jmrplens/gitlab-mcp-server

v2.2.0 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 1mo MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-tools gitlab gitlab-api go llm mcp

+2 more

mcp-server model-context-protocol

Affected surfaces

auth deps

Summary

AI summary

Updates 🚧 Maintenance, ✨ Features, and 🐛 Bug Fixes across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Feature	Low	Adds surface‑aware hints, aliases, and package split to Orbit Knowledge Graph domain Adds surface‑aware hints, aliases, and package split to Orbit Knowledge Graph domain Source: llm_adapter@2026-06-12 Confidence: high	—
Feature	Low	Syncs GitLab access levels (0/5/10/15/20/25/30/40/50/60) across all MCP tools Syncs GitLab access levels (0/5/10/15/20/25/30/40/50/60) across all MCP tools Source: llm_adapter@2026-06-12 Confidence: high	—
Dependency	Low	Bumps Go dependencies (golang.org/x/crypto, x/sync, x/sys, x/tools) and bits-and-blooms/bitset; updates pnpm packages (astro, starlight, sharp, prettier, typescript-eslint); upgrades GitLab client‑go from v2.38.0 to v2.39.0 Bumps Go dependencies (golang.org/x/crypto, x/sync, x/sys, x/tools) and bits-and-blooms/bitset; updates pnpm packages (astro, starlight, sharp, prettier, typescript-eslint); upgrades GitLab client‑go from v2.38.0 to v2.39.0 Source: llm_adapter@2026-06-12 Confidence: high	—
Performance	Low	Improves test coverage: 14 packages reach 100% (155 → 169 total); raises average coverage from ~95% to 96.40% Improves test coverage: 14 packages reach 100% (155 → 169 total); raises average coverage from ~95% to 96.40% Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix	Medium	Prevents bot committer identity leakage in setup‑orbit‑fixtures.sh by using per‑command git -c flags instead of persisting config Prevents bot committer identity leakage in setup‑orbit‑fixtures.sh by using per‑command git -c flags instead of persisting config Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix	Low	Removes stray test log file targeted-mt039-040-096-current.log from version control Removes stray test log file targeted-mt039-040-096-current.log from version control Source: llm_adapter@2026-06-12 Confidence: high	—

Full changelog

Changelog

✨ Features

Orbit surface-aware hints, aliases, and package split — The Orbit Knowledge Graph domain now delivers four signals on every action: surface-agnostic hints (individual tool names in backticks), RelatedActions for cross-call chaining, natural-language aliases (kg.* / knowledge_graph.*), and canonical Usage text. Extracts query-DSL validators into their own package, adds toInt64 handling for json.Number, fixes setup-orbit-fixtures.sh to use http.extraHeader for token auth, URL-encode namespaces for nested subgroups, and adds idempotent resource provisioning with ?search= lookups. Regnerates docs and live-test paths.
Access levels (5/15/60) synced across the MCP surface — Every MCP tool that displays GitLab access levels now reflects the full set (0/5/10/15/20/25/30/40/50/60), not just the legacy subset. Updates 16 packages including members, groupmembers, accessrequests, groupldap, groupsaml, projects, branches, memberroles, and more. Premium/Ultimate context-valid subsets are preserved per-domain.

🚧 Maintenance

Dependency bumps — Go: golang.org/x/{crypto,sync,sys,tools} + bits-and-blooms/bitset. pnpm: astro, starlight, sharp, prettier, typescript-eslint. GitLab client-go v2.38.0 → v2.39.0, surfacing the new Scopes field on OAuth application tools.
Coverage improvement — 14 packages closed to 100% coverage. Total packages at 100%: 155 → 169 (+14). Average coverage ~95% → 96.40%.
Orbit live-test infrastructure — New Makefile targets (orbit-setup-fixtures, orbit-wait-indexer, orbit-run-live-tests, orbit-ensure-token). Indexer baseline sampled on first poll to avoid timeout on re-runs.

🐛 Bug Fixes

setup-orbit-fixtures.sh — Bot committer identity no longer leaks into the main repo's .git/config. Passes identity inline as git -c flags per-command instead of persisting via git config.
Stray test log removed — targeted-mt039-040-096-current.log deleted from version control.

Full diff: v2.1.3 → v2.2.0

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track jmrplens/gitlab-mcp-server

Get notified when new releases ship.

About jmrplens/gitlab-mcp-server

Complete GitLab REST API v4 coverage with 1006 MCP tools across 162 domains, 42 meta-tools, 24 resources, and 38 prompts. Cross-platform Go binary with stdio and HTTP transports, OAuth support, auto-update, read-only and safe modes.

All releases →