GitLab MCP Server: Tools, Setup and Security

The GitLab MCP server lets an AI app read and update merge requests, work items, repository files and CI pipelines in your GitLab instance. GitLab builds it into the product itself, so it runs on GitLab.com, Self-Managed and Dedicated.

Checked against: GitLab MCP server docs on 28 October 2026. eSEOspace did not install or test this server.

At a glance

What it can do

GitLab groups tools into toolsets. The defaults are core, merge_requests, work_items, repository and ci, and meta is always on. wikis, code_security and orbit are opt-in. A duo_agent_platform toolset appears only when GitLab Duo Agent Platform is available.

The MCP server tools page lists tools such as:

• Merge requests: get_merge_request, list_merge_requests, save_merge_request, save_merge_request_review, accept_merge_request
• Work items: get_work_item, list_work_items, save_work_item, save_note, link_work_items
• Repository: get_repository_file, list_repository_tree, list_commits, add_commit, add_branch, search, semantic_search
• CI/CD: get_pipeline, list_pipelines, save_pipeline, get_job, get_artifact_file
• Security (Ultimate): list_vulnerabilities, get_vulnerability, save_vulnerability

You choose toolsets with the X-Gitlab-Enabled-Mcp-Server-Toolsets header. Use all to request everything.

How to connect it

For Claude Code, GitLab documents this command, then running /mcp in the chat to sign in:

claude mcp add -s user --transport http GitLab https://<gitlab.example.com>/api/v4/mcp

For Cursor and other HTTP clients, the generic config is:

{"mcpServers": {"GitLab": {"type": "http", "url": "https://<gitlab.example.com>/api/v4/mcp"}}}

Use gitlab.com as the host for GitLab.com. GitLab also documents setup for Codex, Gemini CLI, OpenCode, Kiro, GitHub Copilot in VS Code and Amazon Q Developer. Claude Desktop and Zed connect through npx -y mcp-remote, which needs Node.js 20 or later.

Security notes

GitLab's permission model is clear. Users sign in with their own credentials and can reach only data they are already allowed to see.

Points GitLab calls out:

• Prompt injection is on you. The docs say to use MCP tools only on GitLab objects you trust.
• Token types. Only OAuth tokens with the mcp scope and fine-grained PATs work. Legacy personal, project and group tokens return 403.
• Shared OAuth apps. GitLab does not verify which client uses a shared clientId, and apps created through the REST API do not enforce PKCE.
• Write tools. accept_merge_request merges code, save_pipeline can run or cancel pipelines, and start_duo_session can push commits.

The MCP project's security best practices also cover risks such as token passthrough, confused deputy attacks and scope minimization.

Start with the default toolsets and add more only when needed. For background, read MCP OAuth misconfigurations and prompt injection through tool results, or browse the MCP Security Center.

Alternatives

• GitHub MCP Server for teams on GitHub.
• Atlassian Rovo MCP Server for Bitbucket Cloud plus Jira.
• CircleCI MCP server or Buildkite MCP server if your CI runs outside GitLab.

Next step

Ask your GitLab admin to allow MCP access, then start with read-heavy toolsets. The MCP server directory has profiles of other code and CI tools.

Frequently asked questions