// SCAN REPORT

GitLab MCP

43 tools. 19 can modify or destroy data without limits.

3 destructive tools with no built-in limits. Policy required.

Last updated: 2 Jul 2026

19 can modify or destroy data

24 read-only

43 tools total

Community server · catalogue entry verified 02/07/2026

How to control GitLab MCP ↓

TOOL MAP

What GitLab MCP exposes to your agents

Read (24) Write / Execute (16) Destructive / Financial (3)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous GitLab MCP tools

Destructive · High cancel_pipeline Cancelling a pipeline is not easily reversible: jobs that were running are killed, deployment steps are aborted, and any side effects already applied by those jobs cannot be undone. Destructive · High delete_branch Deleting a branch is an irreversible operation that permanently removes version control history and work associated with that branch. Destructive · High delete_file This tool permanently removes a file from a GitLab repository via a commit. Execute · High create_pipeline Triggering a CI/CD pipeline causes external code execution on CI runners.

19 of GitLab MCP's 43 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control GitLab MCP

PolicyLayer is an MCP gateway — it sits between your AI agents and GitLab MCP, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "cancel_pipeline": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "approve_merge_request": {
    "limits": [
      {
        "counter": "approve_merge_request_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "get_commit_diff": {
    "limits": [
      {
        "counter": "get_commit_diff_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register GitLab MCP — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON GITLAB →

Instant setup, no code required.

FULL CATALOGUE

All 43 GitLab MCP tools

DESTRUCTIVE 3 tools

Destructive cancel_pipeline Cancel a running pipeline. Destructive delete_branch Delete a branch. Destructive delete_file Delete a file in a single commit.

EXECUTE 3 tools

Execute create_pipeline Trigger a new pipeline on ref. variables is a name->value map. Execute gitlab_api gitlab_api Execute retry_pipeline Retry the failed/canceled jobs of a pipeline.

WRITE 13 tools

Write approve_merge_request Approve a merge request (requires the GitLab approvals feature). Write comment_issue Add a comment (note) to an issue. Write comment_merge_request Add a comment (note) to a merge request. Write create_branch Create branch from ref (an existing branch name, tag, or commit SHA). Write create_commit Commit multiple file changes atomically. Write create_issue Create an issue in a project. labels is comma-separated. Write create_merge_request Open a merge request from source_branch into target_branch. Write create_or_update_file Create (or, with update=True, overwrite) a single file in one commit. Write create_project Create a new project. namespace_id targets a group; omit for the user's namespace. Write create_tag Create a tag at ref. Write merge_merge_request Accept (merge) a merge request. Write update_issue Update an issue. Use state_event = "close" or "reopen" to change state. Write update_merge_request Update a merge request. state_event = "close" or "reopen".

READ 24 tools

Read get_commit_diff Get the per-file diff of a single commit. Read get_current_user Return the user that owns the configured personal access token. Read get_file Read a file's decoded text content at ref (branch, tag, or SHA). Read get_issue Get one issue by its project-scoped IID. Read get_job_log Get the trace (console log) of a job. Read get_merge_request Get full details for one merge request by its project-scoped IID. Read get_merge_request_diffs Get the per-file diffs (changes) of a merge request. Read get_pipeline Get details for one pipeline. Read get_project Get full details for one project by numeric ID or "namespace/path". Read list_branches List repository branches. Read list_commits List commits. since/until are ISO 8601 timestamps. Read list_group_projects List projects belonging to a group (by numeric ID or full path). Read list_groups List groups visible to the authenticated user. Read list_issue_notes List comments (notes) on an issue, oldest first. Read list_issues list_issues Read list_merge_request_notes List comments (notes) on a merge request, oldest first. Read list_merge_requests List merge requests. Omit project_id to search across all projects. Read list_pipeline_jobs List the jobs of a pipeline. Read list_pipelines List pipelines. status e.g. "running", "success", "failed", "canceled". Read list_projects list_projects Read list_repository_tree List files and directories in the repository tree. Read search search Read search_users Search users by name, username, or email.

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about GitLab MCP

Can an AI agent delete data through the GitLab MCP server? +

Yes. The GitLab MCP server exposes 3 destructive tools including cancel_pipeline, delete_branch, delete_file. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through GitLab MCP? +

The GitLab MCP server has 13 write tools including approve_merge_request, comment_issue, comment_merge_request. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach GitLab MCP.

How many tools does the GitLab MCP server expose? +

43 tools across 3 categories: Destructive, Read, Write. 24 are read-only. 19 can modify, create, or delete data.

How do I enforce a policy on GitLab MCP? +

Register the GitLab MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every GitLab MCP tool call.

Deterministic rules across all 43 GitLab MCP tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON GITLAB →

Instant setup, no code required.

43 GitLab MCP tools catalogued and risk-classified — across an index of 43,000+ MCP servers.