GitLab 19.5: MCP Server GA — Six Tools Deprecated

GitLab 19.5, shipped October 15, made the GitLab MCP server generally available across Free, Premium and Ultimate tiers on GitLab.com, Self-Managed and Dedicated, while deprecating six MCP tools that are already removed from `tools/list` but still respond to direct calls until a future release. The release adds tools including `semantic_search`, `get_artifact_file`, `get_repository_file` and Duo Agent Platform tools (`start_duo_session`, `get_duo_session`, `list_duo_agents_and_flows`) that let external agents hand work to GitLab's own agent layer, and consolidates the deprecated merge request and pipeline tools into `get_merge_request` and `get_pipeline` calls using an `include` parameter. GitLab also set GitLab.com MCP rate limits effective October 15 at 60 requests per minute for Free users and 600 for Premium and Ultimate, with every reconnect and retry counting toward the limit, and made GitLab Secrets Manager generally available for Premium and Ultimate on GitLab.com and Self-Managed.

GitLab 19.5 shipped on October 15, and the headline is that the MCP server is now generally available. The real gotcha is buried further down the release notes: six MCP tools were quietly deprecated in the same release, and if your agents are calling any of them, they’ll keep working for now — but they’ve already been removed from tools/list . GitLab will pull them entirely. Check your configs today. MCP Server Is Now GA The GitLab MCP server has been in beta since early 2026. As of 19.5, it’s production-ready and available across all tiers — Free, Premium, and Ultimate — on GitLab.com, Self-Managed, and Dedicated. Any MCP-compatible agent works: Claude Code, Cursor, and anything else that speaks the protocol. The GA release ships a meaningful expansion of available tools. New additions include semantic search for finding code by meaning rather than file path, get artifact file for reading a single file from a CI/CD job’s artifacts without downloading the whole archive, get repository file for reading files at any ref, and a suite of Duo Agent Platform tools — start duo session , get duo session , and list duo agents and flows — that let external agents hand work off to GitLab’s own agent layer. This is a meaningful shift. GitLab is not just exposing its data to agents — it’s making its own agent infrastructure callable. An external agent can now delegate a task to a GitLab Duo flow and get the result back. That’s a different model from GitHub’s MCP offering, which remains focused on data access rather than agent-to-agent handoffs. Six Tools Deprecated: Migrate Now These six tools are unlisted in 19.5 — they won’t show up in tools/list , but they still respond to direct calls while teams migrate. They will be removed in a future release. - get merge request commits → use get merge request with include: "commits" - get merge request diffs → use get merge request with include: "diffs" - get merge request pipelines → use get merge request with include: "pipelines" - get merge request conflicts → use get merge request with include: "conflicts" - get merge request notes → use get merge request notes facet - get pipeline jobs → use get pipeline with include: "jobs" The pattern is intentional. GitLab is consolidating multiple specialized tools into single tools with an include parameter — fewer tools, less LLM context overhead, same data. Expect this to continue in 19.6 and beyond. If you’ve built agents against the GitLab MCP, audit every tool call now rather than waiting for the silent failure. The full migration reference is in the GitLab MCP server tools docs https://docs.gitlab.com/user/model context protocol/mcp server tools/ . Rate Limits Are Live Also effective October 15: rate limits on GitLab.com. Free users get 60 MCP requests per minute. Premium and Ultimate get 600. Every reconnect and retry counts toward the limit — so if your agent retries aggressively on failures, you’ll burn your budget faster than the raw request count suggests. For teams running automation on the Free tier, 60 req/min is tight. A single agent doing a code review loop — fetch MR, fetch diffs, post comments, update status — can hit that ceiling in under a minute on a busy PR. Consider batching with include parameters which also reduces total tool call count or moving to Premium if the workflow is business-critical. Secrets Manager Reaches GA GitLab Secrets Manager, built on OpenBao https://openbao.org/ the open-source HashiCorp Vault fork , is generally available in 19.5 for Premium and Ultimate on GitLab.com and Self-Managed. Dedicated support is coming. The core value proposition: secrets scoped to individual CI/CD jobs. Declare what a job needs with the secrets: keyword in .gitlab-ci.yml , set conditions on branch and environment, and GitLab injects the credential only into matching jobs as a temporary file — masked in logs, encrypted at rest with AES-256-GCM, delivered via short-lived job-bound tokens. No more sharing a single environment secret across an entire pipeline stage. The audit trail follows your existing group and project permissions, so there’s no separate secrets hierarchy to maintain. What to Do Now - Audit your MCP configs for the six deprecated tools and update to the include: equivalents before they’re removed. - Check your request volume against the new rate limits, especially on Free tier. Batching with include cuts both call count and latency. - Evaluate Secrets Manager if you’re on Premium or Ultimate and still using environment variables for CI credentials. Job-scoped secrets with audit trails are worth the migration for anything touching production. - Update Duo CLI to 9.22.0+ if you want auto mode for longer-running autonomous workflows — it removes per-call approval prompts for shell commands, git operations, and MCP calls. Full details: GitLab 19.5 release notes https://docs.gitlab.com/releases/19/gitlab-19-5-released/ and the MCP server GA announcement https://about.gitlab.com/blog/mcp-server-ga/ . The Secrets Manager deep-dive is at about.gitlab.com/blog/secrets-manager-ga https://about.gitlab.com/blog/secrets-manager-ga/ .