Andromity Logo
Andromity
Install Free

GITLAB MCP SERVER

Connect GitLab to Andromity with the GitLab MCP server

Connect GitLab's official MCP server to Andromity: let your AI coding agent read merge requests, issues and CI pipelines, and create branches and commits.

Server
https://gitlab.com/api/v4/mcp
Connects with
Browser sign-in (OAuth)
Category
Developer

Shekhar Pachlore · Updated

GitLab runs an official MCP server on every instance at /api/v4/mcp. On GitLab.com that is https://gitlab.com/api/v4/mcp. With it, Andromity can read merge requests and their diffs, look at failing pipelines and job logs, work with issues, and create branches and commits.

Sign-in is OAuth with dynamic client registration: the browser opens GitLab, you approve, and the agent gets a token with the mcp scope. GitLab documents the server as generally available since GitLab 19.5, on Free, Premium and Ultimate.

What the agent can do with GitLab

  • Read merge requests with diffs, commits, comments, approvals and pipelines (get_merge_request, list_merge_requests).
  • Create and update merge requests, post review comments and add notes (save_merge_request, save_merge_request_review, save_note).
  • Create and update issues and other work items, and link them (save_work_item, get_work_item, list_work_items, link_work_items).
  • Read files and browse the repository tree, list branches and commits (get_repository_file, list_repository_tree, list_branches, list_commits).
  • Create branches and commit file changes (add_branch, add_commit).
  • Inspect pipelines and jobs, read job logs, and run or retry a pipeline (get_pipeline, get_job, save_pipeline).
  • Search projects, groups and code (search, list_projects, semantic_search).
  • On Ultimate, list and triage security vulnerabilities (list_vulnerabilities, get_vulnerability).

Example prompts

Ask for the work in plain language. Naming the server helps, for example “use the GitLab MCP server”.

  • The pipeline on merge request !482 is failing. Read the job log, find the cause and fix it on this branch.
  • Read GitLab issue #217, implement it, and add a note on the issue summarizing what changed.
  • Review the diff of merge request !530 and post comments on anything that looks wrong.
  • List open work items labeled bug in this project and tell me which ones touch the files in this diff.

Connect GitLab

  1. On GitLab.com, a top-level group owner must allow access to the MCP server. On Self-Managed and Dedicated, an administrator allows it for the instance.
  2. In VS Code, open Andromity Hub → MCP Servers → Discover. In the terminal app, open /settings → MCP → + Connect an app. Find GitLab and select Connect.
  3. Approve the connection in your browser.
  4. Andromity saves GitLab to ~/.andromity/mcp.json and connects it.
  5. On Self-Managed or Dedicated, add the server by hand in mcp.json with the URL https://<your-instance>/api/v4/mcp and sign in from its card.

See Connect an app for how Andromity stores connectors and tokens.

Access and safety

  • The agent acts as you. You authorize with your own GitLab credentials, and the server only returns data you can access. Listing a tool does not grant access; each call checks permissions.
  • GitLab accepts OAuth tokens with the mcp scope or fine-grained personal access tokens with the MCP tool resource and Execute permission. Legacy personal access tokens, project tokens and group tokens are rejected with 403.
  • GitLab groups tools into toolsets, selected with the X-Gitlab-Enabled-Mcp-Server-Toolsets header. Meta, core, merge requests, work items, repository and CI are on by default; wikis, code security and orbit are opt-in.
  • GitLab warns about prompt injection and advises using the tools only on GitLab objects you trust. Andromity's permission modes apply to every GitLab tool call.

In an untrusted folder, MCP servers don’t start at all. Read workspace trust and permission modes for the full model.

Limits to know

  • On GitLab.com, requests are limited to 60 per minute per user on Free and 600 per minute on Premium and Ultimate. Self-Managed and Dedicated use an instance-wide limit set by an admin.
  • Dynamic client registration is limited to 10 registrations per hour per IP address, which can affect people behind a shared egress IP.
  • Security tools such as list_vulnerabilities need Ultimate.

Questions

Does GitLab have an official MCP server?
Yes. GitLab ships one at /api/v4/mcp on GitLab.com, Self-Managed and Dedicated. It is generally available since GitLab 19.5.
Does the GitLab MCP server work with self-managed GitLab?
Yes. Use https://<your-instance>/api/v4/mcp. An administrator must allow MCP server access for the instance.
Is the GitLab MCP server free?
GitLab documents it for Free, Premium and Ultimate. Rate limits are higher on Premium and Ultimate, and security tools need Ultimate.

Sources

This guide is based on GitLab’s own documentation. The app controls its server, so tools can change; check the source for the current list.

GitLab is a trademark of its owner. Andromity is not affiliated with or endorsed by GitLab.