GitLab 19.5: MCP Server GA — Six Tools Deprecated

GitLab 19.5 shipped on October 15, and the headline is that the MCP server is now generally available. The real gotcha is buried further down the release notes: six MCP tools were quietly deprecated in the same release, and if your agents are calling any of them, they’ll keep working for now — but they’ve already been removed from tools/list. GitLab will pull them entirely. Check your configs today.

MCP Server Is Now GA

The GitLab MCP server has been in beta since early 2026. As of 19.5, it’s production-ready and available across all tiers — Free, Premium, and Ultimate — on GitLab.com, Self-Managed, and Dedicated. Any MCP-compatible agent works: Claude Code, Cursor, and anything else that speaks the protocol.

The GA release ships a meaningful expansion of available tools. New additions include semantic_search for finding code by meaning rather than file path, get_artifact_file for reading a single file from a CI/CD job’s artifacts without downloading the whole archive, get_repository_file for reading files at any ref, and a suite of Duo Agent Platform tools — start_duo_session, get_duo_session, and list_duo_agents_and_flows — that let external agents hand work off to GitLab’s own agent layer.

This is a meaningful shift. GitLab is not just exposing its data to agents — it’s making its own agent infrastructure callable. An external agent can now delegate a task to a GitLab Duo flow and get the result back. That’s a different model from GitHub’s MCP offering, which remains focused on data access rather than agent-to-agent handoffs.

Six Tools Deprecated: Migrate Now

These six tools are unlisted in 19.5 — they won’t show up in tools/list, but they still respond to direct calls while teams migrate. They will be removed in a future release.

• get_merge_request_commits → use get_merge_request with include: ["commits"]
• get_merge_request_diffs → use get_merge_request with include: ["diffs"]
• get_merge_request_pipelines → use get_merge_request with include: ["pipelines"]
• get_merge_request_conflicts → use get_merge_request with include: ["conflicts"]
• get_merge_request_notes → use get_merge_request notes facet
• get_pipeline_jobs → use get_pipeline with include: ["jobs"]

The pattern is intentional. GitLab is consolidating multiple specialized tools into single tools with an include parameter — fewer tools, less LLM context overhead, same data. Expect this to continue in 19.6 and beyond. If you’ve built agents against the GitLab MCP, audit every tool call now rather than waiting for the silent failure. The full migration reference is in the GitLab MCP server tools docs.

Rate Limits Are Live

Also effective October 15: rate limits on GitLab.com. Free users get 60 MCP requests per minute. Premium and Ultimate get 600. Every reconnect and retry counts toward the limit — so if your agent retries aggressively on failures, you’ll burn your budget faster than the raw request count suggests.

For teams running automation on the Free tier, 60 req/min is tight. A single agent doing a code review loop — fetch MR, fetch diffs, post comments, update status — can hit that ceiling in under a minute on a busy PR. Consider batching with include parameters (which also reduces total tool call count) or moving to Premium if the workflow is business-critical.

Secrets Manager Reaches GA

GitLab Secrets Manager, built on OpenBao (the open-source HashiCorp Vault fork), is generally available in 19.5 for Premium and Ultimate on GitLab.com and Self-Managed. Dedicated support is coming.

The core value proposition: secrets scoped to individual CI/CD jobs. Declare what a job needs with the secrets: keyword in .gitlab-ci.yml, set conditions on branch and environment, and GitLab injects the credential only into matching jobs as a temporary file — masked in logs, encrypted at rest with AES-256-GCM, delivered via short-lived job-bound tokens. No more sharing a single environment secret across an entire pipeline stage. The audit trail follows your existing group and project permissions, so there’s no separate secrets hierarchy to maintain.

What to Do Now

• Audit your MCP configs for the six deprecated tools and update to the include: equivalents before they’re removed.
• Check your request volume against the new rate limits, especially on Free tier. Batching with include cuts both call count and latency.
• Evaluate Secrets Manager if you’re on Premium or Ultimate and still using environment variables for CI credentials. Job-scoped secrets with audit trails are worth the migration for anything touching production.
• Update Duo CLI to 9.22.0+ if you want auto mode for longer-running autonomous workflows — it removes per-call approval prompts for shell commands, git operations, and MCP calls.

Full details: GitLab 19.5 release notes and the MCP server GA announcement. The Secrets Manager deep-dive is at about.gitlab.com/blog/secrets-manager-ga.