GitLab manages source code, merge requests, CI/CD pipelines, and project planning. Its MCP server supports OAuth Dynamic Client Registration (DCR), plus personal, project, and group access tokens for static-credential connections.
This guide prepares GitLab for any compatible MCP client. The GitLab agent template deploys the Dome configuration separately.
Choose a connection method
Choose OAuth when the MCP connection should use a GitLab member's normal group and project access. Choose a project access token for one project, a group access token for several related projects, or a personal access token only when neither resource-scoped token is practical. See GitLab's MCP server documentation.
Recommended: OAuth for user-delegated access
GitLab's MCP server supports OAuth 2.0 DCR, so an OAuth-capable MCP client registers itself automatically. Prepare a test group and project and use a non-owner test member.
- Add
https://gitlab.com/api/v4/mcpto the OAuth-capable MCP client. - Start the client’s authorization flow and sign in as the test member.
- Approve only the scopes required for the intended work; begin read-only where the client and server support it.
- Confirm a known project is visible and a private project outside the test member's membership is unavailable.
Alternative: Access token
For a non-interactive connection, GitLab accepts a bearer access token. Pick the narrowest token type the deployment permits:
- Project access token: one project; preferred static option.
- Group access token: several related projects in one group.
- Personal access token: a dedicated test user only; use this only when a project or group token cannot meet the requirement.
Set an expiration, request only read_api and read_repository for a read-only connection, and send it as Authorization: Bearer <token>. GitLab documents project access tokens and group access tokens.
Verify GitLab MCP
Use this checklist to confirm the MCP server is connected with the intended access.
- Connect the MCP client using the newly created authorization.
- Confirm that GitLab MCP tools are discovered.
- Read one known test resource that the authorized identity is allowed to access.
- Attempt to read a resource outside the approved GitLab boundary; it should be unavailable or denied.
- Confirm that no write capability beyond the reviewed setup is available.
Troubleshooting
If the token authenticates but cannot read a project, check project membership and token resource scope. If OAuth fails, check the exact callback URL and whether GitLab administrators restrict OAuth applications.
Next steps
Deploy the GitLab agent template to create a governed agent in Dome that can work with the approved groups and projects, with the template's included model, tools, and rules.
