GitLabGenerally available (GitLab 19.5)Verified 2026-10-18

GitLab MCP server for Claude, Cursor & Codex

Built into GitLab at /api/v4/mcp: agents can read and act on projects, issues, merge requests, pipelines and repositories. Generally available since GitLab 19.5, on all tiers; OAuth or a fine-grained token required.

CompareDocs

Verified factsChecked 2026-10-18

PriceAvailable on GitLab Free, Premium and Ultimate, on GitLab.com, Self-Managed and Dedicated. The MCP server moved from Premium to Free in GitLab 19.2. Some toolsets need paid features (Duo Agent Platform, Ultimate security tools).1 [Verified 2026-10-18]
API key / authOAuth access token with the mcp scope (clients get it through the OAuth flow) or a fine-grained personal access token with the MCP tool resource and Execute permission. Legacy, project and group tokens are rejected with 403 insufficient_scope. Our unauthenticated request on 2026-10-18 returned HTTP 401 with a Bearer challenge for scope mcp.1 [Verified 2026-10-18]
Rate limitGitLab.com, per user across all clients: 60 MCP requests a minute on Free, 600 on Premium and Ultimate (introduced in 19.5 behind feature flags). Over the limit: HTTP 429 with Retry-After. Self-managed admins set their own limit.1 [Verified 2026-10-18]
TermsGitLab’s subscription terms govern GitLab.com and licensed instances; the data is your own projects’.3 [Verified 2026-10-18]
StatusGenerally available since GitLab 19.5 (experiment in 18.3, beta in 18.6). On GitLab.com the top-level group must allow MCP server access.1 [Verified 2026-10-18]
Registry listingListed in the official MCP Registry as com.gitlab/mcp with remote https://gitlab.com/api/v4/mcp.4 [Verified 2026-10-18]

FeaturesChecked 2026-10-18

YesNoN/ANot published
CapabilityValueNote
StatusExperiment in 18.3, beta in 18.6, GA in 19.5.Generally available (GitLab 19.5)1 [Verified 2026-10-18 on https://docs.gitlab.com/user/model_context_protocol/mcp_server/]Experiment in 18.3, beta in 18.6, GA in 19.5.
API key requiredOAuth (mcp scope) or fine-grained PAT. Our unauthenticated request returned HTTP 401 with a Bearer challenge for scope mcp.Yes2 [Verified 2026-10-18 by test request to https://gitlab.com/api/v4/mcp]OAuth (mcp scope) or fine-grained PAT. Our unauthenticated request returned HTTP 401 with a Bearer challenge for scope mcp.
Free tierOn GitLab Free. Moved from Premium to Free in 19.2; some toolsets need paid features.Yes1 [Verified 2026-10-18 on https://docs.gitlab.com/user/model_context_protocol/mcp_server/]On GitLab Free. Moved from Premium to Free in 19.2; some toolsets need paid features.
Rate limitPer user on GitLab.com across all clients (19.5, behind feature flags); self-managed admins set their own.Free 60/min; Premium+ 600/min1 [Verified 2026-10-18 on https://docs.gitlab.com/user/model_context_protocol/mcp_server/]Per user on GitLab.com across all clients (19.5, behind feature flags); self-managed admins set their own.
Official MCP serverBuilt in, /api/v4/mcp. Streamable HTTP with OAuth dynamic client registration; listed as com.gitlab/mcp in the official registry.Yes1 [Verified 2026-10-18 on https://docs.gitlab.com/user/model_context_protocol/mcp_server/]Built in, /api/v4/mcp. Streamable HTTP with OAuth dynamic client registration; listed as com.gitlab/mcp in the official registry.
Official SDKAny MCP client connects directly; GitLab’s REST API remains available for bulk jobs.N/A1 [Verified 2026-10-18 on https://docs.gitlab.com/user/model_context_protocol/mcp_server/]Any MCP client connects directly; GitLab’s REST API remains available for bulk jobs.
Data license / termsYour own project data; GitLab’s terms govern the service.GitLab subscription terms3 [Verified 2026-10-18 on https://about.gitlab.com/terms/]Your own project data; GitLab’s terms govern the service.
Commercial use allowedYour own projects. MCP access is a feature of your GitLab plan; the docs state no separate usage restriction.Yes1 [Verified 2026-10-18 on https://docs.gitlab.com/user/model_context_protocol/mcp_server/]Your own projects. MCP access is a feature of your GitLab plan; the docs state no separate usage restriction.
CORS / browser useAccess-Control-Allow-Origin: *. Preflight returned 200 with *.Yes2 [Verified 2026-10-18 by test request to https://gitlab.com/api/v4/mcp]Access-Control-Allow-Origin: *. Preflight returned 200 with *.
Freshness / coverageTools read and write your GitLab data directly.Live project data1 [Verified 2026-10-18 on https://docs.gitlab.com/user/model_context_protocol/mcp_server/]Tools read and write your GitLab data directly.

What it does

GitLab runs an MCP server inside the product, at https://gitlab.com/api/v4/mcp on GitLab.com or the same path on a self-managed or Dedicated instance. Clients connect over Streamable HTTP and sign in with OAuth (dynamic client registration is supported), so there is usually nothing to install. Tools are grouped into toolsets: core, merge_requests, work_items, repository and ci are on by default; wikis, code_security and orbit are opt-in; and the X-Gitlab-Enabled-Mcp-Server-Toolsets header trims what the agent sees. Some tools write (commits, issues, merge requests), so scope tokens and toolsets to the job.

Working exampleNot run: needs a GitLab OAuth token with the mcp scope or a fine-grained personal access token

Documented request, not run by us: needs a GitLab OAuth token with the mcp scope or a fine-grained personal access token. The response below is what we did run on 2026-10-18.

# Not run: needs an OAuth token (mcp scope) or a fine-grained personal access token
curl -sS -X POST https://gitlab.com/api/v4/mcp \
  -H "Authorization: Bearer $GITLAB_MCP_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "X-Gitlab-Enabled-Mcp-Server-Toolsets: core,merge_requests" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Response (trimmed)

Not run with a token. What we did run on 2026-10-18 (initialize, no token):
HTTP 401
www-authenticate: Bearer realm="GitLab", scope="mcp",
  resource_metadata="https://gitlab.com/.well-known/oauth-protected-resource/api/v4/mcp"
ratelimit-name: throttle_unauthenticated_api
{"message":"401 Unauthorized"}

Agent setup

Prompt to give your agent

You are connected to GitLab through its MCP server with the core and merge_requests toolsets. Summarize open merge requests in group/project that have failing pipelines, with links. Do not create commits, issues or merge requests, or post comments, unless I ask for that specific change.

Agent / MCP-style tool snippet

// Claude Code (OAuth opens in the browser on first use):
//   claude mcp add -s user --transport http GitLab https://gitlab.com/api/v4/mcp \
//     --header "X-Gitlab-Enabled-Mcp-Server-Toolsets: core,merge_requests"
// Codex:
//   codex mcp add GitLab --url "https://gitlab.com/api/v4/mcp" && codex mcp login GitLab
// Cursor .cursor/mcp.json
{
  "mcpServers": {
    "GitLab": {
      "type": "http",
      "url": "https://gitlab.com/api/v4/mcp",
      "headers": { "X-Gitlab-Enabled-Mcp-Server-Toolsets": "core,merge_requests" }
    }
  }
}

Fit and safety

Good for

  • Letting a coding agent read issues and merge requests before making changes
  • Summarizing failing pipelines across projects
  • Opening a merge request from an agent with a human reviewing it

Watch out

  • Do not connect it with every toolset when the agent only reads. Limit toolsets with the header and prefer read-only tasks.
  • Do not try a legacy personal access token. The server only accepts OAuth tokens with the mcp scope or fine-grained tokens.
  • Do not run high-volume automation through it on the Free plan. GitLab.com allows 60 MCP requests a minute per user there; use the REST API for bulk jobs.
  • Do not assume it is on for your group. A top-level group owner on GitLab.com, or an admin on self-managed, must allow MCP access.

Alternatives

GitHub MCP serverGitHub’s official MCP server for repositories, issues and pull requests.
Gitea MCPMCP server for self-hosted Gitea instances.
Official MCP Registry APITo look up official MCP servers for other dev tools.

FAQ

Is the GitLab MCP server free?

Yes. It is available on GitLab Free, Premium and Ultimate. On GitLab.com, Free users get 60 MCP requests a minute.

What is the GitLab MCP server URL?

https://gitlab.com/api/v4/mcp on GitLab.com, or https://<your-instance>/api/v4/mcp on self-managed and Dedicated.

Can I use a personal access token with the GitLab MCP server?

Only a fine-grained personal access token with the MCP tool resource and Execute permission. Legacy, project and group tokens are rejected.

Compare

Put GitLab MCP server side by side with other free agent tools on keys, limits, MCP support, licensing and CORS. Open the comparison grid →

SourcesFootnotes

  1. 1docs.gitlab.com/user/model_context_protocol/mcp_serverVerified 2026-10-18
  2. 2gitlab.com/api/v4/mcpTested 2026-10-18
  3. 3about.gitlab.com/termsVerified 2026-10-18
  4. 4registry.modelcontextprotocol.io/v0.1/servers?search=gitlab&version=lateVerified 2026-10-18