<!--IssueSummary start--> <details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Close this issue](https://contributors.gitlab.com/manage-issue?action=close&projectId=278964&issueIid=567747) </details> <!--IssueSummary end--> ## Problem to solve Grant MCP tools the minimum required permissions instead of full OAuth user privileges we have today. We'll follow the principle of least privilege with a simple, practical scope design that focuses on real security risks. ### Proposal We need to define the minimum access level required for MCP tools to interact with the GitLab API (both for internal and external usage). ## Scope taxonomy | Resource | Operations | Risk Level | |----------|------------|------------| | **`repo`** | `read`, `write` | 🔴 Critical | | **`issue`** | `read`, `write` | ✅ Low / 📋 Medium | | **`mr`** | `read`, `write` | ✅ Low / 📋 Medium | | **`epic`** | `read`, `write` | ✅ Low / 📋 Medium | | **`work-item`** | `read`, `write` | ✅ Low / 📋 Medium | | **`commit`** | `read` | ✅ Low | | **`pipeline`** | `read`, `logs` | ✅ Low / 🔴 Critical | | **`security`** | `read`, `write` | ⚠️ High | | **`audit`** | `read` | ⚠️ High | | **`project`** | `read` | ✅ Low | ## Tools by scope and risk level <table> <tr> <th>Tool</th> <th>Required Scope</th> <th>Risk Level</th> <th>Use Case</th> </tr> <tr> <td colspan="4"> **Repository Operations** </td> </tr> <tr> <td> `get_repository_file` </td> <td> `repo:read` </td> <td> :red_circle: Critical </td> <td>Source code access</td> </tr> <tr> <td> `list_repository_tree` </td> <td> `repo:read` </td> <td> :red_circle: Critical </td> <td>Repo structure</td> </tr> <tr> <td> `gitlab_blob_search` </td> <td> `repo:read` </td> <td> :red_circle: Critical </td> <td>Code search</td> </tr> <tr> <td> `list_merge_request_diffs` </td> <td> `repo:read` </td> <td> :red_circle: Critical </td> <td>Code changes in MR</td> </tr> <tr> <td> `get_commit_diff` </td> <td> `repo:read` </td> <td> :red_circle: Critical </td> <td>Code changes in commit</td> </tr> <tr> <td> `gitlab_documentation_search` </td> <td> `project:read` </td> <td> :white_check_mark: Low </td> <td>Documentation search</td> </tr> <tr> <td> `create_commit` </td> <td> `repo:write` </td> <td> :red_circle: Critical </td> <td>Source code modification</td> </tr> <tr> <td colspan="4"> **Pipeline Operations** </td> </tr> <tr> <td> `get_job_logs` </td> <td> `pipeline:logs` </td> <td> :red_circle: Critical </td> <td>Access build logs (secrets risk)</td> </tr> <tr> <td> `get_pipeline_errors` </td> <td> `pipeline:read` </td> <td> :white_check_mark: Low </td> <td>Pipeline status</td> </tr> <tr> <td> `ci_linter` </td> <td> `pipeline:read` </td> <td> :white_check_mark: Low </td> <td>CI config validation</td> </tr> <tr> <td colspan="4"> **Security Operations** </td> </tr> <tr> <td> `list_vulnerabilities` </td> <td> `security:read` </td> <td> :warning: High </td> <td>Security scanning</td> </tr> <tr> <td> `get_vulnerability_details` </td> <td> `security:read` </td> <td> :warning: High </td> <td>Vulnerability details</td> </tr> <tr> <td> `confirm_vulnerability` </td> <td> `security:write` </td> <td> :warning: High </td> <td>Security management</td> </tr> <tr> <td> `dismiss_vulnerability` </td> <td> `security:write` </td> <td> :warning: High </td> <td>Security management</td> </tr> <tr> <td> `update_vulnerability_severity` </td> <td> `security:write` </td> <td> :warning: High </td> <td>Security management</td> </tr> <tr> <td> `link_vulnerability_to_issue` </td> <td> `security:write` </td> <td> :warning: High </td> <td>Security workflow</td> </tr> <tr> <td colspan="4"> **Audit Operations** </td> </tr> <tr> <td> `list_instance_audit_events` </td> <td> `audit:read` </td> <td> :warning: High </td> <td>Compliance data</td> </tr> <tr> <td> `list_project_audit_events` </td> <td> `audit:read` </td> <td> :warning: High </td> <td>Compliance data</td> </tr> <tr> <td> `list_group_audit_events` </td> <td> `audit:read` </td> <td> :warning: High </td> <td>Compliance data</td> </tr> <tr> <td colspan="4"> **Issue Operations** </td> </tr> <tr> <td> `get_issue` </td> <td> `issue:read` </td> <td> :white_check_mark: Low </td> <td>Issue viewing</td> </tr> <tr> <td> `list_issues` </td> <td> `issue:read` </td> <td> :white_check_mark: Low </td> <td>Issue browsing</td> </tr> <tr> <td> `gitlab_issue_search` </td> <td> `issue:read` </td> <td> :white_check_mark: Low </td> <td>Issue search</td> </tr> <tr> <td> `get_issue_note` </td> <td> `issue:read` </td> <td> :white_check_mark: Low </td> <td>Issue comments</td> </tr> <tr> <td> `list_issue_notes` </td> <td> `issue:read` </td> <td> :white_check_mark: Low </td> <td>Issue comments</td> </tr> <tr> <td> `create_issue` </td> <td> `issue:write` </td> <td> :clipboard: Medium </td> <td>Issue creation</td> </tr> <tr> <td> `update_issue` </td> <td> `issue:write` </td> <td> :clipboard: Medium </td> <td>Issue modification</td> </tr> <tr> <td> `create_issue_note` </td> <td> `issue:write` </td> <td> :clipboard: Medium </td> <td>Issue commenting</td> </tr> <tr> <td colspan="4"> **Merge Request Operations** </td> </tr> <tr> <td> `get_merge_request` </td> <td> `mr:read` </td> <td> :white_check_mark: Low </td> <td>MR viewing</td> </tr> <tr> <td> `gitlab_merge_request_search` </td> <td> `mr:read` </td> <td> :white_check_mark: Low </td> <td>MR search</td> </tr> <tr> <td> `list_all_merge_request_notes` </td> <td> `mr:read` </td> <td> :white_check_mark: Low </td> <td>MR comments</td> </tr> <tr> <td> `create_merge_request` </td> <td> `mr:write` </td> <td> :clipboard: Medium </td> <td>MR creation</td> </tr> <tr> <td> `update_merge_request` </td> <td> `mr:write` </td> <td> :clipboard: Medium </td> <td>MR modification</td> </tr> <tr> <td> `create_merge_request_note` </td> <td> `mr:write` </td> <td> :clipboard: Medium </td> <td>MR commenting</td> </tr> <tr> <td colspan="4"> **Epic Operations** </td> </tr> <tr> <td> `get_epic` </td> <td> `epic:read` </td> <td> :white_check_mark: Low </td> <td>Epic viewing</td> </tr> <tr> <td> `list_epics` </td> <td> `epic:read` </td> <td> :white_check_mark: Low </td> <td>Epic browsing</td> </tr> <tr> <td> `get_epic_note` </td> <td> `epic:read` </td> <td> :white_check_mark: Low </td> <td>Epic comments</td> </tr> <tr> <td> `list_epic_notes` </td> <td> `epic:read` </td> <td> :white_check_mark: Low </td> <td>Epic comments</td> </tr> <tr> <td> `create_epic` </td> <td> `epic:write` </td> <td> :clipboard: Medium </td> <td>Epic creation</td> </tr> <tr> <td> `update_epic` </td> <td> `epic:write` </td> <td> :clipboard: Medium </td> <td>Epic modification</td> </tr> <tr> <td colspan="4"> **Work Item Operations** </td> </tr> <tr> <td> `get_work_item` </td> <td> `work-item:read` </td> <td> :white_check_mark: Low </td> <td>Work item viewing</td> </tr> <tr> <td> `list_work_items` </td> <td> `work-item:read` </td> <td> :white_check_mark: Low </td> <td>Work item browsing</td> </tr> <tr> <td> `get_work_item_notes` </td> <td> `work-item:read` </td> <td> :white_check_mark: Low </td> <td>Work item comments</td> </tr> <tr> <td> `create_work_item` </td> <td> `work-item:write` </td> <td> :clipboard: Medium </td> <td>Work item creation</td> </tr> <tr> <td> `create_work_item_note` </td> <td> `work-item:write` </td> <td> :clipboard: Medium </td> <td>Work item commenting</td> </tr> <tr> <td colspan="4"> **Commit Operations** </td> </tr> <tr> <td> `list_commits` </td> <td> `commit:read` </td> <td> :white_check_mark: Low </td> <td>Commit browsing</td> </tr> <tr> <td> `get_commit` </td> <td> `commit:read` </td> <td> :white_check_mark: Low </td> <td>Commit details</td> </tr> <tr> <td> `get_commit_comments` </td> <td> `commit:read` </td> <td> :white_check_mark: Low </td> <td>Commit comments</td> </tr> <tr> <td colspan="4"> **Project Operations** </td> </tr> <tr> <td> `get_project` </td> <td> `project:read` </td> <td> :white_check_mark: Low </td> <td>Project info</td> </tr> <tr> <td> `get_current_user` </td> <td> `project:read` </td> <td> :white_check_mark: Low </td> <td>User info</td> </tr> </table> ##