Diátaxis type: Reference Domain: Packages, Container Registry & Package Protection Rules Individual tools: 33 Meta-tool:
gitlab_package(GITLAB_MCP_TOOL_SURFACE=metacatalog) Dynamic IDs:dependency.*,package.*(default surface, viagitlab_execute_action) GitLab API: Packages API, Container Registry API, Package Protection Rules API Audience: 👤 End users, AI assistant users
The packages domain covers the GitLab Generic Package Registry (publish, download, list, delete packages and files) and the Container Registry (repositories, tags, protection rules). It also includes composite operations like publish-and-link (publish a file and create a release asset link in one step) and publish-directory (batch-publish files from a local directory).
On the default dynamic surface, these operations are the dependency.*, package.* entries of the canonical action catalog: find them with gitlab_find_action and run them with gitlab_execute_action by domain.action ID. With GITLAB_MCP_TOOL_SURFACE=individual, each is the tool named in the tables below.
With GITLAB_MCP_TOOL_SURFACE=meta, the package-domain tools below are consolidated into the gitlab_package meta-tool. It includes generic package actions (publish, download, list, group_list, file_list, delete actions), container registry actions with registry_* prefixes, container registry protection actions with registry_rule_* prefixes, and package protection actions with protection_rule_* prefixes. Enterprise/Premium dependency tools remain gated by GITLAB_MCP_TIER (Premium or Ultimate).
"List packages in project 42" "Upload a release binary to the package registry" "Show container registry images"
| Annotation | ReadOnly | Destructive | Idempotent | Description |
|---|---|---|---|---|
| Read | Yes | No | Yes | Safe read-only operation |
| Create | — | No | — | Creates a new resource |
| Update | — | No | Yes | Modifies an existing resource |
| Delete | — | Yes | Yes | Destroys a resource; protected by confirmation |
Tools marked Delete require user confirmation before execution.
Local paths are confined to allow-listed roots. Every
file_pathanddirectory_pathbelow must resolve, after symlinks, under the working directory, the OS temporary directory, or a directory named inGITLAB_MCP_ALLOWED_UPLOAD_DIRS(path-list separated::on Unix,;on Windows). Destinations written by a download follow the same rule underGITLAB_MCP_ALLOWED_DOWNLOAD_DIRS. A server reached over HTTP refuses every local path outright, whatever those variables say: the caller has no files on the machine the server runs on, socontent_base64is the remote form.
Publish (upload) a file to the GitLab Generic Package Registry. Provide either file_path (absolute local path) or content_base64 (base64-encoded content), not both. The file_name may include / to describe a directory structure inside the package; segments between separators must not be empty, ., or ... Returns the package file ID, size, SHA256, and download URL.
| Annotation | Create |
|---|
Download a file from the GitLab Generic Package Registry and save it to a local path. Returns the output path, file size, and SHA256 checksum.
The read is of the registry, but the write is to this machine's disk, so the action is classified as mutating rather than read-only: --read-only removes it, --safe-mode previews it, a read_api token is not served it, and a client that auto-approves readOnlyHint: true no longer auto-approves a file write. output_path must resolve under the working directory, the OS temporary directory, or a directory named in GITLAB_MCP_ALLOWED_DOWNLOAD_DIRS; a server reached over HTTP refuses every local path, since the caller has no files on this machine.
| Annotation | Update |
|---|
List packages in a GitLab project. Can filter by name, version, type, and supports pagination and sorting. When GitLab includes package pipeline metadata, the response preserves both pipeline and pipelines fields.
| Annotation | Read |
|---|
List files within a specific package. Returns file ID, name, size, and SHA256 for each file with pagination.
| Annotation | Read |
|---|
List packages across a GitLab group and its descendant projects with optional filters and ordering. Supports filtering by package name and type (composer, conan, generic, golang, helm, maven, npm, nuget, pypi, terraform_module) and status (default, hidden, processing, error, pending_destruction, deprecated). Set exclude_subgroups to limit results to the group's direct projects, and include_versionless to include packages without a version. Order by created_at, name, version, type, or project_path.
| Annotation | Read |
|---|
Delete a package and all its files from the GitLab Package Registry. This action cannot be undone.
| Annotation | Delete |
|---|
Destructive: Protected by confirmation prompt. Deletes the entire package and all its files.
Delete a single file from a package in the GitLab Package Registry. This action cannot be undone.
| Annotation | Delete |
|---|
Destructive: Protected by confirmation prompt.
Publish a file to the Generic Package Registry and create a release asset link pointing to it in one step. Provide either file_path or content_base64 for the file content. The release identified by tag_name must already exist.
| Annotation | Create |
|---|
Publish all matching files from a local directory to the Generic Package Registry. Walks the directory (non-recursive), filters by an optional glob pattern, and publishes each file. Returns the list of published files with checksums and URLs.
| Annotation | Create |
|---|
List container registry repositories for a GitLab project.
| Annotation | Read |
|---|
List container registry repositories for a GitLab group.
| Annotation | Read |
|---|
Get details of a single container registry repository by its ID.
| Annotation | Read |
|---|
Delete a container registry repository. This action cannot be undone.
| Annotation | Delete |
|---|
Destructive: Deletion cannot be undone.
List tags for a container registry repository.
| Annotation | Read |
|---|
Get details of a specific container registry repository tag.
| Annotation | Read |
|---|
Delete a single container registry repository tag. This action cannot be undone.
| Annotation | Delete |
|---|
Destructive: Deletion cannot be undone.
Delete container registry repository tags in bulk using regex patterns. Use name_regex_delete to match tags to delete and name_regex_keep to exclude tags from deletion.
| Annotation | Delete |
|---|
Destructive: Bulk deletion cannot be undone.
Manage package protection rules that restrict who can push, update, or delete packages matching specific name patterns.
List all package protection rules for a project. Returns rules with their package name patterns, package types, and minimum access levels for push and delete operations.
| Annotation | Read |
|---|
Create a new package protection rule for a project. Define a package name pattern (supports * wildcard), package type, and minimum access levels required for push and delete.
| Annotation | Create |
|---|
Update an existing package protection rule. Modify the package name pattern, package type, or minimum access levels for push and delete operations.
| Annotation | Update |
|---|
Delete a package protection rule. This action cannot be undone.
| Annotation | Delete |
|---|
Destructive: Deletion cannot be undone.
List container registry protection rules for a GitLab project.
| Annotation | Read |
|---|
Create a container registry protection rule to restrict push/delete access by minimum access level.
| Annotation | Create |
|---|
Update a container registry protection rule.
| Annotation | Update |
|---|
Delete a container registry protection rule. This action cannot be undone.
| Annotation | Delete |
|---|
Destructive: Deletion cannot be undone.
Tag protection rules restrict who can push or delete container image tags that match a pattern, independent of the repository-path protection rules above. Omitting both minimum access levels makes matching tags immutable.
List container registry tag protection rules for a GitLab project.
| Annotation | Read |
|---|
Create a container registry tag protection rule. The tag_name_pattern is an RE2 regular expression; omit both access levels to make matching tags immutable.
| Annotation | Create |
|---|
Update a container registry tag protection rule.
| Annotation | Update |
|---|
Delete a container registry tag protection rule. This action cannot be undone.
| Annotation | Delete |
|---|
Destructive: Deletion cannot be undone.
List dependencies for a GitLab project. Supports filtering by package manager (bundler, composer, go, gradle, maven, npm, nuget, pip, etc.). Returns name, version, package manager, file path, vulnerabilities, and licenses.
| Annotation | Read |
|---|
Create a dependency list export (SBOM) for a pipeline. Returns export ID and status. Use gitlab_get_dependency_list_export to check status, then gitlab_download_dependency_list_export to download.
| Annotation | Create |
|---|
Check the status of a dependency list export. Returns export ID, completion status, and download URL when ready.
| Annotation | Read |
|---|
Download a completed dependency list export (CycloneDX SBOM JSON). Returns raw SBOM content (limited to 1 MB).
| Annotation | Read |
|---|
| # | Tool Name | Category | Annotation |
|---|---|---|---|
| 1 | gitlab_package_publish |
Generic Package Registry | Create |
| 2 | gitlab_package_download |
Generic Package Registry | Update |
| 3 | gitlab_package_list |
Generic Package Registry | Read |
| 4 | gitlab_package_file_list |
Generic Package Registry | Read |
| 5 | gitlab_package_delete |
Generic Package Registry | Delete |
| 6 | gitlab_package_file_delete |
Generic Package Registry | Delete |
| 7 | gitlab_package_publish_and_link |
Generic Package Registry | Create |
| 8 | gitlab_package_publish_directory |
Generic Package Registry | Create |
| 9 | gitlab_registry_list_project |
Registry Repositories & Tags | Read |
| 10 | gitlab_registry_list_group |
Registry Repositories & Tags | Read |
| 11 | gitlab_registry_get_repository |
Registry Repositories & Tags | Read |
| 12 | gitlab_registry_delete_repository |
Registry Repositories & Tags | Delete |
| 13 | gitlab_registry_list_tags |
Registry Repositories & Tags | Read |
| 14 | gitlab_registry_get_tag |
Registry Repositories & Tags | Read |
| 15 | gitlab_registry_delete_tag |
Registry Repositories & Tags | Delete |
| 16 | gitlab_registry_delete_tags_bulk |
Registry Repositories & Tags | Delete |
| 17 | gitlab_registry_protection_list |
Registry Protection Rules | Read |
| 18 | gitlab_registry_protection_create |
Registry Protection Rules | Create |
| 19 | gitlab_registry_protection_update |
Registry Protection Rules | Update |
| 20 | gitlab_registry_protection_delete |
Registry Protection Rules | Delete |
| 21 | gitlab_registry_tag_protection_list |
Registry Tag Protection Rules | Read |
| 22 | gitlab_registry_tag_protection_create |
Registry Tag Protection Rules | Create |
| 23 | gitlab_registry_tag_protection_update |
Registry Tag Protection Rules | Update |
| 24 | gitlab_registry_tag_protection_delete |
Registry Tag Protection Rules | Delete |
| 25 | gitlab_list_package_protection_rules |
Package Protection Rules | Read |
| 26 | gitlab_create_package_protection_rule |
Package Protection Rules | Create |
| 27 | gitlab_update_package_protection_rule |
Package Protection Rules | Update |
| 28 | gitlab_delete_package_protection_rule |
Package Protection Rules | Delete |
| 29 | gitlab_list_project_dependencies |
Dependencies | Read |
| 30 | gitlab_create_dependency_list_export |
Dependencies | Create |
| 31 | gitlab_get_dependency_list_export |
Dependencies | Read |
| 32 | gitlab_download_dependency_list_export |
Dependencies | Read |
| 33 | gitlab_list_group_packages |
Generic Package Registry | Read |
The following tools are annotated with DestructiveHint: true and require user confirmation before execution:
gitlab_package_delete— deletes an entire package and all its filesgitlab_package_file_delete— deletes a single file from a packagegitlab_registry_delete_repository— deletes a container registry repositorygitlab_registry_delete_tag— deletes a single container registry taggitlab_registry_delete_tags_bulk— bulk-deletes tags by regex patterngitlab_registry_protection_delete— deletes a registry protection rulegitlab_registry_tag_protection_delete— deletes a registry tag protection rulegitlab_delete_package_protection_rule— deletes a package protection rule