Skip to main content

GitLab MCP server

GitLab is a complete DevOps platform that unifies source code management, CI/CD pipelines, security scanning, and more. An AI agent with access to GitLab can manage repositories, create merge requests, orchestrate CI/CD pipelines, analyze security, and coordinate development workflows without manual GitLab operations.

Setting up an MCP server

This article covers the standard steps for creating an MCP server in AI Gateway and connecting it to an AI client. The steps are the same for every integration — application-specific details (API credentials, OAuth endpoints, and scopes) are covered in the individual application pages.

Before you begin

You'll need:

  • Access to AI Gateway with permission to create MCP servers
  • API credentials for the application you're connecting (see the relevant application page for what to collect)

Create an MCP server

Find the API in the catalog

  1. Sign in to AI Gateway and select MCP Servers from the left navigation.
  2. Select New MCP Server.
  3. Search for the application you want to connect, then select it from the catalog.

Configure the server

  1. Enter a Name for your server — something descriptive that identifies both the application and its purpose (for example, "Zendesk Support — Prod").
  2. Enter a Description so your team knows what the server is for.
  3. Set the Timeout value. 30 seconds works for most APIs; increase to 60 seconds for APIs that return large payloads.
  4. Toggle Production mode on if this server will be used in a live workflow.
  5. Select Next.

Configure authentication

Enter the authentication details for the application. This varies by service — see the Authentication section of the relevant application page for the specific credentials, OAuth URLs, and scopes to use.

Configure security

  1. Set any Rate limits appropriate for your use case and the API's own limits.
  2. Enable Logging if you want AI Gateway to record requests and responses for auditing.
  3. Select Next.

Deploy

Review the summary, then select Deploy. AI Gateway provisions the server and provides a server URL you'll use when configuring your AI client.


Connect to an AI client

Once your server is deployed, you'll need to add it to the AI client your team uses. Select your client for setup instructions:

Tips

  • You can create multiple MCP servers for the same application — for example, a read-only server for reporting agents and a read-write server for automation workflows.
  • If you're unsure which OAuth scopes to request, start with the minimum read-only set and add write scopes only when needed. Most application pages include scope recommendations.
  • You can edit a server's name, description, timeout, and security settings after deployment without redeploying.

Authentication

GitLab uses OAuth 2.0 authentication. Create an OAuth application in your GitLab settings at Settings > Applications. The authorization endpoint for gitlab.com is https://gitlab.com/oauth/authorize and the token endpoint is https://gitlab.com/oauth/token. For self-hosted GitLab, use your instance URL with the same paths. Configure scopes based on your needs: api (full API access), read_api (read-only API), read_repository (clone/pull), write_repository (push), read_registry (container registry read), write_registry (container registry write), and read_user (user profile). The API base URL is https://gitlab.com/api/v4 for gitlab.com.

Available tools

This MCP server enables repository management, merge request workflows, CI/CD pipeline orchestration, issue tracking, security operations, and analytics for GitLab projects.

ToolDescription
Create projectCreate a new GitLab project with settings
Get projectRetrieve project details and configuration
Update projectModify project settings and metadata
Delete projectRemove a project
List projectsRetrieve projects with filtering and sorting
Create branchCreate a new branch in a project
Delete branchDelete a branch
List branchesRetrieve all branches in a project
Protect branchProtect a branch from direct pushes
Create fileCreate a file in a repository
Update fileModify a file in a repository
Delete fileDelete a file from a repository
Get fileRetrieve file contents from a repository
Create merge requestCreate a merge request between branches
Get merge requestRetrieve merge request details and status
Update merge requestModify MR title, description, or state
Approve merge requestMark an MR as approved
Merge merge requestMerge an approved merge request
Close merge requestClose an MR without merging
Add commentComment on a merge request or issue
Create issueCreate a new issue in a project
Get issueRetrieve issue details
List issuesRetrieve issues with filtering options
Update issueModify issue status, labels, or assignee
Close issueClose an issue
Create pipelineTrigger a pipeline run
Get pipelineRetrieve pipeline execution status
List pipelinesRetrieve recent pipeline runs
Get jobRetrieve job details and logs
Get artifactsRetrieve job artifacts and download links
Create releaseCreate a release with tag and notes
Get releaseRetrieve release details
Create tagCreate a git tag for versioning
Scan for vulnerabilitiesTrigger SAST or dependency scanning
Get scan resultsRetrieve security scan results
List merge requestsRetrieve open merge requests
Create milestoneCreate a milestone for issues and epics
Get milestoneRetrieve milestone details

Tips

Generate personal access tokens for automated operations that run without user interaction and don't need to act on behalf of a specific person.

Use OAuth for integrations that act on behalf of users and should reflect their identity in audit logs.

Store CI/CD configuration in .gitlab-ci.yml at the repository root to define your pipeline steps.

Commit the .gitlab-ci.yml file before attempting to trigger pipelines via the API, or the API calls will fail to find the pipeline definition.

Check merge conflict status before attempting to merge — the API cannot resolve merge conflicts automatically, and merge will fail if conflicts exist.

Ensure approval rules pass before attempting to merge, as branches with protection rules require approvals and status checks.

Monitor API usage and implement exponential backoff for retries to respect rate limits, as GitLab enforces 600 requests per minute.