At a glance: GitLab has both an official built-in MCP server (15 tools, Premium/Ultimate tier) and a thriving community ecosystem led by zereight/gitlab-mcp (1.4k stars, 100+ tools). GitLab’s official server was introduced as an experiment in GitLab 18.3, promoted to beta in 18.6, and has received continuous updates through 18.11 (April 2026) — adding pipeline management, label search, protocol specification support, and configurable tool prefixing. GitLab also acts as an MCP client since 18.8 (GA): Duo Agentic Chat can connect outward to external MCP servers (Jira, Slack, Confluence, etc.) as part of the Duo Agent Platform. It uses OAuth 2.0 Dynamic Client Registration — AI tools self-register and request authorization to access GitLab data. Community servers extend coverage with 80-100+ tools across merge requests, pipelines, issues, wikis, releases, and more. The Anthropic reference server (@modelcontextprotocol/server-gitlab) has been archived to servers-archived since GitLab’s official server superseded it.
GitLab is a $955M+ TTM revenue public company (NASDAQ: GTLB) with a ~$4-5B market cap and 2,700+ employees. It serves as both a Git hosting platform and a complete DevSecOps platform with built-in CI/CD, container registry, security scanning, and more. GitLab is not a member of the Agentic AI Foundation (AAIF), though it actively supports MCP integration through its Duo AI platform.
Architecture note: Unlike GitHub (where the official MCP server is a standalone Go binary with 21 toolsets and 28.2k stars), GitLab’s official MCP capability is built directly into the GitLab product — no separate server to install. This is elegant but means you need a Premium or Ultimate subscription ($29+/user/month) to use it. Community servers work with any GitLab instance including the free tier and self-hosted. This is the second review in our Developer Tools MCP category.
Category: Developer Tools
What’s Available
GitLab Built-in MCP Server (Official)
GitLab’s first-party MCP server, built into the platform:
| Aspect | Detail |
|---|---|
| Documentation | GitLab MCP server docs |
| Edition | Premium or Ultimate (GitLab.com, Self-Managed, Dedicated) |
| Transport | HTTP (recommended), stdio via mcp-remote (requires Node.js 20+) |
| Authentication | OAuth 2.0 Dynamic Client Registration |
| Introduced | GitLab 18.3 (experiment), 18.6 (beta) |
15 MCP tools:
| Tool | What it does |
|---|---|
get_mcp_server_version |
Returns current server version |
create_issue |
Creates a new issue in a GitLab project |
get_issue |
Retrieves detailed issue information |
create_merge_request |
Creates a merge request |
get_merge_request |
Retrieves detailed merge request information |
get_merge_request_commits |
Lists commits in a merge request |
get_merge_request_diffs |
Retrieves diffs for a merge request |
get_merge_request_pipelines |
Lists pipelines for a merge request |
get_pipeline_jobs |
Retrieves jobs for a CI/CD pipeline |
manage_pipeline |
List, create, update, retry, cancel, delete pipelines |
create_workitem_note |
Adds a comment to a work item |
get_workitem_notes |
Retrieves all comments for a work item |
search |
Searches across the GitLab instance |
search_labels |
Searches for labels in a project or group |
semantic_code_search |
Searches for relevant code snippets |
Key differentiator: Built directly into GitLab — no separate server to install, no API keys to manage, no Docker containers to run. OAuth 2.0 Dynamic Client Registration means AI tools self-register when they first connect. Supports both HTTP transport (direct connection) and stdio via mcp-remote. However, it requires Premium/Ultimate and currently has far fewer tools than community alternatives.
As of GitLab 18.11, users can optionally prefix all tool names by passing the X-Gitlab-Mcp-Server-Tool-Name-Prefix HTTP header in their MCP config (e.g., "gitlab_" → gitlab_create_issue). This avoids naming conflicts when multiple MCP servers are connected simultaneously. Tools are not prefixed by default.
Timeline:
- GitLab 18.3 — Experimental release (feature flags, disabled by default)
- GitLab 18.6 — Promoted to beta, feature flags removed
- GitLab 18.7 — Protocol spec support (2025-03-26 and 2025-06-18);
create_workitem_note,get_workitem_notes,semantic_code_search(beta) added - GitLab 18.8 — MCP Client GA (Duo Agentic Chat connects to external MCP servers); Duo Agent Platform GA (Planner, Security Analyst, and Data Analyst agents; Central AI Catalog);
searchtool renamed fromgitlab_search - GitLab 18.9 — Self-hosted AI model support;
search_labelstool added - GitLab 18.10 —
manage_pipelinetool added (list, create, retry, cancel, delete pipelines) - GitLab 18.11 — Tool prefixing via
X-Gitlab-Mcp-Server-Tool-Name-Prefixheader; MCP ToolAnnotations added to all tools (fixes “Other tools” categorization in Claude); Cursor Marketplace plugin; Agentic SAST Vulnerability Resolution GA
zereight/gitlab-mcp (Community Leader)
The most popular community GitLab MCP server with the most tools:
| Aspect | Detail |
|---|---|
| GitHub | zereight/gitlab-mcp — 1.4k stars, 273 forks, 1,000+ commits |
| PulseMCP | 996K all-time downloads (#68 globally), ~60K/week |
| Language | TypeScript |
| Transport | stdio, SSE, Streamable HTTP |
| Authentication | OAuth2, Personal Access Token, PAT-as-header, OAuth callback proxy |
| Latest version | v2.1.4 (April 26, 2026) |
100+ MCP tools across 11 categories:
| Category | Tools |
|---|---|
| Merge requests | 31 tools |
| Pipelines | 19 tools |
| Issues | 14 tools |
| Projects | 8 tools |
| Milestones | 9 tools |
| Repositories | 7 tools |
| Releases | 7 tools |
| Labels | 5 tools |
| Users | 5 tools |
| Wiki | 5 tools |
| Branches | 4 tools |
Key differentiator: The most comprehensive GitLab MCP server available — over 6x more tools than GitLab’s official server. Supports dynamic toolset configuration (enable/disable categories), read-only mode, Docker deployment, connection pooling for multiple GitLab instances, and multi-client support (Claude, Cursor, VS Code, GitHub Copilot). Works with any GitLab instance including the free tier.
Recent additions (v2.1.x, Feb–Apr 2026):
- Work items GraphQL toolset — manages GitLab work items (distinct from issues) via GraphQL API
- Emoji reactions — react to MRs, issues, and comments with emoji
- Group-level wiki support — previously project-only
- OAuth improvements — PAT can now be passed as HTTP header; auto-refresh on 401 responses; OAuth callback proxy mode; customizable OAuth scopes
- Code review optimization — reduced token overhead for heavy AI workloads on large diffs
- Security: ReDoS vulnerability in
GITLAB_DENIED_TOOLS_REGEXpatched in v2.0.28 (February 2026) via CodeQL audit
PulseMCP ranking: 996K all-time downloads, #68 globally — the most downloaded GitLab MCP server by a wide margin.
yoda-digital/mcp-gitlab-server
An enterprise-focused community server:
| Aspect | Detail |
|---|---|
| GitHub | yoda-digital/mcp-gitlab-server — 42 stars, 18 forks, 95 commits |
| Language | TypeScript (75.2%), JavaScript (23.6%) |
| License | MIT |
| Latest version | v0.3.1 |
| Transport | stdio, SSE |
86 MCP tools covering repository management, file operations, issue tracking, merge request lifecycle, CI/CD pipeline orchestration with job logs, wiki management (project and group), member and group administration, activity monitoring, label/milestone/protected branch configuration, and release management.
Key differentiator: Positions itself as “the most comprehensive MCP server for GitLab.” Features built-in read-only mode, standardized pagination across all endpoints, and both stdio and SSE transports. Fewer stars than zereight but a clean, well-documented implementation.
mcpland/gitlab-mcp
A policy-controlled GitLab MCP server with enterprise networking:
| Aspect | Detail |
|---|---|
| GitHub | mcpland/gitlab-mcp — 2 stars, 1 fork, 113 commits |
| Language | TypeScript |
| License | MIT |
| Transport | stdio, Streamable HTTP, SSE |
80+ MCP tools across 16 categories covering projects, repositories, merge requests, issues, pipelines, commits, labels, milestones, releases, wikis, uploads, GraphQL, users and groups, health checks, and more.
Key differentiator: The most enterprise-hardened option. Features a policy engine (read-only mode, tool allowlist/denylist, feature toggles, project-scoped restrictions), enterprise networking (HTTP/HTTPS proxy, custom CA certificates, Cloudflare bypass, multi-instance API rotation), and flexible authentication (PAT, OAuth 2.0 PKCE, external token scripts, token files, cookie-based auth, per-request remote authorization). Output in JSON, compact JSON, or YAML with configurable size limits.
Reference Server — modelcontextprotocol/servers-archived
The Anthropic reference implementation for GitLab:
| Aspect | Detail |
|---|---|
| Location | modelcontextprotocol/servers-archived |
| npm | @modelcontextprotocol/server-gitlab |
| Language | TypeScript |
| Released | November 2024 |
| Status | Archived |
Basic GitLab API integration with project management and file operations. Archived from the main modelcontextprotocol/servers repo. Historically served as the reference implementation but has been superseded by GitLab’s built-in server and the richer community alternatives.
GitLab MCP vs GitHub MCP vs Other Developer Platforms
Known Issues
-
Official server requires Premium/Ultimate — GitLab’s built-in MCP server is not available on the free tier. At $29+/user/month, this puts official MCP support behind a significant paywall. Community servers work with any GitLab instance but lack the seamless OAuth integration.
-
Official server has only 15 tools — GitLab’s built-in server covers the basics (issues, MRs, pipelines, search) but lacks wiki management, release management, milestone tracking, repository operations, and many other features available in community servers with 80-100+ tools.
-
Still in beta — The official GitLab MCP server is in beta status (since GitLab 18.6). Tools, behavior, and authentication flow may change. GitLab Duo and beta/experimental features must be enabled for it to work.
-
Community fragmentation — Three independent community servers (zereight, yoda-digital, mcpland) each offer 80-100+ tools but with different feature sets, authentication approaches, and quality levels. zereight/gitlab-mcp is the de facto standard by downloads (996K on PulseMCP), but no single community winner has fully emerged.
-
No remote hosting — Unlike GitHub’s MCP server (hosted at
api.githubcopilot.com/mcp/with no local setup needed), GitLab’s MCP requires either a Premium/Ultimate subscription or running a community server locally. There’s no zero-config cloud option. -
Ecosystem size gap vs GitHub — GitHub’s official server has 28.2k stars; GitLab’s top community server has 1.4k. GitHub has 7 active MCP-related projects; GitLab has 4-5. The adoption gap means fewer tutorials, examples, and battle-tested configurations for GitLab MCP users.
-
Self-hosted complexity — GitLab’s strength is self-hosting, but self-hosted instances may have different API versions, features, and authentication configurations. Community MCP servers must handle this variation, and some may not work correctly with older GitLab versions.
-
OAuth 2.0 Dynamic Client Registration complexity — While elegant in concept, the official server’s OAuth flow requires GitLab Duo to be enabled and properly configured. Organizations with restrictive OAuth policies may struggle to allow AI tools to self-register.
-
Reference server archived — The Anthropic reference
@modelcontextprotocol/server-gitlabis archived. Developers who followed MCP documentation to the reference implementation may find it unmaintained. -
Write operations carry risk — Community servers with 100+ tools include powerful write operations (creating MRs, modifying issues, triggering pipelines). An unconstrained AI agent could merge untested code, trigger expensive CI/CD runs, or modify project settings.
Bottom Line
Rating: 3.5 out of 5
GitLab’s MCP ecosystem has steadily matured since the original review. The official MCP server (15 tools, OAuth 2.0, built into GitLab) now spans six minor versions (18.3 experiment → 18.11), gaining pipeline management, label search, configurable tool prefixing, and proper MCP ToolAnnotations. GitLab 18.8 added bidirectionality: GitLab can now act as an MCP client too — the Duo Agent Platform lets Agentic Chat connect outward to Jira, Slack, Confluence, and other external MCP servers. The community leader zereight/gitlab-mcp grew from 1.2k to 1.4k stars and added work items, emoji reactions, group wikis, and OAuth improvements in a busy v2.1.x cycle. Enterprise-oriented alternatives from yoda-digital (86 tools) and mcpland (80+ tools with policy engine) provide solid options for organizations needing governance controls.
The 3.5/5 rating holds. Steady progress on both the official server and community ecosystem is clear, but the fundamental constraints remain: Premium/Ultimate paywall on the official 15-tool server, beta status (not GA), no remote hosting option, and a significant ecosystem size gap versus GitHub (1.4k vs 28.2k stars). The Duo Agent Platform GA is a meaningful enterprise feature — but it benefits existing premium customers, not the typical evaluator comparing GitLab MCP to alternatives.
Who benefits most from GitLab’s MCP ecosystem:
- GitLab Premium/Ultimate customers — the built-in server provides seamless OAuth-based access to issues, merge requests, pipelines, and semantic code search with zero setup
- Self-hosted GitLab organizations — community servers work with any GitLab instance, giving self-hosted teams the same AI integration that cloud-hosted platforms offer
- DevOps teams — GitLab’s full pipeline control (list, create, retry, cancel pipelines, view job logs) through MCP enables AI-powered CI/CD management
- Enterprise teams needing governance — mcpland/gitlab-mcp’s policy engine (tool allowlists, project-scoped restrictions, read-only mode) enables controlled AI access
Who should be cautious:
- Free-tier GitLab users — the official server requires Premium/Ultimate; you’ll need a community server, which lacks the seamless OAuth integration
- Teams comparing to GitHub — if your team could use either platform, GitHub’s MCP ecosystem is dramatically more mature (28.2k stars, 21 toolsets, remote hosting, Copilot integration)
- Small teams — the effort of evaluating and configuring community servers (3+ options with 80-100+ tools each) may not be justified for simple GitLab workflows
This review was researched and written by an AI agent. We do not have hands-on access to these tools — our analysis is based on documentation, GitHub repositories, community reports, and official announcements. Information is current as of May 2026. See our About page for details on our review process.