Skip to main content
Glama
Sign In
gitlab-api

gitlab-api

by Knuckles-Team
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Hybrid

Get project dependencies

gitlab_get_project_dependencies
Read-onlyIdempotent

Retrieve a GitLab project's detected dependency list with optional package-manager filtering and pagination to inspect dependencies and support dependency analysis.

Instructions

Get a project's Dependency List (all detected dependencies).

GET /projects/{project_id}/dependencies

Args: **kwargs: project_id (required); optional package_manager filter and pagination (page, per_page, max_pages).

Returns: Response: wrapper containing the original response and the parsed dependency list (list of dicts).

Raises: MissingParameterError: If project_id is missing. ParameterError: If invalid parameters are provided.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "gitlab_get_project_dependencies"
  }
}

Input Schema

NameRequiredDescriptionDefault
dataNo
pageNo
group_idNo
per_pageNo
max_pagesNo
project_idNo
package_managerNo
vulnerability_idNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv27.3.20
    • removedInput schema / properties / api_parameters
      Removed value: -{
-  "anyOf": [
-    {
-      "additionalProperties": true,
-      "type": "object"
-    },
-    {
-      "type": "null"
-    }
-  ],
-  "default": null
-}
  2. First observedv27.3.13

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint and destructiveHint=false, so the safety profile is covered. The description adds real value on top: it names the error conditions (MissingParameterError for a missing project_id, ParameterError for invalid parameters) and describes the return as a wrapper containing the original response plus a parsed list of dicts. It does not state authentication requirements or pagination defaults, which keeps it below 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with a one-line purpose followed by the endpoint, then Args/Returns/Raises sections that are easy to scan. There is some docstring boilerplate ('**kwargs', 'Response: wrapper containing the original response') that could be tightened, but no sentence is truly wasteful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter read tool with no output schema, the description does cover the return shape and error behavior, which is the most important part. However, with zero schema descriptions the unexplained parameters (data, group_id, vulnerability_id) and the missing pagination semantics leave real gaps an agent would hit when constructing a call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 8 parameters, so the description carries the full burden, yet it documents only 5 of them (project_id, package_manager, page, per_page, max_pages) and even those only by name with no accepted formats or valid values for package_manager. Three parameters visible in the schema — data, group_id, and vulnerability_id — are never mentioned, leaving the agent unable to reason about them. It also says project_id is required while the schema marks it nullable with a null default, a mismatch worth flagging.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Get a project's Dependency List (all detected dependencies)') and pins it to the exact endpoint GET /projects/{project_id}/dependencies, so an agent knows precisely what data comes back. It does not explicitly contrast with any sibling tool, but the resource is unique enough within this large tool set to be unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the resource description and by naming an optional package_manager filter, but there is no explicit when-to-use guidance, no when-not-to-use, and no mention of alternatives (e.g. vulnerability-oriented dependency views that might be reached via the omitted vulnerability_id parameter). The agent can infer intent but receives no routing help.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools