This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+2 more
Summary
AI summaryBroad release touches Highlights, @jmrplens, ๐ Documentation, and ๐ง Maintenance.
Full changelog
Highlights
๐ฅ๏ธ Claude Desktop one-click extension (.mcpb) โ #224
The server now ships as a native Desktop Extension for Claude Desktop: download gitlab-mcp-server.mcpb below, open it with Claude Desktop, fill in the settings, done. No Docker, Node.js, or Python required.
- Single bundle for macOS (universal arm64 + x86_64) and Windows (amd64) โ the macOS binary is a new fat binary built via GoReleaser
universal_binaries, also published standalone asgitlab-mcp-server-darwin-all - Settings UI for URL, token (stored in the OS keychain by Claude Desktop), tool surface, tier, read-only, safe mode, and TLS skip โ defaults to the low-token
dynamicsurface - Auto-update disabled inside the bundle: updates arrive as new extension versions
- New
PRIVACY.md(no telemetry โ data flows only between your machine and your GitLab instance), new guide, andmake mcpb/make check-mcpbtargets - The release pipeline builds, stamps, and uploads the bundle automatically from now on
๐ฉน GitLab 19 self-recovery hints + client-go v2.46.0 โ #218
Every API drift verified live against GitLab 19.0.1 during the e2e gap closure now carries an actionable hint (ADR-0007), so an LLM hitting the error can fix its own call:
deployment_create: 400 "tag is missing" โ retry withtag:false/tag:true; invalid status โ accepted statuses (GitLab 19 rejectscreated)create_fork_relation: GitLab 19 returns the project body โ success-path hint pointing toforked_from_project- Terraform state lock (client-go sends no lock-info body) โ hint pointing to the terraform CLI backend
- Hook URL variables: 422 โ keys accept only letters/underscores
- Usage-data non-SQL metrics 404, CI catalog drafts, legacy epic label events โ all with working alternatives
Plus client-go v2.46.0: adopts reviewer_assignment_strategy (disabled|code_owners|dap_powered) in project create/update/output with doc-grounded tier:"premium" gating. 15 new/extended tests.
๐ค Agent-installability โ #222
New root-level llms-install.md: a deterministic install guide for AI agents (Cline, Claude, Cursor, โฆ) covering Docker and native-binary paths, env var reference, smoke test, and troubleshooting. Groundwork for the Cline Marketplace listing.
๐ Docs & site
- README: Go Reference and Go Report Card badges restored, Claude Desktop install row, and a Privacy Policy section โ #223, #224
- Site: removed references to deleted Wikidata items and refreshed the Person
sameAsgraph โ #220, #221
๐งน Internals
toolutil: use the unmarshal error directly in condition (Sonar S8193) โ #219
Changelog
โจ Features
- c2526c80773696c99ecd717eafd31cf9c5de5f0c: feat: Claude Desktop extension (.mcpb) build and release pipeline (#224) (@jmrplens)
- 0c6991f5709ea3a3ee38c2cee7ad58831a853551: feat: GitLab 19 self-recovery hints + client-go v2.46.0 (reviewer_assignment_strategy) (#218) (@jmrplens)
๐ Bug Fixes
- cfea31f0bd9db1ddd79f7f96419a89dec4ffeee8: fix(mcpb): point manifest author.url at the GitHub profile (#226) (@jmrplens)
๐ Documentation
- e9ab8775140a7414d6d9178418531f7ecdf0acff: docs(readme): restore Go Reference and Go Report Card badges (#223) (@jmrplens)
- 5b4bd73bbd6269140ef74b7d078bfc3bd0b3e38e: docs(site): add personal Wikidata item to Person sameAs and footer (#220) (@jmrplens)
- 2ddbb228a2facbf5a50d0ee33ec88e6c923e3bf2: docs(site): remove references to deleted Wikidata items (#221) (@jmrplens)
- a8a01feb0141978e243a49c9c96045bd4410d3ac: docs: add llms-install.md for AI-agent one-click installs (Cline) (#222) (@jmrplens)
๐ง Maintenance
- 344c8eaa0e85880d30ca487afd9e12791c2074d2: chore: update manifests for v2.4.1 (@jmrplens)
- 94814014bb4d6e057a7998ab15b3854982531470: chore: version bump to 2.5.0 (#225) (@jmrplens)
- e581ed3d9bd830c080e092a0bbe8bb52c4a38175: refactor(toolutil): use unmarshal error directly in condition (Sonar S8193) (#219) (@jmrplens)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About jmrplens/gitlab-mcp-server
Complete GitLab REST API v4 coverage with 1006 MCP tools across 162 domains, 42 meta-tools, 24 resources, and 38 prompts. Cross-platform Go binary with stdio and HTTP transports, OAuth support, auto-update, read-only and safe modes.
Beta — feedback welcome: [email protected]