GitLab

GitLab

This connector works with GitLab through the REST API v4 (<your GitLab address>/api/v4): projects and members, issues with comments, merge requests with diffs, commits and comments, CI/CD pipelines, jobs and job logs, branches, commits, repository files and search. It runs against GitLab.com or a self-managed or Dedicated instance, as the user who owns the token: the AI sees and changes exactly what that user can.

Setup (about 3 minutes)

1. In GitLab click your avatar → Edit profile → Access → Personal access tokens (on GitLab.com: https://gitlab.com/-/user_settings/personal_access_tokens) → Generate token.
2. Name it (for example "AnythingMCP"), set an expiry date (at most 365 days on GitLab.com) and tick the scope api. For a read-only setup tick read_api instead.
3. Copy the token (it starts with glpat-) right away and paste it into GITLAB_TOKEN; GitLab shows it only once.
4. Set GITLAB_URL to https://gitlab.com for GitLab.com, or to your instance's address (for example https://gitlab.example.com), without /api/v4 and without a trailing slash.

Other token types: a fine-grained personal access token (GitLab 19.2 and later) works the same way; give it read and write permission on issues, merge requests, repository, pipelines and jobs for the projects involved. Some GitLab.com groups enforce fine-grained tokens: a legacy token then fails on their projects with "Access denied: This operation requires a fine-grained personal access token". Project and group access tokens also work, but on GitLab.com they need Premium or Ultimate.

Read-only setup: use a token with read_api and switch off gitlab_create_issue, gitlab_update_issue, gitlab_add_issue_note, gitlab_create_merge_request, gitlab_update_merge_request, gitlab_add_merge_request_note and gitlab_create_branch. gitlab_delete_issue and gitlab_delete_branch are installed switched off. Nothing here merges a merge request, pushes commits or runs pipelines.

Projects and numbers: project_id takes the numeric id or the full path such as my-group/my-project (the path is URL-encoded for you; a file path or branch name with slashes too). Issues and merge requests are addressed by their iid, the number shown in the UI (#42, !17), not their global id. gitlab_list_project_members gives user ids for assignee_ids and reviewer_ids. Quick actions such as /label or /close in a comment body are executed by GitLab.

Reading code: gitlab_list_repository_tree lists folders, gitlab_get_file_content returns a file as text (cut at 200 KB), gitlab_get_file_info gives size and last commit without the content. gitlab_search_project with scope blobs searches code inside one project on every tier; instance-wide code search (gitlab_search with blobs, commits, notes or wiki_blobs) needs advanced search, a Premium feature.

Reviewing merge requests: gitlab_get_merge_request (check detailed_merge_status and has_conflicts), then gitlab_get_merge_request_diffs page by page, gitlab_list_merge_request_commits and gitlab_list_merge_request_notes. A file whose diff is too large comes back with too_large or collapsed and no diff text.

Pipelines: gitlab_list_pipelines → gitlab_list_pipeline_jobs with scope ["failed"] → gitlab_get_job_log. Job logs are cut at 200 KB from the start; open the job's web_url for longer ones.

Pagination: list tools take page (from 1) and per_page (up to 100). The response carries _headers with x-next-page (empty on the last page) and, for collections under 10,000 records, x-total. The commit list never reports a total.

Lists across projects: gitlab_list_my_issues and gitlab_list_my_merge_requests default to the token user's own items; set scope to all for everything they can see (with a filter, on GitLab.com that list is huge).

Rate limits: GitLab.com allows about 2,000 API requests per minute per user, 200 new issues and 60 new comments per minute, and 100 searches per minute. Self-managed limits are set by the administrator. Over a limit GitLab answers 429 with Retry-After.

Errors: 401 means the token is wrong, expired or revoked, or GITLAB_URL points at another instance. 403 means a missing scope (for example a read_api token on a write) or a role too low for the action. 404 means the project, issue or file does not exist or the user cannot see it: GitLab hides private resources behind 404. 400 names the missing or invalid field; 409 on a new merge request means one is already open for those branches. A renamed project still answers reads at its old path, but writes there fail with 405: use the new path or the numeric id.

Out of scope here: merging, approving, pushing commits or editing files, running, retrying or cancelling pipelines, CI/CD variables, releases, wikis, packages and container registry, and administration.