create_merge_request_note

What create_merge_request_note does on Gitlab Mcp

AI agents use create_merge_request_note to create or update resources in Gitlab Mcp, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Gitlab Mcp environment.

Why create_merge_request_note is rated Medium

Creating a note on a merge request is a write operation that adds data to a GitLab project. While reversible (unlike destructive operations), it modifies project state and could be misused to add misleading comments, spam, or sensitive information to merge requests. The severity is medium because the blast radius is limited to comment creation without direct impact on code, data deletion, or financial operations.

From the tool's definition Tool description explicitly states 'Add a new note to a merge request', which creates new content in the GitLab system. This is a reversible create operation (notes can be edited or deleted).

The rule that runs create_merge_request_note safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Gitlab Mcp, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For create_merge_request_note, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "create_merge_request_note": {
      "limits": [
        {
          "counter": "create_merge_request_note_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about create_merge_request_note