GitLab MCP Server 3.4.0 ڈاؤن لوڈ

## Summary

3.4.0 serves input schemas the Anthropic Messages API accepts on every surface, can ask a person its questions in Spanish, follows GitLab.com's move of the Orbit routes, and tightens HTTP mode's authentication budgets, its listener and the configuration it starts with.

• No tool carries `allOf`, `anyOf`, `oneOf`, `not`, `if`, `then` or `else` at the root of its input schema (#1509). The Anthropic Messages API refuses a whole request whose tool list holds one, and 3.3.0 served one on several individual tools and on every meta tool in the `compact` and `full` parameter-schema modes. Each rule stays in the catalog, which `gitlab_find_action` and `gitlab://tools` read, and the handler enforces it before anything is sent.
• `GITLAB_MCP_LANGUAGE=es` (or `--language=es`) serves the texts a person reads directly in Spanish：the questions and field titles of the guided flows, the confirmation of a destructive action and the progress messages (#1577 to #1581, ADR-0027). What the model reads stays in English, and a server that sets nothing, or `en`, serves the same texts as 3.3.0.
• Orbit (#1585, #1593)：GitLab.com removed five of the six REST routes the Orbit tools read on 27 and 28 October, and `orbit.status`, `orbit.schema`, `orbit.tools`, `orbit.dsl` and `orbit.graph_status` now read GitLab's GraphQL API and its Orbit MCP endpoint, under the same action IDs, tool names and parameters. Since Orbit's general availability on 29 October, GitLab.com serves a namespace's index and queries only for a top-level group with the `orbit_promo` add-on or an Orbit trial; `orbit.graph_status` publishes such a group's Orbit `access` and `trial` to a token with the Owner role there, and answers a group without access with them rather than with an error.
• HTTP mode：the authentication budgets key an IPv6 address by its /64 and bound each /48, and `unix` in `--trusted-proxies` lets a proxy on a unix socket name its callers through `--trusted-proxy-header` (#1481). The two server cards and the RFC 9728 metadata are rate-limited per client address, at 20 requests a second with a burst of 200 by default (`--discovery-rate-limit-rps`, `--discovery-rate-limit-burst`, `0` to turn it off) (#1483). A listener off loopback that serves plain HTTP warns at startup, and `GITLAB_MCP_ALLOW_PLAINTEXT_HTTP=false` (or `--allow-plaintext-http=false`) refuses one (#1561). A session refused because it is not open for the presented credential is no longer described as belonging to another credential, which was false of one that idled out or did not survive a restart (#1484).
• Configuration (#1519 to #1524)：a zero means off wherever it has a meaning, through the flag and the variable alike, and `0s` reads as `0`; a value the server cannot use refuses the start on both transports instead of being replaced or ignored (see Breaking changes). A stdio server no longer reads the settings only HTTP mode has, and names any it finds set, and it now honors `GITLAB_MCP_SESSION_REVALIDATE_INTERVAL`. `--max-listen-streams` sets the listen ceiling as a flag.
• `gitlab_find_action` ranks the action a plural noun names first, so `list issues` answers `issue.list` (#1470). A string parameter GitLab checks (an email address, a URL, a commit SHA, a cron expression, a semantic version and others) declares its format or pattern, and find's example call fills it with a value of that form (#1504). Every text block of a result is annotated with the priority the output format reference documents, 0.4 for a list, 0.6 for a read and 0.8 for a write, where 3.3.0 annotated most with 0.7 (#1499).
• New parameters：client-go v3.30.0 (#1460), with `member_role_id` on the access levels of project and group protected branches (Ultimate); an `avatar` on `group.create`, `project.create`, `project.create_for_user`, `user.create`, `user.modify`, `admin.topic_create` and `admin.topic_update`, `remove_avatar` on `group.update`, `project.update` and `admin.topic_update`, and 39 more `override_params` keys on `project.import_from_file` (#1640); `hide_backlog_list` and `hide_closed_list` on `group.group_board_update` (#1510); `archived` on `project.label_list`, and `ref` on `search.commits` and `search.wiki` for a project search (#1635). The board listings name every column with a work-in-progress limit (#1512), `mr_review.changes_get` publishes its pagination (#1584), and `security_scan_profile.attach` takes the `business_logic` (GitLab 19.5) and `skillguard` (GitLab 19.6) default profiles by name (#1585).
• Fixes:
• An inline comment or draft note on a file past the first page of a merge request's diff is no longer refused as outside the diff, and the five prompts that read a merge request's changed files say when they read only the first page (#1584, from #1517 by Nikita Turchaninov).
• `access.approve_project` and `access.approve_group` refuse a level the project or group does not grant, where `0` used to grant Developer and another level left the request pending while it was reported as approved; every membership access level parameter offers only the levels its route accepts (#1567).
• On the meta and dynamic surfaces, a protected environment approval rule given a count and no grantee was sent as a rule for Maintainers, and an update of a rule by its `id` moved its grantee to Maintainers; the dynamic surface also turned a top-level `required_approval_count` into such a rule. Both are now refused before a request on every surface (#1503).
• `merge_request.cancel_auto_merge` falls back to the deprecated route when GitLab 19.5 or later answers `cancel_auto_merge` with 404, as a node can during a rolling upgrade (#1594).
• A 405 for a project named by a path it no longer has says to retry with the project's ID, instead of reading as a refusal of the merge request, file or token the call was about (#1496).
• `job.trace` removes the timestamp a runner writes in front of each line and joins a line the runner wrote in pieces, so `tail_lines` counts the lines the job printed (#1498).
• The external status check create and delete name the Maintainer role on the 403 GitLab 19.5 answers a caller without it (#1463), and the safe-mode preview names both spellings that turn safe mode off (#1497).
• Release and project：the image is built on Alpine 3.24.3 (#1554), and its packages are held to Trivy's vulnerability database before anything is pushed (#1553). Every release binary is rebuilt from its tag and compared byte for byte, binaries from this release on are stamped with the full commit, and `scripts/install.sh` honors `DESTDIR` (#1557). Each release opens with a written summary (#1555), and the PyPI wheels carry PEP 740 publish attestations (#1551). The telemetry guide has a worked OpenTelemetry collector example (#1471), the repository states its governance, review standard and roadmap (#1556) and a security policy that describes what happens (#1560), and every commit is signed off under the Developer Certificate of Origin (#1562).

## Breaking changes

Configurations that started under 3.3.0 with a value the server ignored or replaced now refuse to start, naming the setting:

• A unix-socket `--http-addr` whose `--trusted-proxies` names addresses and not `unix`, which used to start with `--trusted-proxy-header` ignored, so every caller on the socket shared one budget (#1481).
• `--oauth-cache-ttl` at `0` or below, in either authentication mode, as `GITLAB_MCP_OAUTH_CACHE_TTL` already was (#1519).
• A negative `--session-timeout`, `--revalidate-interval` or `--pool-idle-timeout` (#1520).
• In HTTP mode, an upload size (`--upload-max-file-size`, `GITLAB_MCP_UPLOAD_MAX_FILE_SIZE`) that does not parse, is not positive or lies above 1 TB, as stdio already refused; on both transports, a size whose byte count does not fit in 64 bits, such as `17179869185GB` (#1524).
• With telemetry on, an identity policy the server does not know, or, with no key configured, a key rotation that does not parse or lies outside 0 to 720h (#1523).

HTTP mode's budgets are shared differently (#1481)：every address of one IPv6 /64 spends one fast budget and one distinct-credential budget, as the callers behind one IPv4 NAT share an address's, and ten /64s of one /48 that had a credential refused inside `--auth-distinct-token-window` block the whole /48 for every credential the deployment does not already serve. `--auth-failure-window=0` no longer turns the distinct-credential budget off, and `GITLAB_MCP_SESSION_TIMEOUT=0` turns the idle timeout off instead of refusing the start (#1519).

The Orbit outputs no longer carry what GitLab.com stopped sending (#1585)：the status's `user`, `system`, `timestamp` and `formatted_text`, and each component's `replicas` and `metrics`; the schema's `schema_version`, each domain's description and each node's incoming and outgoing edges; and the index's `formatted_text`, `last_started_at`, `last_duration_ms` and `last_error`. `response_format` on the status and the index is accepted and changes nothing, and `orbit.query` refuses a query sent as a JSON object, since GitLab.com removed the JSON query DSL on 27 October.

Withdrawn, as the versioning policy allows in a minor release for what a tool could never honor:

• `pagination`, `page_token` and `order_by` on `group.service_account_pat_list` and `project.service_account_pat_list`, whose routes answer every keyset request with 405 and read no `order_by`; `sort` takes the eight orders the routes document in place of `asc` and `desc` (#1573).
• `new_epic` on `user.notification_project_update`, which the project route does not declare (#1570).
• `repository_checksum_failed` and `wiki_checksum_failed` on `project.list`, `project.list_forks`, `project.list_user_projects`, `project.list_user_starred` and `project.list_user_contributed`, which no route reads, so a list asked for them answered every project (#1570).
• `access_level_description` on the approval rules of `environment.protected_protect`, `environment.protected_u