gitlab-api

Create project deploy token

gitlab_create_project_deploy_token

Create a project deploy token to authenticate automated deployments. Save the returned secret immediately, as it is shown only once.

Instructions

Create a deploy token for a project.

Returns a secret: the new token string is returned once, at creation, and never by any read call. Store it now.

Args: **kwargs: Additional parameters for the request (e.g., project_id, name, scopes).

Returns: Response: A wrapper containing the original response and a DeployToken model.

Raises: ParameterError: If invalid parameters are provided. MissingParameterError: If required parameters are missing.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "gitlab_create_project_deploy_token"
  }
}

Input Schema

Name	Required	Description	Default
`name`	No
`page`	No
`token`	No
`scopes`	No
`group_id`	No
`per_page`	No
`username`	No
`max_pages`	No
`expires_at`	No
`project_id`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedv27.3.20Nov 7, 2026

removedInput schema / properties / api_parameters

Removed value: -{
-  "anyOf": [
-    {
-      "additionalProperties": true,
-      "type": "object"
-    },
-    {
-      "type": "null"
-    }
-  ],
-  "default": null
-}

changedInput schema / properties / page / default
```
Previous value: -1New value: +null
```
changedInput schema / properties / per_page / default
```
Previous value: -100New value: +null
```

First observedv27.3.13Oct 25, 2026

TDQS

B3/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds genuinely valuable behavior beyond annotations: the returned token string is a secret shown only once at creation and never returned by any read call, with an explicit 'store it now' instruction. It also enumerates the error types raised. It stops short of stating required permissions or that repeated calls mint distinct tokens (consistent with idempotentHint=false but not explained).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The secret-return warning is correctly front-loaded and is the highest-value sentence. The 'Args: **kwargs' block is boilerplate that spends space without documenting the 0%-covered schema, and Returns/Raises are standard docstring filler, but nothing is egregiously verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter creation tool with no output schema and no schema descriptions, the definition leaves most parameter meaning unexplained. It conveys the return shape only loosely ('a wrapper containing the original response and a DeployToken model') and gives no guidance on required fields, since the schema declares zero required parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 10 parameters, so the description carries the full burden, yet it only names three (project_id, name, scopes) as 'e.g.' examples under a **kwargs catch-all. Important inputs such as token, expires_at, username, group_id, and the pagination params (page, per_page, max_pages) get no explanation, and there is no note on scopes formatting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Create a deploy token for a project.' The 'for a project' scope implicitly separates it from gitlab_create_group_deploy_token, though the description never names that sibling explicitly. An agent can identify the operation without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use or when-not-to-use guidance and no mention of the project-vs-group alternative that dominates the sibling list. The only implied guidance is the operation itself; the agent must infer that a project_id is needed to target a project.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server