Diátaxis type: Reference Domain: Access & Authentication Individual tools: 62 Meta-tool:
gitlab_access(GITLAB_MCP_TOOL_SURFACE=metacatalog) Dynamic IDs:access.*,group.*,job.*,project.*(default surface, viagitlab_execute_action) GitLab API: Access Tokens API, Deploy Tokens API, Deploy Keys API, Members API Audience: 👤 End users, AI assistant users
The access & authentication domain covers project/group/personal access tokens, deploy tokens, deploy keys, access requests, invitations, CI/CD job token scope management, and project/group member management.
On the default dynamic surface, these operations are the access.*, group.*, job.*, project.* entries of the canonical action catalog: find them with gitlab_find_action and run them with gitlab_execute_action by domain.action ID. With GITLAB_MCP_TOOL_SURFACE=individual, each is the tool named in the tables below.
With GITLAB_MCP_TOOL_SURFACE=meta, all 62 individual tools below are consolidated into the gitlab_access meta-tool. It dispatches access token, deploy token, deploy key, access request, and invitation workflows through action prefixes such as token_*, deploy_token_*, deploy_key_*, request_*, approve_*, deny_*, and invite_*.
GitLab assigns numeric access levels to members. The full set recognized by this server is:
| Value | Label | Notes |
|---|---|---|
| 0 | No access | Implicit only |
| 5 | Minimal access | Guests with limited permissions |
| 10 | Guest | Basic read-only access |
| 15 | Planner | Premium/Ultimate: guest + planning board management |
| 20 | Reporter | Read + create issues, MRs, and run CI |
| 25 | Security Manager | Premium/Ultimate: configure security features and review reports |
| 30 | Developer | Push, merge, and run CI |
| 40 | Maintainer | Project administration without destructive actions |
| 50 | Owner | Full project or group administration |
| 60 | Admin | Instance-level administrator (group admin role) |
"List access tokens for project 42" "Create a deploy token for my project" "Show deploy keys for project 42"
| Annotation | ReadOnly | Destructive | Idempotent | Description |
|---|---|---|---|---|
| Read | Yes | No | Yes | Safe read-only operation |
| Create | — | No | — | Creates a new resource |
| Update | — | No | Yes | Modifies an existing resource |
| Delete | — | Yes | Yes | Destroys a resource; protected by confirmation |
Tools marked Delete require user confirmation before execution.
List all access tokens for a GitLab project. Filter by state (active, inactive).
| Annotation | Read |
|---|
Get a specific project access token by its ID.
| Annotation | Read |
|---|
Create a new project access token with specified name, scopes, access level, and optional expiry date.
| Annotation | Create |
|---|
Rotate a project access token, generating a new token value. Optionally set a new expiry date.
| Annotation | Update |
|---|
Revoke a project access token. This action cannot be undone.
| Annotation | Delete |
|---|
Destructive: Protected by confirmation prompt.
Rotate the project access token used for the current request. Returns the new token value.
| Annotation | Update |
|---|
List all access tokens for a GitLab group. Filter by state (active, inactive).
| Annotation | Read |
|---|
Get a specific group access token by its ID.
| Annotation | Read |
|---|
Create a new group access token with specified name, scopes, access level, and optional expiry date.
| Annotation | Create |
|---|
Rotate a group access token, generating a new token value. Optionally set a new expiry date.
| Annotation | Update |
|---|
Revoke a group access token. This action cannot be undone.
| Annotation | Delete |
|---|
Destructive: Protected by confirmation prompt.
Rotate the group access token used for the current request. Returns the new token value.
| Annotation | Update |
|---|
List personal access tokens. Filter by state, search by name, or filter by user ID (admin only).
| Annotation | Read |
|---|
Get a personal access token by ID. Use token_id=0 to retrieve the current token used for authentication.
| Annotation | Read |
|---|
Rotate a personal access token, generating a new token value. Optionally set a new expiry date.
| Annotation | Update |
|---|
Revoke a personal access token by ID. This action cannot be undone.
| Annotation | Delete |
|---|
Destructive: Protected by confirmation prompt.
Rotate the personal access token used for the current request. Returns the new token value.
| Annotation | Update |
|---|
Revoke the personal access token used for the current request. This action cannot be undone.
| Annotation | Delete |
|---|
Destructive: Protected by confirmation prompt.
List all instance-level deploy tokens. Requires admin access.
| Annotation | Read |
|---|
List all deploy tokens for a GitLab project.
| Annotation | Read |
|---|
List all deploy tokens for a GitLab group.
| Annotation | Read |
|---|
Get a specific deploy token for a project.
| Annotation | Read |
|---|
Get a specific deploy token for a group.
| Annotation | Read |
|---|
Create a deploy token for a project with name, scopes, optional username and expiry date.
| Annotation | Create |
|---|
Create a deploy token for a group with name, scopes, optional username and expiry date.
| Annotation | Create |
|---|
Delete a deploy token from a project. This action cannot be undone.
| Annotation | Delete |
|---|
Destructive: Protected by confirmation prompt.
Delete a deploy token from a group. This action cannot be undone.
| Annotation | Delete |
|---|
Destructive: Protected by confirmation prompt.
List all deploy keys for a GitLab project.
| Annotation | Read |
|---|
Get a specific deploy key for a project by its ID.
| Annotation | Read |
|---|
Add a deploy key to a GitLab project with title, public SSH key, and optional push access and expiry date.
| Annotation | Create |
|---|
Update an existing deploy key's title or push access permission.
| Annotation | Update |
|---|
Remove a deploy key from a GitLab project.
| Annotation | Delete |
|---|
Destructive: Protected by confirmation prompt.
Enable an existing deploy key for a project (e.g., a key shared from another project).
| Annotation | Update |
|---|
List all instance-level deploy keys. Requires admin access. Filter by public keys.
| Annotation | Read |
|---|
Create an instance-level deploy key with title, public SSH key, and optional expiry date. Requires admin access.
| Annotation | Create |
|---|
List all deploy keys across projects for a specific user.
| Annotation | Read |
|---|
List access requests for a GitLab project.
| Annotation | Read |
|---|
List access requests for a GitLab group.
| Annotation | Read |
|---|
Request access to a GitLab project for the authenticated user.
| Annotation | Create |
|---|
Request access to a GitLab group for the authenticated user.
| Annotation | Create |
|---|
Approve a project access request. Optionally set the access level (10=Guest, 20=Reporter, 30=Developer, 40=Maintainer).
| Annotation | Update |
|---|
Approve a group access request. Optionally set the access level (10=Guest, 20=Reporter, 30=Developer, 40=Maintainer).
| Annotation | Update |
|---|
Deny a project access request. This action cannot be undone.
| Annotation | Delete |
|---|
Destructive: Protected by confirmation prompt.
Deny a group access request. This action cannot be undone.
| Annotation | Delete |
|---|
Destructive: Protected by confirmation prompt.
List all pending invitations for a project. Supports filtering by query and pagination.
| Annotation | Read |
|---|
List all pending invitations for a group. Supports filtering by query and pagination.
| Annotation | Read |
|---|
Invite a user to a project by email or user ID. Requires access_level (10=Guest, 20=Reporter, 30=Developer, 40=Maintainer, 50=Owner). Optional expires_at (YYYY-MM-DD), invite_source, and member_role_id (Ultimate). Answers with status, a per-invitee message map when any invitation failed, and queued_users when the instance queues promotions for administrator approval, a setting that exists on Ultimate GitLab Self-Managed and GitLab Dedicated only.
| Annotation | Create |
|---|
Invite a user to a group by email or user ID. Requires access_level (10=Guest, 20=Reporter, 30=Developer, 40=Maintainer, 50=Owner). Optional expires_at (YYYY-MM-DD), invite_source, and member_role_id (Ultimate). Answers with status, a per-invitee message map when any invitation failed, and queued_users when the instance queues promotions for administrator approval, a setting that exists on Ultimate GitLab Self-Managed and GitLab Dedicated only.
| Annotation | Create |
|---|
Get the CI/CD job token access settings for a GitLab project.
| Annotation | Read |
|---|
Update the CI/CD job token access settings for a GitLab project.
| Annotation | Update |
|---|
List projects on the CI/CD job token inbound allowlist for a GitLab project.
| Annotation | Read |
|---|
Add a project to the CI/CD job token inbound allowlist.
| Annotation | Create |
|---|
Remove a project from the CI/CD job token inbound allowlist.
| Annotation | Delete |
|---|
Destructive: Protected by confirmation prompt.
List groups on the CI/CD job token allowlist for a GitLab project.
| Annotation | Read |
|---|
Add a group to the CI/CD job token allowlist.
| Annotation | Create |
|---|
Remove a group from the CI/CD job token allowlist.
| Annotation | Delete |
|---|
Destructive: Protected by confirmation prompt.
Direct and inherited project membership tools. The read-only tools (gitlab_project_members_list/_get/_get_inherited) are documented in docs/tools/projects.md.
Add a user as a member of a project. Requires user_id (or username) and access_level (10=Guest, 20=Reporter, 30=Developer, 40=Maintainer, 50=Owner). Optionally set expires_at (YYYY-MM-DD) and member_role_id.
| Annotation | Create |
|---|
Edit a project member's access level or expiration. Requires access_level (10=Guest, 20=Reporter, 30=Developer, 40=Maintainer, 50=Owner).
| Annotation | Update |
|---|
Remove a member from a project.
| Annotation | Delete |
|---|
Destructive: Protected by confirmation prompt.
Group membership mutating tools. The read-only tools (gitlab_group_members_list/_get/_get_inherited) and gitlab_group_member_remove are documented in docs/tools/groups.md.
List groups invited to a GitLab group. Filter by relation (direct, inherited), min_access_level (10–50), order_by (name, path, id) and search. Supports keyset (pagination=keyset, page_token) or offset pagination (per_page 1–100).
| Annotation | Read |
|---|
Add a user as a direct member of a group. Requires access_level (5=Minimal access, 10=Guest, 15=Planner (Premium/Ultimate), 20=Reporter, 25=Security Manager (Premium/Ultimate), 30=Developer, 40=Maintainer, 50=Owner). Optionally set expires_at (YYYY-MM-DD) and member_role_id (Premium/Ultimate).
| Annotation | Create |
|---|
Edit a direct group member's access level, expiry, or custom member role. Requires access_level. Optionally set expires_at (YYYY-MM-DD) and member_role_id (Premium/Ultimate).
| Annotation | Update |
|---|
| # | Tool Name | Category | Annotation |
|---|---|---|---|
| 1 | gitlab_project_access_token_list |
Project Access Tokens | Read |
| 2 | gitlab_project_access_token_get |
Project Access Tokens | Read |
| 3 | gitlab_project_access_token_create |
Project Access Tokens | Create |
| 4 | gitlab_project_access_token_rotate |
Project Access Tokens | Update |
| 5 | gitlab_project_access_token_revoke |
Project Access Tokens | Delete |
| 6 | gitlab_project_access_token_rotate_self |
Project Access Tokens | Update |
| 7 | gitlab_group_access_token_list |
Group Access Tokens | Read |
| 8 | gitlab_group_access_token_get |
Group Access Tokens | Read |
| 9 | gitlab_group_access_token_create |
Group Access Tokens | Create |
| 10 | gitlab_group_access_token_rotate |
Group Access Tokens | Update |
| 11 | gitlab_group_access_token_revoke |
Group Access Tokens | Delete |
| 12 | gitlab_group_access_token_rotate_self |
Group Access Tokens | Update |
| 13 | gitlab_personal_access_token_list |
Personal Access Tokens | Read |
| 14 | gitlab_personal_access_token_get |
Personal Access Tokens | Read |
| 15 | gitlab_personal_access_token_rotate |
Personal Access Tokens | Update |
| 16 | gitlab_personal_access_token_revoke |
Personal Access Tokens | Delete |
| 17 | gitlab_personal_access_token_rotate_self |
Personal Access Tokens | Update |
| 18 | gitlab_personal_access_token_revoke_self |
Personal Access Tokens | Delete |
| 19 | gitlab_deploy_token_list_all |
Deploy Tokens | Read |
| 20 | gitlab_deploy_token_list_project |
Deploy Tokens | Read |
| 21 | gitlab_deploy_token_list_group |
Deploy Tokens | Read |
| 22 | gitlab_deploy_token_get_project |
Deploy Tokens | Read |
| 23 | gitlab_deploy_token_get_group |
Deploy Tokens | Read |
| 24 | gitlab_deploy_token_create_project |
Deploy Tokens | Create |
| 25 | gitlab_deploy_token_create_group |
Deploy Tokens | Create |
| 26 | gitlab_deploy_token_delete_project |
Deploy Tokens | Delete |
| 27 | gitlab_deploy_token_delete_group |
Deploy Tokens | Delete |
| 28 | gitlab_deploy_key_list_project |
Deploy Keys | Read |
| 29 | gitlab_deploy_key_get |
Deploy Keys | Read |
| 30 | gitlab_deploy_key_add |
Deploy Keys | Create |
| 31 | gitlab_deploy_key_update |
Deploy Keys | Update |
| 32 | gitlab_deploy_key_delete |
Deploy Keys | Delete |
| 33 | gitlab_deploy_key_enable |
Deploy Keys | Update |
| 34 | gitlab_deploy_key_list_all |
Deploy Keys | Read |
| 35 | gitlab_deploy_key_add_instance |
Deploy Keys | Create |
| 36 | gitlab_deploy_key_list_user_project |
Deploy Keys | Read |
| 37 | gitlab_access_request_list_project |
Access Requests | Read |
| 38 | gitlab_access_request_list_group |
Access Requests | Read |
| 39 | gitlab_access_request_request_project |
Access Requests | Create |
| 40 | gitlab_access_request_request_group |
Access Requests | Create |
| 41 | gitlab_access_request_approve_project |
Access Requests | Update |
| 42 | gitlab_access_request_approve_group |
Access Requests | Update |
| 43 | gitlab_access_request_deny_project |
Access Requests | Delete |
| 44 | gitlab_access_request_deny_group |
Access Requests | Delete |
| 45 | gitlab_project_invite_list_pending |
Invitations | Read |
| 46 | gitlab_group_invite_list_pending |
Invitations | Read |
| 47 | gitlab_project_invite |
Invitations | Create |
| 48 | gitlab_group_invite |
Invitations | Create |
| 49 | gitlab_get_job_token_access_settings |
Job Token Scope | Read |
| 50 | gitlab_patch_job_token_access_settings |
Job Token Scope | Update |
| 51 | gitlab_list_job_token_inbound_allowlist |
Job Token Scope | Read |
| 52 | gitlab_add_project_job_token_allowlist |
Job Token Scope | Create |
| 53 | gitlab_remove_project_job_token_allowlist |
Job Token Scope | Delete |
| 54 | gitlab_list_job_token_group_allowlist |
Job Token Scope | Read |
| 55 | gitlab_add_group_job_token_allowlist |
Job Token Scope | Create |
| 56 | gitlab_remove_group_job_token_allowlist |
Job Token Scope | Delete |
| 57 | gitlab_project_member_add |
Project Members | Create |
| 58 | gitlab_project_member_edit |
Project Members | Update |
| 59 | gitlab_project_member_delete |
Project Members | Delete |
| 60 | gitlab_group_invited_list |
Group Members | Read |
| 61 | gitlab_group_member_add |
Group Members | Create |
| 62 | gitlab_group_member_edit |
Group Members | Update |
The following tools are annotated with DestructiveHint: true and require user confirmation before execution:
gitlab_project_access_token_revoke— revokes a project access tokengitlab_group_access_token_revoke— revokes a group access tokengitlab_personal_access_token_revoke— revokes a personal access tokengitlab_personal_access_token_revoke_self— revokes the current personal access tokengitlab_deploy_token_delete_project— deletes a project deploy tokengitlab_deploy_token_delete_group— deletes a group deploy tokengitlab_deploy_key_delete— removes a deploy key from a projectgitlab_access_request_deny_project— denies a project access requestgitlab_access_request_deny_group— denies a group access requestgitlab_remove_project_job_token_allowlist— removes a project from job token allowlistgitlab_remove_group_job_token_allowlist— removes a group from job token allowlistgitlab_project_member_delete— removes a member from a project