Example: {"action":"approve_group","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_access/.

Manage GitLab access credentials: access tokens (project/group/personal), deploy tokens, deploy keys, access requests, and invitations. Revoke/delete actions are destructive and irreversible. When to use: provision and audit who/what can access a project or group; rotate (not revoke+create) to roll a token without invalidating CI configurations. NOT for: SSH/GPG keys or impersonation tokens (use gitlab_user), PAT creation (use gitlab_user create_personal_access_token / create_current_user_pat — gitlab_access exposes token_personal_* for list/get/rotate/revoke only), instance admin operations (use gitlab_admin), project membership/permissions (use gitlab_project member_*), 2FA/MFA flows.

Returns:

• token_list / deploy_token_list / deploy_key_list_* / request_list_* / invite_list_*: arrays with pagination.

• token_get / tokencreate / tokenrotate / deploy_token_get / deploy_token_create_* / deploy_key_get / deploy_key_add / deploy_key_update / deploy_key_enable / approve_* / request_*: token / key / request / invitation object. Create / rotate include the cleartext token only ONCE — store it securely; subsequent reads return only the metadata.

• token_revoke / deploy_token_delete / deploy_key_delete / deny_* : {success, message}. Errors: 401/403 (hint: requires Maintainer+ to manage project tokens, Owner for group, admin for instance / deploy_token_list_all / deploy_key_list_all / deploy_key_add_instance), 404 (hint: token_id and deploy_key_id are scoped to the project/group), 400 (hint: scopes must be a subset of {api, read_api, read_repository, write_repository, read_registry, write_registry}; expires_at must be a future ISO date).

Param conventions: * = required. List actions accept page, per_page. Token actions scope to project_id* or group_id*. Deploy token/key delete and token revoke are irreversible.

Access tokens (token_*) — project, group, and personal scopes. Rotate generates a new token and invalidates the old one:

• token_project_list / token_group_list: project_id* or group_id*

• token_project_get / token_group_get: project_id* or group_id*, token_id*

• token_project_create / token_group_create: project_id* or group_id*, name*, scopes*, expires_at, access_level

• token_project_rotate / token_group_rotate: project_id* or group_id*, token_id*, expires_at

• token_project_rotate_self / token_group_rotate_self: project_id* or group_id*, expires_at

• token_project_revoke / token_group_revoke: project_id* or group_id*, token_id*

• token_personal_list: user_id

• token_personal_get: token_id*

• token_personal_rotate: token_id*, expires_at

• token_personal_rotate_self: expires_at

• token_personal_revoke: token_id*

• token_personal_revoke_self: (no params)

Deploy tokens (deploy_token_*) — scoped to project or group, used for CI/CD registry access:

• deploy_token_list_all: (admin only)

• deploy_token_list_project / deploy_token_list_group: project_id* or group_id*

• deploy_token_get_project / deploy_token_get_group: project_id* or group_id*, deploy_token_id*

• deploy_token_create_project / deploy_token_create_group: project_id* or group_id*, name*, scopes*, expires_at

• deploy_token_delete_project / deploy_token_delete_group: project_id* or group_id*, deploy_token_id*

Deploy keys (deploy_key_*) — SSH keys for read/write repo access without a user account:

• deploy_key_list_project / deploy_key_list_user_project: project_id*

• deploy_key_list_all: (admin only)

• deploy_key_get: project_id*, deploy_key_id*

• deploy_key_add: project_id*, title*, key*, can_push

• deploy_key_update: project_id*, deploy_key_id*, title, can_push

• deploy_key_delete: project_id*, deploy_key_id*

• deploy_key_enable: project_id*, deploy_key_id*

• deploy_key_add_instance: title*, key*

Access requests (request_, approve_, deny_*):

• request_list_project / request_list_group: project_id* or group_id*

• request_project / request_group: project_id* or group_id*

• approve_project / approve_group: project_id* or group_id*, user_id*, access_level

• deny_project / deny_group: project_id* or group_id*, user_id*

Invitations (invite_*):

• invite_list_project / invite_list_group: project_id* or group_id*

• invite_project / invite_group: project_id* or group_id*, email*, access_level*, expires_at

See also: gitlab_user (SSH/GPG keys, user PATs), gitlab_admin (instance admin), gitlab_project (project settings)

Example: {"action":"alert_metric_image_delete","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_admin/.

GitLab self-managed instance administration: settings, license, broadcast messages, system hooks, Sidekiq monitoring, plan limits, OAuth applications, secure files, Terraform states, cluster agents, dependency proxy cache, plus bulk imports (GitLab→GitLab migrations) and external imports (GitHub/Bitbucket). Most actions require admin privileges. Delete/purge/revoke actions are destructive. When to use: instance-level admin tasks on a self-managed GitLab (settings, license, features, system hooks, Sidekiq monitoring, bulk imports between GitLab instances, external imports from GitHub/Bitbucket). NOT for: user CRUD (use gitlab_user), group/project administration (use gitlab_group / gitlab_project), MCP server itself (use gitlab_server), runtime feature flags per project (use gitlab_feature_flags), CI variables (use gitlab_ci_variable).

Behavior:

• Idempotent reads: settings_get / appearance_get / *_list / get / sidekiq / app_statistics_get / metadata_get / usage_data_service_ping / usage_data_non_sql_metrics / usage_data_queries / usage_data_metric_definitions / plan_limits_get / feature_list / feature_list_definitions.

• settings_update / appearance_update / feature_set / plan_limits_change / custom_attr_set / error_tracking_update_settings are idempotent (same input → same state). license_add / system_hook_add / system_hook_test / broadcast_message_create / application_create / bulk_import_start / import_github / import_bitbucket / import_bitbucket_server / import_gists are NON-idempotent (re-invocation creates duplicates or new background jobs).

• Side effects: license_add / system_hook_add / broadcast_message_create / settings_update / feature_set apply instance-wide IMMEDIATELY (all sessions affected); bulk_import_* and import_* queue long-running async migrations — poll bulk_import_get / bulk_import_entity_* until status='finished'; usage_data_track_event posts to Snowplow when send_to_snowplow=true; application_create returns the OAuth secret only ONCE.

• Destructive: *_delete, license_delete, system_hook_delete, feature_delete, application_delete, broadcast_message_delete, custom_attr_delete, cluster_agent_delete, dependency_proxy_delete, secure_file_delete, terraform_state_delete / terraform_state_unlock, db_migration_mark, bulk_import_cancel and import_cancel_github are irreversible. db_migration_mark may corrupt the schema if used incorrectly.

Returns: resource object for _get/_create/_update/_set/_add; metrics object for Sidekiq/usage_data/app_statistics/metadata; paginated array for _list / feature_list_definitions; {success, message} for _delete/_revoke/_purge/_unlock. Errors: 401/403 forbidden (hint: most actions require admin token), 404 not found, 400 invalid params (hint: license must be base64-encoded; system hook url must be https).

Param conventions: * = required. List actions accept page, per_page.

Topics:

• topic_list: search

• topic_get / topic_delete: topic_id*

• topic_create: name*, title, description

• topic_update: topic_id*, name, title, description

Settings & appearance:

• settings_get / appearance_get: (no params)

• settings_update: settings (map of setting_name to value)

• appearance_update: title, description, header_message, footer_message, message_background_color, message_font_color, email_header_and_footer_enabled, pwa_name, pwa_short_name, pwa_description, member_guidelines, new_project_guidelines, profile_image_guidelines

Broadcast messages:

• broadcast_message_list: (no params)

• broadcast_message_get / broadcast_message_delete: id*

• broadcast_message_create: message*, starts_at, ends_at, broadcast_type, theme, dismissable (bool), target_path, target_access_levels

• broadcast_message_update: id*, message, starts_at, ends_at, broadcast_type, theme, dismissable

Instance feature flags:

• feature_list / feature_list_definitions: (no params)

• feature_set: name*, value*, key, feature_group, user, group, namespace, project, repository, force (bool)

• feature_delete: name*

License:

• license_get: (no params)

• license_add: license* (Base64-encoded)

• license_delete: id*

System hooks:

• system_hook_list: (no params)

• system_hook_get / system_hook_test / system_hook_delete: id*

• system_hook_add: url*, token, push_events, tag_push_events, merge_requests_events, repository_update_events, enable_ssl_verification

Sidekiq metrics: sidekiq_queue_metrics / sidekiq_process_metrics / sidekiq_job_stats / sidekiq_compound_metrics (no params).

Plan limits:

• plan_limits_get: plan_name

• plan_limits_change: plan_name*, conan_max_file_size, generic_packages_max_file_size, helm_max_file_size, maven_max_file_size, npm_max_file_size, nuget_max_file_size, pypi_max_file_size, terraform_module_max_file_size

Usage data:

• usage_data_service_ping / usage_data_non_sql_metrics / usage_data_queries / usage_data_metric_definitions: (no params)

• usage_data_track_event: event*, send_to_snowplow (bool), namespace_id, project_id

• usage_data_track_events: events* (array)

OAuth applications:

• application_list: (no params)

• application_create: name*, redirect_uri*, scopes*, confidential (bool)

• application_delete: id*

Misc:

• db_migration_mark: version*, database

• app_statistics_get / metadata_get: (no params)

Custom attributes:

• custom_attr_list: resource_type* (user/group/project), resource_id*

• custom_attr_get / custom_attr_delete: resource_type*, resource_id*, key*

• custom_attr_set: resource_type*, resource_id*, key*, value*

Bulk import:

• bulk_import_start: url*, access_token*, entities* (array of {source_type, source_full_path, destination_slug, destination_namespace, migrate_projects (bool), migrate_memberships (bool)})

• bulk_import_list: status, page, per_page

• bulk_import_get: id*

• bulk_import_cancel: id*

• bulk_import_entity_list: bulk_import_id, status, page, per_page

• bulk_import_entity_get: bulk_import_id*, entity_id*

• bulk_import_entity_failures: bulk_import_id*, entity_id*

Error tracking:

• error_tracking_list: project_id*

• error_tracking_create: project_id*

• error_tracking_delete: project_id*, key_id*

• error_tracking_get_settings: project_id*

• error_tracking_update_settings: project_id*, active (bool), integrated (bool)

Alert metric images:

• alert_metric_image_list: project_id*, alert_iid*

• alert_metric_image_upload: project_id*, alert_iid*, url*, url_text

• alert_metric_image_update: project_id*, alert_iid*, image_id*, url, url_text

• alert_metric_image_delete: project_id*, alert_iid*, image_id*

Secure files:

• secure_file_list: project_id*

• secure_file_get / secure_file_delete: project_id*, file_id*

• secure_file_create: project_id*, name*, content* (base64-encoded)

Terraform states:

• terraform_state_list: project_path*

• terraform_state_get: project_path*, name*

• terraform_state_delete / terraform_state_lock / terraform_state_unlock: project_id*, name*

• terraform_version_delete: project_id*, name*, serial*

Cluster agents:

• cluster_agent_list: project_id*

• cluster_agent_get / cluster_agent_delete: project_id*, agent_id*

• cluster_agent_register: project_id*, name*

• cluster_agent_token_list: project_id*, agent_id*

• cluster_agent_token_get / cluster_agent_token_revoke: project_id*, agent_id*, token_id*

• cluster_agent_token_create: project_id*, agent_id*, name*

Imports:

• import_github: personal_access_token*, repo_id*, target_namespace*, new_name

• import_bitbucket: bitbucket_username*, bitbucket_app_password*, repo_path*, target_namespace*, new_name

• import_bitbucket_server: bitbucket_server_url*, bitbucket_server_username*, personal_access_token*, bitbucket_server_project*, bitbucket_server_repo*, new_namespace, new_name

• import_cancel_github: project_id*

• import_gists: personal_access_token*

• dependency_proxy_delete: group_id* — purges the group's dependency proxy cache

Parameter constraints (beyond schema):

• broadcast_message_create.broadcast_type ∈ {banner, notification}; theme is a CSS hex color (e.g. '#E75E40'); target_access_levels uses GitLab numeric levels [10=Guest, 20=Reporter, 30=Developer, 40=Maintainer, 50=Owner]; starts_at/ends_at are ISO 8601 timestamps and ends_at MUST be > starts_at.

• feature_set.value accepts 'true' / 'false' / a 0–100 integer (percentage of time/actors) / 'actor:'; the optional key disambiguates 'percentage_of_time' vs 'percentage_of_actors'; user/group/namespace/project/repository scope the gate and are mutually-exclusive with each other.

• plan_limits_change.*_max_file_size are sizes in BYTES; 0 disables the limit. Omitted fields keep their current value (partial update).

• license_add.license is the Base64 of the raw .gitlab-license file (not the file path).

• system_hook_add.url MUST be https when enable_ssl_verification=true; token is sent as X-Gitlab-Token on every delivery.

• application_create.scopes is a SPACE-separated string of OAuth scopes (e.g. 'api read_user'); confidential=false enables PKCE for public clients. The client_secret is returned ONCE on creation and cannot be retrieved later.

• cluster_agent_token_create returns the token ONCE; revoke + re-create to rotate.

• secure_file_create.content is Base64-encoded; max size 5 MiB.

• custom_attr_set.resource_type ∈ {user, group, project} and (resource_type, resource_id, key) is a unique upsert key.

• bulk_import_start.entities[].source_type ∈ {group_entity, project_entity}; migrate_projects and migrate_memberships apply only to group_entity. destination_namespace must already exist on the target instance.

• import_bitbucket_server.bitbucket_server_project is the project KEY (usually uppercase, from the Bitbucket URL), not the display name.

• usage_data_track_event: namespace_id and project_id are mutually-exclusive context refs (provide at most one); send_to_snowplow=false keeps the event internal to GitLab.

• db_migration_mark.database ∈ {main, ci}; defaults to 'main'. Marking a non-applied migration corrupts schema_migrations — verify first via metadata_get.

• terraform_state_lock fails if the state is already locked; unlock breaks any active client session holding the lock.

• topic_create.name must be globally unique (slug); title is the display name shown in the UI.

• List actions: page defaults to 1, per_page defaults to 20 (GitLab cap is 100).

See also: gitlab_user (user CRUD), gitlab_server (MCP server health and updates), gitlab_group / gitlab_project (group/project admin), gitlab_access (tokens, deploy keys, access requests).

Example: {"action":"ci_config","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_analyze/.

LLM-assisted analysis of GitLab data via MCP sampling. Each action fetches data through GitLab APIs, then asks the connected LLM (the host's sampling capability) to summarize / analyze / classify it. Requires the client to advertise sampling capability — actions return SamplingUnsupportedResult otherwise (human-in-the-loop on the client side). When to use: ask an LLM to interpret GitLab artifacts — MR diffs, issue threads, pipeline failures, CI configs, milestone progress, deployment history, technical-debt markers — and produce Markdown narratives, scopes, or release notes. NOT for: raw data retrieval without LLM analysis (use gitlab_merge_request / gitlab_issue / gitlab_pipeline / gitlab_release / gitlab_repository); long-form report generation outside the chat session; clients without sampling support (the action returns a SamplingUnsupportedResult).

Returns: each action returns action-specific JSON (typically identifiers + a text field plus model and truncated flags) and a Markdown summary suitable for direct display. Per-action text key:

• summary: issue_summary, mr_review

• analysis: mr_changes, pipeline_failure, ci_config, issue_scope, technical_debt, deployment_history

• review: mr_security

• report: milestone_report

• release_notes: release_notes Alongside the resource identifiers (merge_request_iid, issue_iid, pipeline_id, milestone_iid, project_id) supplied as input. Errors: 404 (hint: project_id, merge_request_iid, issue_iid, pipeline_id, milestone_iid must exist), 403 (hint: caller must have access to the underlying resource), SamplingUnsupportedResult when the client did not advertise sampling capability.

All actions need project_id*. Additional params per action:

• mr_changes: merge_request_iid*. Analyze MR code changes for quality, bugs, improvements.

• issue_summary: issue_iid*. Summarize discussion with key decisions and action items.

• release_notes: from_ref*, to_ref*. Generate categorized release notes between refs.

• pipeline_failure: pipeline_id*. Root cause analysis with fix suggestions.

• mr_review: merge_request_iid*. Summarize review feedback and unresolved threads.

• milestone_report: milestone_iid*. Progress report with metrics.

• ci_config: content_ref. Analyze CI/CD config for best practices and security.

• issue_scope: issue_iid*. Scope, complexity, and breakdown recommendations.

• mr_security: merge_request_iid*. OWASP Top 10, secrets, auth review.

• technical_debt: ref. Find TODO/FIXME/HACK markers.

• deployment_history: environment. Frequency, success rate, patterns.

See also: gitlab_merge_request (MR lifecycle), gitlab_issue (issue CRUD), gitlab_pipeline (raw pipelines and test reports), gitlab_release (release CRUD).

Example: {"action":"create","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_branch/.

Manage Git branches and branch protections in a project, plus aggregated branch rules (GraphQL). Delete and unprotect are destructive and irreversible. When to use: create/list/delete branches, protect or update protection on branches, audit aggregated branch rules (push/merge access, approval rules, status checks). NOT for: file contents on a branch (use gitlab_repository file_get/file_create/...), commit operations (use gitlab_repository commit_*), tags (use gitlab_tag), opening MRs against a branch (use gitlab_merge_request).

Returns:

• list / list_protected: array of {name, default, protected, merged, commit, ...} with pagination.

• get / get_protected / create / protect / update_protected: branch or protection object.

• delete / delete_merged / unprotect: {success: bool, message: string}.

• rule_list: GraphQL aggregated view {nodes: [{name, branch_protection, approval_rules, external_status_checks}], page_info}. Errors: 404 not found, 403 forbidden (hint: requires Maintainer+ to protect/unprotect), 400 invalid params (hint: cannot delete default or protected branches — unprotect first).

Param conventions: * = required. All actions need project_id* (numeric or url-encoded path) except rule_list which uses project_path*. Access levels: 0 = no one, 30 = Developer, 40 = Maintainer.

• create: project_id*, branch_name*, ref* (branch/tag/SHA)

• get / delete: project_id*, branch_name*

• list: project_id*, search, page, per_page

• delete_merged: project_id* — deletes all merged branches except default/protected

• protect: project_id*, branch_name*, push_access_level (0/30/40), merge_access_level (0/30/40), allow_force_push (bool)

• unprotect: project_id*, branch_name*

• list_protected: project_id*

• get_protected: project_id*, branch_name*

• update_protected: project_id*, branch_name*, allow_force_push (bool), code_owner_approval_required (bool)

• rule_list: project_path* (e.g. my-group/my-project), first (max 100), after (cursor)

See also: gitlab_repository (file/commit operations on a branch), gitlab_merge_request (open MRs against a branch), gitlab_tag (tag CRUD/protection).

Example: {"action":"get","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_ci_catalog/.

Discover and inspect CI/CD Catalog resources (reusable pipeline components and templates published by groups for import into .gitlab-ci.yml). Read-only; GraphQL endpoint. The underlying GitLab API requires a Premium/Ultimate plan on the target instance (server enforces it with 403); the tool itself is always registered and is not gated by GITLAB_ENTERPRISE. When to use: browse the Catalog to find reusable components, inspect a component's versions before pinning it in include:component, or audit which Catalog resources a publisher group exposes. NOT for: running pipelines or pipeline definitions (use gitlab_pipeline), built-in GitLab templates such as gitignore/Dockerfile/license (use gitlab_template), CI YAML linting (use gitlab_template action=lint).

Returns:

• list: {nodes: [{id, full_path, name, description, latest_version, star_count}], page_info: {end_cursor, has_next_page}}.

• get: {id, full_path, name, description, latest_version, star_count, versions: [{version, released_at, tag_name}]}. Errors: 404 not found (hint: check full_path or id), 403 forbidden (hint: requires Premium/Ultimate or Catalog read access), 400 invalid params (hint: provide id OR full_path).

Param conventions: * = required. id format = GID (gid://gitlab/Ci::Catalog::Resource/123). full_path = namespace/project (e.g. mygroup/components/docker-build).

• list: search, scope (ALL/NAMESPACED), sort (NAME_ASC/NAME_DESC/LATEST_RELEASED_AT_ASC/LATEST_RELEASED_AT_DESC/STAR_COUNT_ASC/STAR_COUNT_DESC), first (max 100), after (cursor)

• get: id OR full_path* (exactly one)

See also: gitlab_template (built-in templates and CI lint), gitlab_pipeline (run pipelines using catalog components), gitlab_project (publisher project metadata).

Example: {"action":"create","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_ci_variable/.

Manage GitLab CI/CD variables at instance, group, and project scope. Delete actions are irreversible. When to use: define / rotate / unmask / scope CI/CD variables at project, group, or instance level, both regular and secret (masked / masked_and_hidden), with environment scoping for per-env values. NOT for: linting CI YAML or browsing CI templates (use gitlab_template), pipeline runs or schedules (use gitlab_pipeline), feature flags (use gitlab_feature_flags), per-deployment env metadata (use gitlab_environment), GitLab instance settings (use gitlab_admin).

Returns:

• list / group_list / instance_list: arrays of variable objects {key, value (or hidden), variable_type, protected, masked, raw, environment_scope, description} with pagination.

• get / create / update / group_get / group_create / group_update / instance_get / instance_create / instance_update: single variable object.

• delete / group_delete / instance_delete: {success, message}. Errors: 404 (hint: a (key, environment_scope) pair must exist for get/update/delete — supply environment_scope when the variable is env-scoped), 403 (hint: project requires Maintainer+, group requires Owner, instance requires admin), 400 (hint: variable_type ∈ env_var/file; masked requires single-line non-empty value matching GitLab's masking rules).

Param conventions: * = required. Project-scoped actions need project_id*, group-scoped need group_id*, instance-scoped need no ID. Common optional params: variable_type, protected, masked, raw, environment_scope.

Project variables:

• list: project_id*

• get / delete: project_id*, key*, environment_scope

• create: project_id*, key*, value*, description, variable_type, protected, masked, masked_and_hidden, raw, environment_scope

• update: project_id*, key*, value, description, variable_type, protected, masked, raw, environment_scope

Group variables (group_*):

• group_list: group_id*

• group_get / group_delete: group_id*, key*

• group_create: group_id*, key*, value*, description, variable_type, protected, masked, raw, environment_scope

• group_update: group_id*, key*, value, description, variable_type, protected, masked, raw, environment_scope

Instance variables (instance_*):

• instance_list: (no params)

• instance_get / instance_delete: key*

• instance_create: key*, value*, description, variable_type, protected, masked, raw

• instance_update: key*, value, description, variable_type, protected, masked, raw

See also: gitlab_pipeline (pipeline operations), gitlab_template (CI lint)

Example: {"action":"create","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_custom_emoji/.

Manage group-level custom emoji via GraphQL. Delete is destructive: existing reactions using the emoji remain in the database but render as :name: text. The underlying GitLab API requires a Premium/Ultimate plan on the target instance (server enforces it with 403); the tool itself is always registered and is not gated by GITLAB_ENTERPRISE. When to use: list, add, or remove the custom emoji available to a group's projects (e.g. company logos, team mascots) used as reactions on issues/MRs/notes. NOT for: posting or removing a reaction on an issue/MR/snippet/commit/note (use the emoji_issue_* / emoji_mr_* / emoji_snippet_* actions on gitlab_issue, gitlab_merge_request, or gitlab_snippet), Unicode emoji (built-in, no action required), instance-level emoji (not supported by GitLab).

Returns:

• list: {nodes: [{id, name, url, external (bool), created_at, user_permissions: {delete}}], page_info: {end_cursor, has_next_page}}.

• create: the created node {id, name, url, external, created_at}.

• delete: {success: bool, message: string}. Errors: 404 not found (hint: check group_path or id GID), 403 forbidden (hint: requires Maintainer+ on the group and Premium/Ultimate), 400 invalid params (hint: name must not contain colons; url must be a publicly reachable image).

Param conventions: * = required. id format = GID (gid://gitlab/CustomEmoji/123). group_path = full namespace path (e.g. mygroup or mygroup/subgroup).

• list: group_path*, first (max 100), after (cursor)

• create: group_path*, name* (no colons), url* (HTTPS image URL)

• delete: id*

See also: gitlab_group (group settings and membership), gitlab_issue / gitlab_merge_request / gitlab_snippet (post reactions using the emoji).

Resolve a git remote URL to a GitLab project and return its project_id and metadata. Read-only; performs a lookup against the GitLab Projects API; no side effects.

When to use: at the start of a workspace session, to obtain the project_id required by most other gitlab_* tools. Extract the FULL remote URL from .git/config ([remote "origin"] url = ...) or from 'git remote -v'. NOT for: searching projects by name (use gitlab_search action=projects), listing a user's projects (use gitlab_project action=list_user_projects), verifying GitLab connectivity or authentication (use gitlab_server action=health_check).

IMPORTANT: pass the complete URL exactly as it appears — do NOT strip the git@ prefix from SSH URLs. Supported formats (a URL scheme or git@ user prefix is required):

• HTTPS: https://gitlab.example.com/group/project.git

• SSH shorthand: git@gitlab.example.com:group/project.git

• SSH protocol: ssh://git@gitlab.example.com/group/project.git

Returns: {id, name, path, path_with_namespace, web_url, description, default_branch, visibility, http_url_to_repo, ssh_url_to_repo, extracted_path}. Errors: 404 not found (hint: project may be private — verify token permissions), 403 forbidden (hint: token lacks read_api scope).

See also: gitlab_project (full project CRUD/settings once id is known), gitlab_server (connectivity and version checks), gitlab_search (find projects by query).

Example: {"action":"create","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_environment/.

Manage GitLab deployment environments, protected environments, freeze (deploy block) periods, and the deployment record audit trail. Delete and stop are destructive (stop terminates the running env; force=true skips on-stop jobs). When to use: define/update environments (production, staging, review/*), restrict who can deploy via protected environments, schedule deploy freezes, audit deployment history, approve/reject deployments awaiting manual gate. NOT for: CI/CD variables scoped to environments (use gitlab_ci_variable), pipelines/jobs (use gitlab_pipeline / gitlab_job), feature flag rollout strategies (use gitlab_feature_flags).

Behavior:

• Idempotent reads: list / get / protected_list / protected_get / freeze_list / freeze_get / deployment_list / deployment_get / deployment_merge_requests.

• update / protected_update / freeze_update / deployment_update are idempotent (same input → same state). create / protected_protect / freeze_create / deployment_create are NON-idempotent on duplicate (project_id, name) — return 409. deployment_approve_or_reject is single-shot per (deployment_id, user) and cannot be reversed.

• Side effects: stop runs the on-stop CI job (unless force=true) and terminates any review-app resources; deployment_approve_or_reject may release queued CI jobs awaiting a manual gate; freeze_create immediately blocks deploys that match the cron window.

• Destructive: delete and stop are destructive — stop cannot be reversed without re-deploying; deployment_delete removes the deployment audit record (history loss).

Returns: resource object (environment / protection / freeze / deployment) for _get/_create/_update/_protect; paginated array for *_list; updated deployment with approval state for deployment_approve_or_reject; MR list for deployment_merge_requests; {success, message} for _delete/_unprotect/stop. Errors: 404 not found, 403 forbidden (hint: protect/unprotect require Maintainer+), 400 invalid params (hint: tier ∈ production/staging/testing/development/other; freeze cron timezone must be valid TZ name).

Param conventions: * = required. All actions need project_id*. environment_id is the numeric ID returned by list/create.

Environments:

• list: project_id*, name, search, states (available/stopped/stopping), page, per_page

• get / delete: project_id*, environment_id*

• create: project_id*, name*, description, external_url, tier (production/staging/testing/development/other)

• update: project_id*, environment_id*, name, description, external_url, tier

• stop: project_id*, environment_id*, force (bool) — force skips on-stop jobs

Protected environments:

• protected_list: project_id*, page, per_page

• protected_get / protected_unprotect: project_id*, name*

• protected_protect / protected_update: project_id*, name*, deploy_access_levels, approval_rules

Freeze periods (cron expressions):

• freeze_list: project_id*, page, per_page

• freeze_get / freeze_delete: project_id*, freeze_period_id*

• freeze_create: project_id*, freeze_start* (cron, e.g. '0 23 * * 5'), freeze_end* (cron), cron_timezone

• freeze_update: project_id*, freeze_period_id*, freeze_start, freeze_end, cron_timezone

Deployments (immutable history records):

• deployment_list: project_id*, order_by, sort, environment, status, page, per_page

• deployment_get / deployment_delete: project_id*, deployment_id*

• deployment_create: project_id*, environment*, ref*, sha*, tag (bool), status (created/running/success/failed/canceled)

• deployment_update: project_id*, deployment_id*, status*

• deployment_approve_or_reject: project_id*, deployment_id*, status* (approved/rejected), comment

• deployment_merge_requests: project_id*, deployment_id*, state, order_by, sort, page, per_page

See also: gitlab_pipeline / gitlab_job (CI runs deploying to environments), gitlab_ci_variable (env-scoped variables), gitlab_feature_flags (env-scoped strategies).

Example: {"action":"feature_flag_create","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_feature_flags/.

Manage project feature flags and feature-flag user lists for gradual rollouts. Delete is destructive; setting active=false disables the flag but preserves history. When to use: define rollout strategies (percentage, user-targeted, environment-scoped) for a project's feature flags, and manage the user lists referenced by gitlabUserList strategies. NOT for: GitLab instance-level feature flags (admin only — use gitlab_admin), environment definitions or protection (use gitlab_environment), code branching (use gitlab_branch), CI/CD variables (use gitlab_ci_variable).

Returns:

• *_list: array with pagination (page, per_page, total, next_page).

• *_get / *_create / *_update: the resource object (flag includes strategies and scopes; user list includes user_xids).

• *_delete: {success: bool, message: string}. Errors: 404 not found, 403 forbidden (hint: requires Developer+ role), 400 invalid params (hint: strategies/scopes JSON shape).

Param conventions: * = required. All actions need project_id*. version = new_version_flag (legacy legacy_flag deprecated).

strategies shape: [{name, parameters, scopes: [{environment_scope}]}] where name ∈ {default, gradualRolloutUserId, userWithId, flexibleRollout, gitlabUserList}. parameters per strategy: gradualRolloutUserId={groupId, percentage}; userWithId={userIds}; flexibleRollout={groupId, rollout, stickiness}; gitlabUserList={userListId}.

Feature flags (feature_flag_*):

• feature_flag_list: project_id*, scope (enabled/disabled), page, per_page

• feature_flag_get / feature_flag_delete: project_id*, name*

• feature_flag_create: project_id*, name*, version*, description, active (bool), strategies

• feature_flag_update: project_id*, name*, description, active (bool), strategies

User lists (ff_user_list_*) — named sets of user IDs referenced by gitlabUserList strategies:

• ff_user_list_list: project_id*, page, per_page

• ff_user_list_get / ff_user_list_delete: project_id*, user_list_iid*

• ff_user_list_create: project_id*, name*, user_xids* (comma-separated user IDs)

• ff_user_list_update: project_id*, user_list_iid*, name, user_xids

See also: gitlab_environment (environment scopes referenced by strategies), gitlab_admin (instance-level feature flags), gitlab_project (project membership and settings).

Example: {"action":"archive","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_group/.

Manage GitLab groups: CRUD, subgroups, members, labels, milestones, webhooks, badges, boards, uploads, and import/export. When to use: group-level operations (groups, subgroups, members, labels, milestones, boards, webhooks, badges, wikis, epics). NOT for: project-specific operations (use gitlab_project or gitlab_merge_request), user accounts (use gitlab_user), cross-project search (use gitlab_search).

Behavior:

• Idempotent reads: get / list / projects / members / subgroups / issues / search / _list / get / hook_list / badge_list / group_label_list / group_milestone_list / group_board_list / release_list (Premium+ adds wiki_list / epic_list / protectedlist / ldap_link_list / saml_link_list / service_account_list).

• update / *_update / *_edit / archive / unarchive are idempotent (same input → same state). create / *_create / hook_add are NON-idempotent (re-invocation creates a duplicate or returns 409).

• Side effects: group_member_add / group_member_share / group_member_edit may notify the invited user/group; hook_add / hook_edit trigger webhook deliveries; transfer_project moves repository data and re-permissions members; ldap/saml link mutations re-evaluate group membership on next sign-in (read-after-write may lag).

• Destructive: delete cascades to subgroups, projects, members, issues, MRs (irreversible when permanently_remove=true; restore window applies otherwise); hook_delete, badge_delete, group_label_delete, group_milestone_delete, group_board_delete, group_upload_delete_* are irreversible. Premium+ adds destructive: epic_delete, wiki_delete, protected__unprotect, ldap_link_delete, saml_link_delete, service_account_delete, service_account_pat_revoke. archive is reversible via unarchive.

Returns: JSON with resource data. Lists include pagination (page, per_page, total, next_page). Void actions return confirmation. Errors: 404 (hint: group_id can be numeric ID or URL-encoded full path), 403 (hint: most mutations require Maintainer+; group_member_share, transfer_project and service_account_* require Owner), 400 (hint: visibility ∈ private/internal/public; permanently_remove=true requires full_path).

Param conventions: * = required. Most actions need group_id* (numeric ID or URL-encoded path like 'group/subgroup'). List actions accept page, per_page.

Group CRUD:

• list: search, owned, top_level_only (no group_id needed)

• get: group_id*

• create: name*, path, description, visibility (private/internal/public), parent_id, request_access_enabled, lfs_enabled, default_branch

• update: group_id*, name, path, description, visibility, request_access_enabled, lfs_enabled, default_branch

• delete: group_id*, permanently_remove, full_path (required when permanently_remove=true)

• restore: group_id*

• archive / unarchive: group_id* (requires Owner role)

• search: query* (no group_id needed)

• transfer_project: group_id*, project_id*

Group queries:

• projects: group_id*, search, include_subgroups (recommended for hierarchies), archived, visibility, order_by, sort, simple, owned, starred, with_shared

• members: group_id*, query (filter name/username)

• subgroups: group_id*, search

• issues: group_id*, state, labels, milestone, scope, search, assignee_username, author_username

Webhooks (hook_*):

• hook_list: group_id*

• hook_get / hook_delete: group_id*, hook_id*

• hook_add: group_id*, url*, name, description, token, event booleans (push/tag_push/merge_requests/issues/note/job/pipeline/wiki_page/deployment/releases/subgroup/member_events), enable_ssl_verification, push_events_branch_filter

• hook_edit: group_id*, hook_id*, same params as hook_add

Badges (badge_*):

• badge_list: group_id*, name

• badge_get / badge_delete: group_id*, badge_id*

• badge_add / badge_preview: group_id*, link_url*, image_url*, name

• badge_edit: group_id*, badge_id*, link_url, image_url, name

Members (group_member_*):

• group_member_get: group_id*, user_id*

• group_member_get_inherited: group_id*, user_id* (includes inherited)

• group_member_add / group_member_edit: group_id*, user_id*, access_level*, expires_at

• group_member_remove: group_id*, user_id*

• group_member_share: group_id*, shared_with_group_id*, group_access*, expires_at

• group_member_unshare: group_id*, shared_with_group_id*

Labels (group_label_*):

• group_label_list: group_id*, search, with_counts, include_ancestor_groups, include_descendant_groups

• group_label_get / group_label_delete / group_label_subscribe / group_label_unsubscribe: group_id*, label_id*

• group_label_create: group_id*, name*, color*, description

• group_label_update: group_id*, label_id*, new_name, color, description

Milestones (group_milestone_*):

• group_milestone_list: group_id*, state, title, search, include_ancestors, include_descendants

• group_milestone_get / group_milestone_delete: group_id*, milestone_iid*

• group_milestone_create: group_id*, title*, description, start_date, due_date

• group_milestone_update: group_id*, milestone_iid*, title, description, start_date, due_date, state_event

• group_milestone_issues / group_milestone_merge_requests / group_milestone_burndown: group_id*, milestone_iid*

Boards (group_board_*):

• group_board_list: group_id*

• group_board_get / group_board_delete: group_id*, board_id*

• group_board_create: group_id*, name*

• group_board_update: group_id*, board_id*, name, assignee_id, milestone_id, labels, weight

• group_board_list_lists: group_id*, board_id*

• group_board_get_list / group_board_delete_list: group_id*, board_id*, list_id*

• group_board_create_list: group_id*, board_id*, label_id

• group_board_update_list: group_id*, board_id*, list_id*, position

Uploads:

• group_upload_list: group_id*

• group_upload_delete_by_id: group_id*, upload_id*

• group_upload_delete_by_secret: group_id*, secret*, filename*

Import/Export:

• group_relations_schedule / group_relations_list_status: group_id*

• group_export_schedule / group_export_download: group_id*

• group_import_file: name*, path*, file*, parent_id (no group_id)

Releases:

• release_list: group_id*, simple

See also: gitlab_project (project-level), gitlab_user (user management), gitlab_search (cross-project search), gitlab_merge_request (MR workflows)

Create a GitLab issue through step-by-step prompts, with explicit confirmation before calling the GitLab API. Cancellation at any prompt aborts without creating the issue.

After invocation, the tool elicits in order:

• title (string, required) — issue title.

• description (string, optional, multi-line, Markdown) — leave empty to skip.

• labels (string, optional) — comma-separated; trimmed and deduped server-side.

• confidential (boolean, optional) — yes/no confirmation; defaults to public when declined.

• confirm (boolean, required) — final yes/no review of the assembled summary.

When to use: human-in-the-loop issue creation. NOT for: scripted/programmatic creation — use gitlab_issue (action='create') with all fields pre-supplied.

Requires the MCP client to support the elicitation capability. If unsupported, returns a structured error naming gitlab_issue (action='create') as the alternative.

Returns: JSON with the created issue (id, issue_iid, web_url, title, state).

See also: gitlab_issue.

Create a GitLab merge request through step-by-step prompts, with explicit confirmation before calling the GitLab API. Cancellation at any prompt aborts without creating the MR.

After invocation, the tool elicits in order:

• source_branch (string, required) — branch with the changes to merge.

• target_branch (string, required) — branch to merge into (e.g. main, develop).

• title (string, required) — MR title.

• description (string, optional, multi-line, Markdown) — leave empty to skip.

• labels (string, optional) — comma-separated; trimmed and deduped server-side.

• remove_source_branch (boolean, optional) — yes/no confirmation; default unset.

• squash (boolean, optional) — yes/no confirmation; default unset.

• confirm (boolean, required) — final yes/no review of the assembled summary.

When to use: human-in-the-loop MR creation. NOT for: scripted/programmatic creation — use gitlab_merge_request (action='create') with all fields pre-supplied.

Requires the MCP client to support the elicitation capability. If unsupported, returns a structured error naming gitlab_merge_request (action='create') as the alternative.

Returns: JSON with the created MR (id, merge_request_iid, web_url, title, source_branch, target_branch, state).

See also: gitlab_merge_request, gitlab_branch.

Create a GitLab project through step-by-step prompts, with explicit confirmation before calling the GitLab API. Cancellation at any prompt aborts without creating the project.

After invocation, the tool elicits in order:

• name (string, required) — project display name and (when path is omitted) URL slug.

• description (string, optional) — leave empty to skip.

• visibility (enum, required) — one of private, internal, public.

• initialize_with_readme (boolean, optional) — yes/no confirmation; defaults to false when declined.

• default_branch (string, optional) — leave empty to use the GitLab default ('main').

• confirm (boolean, required) — final yes/no review of the assembled summary.

When to use: human-in-the-loop project creation. NOT for: scripted/programmatic creation — use gitlab_project (action='create') with all fields pre-supplied.

Requires the MCP client to support the elicitation capability. If unsupported, returns a structured error naming gitlab_project (action='create') as the alternative.

Returns: JSON with the created project (id, path_with_namespace, web_url, visibility, default_branch).

See also: gitlab_project, gitlab_group.

Create a GitLab release through step-by-step prompts, with explicit confirmation before calling the GitLab API. Cancellation at any prompt aborts without creating the release.

After invocation, the tool elicits in order:

• tag_name (string, required) — must reference an existing tag in the project; create it first via gitlab_tag (action='create').

• name (string, optional) — release title; defaults to tag_name when left empty.

• description (string, optional, multi-line, Markdown) — release notes; leave empty to skip.

• confirm (boolean, required) — final yes/no review of the assembled summary.

When to use: human-in-the-loop release publishing. NOT for: CI/automated release creation — use gitlab_release (action='create') with all fields pre-supplied.

Requires the MCP client to support the elicitation capability. If unsupported, returns a structured error naming gitlab_release (action='create') as the alternative.

Behavior: each successful invocation publishes ONE new release after explicit user confirmation. NON-idempotent — re-running with the same tag returns 409 (release already exists). Cancellation/decline at any prompt aborts with no GitLab API call and no side effects. Side effects on success: GitLab fires release-created webhooks and may notify release subscribers.

Returns: JSON with the created release (tag_name, name, description, web_url).

See also: gitlab_release, gitlab_tag.

Example: {"action":"create","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_issue/.

Manage GitLab issues: CRUD, notes, discussions, links, time tracking, work items, award emoji, statistics, and resource events. When to use: issue lifecycle — create, update, close, move, comment, link, time-track, and manage Work Items (including Epics). NOT for: merge requests (use gitlab_merge_request), project settings (use gitlab_project), CI/CD (use gitlab_pipeline).

Side effects: delete/move are irreversible; move changes URL and IID. Time tracking uses dedicated actions — do NOT pass time params to update.

Returns: resource object for single-item actions; paginated list ({page, per_page, total, next_page}) for list / list / list_all / list_group / participants / mrs / iteration_list_*; GraphQL cursor pagination ({nodes, page_info}) for work_item_list; {success, message} for delete actions. Errors: 404 (hint: issue_iid is project-scoped — supply project_id; for list_all use scope/iids), 403 (hint: Reporter+ to comment, Developer+ to edit/move), 400 (hint: state_event ∈ close/reopen; dates ISO 8601; weight integer 0–9 — Premium+).

Param conventions: * = required. Most actions need project_id* + issue_iid*. List actions accept page, per_page. Work item actions use full_path* + work_item_iid* (GraphQL).

Issue CRUD:

• create: project_id*, title*, description, assignee_id, assignee_ids ([]int), labels (comma-separated), milestone_id, due_date (YYYY-MM-DD), confidential, issue_type (issue/incident/test_case/task), weight, epic_id

• get: project_id*, issue_iid*

• get_by_id: issue_id* (global ID, no project_id needed)

• list: project_id*, state (opened/closed/all), labels, not_labels, milestone, scope (created_by_me/assigned_to_me/all), search, assignee_username, author_username, iids ([]int), issue_type, confidential, created_after/before, updated_after/before (ISO 8601), order_by (created_at/updated_at/priority/due_date), sort (asc/desc)

• list_all: global issue list (no project_id). Same filters as list.

• list_group: group_id*, state, labels, milestone, scope, search, order_by, sort

• update: project_id*, issue_iid*, title, description, state_event (close/reopen), assignee_id, assignee_ids, labels, add_labels, remove_labels, milestone_id, due_date, confidential, issue_type, weight, epic_id, discussion_locked

• delete: project_id*, issue_iid* (permanent, irreversible)

• reorder: project_id*, issue_iid*, move_after_id, move_before_id

• move: project_id*, issue_iid*, to_project_id* (moves to another project)

• subscribe / unsubscribe: project_id*, issue_iid*

• create_todo: project_id*, issue_iid*

Time tracking:

• time_estimate_set: project_id*, issue_iid*, duration* (e.g. 3h30m)

• time_estimate_reset / spent_time_reset: project_id*, issue_iid*

• spent_time_add: project_id*, issue_iid*, duration*, summary

• time_stats_get: project_id*, issue_iid*

Participants & related MRs:

• participants: project_id*, issue_iid*

• mrs_closing / mrs_related: project_id*, issue_iid*

Notes (note_): project_id, issue_iid* for all.

• note_list: order_by, sort

• note_get / note_delete: note_id*

• note_create: body*, internal

• note_update: note_id*, body*

Issue links (link_): project_id, issue_iid* for all.

• link_list

• link_get / link_delete: issue_link_id*

• link_create: target_project_id*, target_issue_iid*, link_type

Discussions (discussion_): project_id, issue_iid* for all.

• discussion_list

• discussion_get: discussion_id*

• discussion_create: body*

• discussion_add_note: discussion_id*, body*

• discussion_update_note: discussion_id*, note_id*, body*

• discussion_delete_note: discussion_id*, note_id*

Work Items (work_item_): full_path for all. Use types=["Epic"] to list epics (replaces deprecated epic_list).

• work_item_list: state, search, types, author_username, label_name, confidential, sort, first, after

• work_item_get: work_item_iid*

• work_item_create: work_item_type_id*, title*, description, confidential, assignee_ids, milestone_id, label_ids, weight, health_status, color, due_date, start_date, linked_items {work_item_ids, link_type}

• work_item_update: work_item_iid*, title, state_event (CLOSE/REOPEN), description, assignee_ids, milestone_id, crm_contact_ids, parent_id, add_label_ids, remove_label_ids, start_date, due_date, weight, health_status, iteration_id, color, status (TODO/IN_PROGRESS/DONE/WONT_DO/DUPLICATE)

• work_item_delete: work_item_iid* (permanent)

Statistics:

• statistics_get: global issue stats (optional filters same as list)

• statistics_get_group: group_id*

• statistics_get_project: project_id*

Award emoji (emoji_issue_): project_id, issue_iid* for all.

• emoji_issue_list / emoji_issue_get (+ award_id*) / emoji_issue_delete (+ award_id*)

• emoji_issue_create: name*

• emoji_issue_note_list / emoji_issue_note_get: note_id*, (+ award_id* for get)

• emoji_issue_note_create: note_id*, name*

• emoji_issue_note_delete: note_id*, award_id*

Resource events (event_issue_): project_id, issue_iid* for all.

• event_issue_label_list / event_issue_label_get (+ label_event_id*)

• event_issue_milestone_list / event_issue_milestone_get (+ milestone_event_id*)

• event_issue_state_list / event_issue_state_get (+ state_event_id*)

• event_issue_iteration_list / event_issue_iteration_get (+ iteration_event_id*)

• event_issue_weight_list

See also: gitlab_merge_request (MR lifecycle), gitlab_project (project settings, labels, milestones), gitlab_pipeline (CI/CD).

Example: {"action":"artifacts","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_job/.

Manage GitLab CI/CD jobs and the CI/CD job token scope: lifecycle, manual play, log/artifact retrieval, and inbound trust boundaries. Erase/delete actions are destructive. When to use: job details, logs, artifacts, retry/cancel jobs, job token scope. NOT for: pipeline-level operations (use gitlab_pipeline).

Behavior:

• Idempotent reads: list / list_project / get / trace / artifacts / download_artifacts / download_single_artifact / download_single_artifact_by_ref / list_bridges / token_scope_get / token_scope_list_inbound / token_scope_list_groups.

• retry starts a NEW job run on every call (NON-idempotent — returns a fresh job_id). play activates an existing manual job that has not yet run (same job_id; only manual jobs with rules.when=manual are eligible) and may pass new variables. cancel is idempotent (no-op once final). keep_artifacts / token_scope_patch / token_scope_add_project / token_scope_add_group are idempotent.

• Side effects: retry / play queue runners, consume CI minutes, and may trigger downstream pipelines and notifications. trace returns up to 100KB of log; download_artifacts streams up to 1MB inline (base64).

• Destructive: erase clears the job log and artifacts in place (irreversible); delete_artifacts removes a single job's artifacts; delete_project_artifacts wipes ALL artifacts across the project (irreversible). token_scope_remove_* tightens trust boundaries and may break running pipelines.

Param conventions: * = required. All job actions need project_id*. List actions accept page, per_page.

Jobs:

• list: project_id*, pipeline_id*, scope

• list_project: project_id*, scope, include_retried

• get: project_id*, job_id*

• trace: project_id*, job_id*. Returns job log (truncated to 100KB).

• cancel / retry / erase / keep_artifacts: project_id*, job_id*

• play: project_id*, job_id*, variables (array of {key, value, variable_type})

• wait: project_id*, job_id*, interval_seconds (5-60, default 10), timeout_seconds (1-3600, default 300), fail_on_error (default true)

• list_bridges: project_id*, pipeline_id*, scope

• delete_artifacts: project_id*, job_id*

• delete_project_artifacts: project_id*. Deletes ALL artifacts across project.

Artifact downloads (base64, max 1MB):

• artifacts: project_id*, job_id*

• download_artifacts: project_id*, ref_name*, job

• download_single_artifact: project_id*, job_id*, artifact_path*

• download_single_artifact_by_ref: project_id*, ref_name*, artifact_path*, job

Job token scope:

• token_scope_get / token_scope_patch: project_id*. Patch params: enabled.

• token_scope_list_inbound: project_id*

• token_scope_add_project / token_scope_remove_project: project_id*, target_project_id*

• token_scope_list_groups: project_id*

• token_scope_add_group / token_scope_remove_group: project_id*, target_group_id*

See also: gitlab_pipeline, gitlab_repository

Example: {"action":"approval_config","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_merge_request/.

Manage GitLab merge request lifecycle plus approval rules and settings, time tracking, subscriptions, context commits, MR dependencies (blocking MRs), todos, related issues, award emoji, and resource events. Delete permanently removes an MR. When to use: MR lifecycle (open/list/update/merge/close/delete/rebase), approvals at MR/group/project level, time tracking, subscriptions, context commits, MR dependencies, todos, related issues, award emoji, MR resource events. NOT for: comments, discussions, diffs, draft notes, raw diffs (use gitlab_mr_review), CI pipelines (use gitlab_pipeline; use action 'pipelines' here only to LIST MR pipelines), branches/tags (use gitlab_branch / gitlab_tag), commits in the repo (use gitlab_repository).

Returns:

• list / list_global / list_group / commits / pipelines / participants / reviewers / issues_closed / related_issues / dependencies_list / approval_rules / context_commits_list / event_list / emoji_list: arrays with pagination {page, per_page, total, next_page}.

• get / create / update / approve / merge / rebase / approval_state / approval_config / approval_rule_create / approval_rule_update / approval_settings_* / dependency_create / create_todo: MR, dependency, todo or settings object.

• time_estimate_set / spent_time_add / time_stats / time_estimate_reset / spent_time_reset: {time_estimate, total_time_spent, human_time_estimate, human_total_time_spent}.

• subscribe / unsubscribe / cancel_auto_merge / create_pipeline: updated MR or pipeline object.

• delete / unapprove / approval_reset / approval_rule_delete / context_commits_delete / dependency_delete / emoji_*_delete: {success, message}. Errors: 404 (hint: confirm project_id and merge_request_iid — merge_request_iid is project-scoped, not the global ID), 403 (hint: requires Reporter+ to comment, Developer+ to merge, configured approvers to approve), 405/409 on merge (hint: WIP/draft, unresolved threads, failing pipelines or pending approvals — see approval_state).

Param conventions: * = required. Most actions need project_id*, merge_request_iid*. List actions accept page, per_page.

IMPORTANT for create: target_branch* — if user doesn't specify, retrieve project's default_branch via gitlab_project get; do NOT assume 'main'. IMPORTANT for merge: auto-detects project squash/delete-branch settings — do NOT set squash or should_remove_source_branch unless user explicitly asks.

MR lifecycle:

• create: project_id*, source_branch*, target_branch*, title*, description, assignee_id, assignee_ids, reviewer_ids, labels (comma-separated), milestone_id, remove_source_branch, squash, allow_collaboration, target_project_id (forks)

• get: project_id*, merge_request_iid*

• list: project_id*, state (opened/closed/merged/all), labels, not_labels, milestone, scope, search, source_branch, target_branch, author_username, draft, iids, created_after/before, updated_after/before, order_by, sort

• list_global / list_group: same filters as list. list_group needs group_id* instead of project_id.

• update: project_id*, merge_request_iid*, title, description, target_branch, assignee_id, assignee_ids, reviewer_ids, labels, add_labels, remove_labels, milestone_id, remove_source_branch, squash, discussion_locked, allow_collaboration, state_event (close/reopen)

• merge: project_id*, merge_request_iid*, merge_commit_message, squash, should_remove_source_branch, auto_merge, sha, squash_commit_message

• approve / unapprove / rebase / delete / participants / reviewers / create_pipeline / cancel_auto_merge: project_id*, merge_request_iid*

• rebase also accepts: skip_ci

• commits / pipelines / issues_closed: project_id*, merge_request_iid*

• subscribe / unsubscribe: project_id*, merge_request_iid*

Approvals:

• approval_state / approval_rules / approval_config / approval_reset: project_id*, merge_request_iid*

• approval_rule_create: project_id*, merge_request_iid*, name*, approvals_required*, approval_project_rule_id, user_ids, group_ids

• approval_rule_update: project_id*, merge_request_iid*, approval_rule_id*, name, approvals_required, user_ids, group_ids

• approval_rule_delete: project_id*, merge_request_iid*, approval_rule_id*

• approval_settings_group_get / approval_settings_group_update: group_id*. Update params: allow_author_approval, allow_committer_approval, allow_overrides_approver_list_per_mr, retain_approvals_on_push, require_reauthentication_to_approve

• approval_settings_project_get / approval_settings_project_update: project_id*. Same params + selective_code_owner_removals.

Time tracking:

• time_estimate_set / spent_time_add: project_id*, merge_request_iid*, duration* (e.g. '3h30m', '1w2d'). spent_time_add also accepts summary.

• time_estimate_reset / spent_time_reset / time_stats: project_id*, merge_request_iid*

Context commits:

• context_commits_list / context_commits_create / context_commits_delete: project_id*, merge_request_iid*. create/delete need commits ([]string)*.

MR dependencies (blocking MRs):

• dependencies_list: project_id*, merge_request_iid* — list MRs that block this MR from merging.

• dependency_create: project_id*, merge_request_iid*, blocking_merge_request_id* (global ID of the blocking MR).

• dependency_delete: project_id*, merge_request_iid*, blocking_merge_request_id*.

Todos and related issues:

• create_todo: project_id*, merge_request_iid* — add this MR to the authenticated user's to-do list.

• related_issues: project_id*, merge_request_iid* — list issues mentioned or linked from the MR (paginated).

Award emoji:

• emoji_mr_list / emoji_mr_create / emoji_mr_delete: project_id*, merge_request_iid*, name* (create), award_id* (get/delete)

• emoji_mr_get: project_id*, merge_request_iid*, award_id*

• emoji_mr_note_list / emoji_mr_note_create / emoji_mr_note_delete: project_id*, merge_request_iid*, note_id*, name* (create), award_id* (get/delete)

• emoji_mr_note_get: project_id*, merge_request_iid*, note_id*, award_id*

Resource events:

• event_mr_label_list / event_mr_label_get: project_id*, merge_request_iid*, label_event_id* (get)

• event_mr_milestone_list / event_mr_milestone_get: project_id*, merge_request_iid*, milestone_event_id* (get)

• event_mr_state_list / event_mr_state_get: project_id*, merge_request_iid*, state_event_id* (get)

See also: gitlab_mr_review (comments, discussions, diffs, raw diffs, draft notes), gitlab_pipeline, gitlab_branch, gitlab_issue (linked/related issue lifecycle)

Example: {"action":"download","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_model_registry/.

Download ML model package files from the GitLab Model Registry. Read-only — cannot publish or delete model versions through this tool. The underlying GitLab API requires a Premium/Ultimate plan on the target instance (server enforces it with 403); the tool itself is always registered and is not gated by GITLAB_ENTERPRISE. When to use: pull a model artifact (.pkl, .onnx, .safetensors, .bin, .gguf, etc.) attached to a registered model version, e.g. for inference, evaluation or vendoring into a build pipeline. NOT for: generic packages (use gitlab_package), container images (use gitlab_package registry_), release attachments (use gitlab_release link_), training jobs or experiment tracking, model publishing or versioning (not yet exposed through MCP).

Returns:

• download: {file_name, model_version_id, size, content_base64} — binary content is base64-encoded; large models can produce very large responses. Errors: 404 (hint: project_id, model_version_id and path are model-registry-scoped; verify in the GitLab UI under Deploy → Model registry), 403 (hint: requires Reporter+ on the project and a Premium/Ultimate plan), 400 (hint: filename must match an asset attached to the version).

• download: project_id*, model_version_id*, path*, filename*. Returns base64-encoded file content.

  • project_id (string | int, required) — numeric ID or URL-encoded full path of the project that owns the registered model.

  • model_version_id (int, required) — registered model version ID; visible in the GitLab UI under Deploy → Model registry → → Versions.

  • path (string, required) — package-relative directory of the asset (use '/' for the package root, otherwise e.g. 'artifacts/' or 'weights/').

  • filename (string, required) — exact asset filename within the package, including extension (e.g. 'model.safetensors', 'config.json').

  • Any unrecognized parameter name is rejected by the meta-tool router (strict unknown-field validation); only the reserved meta key 'confirm' is stripped before unmarshalling.

See also: gitlab_package (generic / npm / maven / conan / pypi / nuget / container packages), gitlab_release (asset links per release), gitlab_repository (raw files in the repo).

Example: {"action":"changes_get","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_mr_review/.

Review and comment on GitLab merge requests: notes, threaded discussions (inline + general), code diffs, draft notes (batch review), diff versions, and the per-version diff payload. When to use: post review comments, open or resolve discussion threads, fetch the diff to comment inline, queue draft notes during a session and publish them as a single review. NOT for: MR lifecycle — create/update/merge/approve/rebase/delete (use gitlab_merge_request), reactions on MR notes (use gitlab_merge_request emoji_mr_note_*), CI pipelines on the MR (use gitlab_pipeline or gitlab_merge_request pipelines).

IMPORTANT — batch review pattern: call draft_note_create once per comment (with position for inline comments, or in_reply_to_discussion_id for replies), then draft_note_publish_all ONCE to send a single notification. Use discussion_create only for standalone questions that need immediate visibility.

Returns:

• *_list: array with pagination (page, per_page, total, next_page).

• note_, discussion_, draft_note_, diff_: resource object(s) with id, body/note, author, position (when inline).

• changes_get: {changes: [{old_path, new_path, diff, ...}], truncated_files} — if truncated, use diff_versions_list + diff_version_get, or raw_diffs for the full unified diff payload.

• raw_diffs: {raw_diff: string} — full unified diff for the MR head; ideal when changes_get returns truncated_files.

• *_delete / *_publish: {success: bool, message: string}. Errors: 404 not found (hint: check note_id/discussion_id and merge_request_iid), 403 forbidden (hint: requires Reporter+ to comment), 400 invalid params (hint: position requires base_sha + start_sha + head_sha + new_path/old_path + new_line/old_line).

Param conventions: * = required. All actions need project_id*, merge_request_iid*. List actions accept page, per_page. position object: {base_sha, start_sha, head_sha, new_path, old_path, new_line (added/modified), old_line (removed), both lines for unchanged context}.

Notes (general comments):

• note_list: order_by (created_at/updated_at), sort

• note_get / note_delete: note_id*

• note_create: body*

• note_update: note_id*, body*

Discussions (threaded, can be inline via position):

• discussion_list

• discussion_get: discussion_id*

• discussion_create: body*, position (inline)

• discussion_reply: discussion_id*, body*

• discussion_resolve: discussion_id*, resolved* (bool)

• discussion_note_update: discussion_id*, note_id*, body, resolved

• discussion_note_delete: discussion_id*, note_id*

Changes and diff versions:

• changes_get: returns file diffs; check truncated_files

• raw_diffs: project_id*, merge_request_iid* — returns the full raw unified diff for the MR head (use when changes_get reports truncated_files)

• diff_versions_list: list MR diff revisions

• diff_version_get: version_id*, unidiff (bool)

Draft notes (batch review):

• draft_note_list: order_by, sort

• draft_note_get: note_id*

• draft_note_create: note*, commit_id, in_reply_to_discussion_id, resolve_discussion (bool), position

• draft_note_update: note_id*, note, position

• draft_note_delete / draft_note_publish: note_id*

• draft_note_publish_all: publishes ALL pending drafts as a single review notification

See also: gitlab_merge_request (MR lifecycle, approvals, merge, time tracking, reactions), gitlab_pipeline (MR pipelines), gitlab_repository (file blame for context).

Example: {"action":"delete","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_package/.

Manage GitLab package registry, container registry, and protection rules. Upload/download generic packages, list/delete packages, browse container images/tags, and configure access policies. Delete actions are destructive. When to use: publish / download / list / delete generic packages, browse npm/maven/conan/nuget/pypi/etc. metadata, browse and prune container images and tags, manage container and package protection rules. NOT for: release asset links — these are managed by gitlab_release link_; secure files (use gitlab_admin secure_file_); ML model registry artifacts (use gitlab_model_registry); upload general project attachments (use gitlab_project upload).

Behavior:

• Idempotent reads: list / file_list / registry_list_project / registry_list_group / registry_get / registry_tag_list / registry_tag_get / registry_rule_list / protection_rule_list / download.

• publish / publish_directory / publish_and_link create a NEW package version (NON-idempotent — re-publishing the same (package_name, package_version, file_name) returns 400/409 or creates a duplicate file depending on package_type). registry_rule_update / protection_rule_update are idempotent; *_create are non-idempotent on duplicate keys.

• Side effects: publish_and_link also creates a release link visible to release subscribers; download streams large files to disk when output_path is set; protection_rule_create / registry_rule_create take effect immediately and may block subsequent publish/delete calls.

• Destructive: delete (entire package), file_delete (single file), registry_delete (entire image repo), registry_tag_delete / registry_tag_delete_bulk (image tags — name_regex_delete may match many tags) and *_rule_delete are irreversible. Protection rules can return 403 ('forbidden by protection rule') instead of executing the delete.

Returns:

• list / file_list / registry_list_project / registry_list_group / registry_tag_list / registry_rule_list / protection_rule_list: arrays with pagination.

• publish / publish_and_link / publish_directory / registry_get / registry_tag_get / registry_rule_create / registry_rule_update / protection_rule_create / protection_rule_update: package / image / rule object. publish_and_link also returns the created release link.

• download: {file_name, content_base64 (or saved_to)} — large files are streamed to disk when output_path is set.

• delete / file_delete / registry_delete / registry_tag_delete / registry_tag_delete_bulk / registry_rule_delete / protection_rule_delete: {success, message}. Errors: 404 (hint: package_id, repository_id and tag_name are project-scoped), 403 (hint: requires Maintainer+ to delete; protection rules may block delete with a 'forbidden by protection rule' message), 400 (hint: file_path must exist locally; content_base64 must be valid base64; package_type must be one of GitLab's supported types).

Param conventions: * = required. Most actions need project_id*. List actions accept page, per_page.

Packages:

• publish: project_id*, package_name*, package_version*, file_name*, file_path or content_base64 (one required), status (default/hidden)

• download: project_id*, package_name*, package_version*, file_name*, output_path*

• list: project_id*, package_name, package_version, package_type (generic/npm/maven/etc.), order_by, sort

• file_list: project_id*, package_id*

• delete: project_id*, package_id*. Deletes package and all files.

• file_delete: project_id*, package_id*, package_file_id*

• publish_and_link: publish + create release link. project_id*, package_name*, package_version*, file_name*, file_path or content_base64 (one required), tag_name*, link_name, link_type

• publish_directory: project_id*, package_name*, package_version*, directory_path*, include_pattern (glob), status

Container registry:

• registry_list_project: project_id*, tags, tags_count

• registry_list_group: group_id*

• registry_get: repository_id*, tags, tags_count

• registry_delete: project_id*, repository_id*

• registry_tag_list / registry_tag_get / registry_tag_delete: project_id*, repository_id*, tag_name* (for get/delete)

• registry_tag_delete_bulk: project_id*, repository_id*, name_regex_delete, name_regex_keep, keep_n, older_than

Container registry protection rules:

• registry_rule_list: project_id*

• registry_rule_create: project_id*, repository_path_pattern*, minimum_access_level_for_push, minimum_access_level_for_delete

• registry_rule_update: project_id*, rule_id*, repository_path_pattern, minimum_access_level_for_push, minimum_access_level_for_delete

• registry_rule_delete: project_id*, rule_id*

Package protection rules:

• protection_rule_list: project_id*

• protection_rule_create: project_id*, package_name_pattern*, package_type*, minimum_access_level_for_push, minimum_access_level_for_delete

• protection_rule_update: project_id*, rule_id*, package_name_pattern, package_type, minimum_access_level_for_push, minimum_access_level_for_delete

• protection_rule_delete: project_id*, rule_id*

See also: gitlab_release (release asset links), gitlab_project

Example: {"action":"cancel","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_pipeline/.

Manage GitLab CI/CD pipelines plus trigger tokens, resource groups (mutual-exclusion locks), JUnit test reports, and pipeline schedules. Delete permanently removes a pipeline and all its jobs. When to use: pipeline CRUD on a project, retry/cancel a run, fetch CI variables and JUnit test reports, manage trigger tokens, resource groups (mutual-exclusion locks), scheduled pipelines and their variables. NOT for: jobs, logs, artifacts, manual play actions (use gitlab_job), MR-specific pipelines (use gitlab_merge_request 'pipelines' / 'create_pipeline'), CI lint or includes (use gitlab_template).

Behavior:

• Idempotent reads: list / latest / get / variables / test_report / test_report_summary / trigger_list / trigger_get / resource_group_list / resource_group_get / resource_group_upcoming_jobs / schedule_list / schedule_get / schedule_list_triggered_pipelines.

• create / schedule_run / trigger_run start a NEW run on every call (NON-idempotent — produce a fresh pipeline_id). retry re-queues failed/canceled jobs on the existing pipeline (same pipeline_id; continue using it for subsequent get/wait calls). cancel is idempotent (no-op once final). update_metadata / trigger_update / resource_group_edit / schedule_update / schedule_edit_variable / schedule_take_ownership are idempotent (same input → same state).

• Side effects: create / retry / schedule_run / trigger_run queue runners, consume CI minutes, may trigger downstream pipelines, deployments and webhooks. trigger_create returns a secret token visible only ONCE — store it immediately. wait blocks server-side until terminal state or timeout.

• Destructive: delete permanently removes the pipeline and all its jobs, artifacts, logs and traces (irreversible). trigger_delete / schedule_delete / schedule_delete_variable are irreversible.

Returns:

• list / latest / variables / test_report / test_report_summary / trigger_list / resource_group_list / resource_group_upcoming_jobs / schedule_list / schedule_list_triggered_pipelines: array(s) or aggregated payloads with pagination where applicable.

• get / create / cancel / retry / update_metadata / wait / trigger_get / trigger_create / trigger_update / trigger_run / resource_group_get / resource_group_edit / schedule_get / schedule_create / schedule_update / schedule_run / schedule_take_ownership / schedule_create_variable / schedule_edit_variable: pipeline / trigger / resource group / schedule object.

• delete / trigger_delete / schedule_delete / schedule_delete_variable: {success, message}. Errors: 404 (hint: pipeline_id and trigger/schedule IDs are project-scoped), 403 (hint: requires Maintainer+ to delete pipelines or manage triggers/schedules), 400 (hint: cron expressions must use 5 fields; cron_timezone must be a valid TZ name; create requires 'ref').

Param conventions: * = required. All pipeline actions need project_id*. List actions accept page, per_page.

Pipelines:

• list: project_id*, status (success/failed/running/pending/canceled), scope, source, ref, sha, username

• get / cancel / retry / variables / test_report / test_report_summary: project_id*, pipeline_id*

• delete: project_id*, pipeline_id*. PERMANENTLY removes pipeline and jobs.

• latest: project_id*, ref

• create: project_id*, ref*, variables (array of {key, value, variable_type})

• update_metadata: project_id*, pipeline_id*, name*

• wait: project_id*, pipeline_id*, interval_seconds (5-60, default 10), timeout_seconds (1-3600, default 300), fail_on_error (default true)

Triggers:

• trigger_list: project_id*

• trigger_get / trigger_delete: project_id*, trigger_id*

• trigger_create: project_id*, description*

• trigger_update: project_id*, trigger_id*, description

• trigger_run: project_id*, ref*, token*, variables (map)

Resource groups:

• resource_group_list: project_id*

• resource_group_get / resource_group_edit: project_id*, key*. Edit params: process_mode.

• resource_group_upcoming_jobs: project_id*, key*

Schedules:

• schedule_list: project_id*, scope (active/inactive)

• schedule_get / schedule_delete / schedule_run / schedule_take_ownership: project_id*, schedule_id*

• schedule_create: project_id*, description*, ref*, cron*, cron_timezone, active

• schedule_update: project_id*, schedule_id*, description, ref, cron, cron_timezone, active

• schedule_create_variable: project_id*, schedule_id*, key*, value*, variable_type (env_var/file)

• schedule_edit_variable: project_id*, schedule_id*, key*, value*, variable_type

• schedule_delete_variable: project_id*, schedule_id*, key*

• schedule_list_triggered_pipelines: project_id*, schedule_id*

See also: gitlab_job (job details/logs/artifacts), gitlab_merge_request, gitlab_ci_variable

Example: {"action":"approval_config_change","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_project/.

Manage GitLab projects end-to-end: lifecycle (create/fork/transfer/archive/delete), visibility & access (members, share, approval rules, integrations, webhooks), and advanced features (mirrors, Pages, badges, boards, labels, milestones, uploads, avatars, import/export, housekeeping). Delete, unpublish, force-push and *_delete actions are destructive. When to use: project-level configuration and metadata. NOT for: file content/commits (use gitlab_repository), branches (gitlab_branch), wiki pages (gitlab_wiki), issues (gitlab_issue), MRs (gitlab_merge_request).

Behavior:

• Idempotent reads: every get/list/_get/_list action plus badge_preview, languages, repository_storage_get, statistics_get.

• Idempotent mutations: update / *_update / edit / star / unstar / archive / unarchive / hook_set. NON-idempotent: create, fork, *_create, hook_add, hook_test — each invocation queues a new webhook delivery.

• Side effects: hook_add/edit/test trigger webhook deliveries; member_add/share/edit and integration_set_* notify users; transfer relocates the project and members; export_schedule / import_from_file / start_mirroring / start_housekeeping queue long-running async work (poll *_status); upload_avatar / upload mutate storage.

• Destructive: delete (unless restore window applies), *_delete (hook/label/milestone/badge/board/integration/approval_rule/mirror/upload/pages_domain/board_list), pages_unpublish, mirror_force_push, delete_shared_group, delete_fork_relation. archive is reversible via unarchive.

Returns: list/*_list actions return paginated arrays {page, per_page, total, next_page}. CRUD/get/configure/upload actions return the resource object — including label_subscribe (returns the updated label). Pure-mutation actions (delete, delete, mirror_force_push, start, *_promote, label_unsubscribe) return {success, message}. Errors: 404 (hint: project_id may be a numeric ID or URL-encoded path like 'group%2Frepo'), 403 (hint: most mutations require Maintainer+; settings/transfers require Owner; instance-level actions require admin), 400 (hint: visibility ∈ private/internal/public; merge_method ∈ merge/rebase_merge/ff; namespace_id must be writable by the caller).

Param conventions: * = required. Most actions need project_id* (numeric ID or URL-encoded path like 'group/repo'). List actions accept page, per_page. Access levels: 10=Guest, 20=Reporter, 30=Developer, 40=Maintainer, 50=Owner.

Project CRUD:

• create: name*, namespace_id, description, visibility (private/internal/public), initialize_with_readme, default_branch, path, topics, merge_method (merge/rebase_merge/ff), squash_option (never/always/default_on/default_off), ci_config_path, feature toggles (issues/merge_requests/wiki/jobs/lfs/request_access_enabled)

• get: project_id*

• list: owned, search, visibility, archived, order_by, sort, topic, simple, min_access_level, last_activity_after/before, starred, membership, search_namespaces, statistics, include_pending_delete, include_hidden

• update: project_id*, name, description, visibility, default_branch, merge_method, topics, squash_option, merge_commit_template, squash_commit_template, merge_pipelines_enabled, merge_trains_enabled, approvals_before_merge, feature toggles

• delete: project_id*, permanently_remove, full_path (required when permanently_remove=true). Delayed deletion by default; permanently_remove bypasses it

• restore: project_id*

Project actions:

• fork: project_id*, name, path, namespace_id, namespace_path, visibility, branches, mr_default_target_self

• star / unstar / archive / unarchive / languages: project_id*

• transfer: project_id*, namespace* (ID or path)

• list_forks: project_id*, owned, search, visibility, order_by, sort

• create_fork_relation: project_id*, forked_from_id*

• delete_fork_relation: project_id*

Users and groups:

• list_user_projects: user_id* (ID or username), search, visibility, archived, order_by, sort, simple

• list_users / list_starrers: project_id*, search

• list_groups: project_id*, search, with_shared, shared_visible_only, skip_groups, shared_min_access_level

• share_with_group: project_id*, group_id*, group_access* (10-40), expires_at

• delete_shared_group: project_id*, group_id*

• list_invited_groups: project_id*, search, min_access_level

• list_user_contributed / list_user_starred: user_id*, search, visibility, archived, order_by, sort, simple

Members (member_*):

• members: project_id*, query (filter name/username)

• member_get / member_inherited: project_id*, user_id*

• member_add: project_id*, user_id or username*, access_level* (10-50), expires_at, member_role_id

• member_edit: project_id*, user_id*, access_level*, expires_at, member_role_id

• member_delete: project_id*, user_id*

Webhooks (hook_*) — event booleans: push/tag_push/issues/merge_requests/note/job/pipeline/wiki_page/deployment/releases/emoji:

• hook_list: project_id*

• hook_get / hook_delete: project_id*, hook_id*

• hook_add: project_id*, url*, name, description, token, event booleans, enable_ssl_verification, push_events_branch_filter, custom_webhook_template, branch_filter_strategy

• hook_edit: project_id*, hook_id*, same params as hook_add

• hook_test: project_id*, hook_id*, event* (e.g. push_events)

• hook_set_custom_header / hook_set_url_variable: project_id*, hook_id*, key*, value*

• hook_delete_custom_header / hook_delete_url_variable: project_id*, hook_id*, key*

Labels (label_*):

• label_list: project_id*, search, with_counts, include_ancestor_groups

• label_get / label_delete / label_subscribe / label_unsubscribe / label_promote: project_id*, label_id*

• label_create: project_id*, name*, color* (hex), description, priority

• label_update: project_id*, label_id*, new_name, color, description, priority

Milestones (milestone_*):

• milestone_list: project_id*, state (active/closed), title, search, include_ancestors

• milestone_get / milestone_delete: project_id*, milestone_iid*

• milestone_create: project_id*, title*, description, start_date, due_date

• milestone_update: project_id*, milestone_iid*, title, description, start_date, due_date, state_event (activate/close)

• milestone_issues / milestone_merge_requests: project_id*, milestone_iid*

Badges (badge_*):

• badge_list: project_id*, name

• badge_get / badge_delete: project_id*, badge_id*

• badge_add / badge_preview: project_id*, link_url*, image_url*, name

• badge_edit: project_id*, badge_id*, link_url, image_url, name

Boards (board_*):

• board_list: project_id*

• board_get / board_delete: project_id*, board_id*

• board_create: project_id*, name*

• board_update: project_id*, board_id*, name, assignee_id, milestone_id, labels, weight, hide_backlog_list, hide_closed_list

• board_list_list: project_id*, board_id*

• board_list_get / board_list_delete: project_id*, board_id*, list_id*

• board_list_create: project_id*, board_id*, label_id

• board_list_update: project_id*, board_id*, list_id*, position

Integrations (integration_*):

• integration_list: project_id*

• integration_get / integration_delete: project_id*, slug* (e.g. jira, slack, discord, datadog, jenkins, mattermost, telegram)

• integration_set_jira: project_id*, url*, username, password, active, api_url, jira_auth_type, jira_issue_prefix, commit_events, merge_requests_events, issues_enabled, project_keys

Uploads:

• upload: project_id*, filename*, file_path or content_base64 (one required). Returns Markdown embed

• upload_list: project_id*

• upload_delete: project_id*, upload_id*

Import/Export:

• export_schedule / export_status / export_download: project_id*

• import_from_file: file_path or content_base64 (one required), namespace, name, path, overwrite

• import_status: project_id*

Pages (pages_*):

• pages_get / pages_unpublish: project_id*

• pages_update: project_id*, pages_https_only, pages_access_level

• pages_domain_list_all: (admin only)

• pages_domain_list: project_id*

• pages_domain_get / pages_domain_delete: project_id*, domain*

• pages_domain_create / pages_domain_update: project_id*, domain*, certificate, key

Avatars:

• upload_avatar: project_id*, filename*, content_base64*

• download_avatar: project_id*

Approval rules (approval_*):

• approval_config_get: project_id*

• approval_config_change: project_id*, approvals_before_merge, reset_approvals_on_push, merge_requests_author_approval, merge_requests_disable_committers_approval, require_password_to_approve

• approval_rule_list: project_id*

• approval_rule_get / approval_rule_delete: project_id*, rule_id*

• approval_rule_create: project_id*, name*, approvals_required*, rule_type, user_ids, group_ids, protected_branch_ids, usernames, applies_to_all_protected_branches

• approval_rule_update: project_id*, rule_id*, name, approvals_required, user_ids, group_ids, protected_branch_ids, usernames

Pull mirroring:

• pull_mirror_get: project_id*

• pull_mirror_configure: project_id*, enabled, url, auth_user, auth_password, mirror_branch_regex, mirror_trigger_builds, only_mirror_protected_branches

• start_mirroring: project_id*

Remote mirrors (mirror_*):

• mirror_list: project_id*

• mirror_get / mirror_delete: project_id*, mirror_id*

• mirror_get_public_key: project_id*, mirror_id*

• mirror_add: project_id*, url*, enabled, keep_divergent_refs, only_protected_branches, mirror_branch_regex, auth_method (password/ssh_public_key)

• mirror_edit: project_id*, mirror_id*, enabled, keep_divergent_refs, only_protected_branches, mirror_branch_regex, auth_method

• mirror_force_push: project_id*, mirror_id*

Maintenance:

• start_housekeeping / repository_storage_get / statistics_get: project_id*

Admin:

• create_for_user: user_id*, name*, path, namespace_id, description, visibility, initialize_with_readme, default_branch, topics

See also: gitlab_repository (files/commits), gitlab_branch, gitlab_wiki, gitlab_issue, gitlab_merge_request, gitlab_discover_project (find project ID)

Example: {"action":"create","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_release/.

Manage GitLab releases and their asset links (binaries, packages, runbooks). Releases wrap a Git tag with notes, milestones and downloadable assets. Delete is destructive: it removes the release but preserves the underlying tag. When to use: publish a release for a tag, list/get/update releases, attach asset links to a release, batch-attach links after a CI build. NOT for: creating tags (use gitlab_tag create first — release_create requires an existing tag_name), uploading binaries to the package registry (use gitlab_package), milestones (use gitlab_project milestone_*).

Returns:

• list: array of releases with pagination.

• get / get_latest / create / update: release object {name, tag_name, description, released_at, assets: {sources, links}, evidences, milestones}.

• link_list: array of {id, name, url, link_type, direct_asset_path}.

• link_create / link_create_batch / link_get / link_update: link object(s).

• delete / link_delete: {success: bool, message: string}. Errors: 404 not found (hint: tag_name must exist), 403 forbidden (hint: requires Developer+ for create, Maintainer+ for update/delete), 400 invalid params (hint: link url must be absolute https://).

Param conventions: * = required. All actions need project_id*. Release actions need tag_name*. Link actions need tag_name* + link_id* (except link_create / link_create_batch / link_list).

Releases:

• create: project_id*, tag_name* (must exist), name, description (Markdown), released_at (ISO 8601), milestones ([]string)

• get: project_id*, tag_name*

• get_latest: project_id*

• list: project_id*, order_by (released_at/created_at), sort (asc/desc), page, per_page

• update: project_id*, tag_name*, name, description, released_at, milestones

• delete: project_id*, tag_name*

Asset links:

• link_create: project_id*, tag_name*, name*, url*, link_type (runbook/package/image/other), filepath, direct_asset_path

• link_create_batch: project_id*, tag_name*, links* (array of {name, url, link_type, filepath, direct_asset_path})

• link_get: project_id*, tag_name*, link_id*

• link_list: project_id*, tag_name*, page, per_page

• link_update: project_id*, tag_name*, link_id*, name, url, filepath, direct_asset_path, link_type

• link_delete: project_id*, tag_name*, link_id*

See also: gitlab_tag (create the tag before the release), gitlab_package (upload binaries; link_create can point at the package URL), gitlab_project (milestones referenced by releases).

Example: {"action":"archive","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_repository/.

Browse and manage GitLab repository content: file tree, read/write/delete files, commits, diffs, cherry-pick, revert, blame, compare branches, contributors, archives, changelogs, submodules, render markdown, and commit discussions. File delete is destructive. When to use: file/commit operations, diffs, blame, compare, archives, submodules, markdown rendering. NOT for: branch CRUD (use gitlab_branch), tag CRUD (use gitlab_tag).

Behavior:

• Idempotent reads: tree, blob, raw_blob, archive, compare, merge_base, contributors, file_get/raw/metadata/raw_metadata/blame, list_submodules, read_submodule_file, file_history, commit_list/get/diff/refs/comments/merge_requests/statuses/signature, commit_discussion_list/get, markdown_render, changelog_generate.

• file_create / file_update / file_delete / commit_create / commit_cherry_pick / commit_revert / update_submodule / changelog_add are NON-idempotent: when preconditions are satisfied each call produces a new commit SHA; otherwise they fail (e.g. 400 on conflict, 409 on stale last_commit_id). Use last_commit_id on file_update/file_delete for optimistic-concurrency safety.

• commit_status_set is idempotent per (sha, name, ref); commit_comment_create / commit_discussion_create / commit_discussion_add_note append rather than replace. commit_discussion_update_note replaces the existing note body.

• Side effects: any commit-producing action triggers webhooks, CI pipelines, and protected-branch / push-rule checks; archive returns large binary payloads (base64).

• File delete is destructive at the working-tree level but git history is preserved.

Returns: JSON with resource data. Lists include pagination (page, per_page, total, next_page). Void actions return confirmation. Errors: 404 (hint: confirm project_id, ref/sha, and file_path — paths are URL-encoded), 403 (hint: file_create/file_update/file_delete and commit_* require Developer+; protected branches may need Maintainer+), 400 (hint: file_update/file_delete accept last_commit_id for optimistic concurrency; commit_create needs at least one entry in actions).

Param conventions: * = required. Most actions need project_id*. List actions accept page, per_page.

Repository browsing:

• tree: project_id*, path, ref, recursive

• compare: project_id*, from*, to*, straight

• contributors: project_id*, order_by (name/email/commits), sort

• merge_base: project_id*, refs* (array of 2+ branch/tag/SHA)

• blob / raw_blob: project_id*, sha*

• archive: project_id*, sha, format (tar.gz/zip/tar.bz2), path

Changelogs:

• changelog_add: project_id*, version*, branch, config_file, file, from, to, message, trailer

• changelog_generate: project_id*, version*, config_file, from, to, trailer

Commits:

• commit_create: project_id*, branch*, commit_message*, actions* (array of {action: create/update/delete/move, file_path, content, previous_path}), start_branch, author_email, author_name

• commit_list: project_id*, ref_name, since, until, path, author, with_stats

• file_history: alias for commit_list filtered by path* — list commits modifying a specific file

• commit_get: project_id*, sha*

• commit_diff: project_id*, sha*

• commit_refs: project_id*, sha*, type (branch/tag/all)

• commit_comments / commit_merge_requests: project_id*, sha*

• commit_comment_create: project_id*, sha*, note*, path, line, line_type (new/old)

• commit_statuses: project_id*, sha*, ref, stage, name, pipeline_id, all

• commit_status_set: project_id*, sha*, state* (pending/running/success/failed/canceled), ref, name, context, target_url, description, coverage, pipeline_id

• commit_cherry_pick: project_id*, sha*, branch*, dry_run, message

• commit_revert: project_id*, sha*, branch*

• commit_signature: project_id*, sha*

Files:

• file_get / file_raw / file_metadata / file_raw_metadata / file_blame: project_id*, file_path*, ref. Blame also accepts range_start, range_end.

  • file_metadata: HEAD-style metadata for the file content endpoint (size, encoding, content_sha256, blob_id, last_commit_id, ref).

  • file_raw_metadata: HEAD-style metadata for the raw file endpoint (size, content_type, ref) — useful to size-check before downloading via file_raw.

• file_create: project_id*, file_path*, branch*, commit_message*, content, start_branch, encoding (text/base64), author_email, author_name, execute_filemode

• file_update: project_id*, file_path*, branch*, commit_message*, content, start_branch, encoding, author_email, author_name, last_commit_id, execute_filemode

• file_delete: project_id*, file_path*, branch*, commit_message*, start_branch, author_email, author_name, last_commit_id

Submodules:

• update_submodule: project_id*, submodule* (URL-encoded path), branch*, commit_sha*, commit_message

• list_submodules: project_id*, ref

• read_submodule_file: project_id*, submodule_path*, file_path*, ref

Markdown:

• markdown_render: text*, gfm, project (path for resolving references)

Commit discussions:

• commit_discussion_list: project_id*, commit_id*

• commit_discussion_get: project_id*, commit_id*, discussion_id*

• commit_discussion_create: project_id*, commit_id*, body*, position

• commit_discussion_add_note: project_id*, commit_id*, discussion_id*, body*

• commit_discussion_update_note: project_id*, commit_id*, discussion_id*, note_id*, body*

• commit_discussion_delete_note: project_id*, commit_id*, discussion_id*, note_id*

See also: gitlab_branch, gitlab_tag, gitlab_project, gitlab_merge_request

Example: {"action":"controller_create","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_runner/.

Manage GitLab CI/CD runners (instance, group, project) and runner controllers (admin, experimental): CRUD, registration tokens, and job assignments. Remove/delete/revoke and reset_token actions are destructive — revoking the registration token only invalidates future registrations; already-registered runners keep operating using their existing runner authentication tokens. Valid actions: controller_create, controller_delete, controller_get, controller_list, controller_scope_add_instance, controller_scope_add_runner, controller_scope_list, controller_scope_remove_instance, controller_scope_remove_runner, controller_token_create, controller_token_get, controller_token_list, controller_token_revoke, controller_token_rotate, controller_update, delete_by_token, delete_registered, disable_project, enable_project, get, jobs, list, list_all, list_group, list_managers, list_project, register, remove, reset_group_reg_token, reset_instance_reg_token, reset_project_reg_token, reset_token, update, verify

When to use: register or pause runners, change runner tags / access_level / maximum_timeout, attach or detach runners from a project / group, rotate registration tokens, drive runner controllers (CRUD + scopes + tokens) for admins. NOT for: pipeline runs (use gitlab_pipeline), job logs / retry / play (use gitlab_job), CI variables (use gitlab_ci_variable), CI lint or templates (use gitlab_template), self-hosted GitLab Runner installation (out of scope — install via the GitLab Runner CLI).

Returns:

• list / list_all / list_project / list_group / list_managers / jobs / controller_list / controller_scope_list / controller_token_list: arrays with pagination {page, per_page, total, next_page}.

• get / update / register / reset_token / enable_project / controller_get / controller_create / controller_update / controller_scope_add / controller_token_get / controller_token_create / controller_token_rotate: runner / controller / token object. register and reset_*_token / controller_token_create / controller_token_rotate include the cleartext token only ONCE — store it securely.

• verify / remove / delete_registered / delete_by_token / disable_project / controller_delete / controller_scope_remove_* / controller_token_revoke: {success, message}. Errors: 401/403 (hint: list_all / register with admin token / runner controller actions require admin), 404 (hint: runner_id and controller_id are global, project / group context only filters), 400 (hint: access_level ∈ not_protected / ref_protected; tag_list is a comma-separated string; deprecated reset_*_reg_token endpoints — prefer controller_token_create).

Param conventions: * = required. List actions accept page, per_page. Runner IDs are integers.

Runner CRUD:

• list: type, status, paused, tag_list (comma-separated)

• list_all: (admin) type, status, paused, tag_list

• get / remove: runner_id*

• update: runner_id*, description, paused, tag_list, run_untagged, locked, access_level, maximum_timeout, maintenance_note

• jobs: runner_id*, status (running/success/failed/canceled), order_by, sort, page, per_page

Project/Group runners:

• list_project: project_id*, type, status, tag_list

• enable_project: project_id*, runner_id*

• disable_project: project_id*, runner_id*

• list_group: group_id*, type, status, tag_list

Registration and tokens:

• register: token*, description, paused, locked, run_untagged, tag_list, access_level, maximum_timeout, maintenance_note

• delete_registered: runner_id*

• delete_by_token: token*

• verify: token*

• reset_token: runner_id*

• reset_instance_reg_token: (deprecated, no params)

• reset_group_reg_token: group_id* (deprecated)

• reset_project_reg_token: project_id* (deprecated)

• list_managers: runner_id*

Runner controllers (admin, experimental):

• controller_list

• controller_get / controller_delete: controller_id*

• controller_create: description, state (enabled/disabled/dry_run)

• controller_update: controller_id*, description, state

Controller scopes:

• controller_scope_list / controller_scope_add_instance / controller_scope_remove_instance: controller_id*

• controller_scope_add_runner / controller_scope_remove_runner: controller_id*, runner_id*

Controller tokens:

• controller_token_list: controller_id*

• controller_token_get / controller_token_rotate / controller_token_revoke: controller_id*, token_id*

• controller_token_create: controller_id*, description

See also: gitlab_pipeline, gitlab_job

Example: {"action":"code","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_search/.

Search GitLab by scope (instance / group / project) for code, MRs, issues, commits, milestones, notes, projects, snippets, users, or wiki pages. Read-only. When to use: full-text search across the supplied scope. Most actions accept project_id and / or group_id; if both are omitted the search runs at instance level (an authenticated user always has implicit instance scope on GitLab.com). NOT for: discovering a project from a git remote (use gitlab_discover_project), listing labels / milestones / issues with structured filters (use gitlab_project, gitlab_issue, gitlab_merge_request — those support filters like state/labels/milestone), reading file contents (use gitlab_repository file_get).

Scope precedence: project_id > group_id > global. Pagination: page, per_page (max 100). All actions need query*.

Returns:

• code: array of {basename, data, path, ref, startline, project_id} blobs.

• merge_requests / issues: arrays of MR / issue objects.

• commits: array of {id, short_id, title, author_name, committed_date, project_id}.

• milestones / projects / snippets / users / wiki: arrays of resource summaries.

• notes: array of {id, body, notable_type, notable_id, notable_iid} entries. All lists paginate with {page, per_page, total, next_page}. Errors: 403 (hint: project_id / group_id must be visible to the caller), 404 (hint: project_id / group_id wrong or no permission), 400 (hint: query must not be empty; some scopes only support global — e.g. snippets).

• code: query*, project_id, group_id, ref

• merge_requests / issues / commits / milestones / users / wiki: query*, project_id, group_id

• notes: query*, project_id* (project-scoped only)

• projects: query*, group_id

• snippets: query* (global only)

See also: gitlab_discover_project (resolve git remote URL → project_id), gitlab_project / gitlab_merge_request / gitlab_issue (structured filtering).

Example: {"action":"health_check","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_server/.

MCP server self-diagnostics: GitLab connectivity probe, server/GitLab version, and authenticated user identity. Read-only; no required params. Valid actions: health_check, status

When to use: at session start to confirm the GitLab token works, when diagnosing 401/403 errors from other tools, or to record server/GitLab versions for support tickets. NOT for: resolving a git remote URL to a project (use gitlab_discover_project), GitLab instance admin (use gitlab_admin), per-project membership/permissions (use gitlab_project / gitlab_user), CI runner health (use gitlab_runner).

Returns: {status, mcp_server_version, gitlab_url, gitlab_version, gitlab_revision, authenticated (bool), username, user_id, response_time_ms, error}. Authentication and connectivity failures are surfaced inside this diagnostics object (status / error fields), not as a tool-level JSON-RPC error. Errors: tool-level errors are rare — inspect the returned status / error fields. Network errors include the GitLab URL verbatim.

• status: (no params) — returns the diagnostics object above.

• health_check: alias for status. (no params)

See also: gitlab_discover_project (resolve git remote URL → project_id), gitlab_admin (instance admin), gitlab_user (current user details and impersonation tokens).

Example: {"action":"content","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_snippet/.

Manage GitLab snippets (personal, project-scoped, and explore feed): CRUD snippet metadata and content, threaded discussions, notes (project snippets only), and award emoji on snippets and snippet notes. Delete is destructive and irreversible. When to use: store/share standalone code or text outside a repo, comment on existing snippets, react with emoji on a snippet or snippet note, browse public snippets via explore. NOT for: files in a repository (use gitlab_repository), wiki pages (use gitlab_wiki), MR/issue notes (use gitlab_mr_review or gitlab_issue), custom group emoji (use gitlab_custom_emoji — enterprise).

Returns:

• *_list / list_all / explore: array with pagination.

• *_get / *_create / *_update: snippet object {id, title, file_name, files, visibility, author, web_url, raw_url}.

• content / project_content: raw snippet body as text.

• file_content: raw content of a single file in a multi-file snippet.

• discussion_* / note_*: discussion or note object.

• emoji_*: award emoji object.

• *_delete: {success: bool, message: string}. Errors: 404 not found, 403 forbidden (hint: requires Reporter+ for project snippets; private snippets require ownership), 400 invalid params (hint: visibility ∈ private/internal/public).

Param conventions: * = required. List actions accept page, per_page. visibility ∈ private/internal/public.

Personal snippets:

• list / list_all / explore: (no required params)

• get / content: snippet_id*

• file_content: snippet_id*, file_path*

• create: title*, file_name*, content*, visibility, description

• update: snippet_id*, title, file_name, content, visibility, description

• delete: snippet_id*

Project snippets:

• project_list: project_id*

• project_get / project_content: project_id*, snippet_id*

• project_create: project_id*, title*, file_name*, content*, visibility

• project_update: project_id*, snippet_id*, title, file_name, content, visibility

• project_delete: project_id*, snippet_id*

Discussions (threaded):

• discussion_list: snippet_id*

• discussion_get: snippet_id*, discussion_id*

• discussion_create: snippet_id*, body*

• discussion_add_note: snippet_id*, discussion_id*, body*

• discussion_update_note: snippet_id*, discussion_id*, note_id*, body*

• discussion_delete_note: snippet_id*, discussion_id*, note_id*

Notes (project snippets only) — all need project_id*, snippet_id*:

• note_list: order_by, sort

• note_get / note_delete: note_id*

• note_create: body*

• note_update: note_id*, body*

Award emoji — all need project_id*, snippet_id* (snippet emoji) or project_id*, snippet_id*, note_id* (note emoji):

• emoji_snippet_list / emoji_snippet_note_list: (no extra params)

• emoji_snippet_get / emoji_snippet_note_get: award_id*

• emoji_snippet_create / emoji_snippet_note_create: name*

• emoji_snippet_delete / emoji_snippet_note_delete: award_id*

See also: gitlab_repository (project files and commits), gitlab_wiki (long-form project docs), gitlab_project (project membership and visibility), gitlab_custom_emoji (define group-level custom emoji).

Example: {"action":"create","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_tag/.

Manage Git tags and tag protections in a project, plus GPG signature inspection. Delete is destructive and also removes any release attached to the tag. When to use: create/list/delete tags, protect or unprotect tag patterns, verify a tag's GPG/X.509 signature. NOT for: releases (use gitlab_release — a release wraps a tag with notes/assets), branches (use gitlab_branch), repository file/commit operations (use gitlab_repository).

Returns:

• list / list_protected: array of {name, target, message, protected, ...} with pagination.

• get / create / get_protected / protect: tag or protection object.

• get_signature: {signature_type, gpg_key_id, verification_status, ...} or X.509 equivalent.

• delete / unprotect: {success: bool, message: string}. Errors: 404 not found, 403 forbidden (hint: requires Maintainer+ to protect/unprotect), 400 invalid params (hint: tag name must not exist for create).

Param conventions: * = required. All actions need project_id*. Access levels: 0 = no one, 30 = Developer, 40 = Maintainer.

• create: project_id*, tag_name*, ref* (branch/tag/SHA), message (annotated tag if non-empty)

• get / delete: project_id*, tag_name*

• list: project_id*, search, order_by (name/updated/version), sort (asc/desc)

• get_signature: project_id*, tag_name*

• list_protected: project_id*

• get_protected / unprotect: project_id*, tag_name*

• protect: project_id*, tag_name* (literal or wildcard e.g. 'v*'), create_access_level (0/30/40), allowed_to_create (array of {user_id|group_id|deploy_key_id|access_level})

See also: gitlab_release (releases use tags as anchors), gitlab_repository (commits referenced by tags), gitlab_branch (branches).

Example: {"action":"ci_yml_get","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_template/.

Browse GitLab built-in templates (gitignore, CI/CD YAML, Dockerfile, license, project scaffolding) and lint CI configuration. Read-only; ci_lint may resolve include: directives that fetch remote URLs. When to use: discover available built-in templates, fetch a template body to commit into a project, validate a .gitlab-ci.yml before pushing, or list project scaffolds. NOT for: reusable Catalog components published by groups (use gitlab_ci_catalog), running pipelines (use gitlab_pipeline), CI/CD variables (use gitlab_ci_variable), repository files (use gitlab_repository).

Returns:

• *_list: [{key, name}] with pagination (page, per_page, total, next_page).

• *_get: {name, content} — paste content into the target file.

• lint / lint_project: {valid (bool), errors: [string], warnings: [string], merged_yaml (string), jobs: [...] when include_jobs=true}. Errors: 404 not found (hint: check key or template_type), 403 forbidden, 400 invalid params (hint: content required for lint, project_id required for project_template_*).

Param conventions: * = required. template_type ∈ {dockerfiles, gitignores, gitlab_ci_ymls, licenses}.

CI lint:

• lint: project_id*, content*, dry_run (bool), include_jobs (bool), ref

• lint_project: project_id*, content_ref, dry_run (bool), dry_run_ref, include_jobs (bool), ref

Global templates:

• ci_yml_list / dockerfile_list / gitignore_list: page, per_page

• ci_yml_get / dockerfile_get / gitignore_get: key*

• license_list: page, per_page, popular (bool)

• license_get: key*, project, fullname

Project templates:

• project_template_list: project_id*, template_type*, page, per_page

• project_template_get: project_id*, template_type*, key*

See also: gitlab_ci_catalog (reusable Catalog components), gitlab_pipeline (run pipelines), gitlab_project (project membership/settings).

Example: {"action":"activate","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_user/.

User management for GitLab: full user account CRUD plus SSH/GPG keys, emails, personal access tokens (PATs), impersonation tokens, user status, todos, contribution events, notification settings, namespaces, and avatars. This is the canonical user management tool — covers the entire /users API surface. Delete / block / ban / reject actions are destructive. When to use: any user-management workflow — user CRUD (create / modify / delete / block / unblock / ban / unban / approve / reject / activate / deactivate), SSH/GPG key management, personal access token (PAT) management, impersonation tokens (admin), todos, contribution events, notification settings, namespaces, avatars, current-user status. NOT for: deploy tokens or project/group access tokens (use gitlab_access), instance-wide admin operations (use gitlab_admin), project/group memberships (use gitlab_project / gitlab_group).

Param conventions: * = required. User IDs are integers. List actions accept page, per_page. Actions ending in _for_user take the same params as the base action plus user_id*. Plain ssh_keys / gpg_keys / emails (no suffix) operate on the current authenticated user with no params.

Current user:

• current / me: returns authenticated user info.

• current_user_status: returns emoji, message, availability.

• set_status: emoji, message, availability (not_set/busy), clear_status_after (30_minutes/3_hours/8_hours/1_day/3_days/7_days/30_days)

User CRUD (admin):

• list: search, username, active, blocked, external, order_by, sort

• get: user_id*

• get_status: user_id*

• create: email*, name*, username*, password, reset_password, force_random_password, skip_confirmation, admin, external, bio, location, job_title, organization, projects_limit, note

• modify: user_id*, email, name, username, bio, location, job_title, organization, projects_limit, admin, external, note

• delete: user_id*

• associations_count: user_id*

User state (admin):

• block / unblock / ban / unban / activate / deactivate / approve / reject / disable_two_factor: user_id*

SSH keys:

• get_ssh_key: key_id*

• get_ssh_key_for_user: user_id*, key_id*

• add_ssh_key: title*, key*, expires_at, usage_type (auth/signing)

• delete_ssh_key: key_id*

• delete_ssh_key_for_user: user_id*, key_id*

GPG keys:

• get_gpg_key: key_id*

• get_gpg_key_for_user: user_id*, key_id*

• add_gpg_key: key* (armored GPG public key)

• delete_gpg_key: key_id*

• delete_gpg_key_for_user: user_id*, key_id*

Emails:

• get_email: email_id*

• add_email: email*, skip_confirmation

• add_email_for_user: user_id*, email*, skip_confirmation

• delete_email: email_id*

• delete_email_for_user: user_id*, email_id*

Tokens:

• list_impersonation_tokens: user_id*, state (active/inactive)

• get_impersonation_token: user_id*, token_id*

• create_impersonation_token: user_id*, name*, scopes*, expires_at

• revoke_impersonation_token: user_id*, token_id*

• create_personal_access_token: user_id*, name*, scopes*, description, expires_at

• create_current_user_pat: name*, scopes*, description, expires_at

Activity and events:

• activities: (admin) from (YYYY-MM-DD)

• memberships: user_id*, type (Project/Namespace)

• contribution_events: user_id*, action, target_type, before, after, sort

• event_list_project: project_id*, action, target_type, before, after, sort

• event_list_contributions: action, target_type, before, after, sort

Todos:

• todo_list: action, author_id, project_id, group_id, state (pending/done), type

• todo_mark_done: id*

• todo_mark_all_done: no params

Notifications:

• notification_global_get / notification_global_update: no ID needed. Update params: level, notification_email, event booleans

• notification_project_get / notification_project_update: project_id*. Update params: level, event booleans

• notification_group_get / notification_group_update: group_id*. Update params: level, event booleans

Keys and namespaces:

• key_get_with_user: key_id*. Returns SSH key with user info.

• key_get_by_fingerprint: fingerprint*

• namespace_list: search, owned_only

• namespace_get: namespace_id*

• namespace_exists: namespace*, parent_id

• namespace_search: search*

• avatar_get: email*, size

Misc:

• create_runner: runner_type*, group_id, project_id, description, paused, locked, run_untagged, tag_list, access_level, maximum_timeout, maintenance_note

• delete_identity: user_id*, provider*

See also: gitlab_access (deploy/access tokens), gitlab_admin (instance administration)

Example: {"action":"create","params":{...}} For the params schema of any action, read the MCP resource gitlab://schema/meta/gitlab_wiki/.

CRUD project wiki pages and upload attachments to wikis. Delete is destructive and irreversible. When to use: read, write, or delete wiki pages of a project; attach images or files referenced from wiki content. NOT for: repository files or commits (use gitlab_repository), code snippets (use gitlab_snippet), group-level wikis (Enterprise/Premium — use gitlab_group when GITLAB_ENTERPRISE=true), issues or MR descriptions (use gitlab_issue / gitlab_merge_request).

Returns:

• get / create / update: {slug, title, format, content, encoding}.

• list: array of {slug, title, format} (content omitted unless with_content=true).

• delete: {success: bool, message: string}.

• upload_attachment: {file_name, url, alt, markdown} — embed markdown directly in a page. Errors: 404 not found (hint: check slug or project_id), 403 forbidden (hint: wiki disabled or insufficient role), 400 invalid params (hint: title/content required, slug must be URL-encoded).

Param conventions: * = required. All actions need project_id* (numeric ID or url-encoded path). slug is the URL-encoded page path (e.g. docs%2Fsetup). format default = markdown. content max ~1 MB.

• list: project_id*, with_content (bool)

• get: project_id*, slug*, render_html (bool), version (commit SHA)

• create: project_id*, title*, content*, format (markdown/rdoc/asciidoc/org)

• update: project_id*, slug*, title, content, format

• delete: project_id*, slug*

• upload_attachment: project_id*, filename*, content_base64 OR file_path (exactly one), branch

See also: gitlab_project (settings/membership), gitlab_repository (file commits), gitlab_snippet (standalone code snippets).