

  Returns the branches of a project, optionally filtered by name.

  Try: “List branches starting with fix/ in this project.”

  Read · list_branches

• Creates a branch from a ref

  Creates a new branch in a project from a source branch, tag or commit.

  Try: “Create branch docs-update from main.”

  Write · add_branch

• Forks a project

  Forks a project into a namespace. The fork is created in the background, and the response shows its progress.

  Try: “Fork gitlab-org/gitlab into my namespace.”

  Write · fork_repository

• Reads a file from a repository

  Returns a file's contents as committed at a given ref, not from your local checkout.

  Try: “Show README.md on main in gitlab-org/gitlab.”

  Read · get_repository_file

• Lists files and folders in a repository

  Lists the entries at a path and ref. It returns names and metadata only, not file contents.

  Try: “List the files in the docs folder on main.”

  Read · list_repository_tree

• Commits file changes to a branch

  Creates one commit holding several file actions (create, update, delete, move, chmod) on a branch, creating it from a start branch if needed.

  Try: “Create README.md on branch docs-update with commit message "Add README".”

  Delete · add_commit

• Reads one commit

  Returns a commit's metadata, and optionally its diff or notes.

  Try: “Show commit abc123 with its diff.”

  Read · get_commit

• Lists commits in a project

  Returns compact commit details, filterable by ref, author, path or date.

  Try: “Show commits by jane on main since last Monday.”

  Read · list_commits

• Lists tags

  Lists tags, most recently updated first, with exact name matches shown first.

  Try: “List the latest tags in this project.”

  Read · list_tags

• Lists releases

  Lists a project's releases, newest first.

  Try: “What was the last release of this project?”

  Read · list_releases

• Lists CI/CD pipelines

  Lists pipelines in a project with optional filters.

  Try: “Show failed pipelines on main this week.”

  Read · list_pipelines

• Reads a pipeline and its parts

  Fetches a pipeline, and optionally its jobs, downstream pipelines, trigger jobs or the artifacts its jobs produced.

  Try: “Why did pipeline 9001 fail? Include its jobs.”

  Read · get_pipeline

• Reads a CI/CD job and its log

  Returns a job's metadata, and optionally its trace log or artifacts.

  Try: “Show the log of the failing test job.”

  Read · get_job

• Reads a job artifact file as text

  Reads a file from a job's artifacts, including report files such as junit or SAST.

  Try: “Read the junit report from the last test job.”

  Read · get_artifact_file

• Runs, retries, cancels or renames a pipeline

  Starts a new pipeline, retries or cancels an existing one, or renames it.

  Try: “Retry pipeline 9001.”

  Runs code · save_pipeline

• Reads a GitLab Pages page as text

  Fetches content published on a GitLab Pages URL of your instance. Behind a feature flag.

  Try: “Read the text of our docs site on GitLab Pages.”

  Read · get_pages_content

• Lists wiki pages

  Lists the wiki pages of a project or group.

  Try: “What wiki pages does this project have?”

  Read · list_wiki_pages

• Lists project members and roles

  Returns the members of a project with their role and access level.

  Try: “Who are the maintainers of this project?”

  Read · list_project_members

• Looks up a user

  Finds a user by username, ID or yourself, mainly to get the numeric ID needed to assign people in other tools.

  Try: “What is my GitLab user ID?”

  Read · get_user

• Lists your to-do items

  Shows your pending to-dos such as review requests, assignments and mentions, or done ones if asked.

  Try: “What is waiting on me in GitLab?”

  Read · list_todos

• Searches labels

  Finds labels in a project or group by name.

  Try: “Find labels containing "bug".”

  Read · search_labels

• Creates a project

  Creates a new project in a group or your personal namespace, with options such as visibility, README and templates.

  Try: “Create a private project called my-app in the gitlab-org group.”

  Write · save_project

• Lists security vulnerabilities

  Lists a project's vulnerabilities with filters and paging. Needs a licensed security feature.

  Try: “List critical vulnerabilities in this project.”

  Read · list_vulnerabilities

• Reads one vulnerability

  Returns title, state, description, severity and identifiers for a vulnerability. Needs a licensed security feature.

  Try: “Show details of vulnerability 301.”

  Read · get_vulnerability

• Updates a vulnerability

  Performs write actions on a vulnerability in a project. Needs a licensed security feature.

  Try: “Dismiss vulnerability 301 as a false positive.”

  Write · save_vulnerability

• Attaches a security scan profile

  Applies a security scan profile to projects, or to every project in groups. Needs a licensed security feature.

  Try: “Attach the default scan profile to all projects in the platform group.”

  Write · attach_scan_profile

• Lists Duo agents and flows in a project

  Shows which GitLab Duo agents and flows a project offers, so you do not have to guess names.

  Try: “Which Duo flows can I run in this project?”

  Read · list_duo_agents_and_flows

• Starts a GitLab Duo session

  Starts a background Duo Agent Platform session toward a goal in a project and returns an ID to follow up with.

  Try: “Ask Duo to draft a fix for issue 42.”

  Write · start_duo_session

• Lists your Duo sessions

  Lists your Duo Agent Platform sessions with status, goal and start time, excluding Duo Chat.

  Try: “Show my recent Duo sessions.”

  Read · list_duo_sessions

• Checks a Duo session

  Returns a session's status and, when finished, its result. Running sessions suggest how long to wait before checking again.

  Try: “Is my Duo session done yet?”

  Read · get_duo_session

• Answers a waiting Duo session

  Replies to a session that is waiting, by approving or rejecting a plan or tool call, or answering its question.

  Try: “Approve the plan Duo proposed.”

  Write · send_duo_session_input

• Used by the assistant behind the scenes

  Shows the GitLab MCP server version

  Returns the version of the GitLab MCP server you are connected to.

  Try: “What version of the GitLab MCP server am I using?”

  Read · get_mcp_server_version

Watch out for

• It acts with your full GitLab permissions

  Each call runs as you, so it can do anything you can in the projects you reach. The default tool groups include merge requests, commits and pipelines. Use a fine-grained token with only the scopes you need. docs.gitlab.com

• Text in issues and merge requests can trick it

  GitLab says you are responsible for guarding against prompt injection. Use it only on GitLab items you trust. docs.gitlab.com

• Admin tool rules do not cover Claude or Cursor

  Tool governance applies to GitLab Duo agents only. Narrow outside clients with the toolset headers instead. docs.gitlab.com

• Shared sign-in apps may skip a security check

  OAuth apps pre-registered through the API accept but do not require PKCE. Check that your client sends a code challenge. docs.gitlab.com

• Self-Managed: update to 19.4.1 or later

  Two MCP flaws were fixed in 19.4.1, 19.3.3 and 19.2.7. Older patch levels of 18.3 to 19.4 are affected. docs.gitlab.com

Security advisories

In their words