MCP server · GitLab
GitLab MCP Server
⚠ No independent security audit: entries summarize official sources only. Review permissions and code before installing.
- Type
- MCP server
- Tasks
- Git & GitHub reposCode reviewCI/CD
- Compatible agents
- Cursor, Amazon Q Developer, Claude Code, Claude Desktop, Gemini Code Assist, Gemini CLI, GitHub Copilot, VS Code, Kiro, OpenCode, Codex, Zed (source: clients with a "Connect <client> to the GitLab MCP server" section in GitLab's official docs (docs.gitlab.com/user/model_context_protocol/mcp_server))
- Verdict
- Pick it to work with GitLab merge requests, issues and pipelines from the agent; limit toolsets with the X-Gitlab-Enabled-Mcp-Server-Toolsets header for narrower access.
- Permissions
- Acts on your GitLab data on your behalf: projects, issues/work items, merge requests, repository and CI tools by default (wikis, code_security and orbit toolsets are opt-in); each tool still checks your project and namespace permissions. GitLab warns you are responsible for guarding against prompt injection.
- Credentials
- OAuth access token with the `mcp` scope (dynamic client registration or a pre-registered OAuth app), or a fine-grained personal access token with the MCP tool resource; legacy, project and group tokens are rejected. Access must be allowed for the top-level group (GitLab.com) or the instance.
- Maintenance
- Built into GitLab (generally available since GitLab 19.5, all tiers); MCP server docs last changed 2026-10-17 in gitlab-org/gitlab; no separate release
- License
- Not stated for the MCP server (built into GitLab)
- Install
- Add the HTTP server `https://gitlab.com/api/v4/mcp` (Self-Managed/Dedicated: `/api/v4/mcp` on your instance URL). Claude Code: `claude mcp add -s user --transport http GitLab https://gitlab.com/api/v4/mcp`; clients without HTTP support use `npx mcp-remote` (see docs). Official install docs ↗
- Source
- https://gitlab.com/gitlab-org/gitlab
- Verified on
- 2026-10-20
Badge for your README
Maintain this project? Show that it's listed here. The badge only says it's listed; it is not a security review or an endorsement.
