GitLab MCP integration for AI agents.
Connect AI agents to GitLab through 15 structured actions, including get current user, create merge request, and delete project. Review authentication, input…
- ACTION CONTRACTS
- 15
- AUTHENTICATION
- OAuth 2.0 + API key
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the GitLab integration exposes
The GitLab Agent App exposes 15 provider-backed actions for developer tools work. Its current contract lets an authorized agent get the current authenticated gitlab user profile, create a gitlab merge request from a source branch into a target branch, and mark a gitlab project for deletion. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses OAuth 2.0 and API key. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected GitLab account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real GitLab capabilities.
Showing 12 of 15 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
get_current_userREADGet the current authenticated GitLab user profile.
create_merge_requestWRITECreate a GitLab merge request from a source branch into a target branch.
INPUTS: projectId / sourceBranch / targetBranch / title / description
delete_projectHIGH IMPACTMark a GitLab project for deletion.
INPUTS: projectId
create_projectWRITECreate a new GitLab project owned by the authenticated user.
INPUTS: name / path / namespaceId / description / visibility
create_project_issueWRITECreate a new issue in a GitLab project.
INPUTS: projectId / title / description / labels / assigneeIds
delete_project_issueHIGH IMPACTDelete a GitLab project issue.
INPUTS: projectId / issueIid
get_projectREADGet a GitLab project by numeric ID or URL-encoded path with namespace.
INPUTS: projectId
get_project_issueREADGet a single issue from a GitLab project by its internal issue ID.
INPUTS: projectId / issueIid
list_project_issuesREADList issues for a GitLab project with common state, label, assignee, and search filters.
INPUTS: projectId / state / labels / assigneeId / search
list_project_merge_requestsREADList merge requests for a GitLab project with state, branch, search, and pagination filters.
INPUTS: projectId / state / search / sourceBranch / targetBranch
list_projectsREADList GitLab projects visible to the authenticated personal access token, with optional search and membership filters.
INPUTS: search / membership / owned / simple / orderBy
merge_merge_requestWRITEAccept and merge a GitLab merge request, optionally waiting for pipelines or squashing commits.
INPUTS: projectId / mergeRequestIid / autoMerge / sha / shouldRemoveSourceBranch
INPUT CONTRACTS
Know what the action needs before it runs.
create_merge_request
projectIdREQUIRED- The GitLab project ID or URL-encoded path with namespace, such as 123 or group%2Fproject.
sourceBranchREQUIRED- The source branch name.
targetBranchREQUIRED- The target branch name.
titleREQUIRED- The merge request title.
descriptionOPTIONAL- The merge request description.
delete_project
projectIdREQUIRED- The GitLab project ID or URL-encoded path with namespace, such as 123 or group%2Fproject.
create_project
nameREQUIRED- The project name.
pathOPTIONAL- The repository path.
namespaceIdOPTIONAL- The namespace ID for the project.
descriptionOPTIONAL- The project description.
visibilityOPTIONAL- The project visibility.
create_project_issue
projectIdREQUIRED- The GitLab project ID or URL-encoded path with namespace, such as 123 or group%2Fproject.
titleREQUIRED- The issue title.
descriptionOPTIONAL- The issue description.
labelsOPTIONAL- Comma-separated label names to attach to the issue.
assigneeIdsOPTIONAL- User IDs to assign to the issue.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect Get Current User
Get the current authenticated GitLab user profile. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
get_current_userControl Create Merge Request
Create a GitLab merge request from a source branch into a target branch. Resolve the target first, present material changes for confirmation, and make retries idempotent where the provider supports it.
create_merge_requestVerify with Get Project
Get a GitLab project by numeric ID or URL-encoded path with namespace. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
get_projectSAFETY BOUNDARY
Operate GitLab with explicit limits
- Authorize GitLab with OAuth 2.0 and API key and grant only the provider access required by the selected actions.
- 9 actions are change-capable by name. Confirm the target identity and material parameters before allowing a write.
- Treat `delete_project` and `delete_project_issue` as high-impact operations and require an explicit approval boundary.
- The sampled contract declares provider scopes including `api` and `read_api`; verify the complete action contract before execution.
- After a call, inspect the structured result and execution record before reporting that the GitLab task completed successfully.
CONNECTION MODEL
OAuth 2.0 + API key
GitLab personal access token sent with the Authorization Bearer header. Create one in GitLab user preferences under Access tokens.
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 6
- WRITE SIGNALS
- 7
- HIGH IMPACT
- 2
- REVIEW SIGNALS
- 0
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by GitLab.