GitLab MCP Server 3.2.0 download

## Changelog
### 🚧 Maintenance
• 4656ffb1cf9b7c75a5b3683823967fbde2f0f6ad：Admit legacy HTTP tokens at the read_api minimum, uncharged and remembered (#1159) (@jmrplens)
• 4ef4e1d205f5597434c08e9ed53ebfc4637adcde：Answer a missing door permission uncharged (#1139) (@jmrplens)
• 219e7e08c5ffea6c87f7b2d4715b1ce66aba7ec8：Answer pipeline.latest from the ref GitLab was asked about when its head commit has no pipeline (#1252) (@jmrplens)
• 1dfe5367e227f71acf3f314797c9ead2e06a7a18：Answer the review of the documentation stack (#1196) (@jmrplens)
• ab63183edc9082de3470301a6ffc5591bc710b58：Ask GitLab for label counts where they are read, and publish only the counts it sent (#1217) (@jmrplens)
• 04630a41fe819e7c52daff1b262f5fd1835482c7：Attest the NuGet packages, hold nuget.org to them, and say how to verify what each package runs (#1123) (@jmrplens)
• d274a25d49efb5b732c07ea0910b161b29323b15：Bring the site level with the HTTP, OAuth, token and security guides (#1186) (@jmrplens)
• d8b46ffa4dd01b90886fefe6643f7a64bf529142：Bring the site level with the deployment, telemetry and sizing guides (#1187) (@jmrplens)
• 1696f0deec70780c80a1795ba57ebc22afc19986：Bring the site level with the install, client and CI/CD guides (#1188) (@jmrplens)
• 7939917b8ecc9e8a9616f3872589610b4d989d6a：Bring the site level with the reference and concept pages (#1189) (@jmrplens)
• 8fa69e1b1f227378eb56ccb9c412193e6b064147：Bring the upstream register to its state of 2026-10-06 (#1223) (@jmrplens)
• 6bc2c071d8eb24e544a01fb0236d69db370d8c06：Bring the upstream register to its state on 2026-10-08 (#1259) (@jmrplens)
• 96db3f73f62c1c6cc01bb9bb4f1ec1d68bf8d142：Bring the upstream register to its state on 2026-10-09 (#1264) (@jmrplens)
• e19b57926784dcdf40e53d9e5174146d020810c9：Bring the upstream register to the state of 2026-10-05 (#1178) (@jmrplens)
• ce4c7f39e56fd8bd26af8ad574f72e9647cc4276：Build the site on every change and hold its links and tables in CI (#1183) (@jmrplens)
• 39fcdb2626922eb93c88833b8fbaeb69f605b31d：Bump client-go to v3.15.0 and retire the system hook capture (#1177) (@jmrplens)
• 97e22dd2c1a37d2208bb37c7fa1a8ffc36f93888：Call the binary self-contained rather than static, and correct stale statements in llms-install.md and the Docker Hub page (#1263) (@jmrplens)
• d29641d5b1f7bf5fc84b553be170aae21ae730a6：Check the release binaries again when releasing, hold the image, bundles and notices to the release, and correct the stack's documentation (#1127) (@jmrplens)
• dec3a0936c497e210e2eab438e86c1b47da18f75：Clear the 56 open SonarCloud findings on main (#1118) (@jmrplens)
• f4c169d41a412e8d3a6238630016d76216751554：Close the condition and mutation gate of cmd/server, and gate the files only Windows and macOS build (#1206) (@jmrplens)
• c12f7bf4c97da0db3c2888245a4932ae56881c1a：Cover gitlab-org/gitlab and the Hackathon in the upstream contribution skill (#1261) (@jmrplens)
• 7efa36fb4c0b98af7c258d7358c82af2a816d538：Derive every action's requests and join them to the fine-grained permissions GitLab declares (#1143) (@jmrplens)
• aee74b3f603eafc09acfdcbcd767ef310b6bc540：Derive the classic scope each action needs and write it into the action grants table (#1244) (@jmrplens)
• 8153f1e4d0d0f435ce0cb6df76e09fc7ebad74de：Describe the widened supply-chain rule 2 in the command reference (#1249) (@jmrplens)
• 0f36d8982cab57ba8f5a69d1974d53bf2e137af0：Document fine-grained tokens (#1148) (@jmrplens)
• ae0d8c8c6bc9112e344de14e4c6d17481d65aecf：Document per-action token scopes and the read_api narrowing (#1248) (@jmrplens)
• bfee94634b07da48513510d2dbe7161b9013e02e：Fix what review found on the fine-grained stack: the collection flag, the spelling bound, an empty batch and SonarCloud's findings (#1152) (@jmrplens)
• a1a8fd3cee7e218b5c9e6d1ffea8aeb3aed73ee9：Generate the per-domain tool reference from the action catalog (#1191) (@jmrplens)
• 2d0bcea6e67c2491b8365360cb22c96808a53c86：Give gitlab_achievement an icon of its own, and hold the icon map to every group the catalog builds (#1227) (@jmrplens)
• 9ec744be00e947ea45f09080a2acef8cceb2d7a8：Give the tools/call refusals a middleware makes the resultType 2026-07-28 requires (#1120) (@jmrplens)
• 3d49e5ab2f9ebfede3a519fc191476c60ef6314e：Go 1.27.2 and golang.org/x/net v0.60.0 for the 2026-10-08 security advisories (#1265) (@jmrplens)
• 868d84a9301402cb51ad7ab31b089196e2d21778：Hold every script, make target and secret a credentialed job reaches to the supply-chain rule (#1229) (@jmrplens)
• faa932863f8b78201421dd063f3ba4ee34bdcf55：Hold the fine-grained table to the live record in the 1:1 audit (R-GRANT) (#1144) (@jmrplens)
• cfa70407fcf3d9195461ffe3a2446242a0d1cddf：Hold the read_api minimum to a real GitLab, on stdio and over HTTP (#1161) (@jmrplens)
• 9567ab73f3fb7a00d9caf69bca8eeff7c09ce464：Hold the read_api surface to GitLab's answers end to end (#1247) (@jmrplens)
• d638f9af5235f569b4b25751212922d1e1c41ca6：Keep the Premium board scope and list types off the Free schema, and grade parameter rows in audit_edition_tier (#1251) (@jmrplens)
• 75e7bbc3ddc45cbe9e2944241804fa93ae373c7b：Keep the bench harness's dead endpoint on its port for the whole test (#1131) (@jmrplens)
• d6627395b19666873556df6050cd7788031994ab：Key every board role and license hint on the refusal GitLab gives, and name the Planner role (#1226) (@jmrplens)
• 794517cc81f483b7bba0114c4793ae7f26f62a04：Launch Playwright's Chromium before reaching for apt in the site builds (#1257) (@jmrplens)
• 2a760f8e6522fae922546e0f484c6f8ecfff2889：Let GITLAB_MCP_YOLO_MODE pass the dynamic surface's destructive gate (#1214) (@jmrplens)
• 7ca75757319d2259f4c9c17c72b7bd508e31be6c：Let GitLab judge an Orbit query and teach version 12 of its DSL (#1205) (@jmrplens)
• bc02ee43581803b26a53dde1cb278e0e321f58f2：List the registered tools once per registration, bound a registration under the race detector by its own budget, and dial closed listeners only outside the parallel phase (#1258) (@jmrplens)
• 52d53ac5358697ad22949d5c9feccdb40f7588ed：Make every served resource and prompt description say what its handler reads, and refuse a malformed day count everywhere (#1228) (@jmrplens)
• 754bc28fb0ca5aa1451278da6b3617e4fc47068b：Measure the condition gate on Windows, macOS and Linux on demand (#1211) (@jmrplens)
• 13afe463b7ff37bed07e6720958622564f7b5646：Mint fine-grained tokens on the Docker instance and hold every surface to them (#1147) (@jmrplens)
• c6b3f61c5aa15ea2675a698da56e420a1740e57b：Move six upstream register entries out of Other into their projects' sections (#1136) (@jmrplens)
• 7519408c8d02412b878532383a2f122f9ad3512d：Move the upstream-only issues into the upstream register, and record the GitLab merge requests opened on 2026-10-07 (#1254) (@jmrplens)
• 8c963af59dbaedd33421b7f67dffbb5ceb4d3160：Name a credential in the log by a keyed digest, and clear the open Sonar issues (#1220) (@jmrplens)
• fdc2ebb27c3c1adf9ef4eef44778b41f1f3ae7bc：Name the pagination total in the dispatch output schema total_items, as every REST list result writes it (#1215) (@jmrplens)
• 8305be81332ed0651d1432ebd7b5c52e6d7c80d1：Pin devalue past three advisories, and record why basic-ftp cannot be (#1135) (@jmrplens)
• 5e38633a416efaf376330d77a8386845ad84f8e7：Point every link into the retiring docs/ pages at the site (#1192) (@jmrplens)
• aa837be3a0bc74920c528776e05d67e4d12894c7：Print each action's token requirements on its tool reference page (#1246) (@jmrplens)
• 8b425d5d62a9e1720f43955c193fe199a6b52698：Publish one Claude Desktop bundle per operating system (#1124) (@jmrplens)
• fbf81ff259e7c7fd89dab51a8435794b5f647209：Publish the approval state every Enterprise build answers the approvals routes with (#1201) (@jmrplens)
• fd4b34146a73dbea56b0c93dd2245679aef3778b：Publish the default surface's startup totals and reach on the site (#1184) (@jmrplens)
• e5713bb3419ad53090c8fe5b5650c7600481092b：Quote the permission GitLab says a fine-grained token lacks, and stop the stdio version loop (#1140) (@jmrplens)
• 7bf08aa2f50bfd63fa5b76807df698aa0f7017d2：Raise the bound on GitLab's reflected message to 2048 bytes (#1204) (@jmrplens)
• 44fddee9f8f12a0a8ef90ba755485e19c714aeb6：Read a fine-grained token as unknown authority (#1138) (@jmrplens)
• 394a8240f5dd15293b66b5ab45c971dc8209b722：Read a reaped launcher test process as gone instead of failing (#1198) (@jmrplens)
• c39571322d674b28411516a74f3ce92a3834f6ae：Read merge_request.commits and search.commits from the captured response (#1200) (@jmrplens)
• 9c83df3aa877ccc631eeae1884e91f877c81267e：Recognize a Codex client on stateless HTTP by its User-Agent (#1199) (@jmrplens)
• dcb611ca285715858f62862f805452c3beac57f5：Record fine-grained authorization in the live GitLab record (schema 4) (#1141) (@jmrplens)
• 66a032fad25e97ab755b3fb142f6fadbbbdc8c1a：Record the merge requests opened for register rows 24, 86 and 89, and refresh the top of the stack (#1207) (@jmrplens)
• 9f38e914c4d3c7235299716d1ab43bd69a40128b：Record the register's documentation merge requests as they stand on 2026-10-04 (#1153) (@jmrplens)
• 7204974a9b624ca2c137a4aa95fde8e2ff6770e6：Record the site as the only home of user documentation (#1193) (@jmrplens)
• edbd858b8d6327385d5bb39708385d41d490c4c2：Record the tier's Free fallback as INV-008's exception (#1158) (@jmrplens)
• 072520b0593fc414c9f21f23f5e1c322596ad823：Record the upstream gaps fine-grained tokens run into, as register rows 82 to 85 (#1117) (@jmrplens)
• f73f440fca04a7c82e87e314ab3fded4786756c8：Record the upstream state of 2026-10-02 in the register, with row 92 for the moved-project 405 (#1134) (@jmrplens)
• cdf6d85b91e610c96c031efb92842385cc10e3e7：Record why http-cache-semantics cannot be pinned for the site audit (#1151) (@jmrplens)
• 9b36bb3779f7381951c3cf92a01ab83c3ad5e7dc：Refuse every stdio catalog request for a token below the read_api minimum (#1160) (@jmrplens)
• 8e81e472f6cf885ce62bd6853bc56e8caa0f00f5：Regenerate the committed artifacts on the stacked tree (#11