API access control governance for MCP tools

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Close this issue

Problem to solve

Grant MCP tools the minimum required permissions instead of full OAuth user privileges we have today. We'll follow the principle of least privilege with a simple, practical scope design that focuses on real security risks.

Proposal

We need to define the minimum access level required for MCP tools to interact with the GitLab API (both for internal and external usage).

Scope taxonomy

Resource	Operations	Risk Level
repo	read, write	🔴 Critical
issue	read, write	✅ Low / 📋 Medium
mr	read, write	✅ Low / 📋 Medium
epic	read, write	✅ Low / 📋 Medium
work-item	read, write	✅ Low / 📋 Medium
commit	read	✅ Low
pipeline	read, logs	✅ Low / 🔴 Critical
security	read, write	⚠️ High
audit	read	⚠️ High
project	read	✅ Low

Tools by scope and risk level

Tool	Required Scope	Risk Level	Use Case
Repository Operations
get_repository_file	repo:read	🔴 Critical	Source code access
list_repository_tree	repo:read	🔴 Critical	Repo structure
gitlab_blob_search	repo:read	🔴 Critical	Code search
list_merge_request_diffs	repo:read	🔴 Critical	Code changes in MR
get_commit_diff	repo:read	🔴 Critical	Code changes in commit
gitlab_documentation_search	project:read	✅ Low	Documentation search
create_commit	repo:write	🔴 Critical	Source code modification
Pipeline Operations
get_job_logs	pipeline:logs	🔴 Critical	Access build logs (secrets risk)
get_pipeline_errors	pipeline:read	✅ Low	Pipeline status
ci_linter	pipeline:read	✅ Low	CI config validation
Security Operations
list_vulnerabilities	security:read	⚠️ High	Security scanning
get_vulnerability_details	security:read	⚠️ High	Vulnerability details
confirm_vulnerability	security:write	⚠️ High	Security management
dismiss_vulnerability	security:write	⚠️ High	Security management
update_vulnerability_severity	security:write	⚠️ High	Security management
link_vulnerability_to_issue	security:write	⚠️ High	Security workflow
Audit Operations
list_instance_audit_events	audit:read	⚠️ High	Compliance data
list_project_audit_events	audit:read	⚠️ High	Compliance data
list_group_audit_events	audit:read	⚠️ High	Compliance data
Issue Operations
get_issue	issue:read	✅ Low	Issue viewing
list_issues	issue:read	✅ Low	Issue browsing
gitlab_issue_search	issue:read	✅ Low	Issue search
get_issue_note	issue:read	✅ Low	Issue comments
list_issue_notes	issue:read	✅ Low	Issue comments
create_issue	issue:write	📋 Medium	Issue creation
update_issue	issue:write	📋 Medium	Issue modification
create_issue_note	issue:write	📋 Medium	Issue commenting
Merge Request Operations
get_merge_request	mr:read	✅ Low	MR viewing
gitlab_merge_request_search	mr:read	✅ Low	MR search
list_all_merge_request_notes	mr:read	✅ Low	MR comments
create_merge_request	mr:write	📋 Medium	MR creation
update_merge_request	mr:write	📋 Medium	MR modification
create_merge_request_note	mr:write	📋 Medium	MR commenting
Epic Operations
get_epic	epic:read	✅ Low	Epic viewing
list_epics	epic:read	✅ Low	Epic browsing
get_epic_note	epic:read	✅ Low	Epic comments
list_epic_notes	epic:read	✅ Low	Epic comments
create_epic	epic:write	📋 Medium	Epic creation
update_epic	epic:write	📋 Medium	Epic modification
Work Item Operations
get_work_item	work-item:read	✅ Low	Work item viewing
list_work_items	work-item:read	✅ Low	Work item browsing
get_work_item_notes	work-item:read	✅ Low	Work item comments
create_work_item	work-item:write	📋 Medium	Work item creation
create_work_item_note	work-item:write	📋 Medium	Work item commenting
Commit Operations
list_commits	commit:read	✅ Low	Commit browsing
get_commit	commit:read	✅ Low	Commit details
get_commit_comments	commit:read	✅ Low	Commit comments
Project Operations
get_project	project:read	✅ Low	Project info
get_current_user	project:read	✅ Low	User info