// SCAN REPORT

GitLab Merge Request Integration

10 tools. 4 can modify or destroy data without limits.

4 write tools that can modify data. Rate limits recommended.

Last updated: 30 Apr 2026

4 can modify or destroy data

6 read-only

10 tools total

// TOOL MAP

Read (6) Write / Execute (4) Destructive / Financial (0)

// WHAT CAN GO WRONG

Write operations (add_merge_request_comment, add_merge_request_diff_comment, set_merge_request_description) modify state. Without rate limits, an agent can make hundreds of changes in seconds — faster than any human can review or revert.

// RECOMMENDED RULES

Rate limit write operations

add_merge_request_comment:
  rules:
    - rate_limit: 30/hour

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

get_issue_details:
  rules:
    - rate_limit: 60/minute

Controls API costs and prevents retry loops from exhausting upstream rate limits.

// ALL 10 GITLAB MERGE REQUEST INTEGRATION TOOLS

WRITE 4 tools

Write add_merge_request_comment Write add_merge_request_diff_comment Write set_merge_request_description Write set_merge_request_title

READ 6 tools

Read get_issue_details Read get_merge_request_comments Read get_merge_request_details Read get_merge_request_diff Read get_projects Read list_open_merge_requests

// FAQ

How do I prevent bulk modifications through GitLab Merge Request Integration? +

The GitLab Merge Request Integration server has 4 write tools including add_merge_request_comment, add_merge_request_diff_comment, set_merge_request_description. Set rate limits in your policy file -- for example, rate_limit: 10/hour prevents an agent from making more than 10 modifications per hour. Intercept enforces this at the transport layer.

How many tools does the GitLab Merge Request Integration MCP server expose? +

10 tools across 2 categories: Read, Write. 6 are read-only. 4 can modify, create, or delete data.

How do I add Intercept to my GitLab Merge Request Integration setup? +

One line change. Instead of running the GitLab Merge Request Integration server directly, prefix it with Intercept: intercept -c kopfrechner-gitlab-mr-mcp.yaml -- npx -y @kopfrechner/gitlab-mr-mcp. Download a pre-built policy from policylayer.com/policies/kopfrechner-gitlab-mr-mcp and adjust the limits to match your use case.

GitLab Merge Request Integration

Let agents act without letting them run wild.