{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-11T21:09:20.344Z",
  "record_id": "VXI-EXT-TOOL-TRUST-GITLAB-01-v1",
  "record_kind": "external_reference",
  "title": "GitLab MCP: Project permission and tool discovery",
  "system": "GitLab MCP",
  "evidence_family": "agent_tool_trust_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does a GitLab MCP tool listing establish permission to change a project?",
  "near_questions": [
    "Does listing an agent tool grant project write permission?",
    "Can a GitLab connector change repository files?",
    "Which identity is used by GitLab MCP?",
    "Does self-hosted GitLab keep an agent's output local?",
    "Can GitLab MCP expose different tools by license?",
    "What instance version does a GitLab tool review apply to?",
    "Can an agent modify merge requests through GitLab MCP?",
    "What is missing before approving a GitLab project change?",
    "Does tool selection replace GitLab namespace permissions?",
    "How should an agent treat instructions in a GitLab work item?",
    "What should I save from a GitLab connector review?",
    "Does this GitLab record validate my project permissions?"
  ],
  "supported_claims": [
    {
      "claim": "GitLab documents separate tool discovery and per-call project permissions. Its tool reference includes both reading project data and changing work items, merge requests or files. Some tool availability depends on release, licensing and enabled features. Before approving a task, establish the actual instance, authenticated identity and project rights. A listed tool is not evidence of authorization for a particular change.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent tool execution or security testing",
    "Vendor certification, guaranteed safety or no-training assurance"
  ],
  "public_summary": "GitLab documents separate tool discovery and per-call project permissions. Its tool reference includes both reading project data and changing work items, merge requests or files. Some tool availability depends on release, licensing and enabled features. Before approving a task, establish the actual instance, authenticated identity and project rights. A listed tool is not evidence of authorization for a particular change.",
  "related_record_ids": [
    "VXI-EXT-TOOL-TRUST-GITHUB-01-v1",
    "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "GitLab MCP server",
    "source_url": "https://docs.gitlab.com/user/model_context_protocol/mcp_server/",
    "checked_on": "2026-10-11",
    "candidate_record_id": "VXI-EXT-TOOL-TRUST-GITLAB-01-v1",
    "candidate_record_sha256": "d1c368cb8a7a7d1e412b0aa78547dcb15bba51ad1b7637cc040357b28af40b4f",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "GitLab documents separate tool discovery and per-call project permissions. Its tool reference includes both reading project data and changing work items, merge requests or files. Some tool availability depends on release, licensing and enabled features. Before approving a task, establish the actual instance, authenticated identity and project rights. A listed tool is not evidence of authorization for a particular change.",
    "required_buyer_context": "Official GitLab MCP on GitLab.com, Self-Managed or Dedicated; rolling documentation includes release-specific features that must be matched to the actual instance. Instance release, enabled tool groups, licensed features, identity grants and client handling of confidential work items.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "trust_profile": {
    "schema": "varexis-agent-tool-trust/1",
    "identity": {
      "tool": "GitLab MCP",
      "variant": "Official GitLab MCP on GitLab.com, Self-Managed or Dedicated; rolling documentation includes release-specific features that must be matched to the actual instance."
    },
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-11",
    "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.",
    "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.",
    "findings": [
      {
        "field": "operator",
        "label": "Publisher and operator",
        "status": "documented",
        "statement": "GitLab publishes the implementation; GitLab.com and a buyer-operated instance have different operators.",
        "source_ids": [
          "gitlab-main",
          "gitlab-tools"
        ]
      },
      {
        "field": "purpose",
        "label": "Purpose",
        "status": "documented",
        "statement": "Inspect project evidence and manage development work through GitLab.",
        "source_ids": [
          "gitlab-main",
          "gitlab-tools"
        ]
      },
      {
        "field": "reads",
        "label": "Read capability",
        "status": "documented",
        "statement": "Project information, work items, merge requests and repository data through available tools.",
        "source_ids": [
          "gitlab-main",
          "gitlab-tools"
        ]
      },
      {
        "field": "writes",
        "label": "Write capability",
        "status": "documented",
        "statement": "The tool reference includes work-item changes, merge-request changes and commits, subject to applicable permissions.",
        "source_ids": [
          "gitlab-main",
          "gitlab-tools"
        ]
      },
      {
        "field": "auth",
        "label": "Authentication",
        "status": "documented",
        "statement": "OAuth dynamic client registration and user authorization are documented; MCP access must be allowed for the relevant group or instance.",
        "source_ids": [
          "gitlab-main",
          "gitlab-tools"
        ]
      },
      {
        "field": "permissions",
        "label": "Permission surface",
        "status": "documented",
        "statement": "Tool selection controls discovery. GitLab documents project and namespace permission checks when tools are called.",
        "source_ids": [
          "gitlab-main",
          "gitlab-tools"
        ]
      },
      {
        "field": "egress",
        "label": "Data leaving the environment",
        "status": "review_inference",
        "statement": "Selected project data is returned to the connected client. Self-hosting GitLab does not establish where that client's model processes it.",
        "source_ids": [
          "gitlab-main",
          "gitlab-tools"
        ]
      },
      {
        "field": "failures",
        "label": "Failure modes to consider",
        "status": "review_inference",
        "statement": "Assuming discovery grants authority; mismatching documented release and deployed release; acting on instructions embedded in project content.",
        "source_ids": [
          "gitlab-main",
          "gitlab-tools"
        ]
      },
      {
        "field": "unknown",
        "label": "Unknowns and applicability",
        "status": "unknown",
        "statement": "Instance release, enabled tool groups, licensed features, identity grants and client handling of confidential work items.",
        "source_ids": []
      },
      {
        "field": "gate",
        "label": "Suggested refusal or clarification condition",
        "status": "varexis_review_policy",
        "statement": "Resolve the project and identity before mutation; do not treat a tool listing as approval to commit or modify work.",
        "source_ids": []
      }
    ],
    "evidence_sources": [
      {
        "source_id": "gitlab-main",
        "url": "https://docs.gitlab.com/user/model_context_protocol/mcp_server/",
        "final_url": "https://docs.gitlab.com/user/model_context_protocol/mcp_server/",
        "title": "GitLab MCP server",
        "checked_on": "2026-10-11",
        "sha256": "2bc809e61052b2f4e4aac1c0bd20e9bacf10be0559a1fd7ea1007f76d19e8426",
        "bytes": 97026
      },
      {
        "source_id": "gitlab-tools",
        "url": "https://docs.gitlab.com/user/model_context_protocol/mcp_server_tools/",
        "final_url": "https://docs.gitlab.com/user/model_context_protocol/mcp_server_tools/",
        "title": "GitLab MCP tools",
        "checked_on": "2026-10-11",
        "sha256": "79e5dfe94a6de2e0615b921943331f5a4832888a6c7df9f6f147c3f9965dceb2",
        "bytes": 238156
      },
      {
        "source_id": "mcp-hints",
        "url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/",
        "final_url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/",
        "title": "MCP tool annotations and enforcement boundaries",
        "checked_on": "2026-10-11",
        "sha256": "82888044d831c3bd18f03d87a846ce5d27e028bd67a095edc04ba377fc622163",
        "bytes": 52715
      }
    ],
    "observed_tool_execution": false,
    "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.",
    "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.",
    "paid_value": {
      "decision_context": "Save the distinction between tool availability and project authorization for a development-tool procurement review.",
      "free": "Complete profile, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.",
      "specific_watch": "Review the effective tool inventory and client data policy before a new integration decision."
    },
    "change_history": [
      {
        "version": 1,
        "date": "2026-10-11",
        "change": "Initial documentation review; no earlier vendor assessment claimed."
      }
    ]
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#gitlab-mcp-project-permission-trust",
  "machine_readable_record": "/varexis-index/records/gitlab-mcp-project-permission-trust.json"
}