# GitLab: L1 · Needs a person As of 19 Oct 2026, an AI agent can't use GitLab on its own: Arkose Labs puzzle on the sign-up form. Source: https://agentdrives.com/tools/gitlab?via=md · driven 19 Oct 2026 by AgentDrives's agent · 2 of 2 drives agree · Rules of 20 Oct 2026 (rules version rules-2026-10-20-24: https://agentdrives.com/method/changelog?via=md#rules-2026-10-20-24) · method release 2026-Q4.9 · category Project management · license CC BY 4.0 **Not audited** Signup stops an agent cold: both sign-up forms show an Arkose Labs puzzle asking it to prove it's a real person, and our agent never got past it. That's L1 · Needs a person: a person has to open an account before any key work starts. With no account, robots.txt blocks keyless reads of the API too, so neither the REST endpoints nor the MCP server could be tried. Docs promise real agent surfaces once a person sets it up: llms.txt, an official MCP server with OAuth and dynamic client registration, OpenAPI docs, a CLI and a device grant. Paying and cancelling sit behind the same wall, in the Customers Portal, never reached this drive. _Written and checked by our agents from this drive's record. How we write: https://agentdrives.com/method?via=md#notes_ L1 · Needs a person: There is an API, CLI or MCP server, but an agent can't get in on its own: a person has to sign up, verify or make the key. - Learn: Docs it can act on (llms.txt, an OpenAPI and an MCP server) - Access: Can't sign up - Use: Work not reached - Pay: Payment not reached - Leave: Leaving not reached - Next: let an agent sign up on its own - robots.txt asks crawlers to stay off sign-up and the API. Nothing to fix. It keeps these pages out of search and doesn't stop agents signing up. ## The drive, checkpoint by checkpoint 1. **Docs**: on its own (19 Oct 2026) 2. **Sign up**: needs a person (19 Oct 2026) 3. **Verify**: not reached 4. **Key**: not reached 5. **First call**: not reached 6. **First action**: not reached 7. **Pay**: not reached 8. **Cancel**: not reached 9. **Delete**: not reached Where it stopped: **Sign up** (19 Oct 2026). A puzzle challenge blocks the sign-up button. ## How an agent gets in None of the 9 ways in worked without a person. It stopped at sign up, in the drive of 19 Oct 2026. The other ways in, as our agent tried them: - No key needed: Stopped by robots.txt - Email and password: Stopped by a CAPTCHA - Continue with GitHub: Not tried: no account yet - Continue with Google: Not tried: no account yet - CLI code login: Not tried: the same as another way - Sign-in for apps (OAuth, MCP): Not tried: the same as another way - Company single sign-on: Not tried: needs a person's account - Marketplace install: Not tried: a step our agent doesn't take - Added by an admin: Not tried: needs a person's account ## Two kinds of agent - An assistant in a browser (like ChatGPT agent or Claude on a computer): Signing up needs a person: a Arkose challenge blocks the sign-up. - An agent talking to it directly (API, MCP, agent payments): Signing up needs a person: a Arkose challenge blocks the sign-up. ## Who gets in - Agents on a server: Stopped by a CAPTCHA on the sign-up form. - Signed agents: The sign-up page opens. The CAPTCHA on the form stops them too. - Agents in a person's browser: Needs a person. Sign-up page checked 23 Oct 2026. Signed agents: the ones Cloudflare verifies. ## What an agent can do Our agent didn't get in, so none of the 10 core capabilities was tried, in the drive of 19 Oct 2026. | Capability | Result | API | MCP | CLI | UI | |---|---|---|---|---|---| | Create a project or repository | Not tried | Not tried | Not offered | Not tried | Not tried | | Create an issue | Not tried | Not tried | Not tried | Not tried | Not tried | | Create a merge request to review code changes | Not tried | Not tried | Not tried | Not tried | Not tried | | Comment on an issue or merge request | Not tried | Not tried | Not tried | Not tried | Not tried | | Run a CI/CD pipeline | Not tried | Not tried | Not offered | Not tried | Not tried | | Deploy or release an application | Not tried | Not tried | Not offered | Not tried | Not tried | | Scan code for security vulnerabilities (SAST/dependency/container scanning) | Not tried | Not tried | Not offered | Not offered | Not tried | | Ask GitLab Duo Chat a question about code | Not tried | Not tried | Not offered | Not offered | Not tried | | Delegate a task to a GitLab Duo Agent Platform agent/flow | Not tried | Not offered | Not offered | Not offered | Not tried | | Get AI code suggestions while typing | Not tried | Not offered | Not offered | Not offered | Not tried | Other capabilities: 0 of 27 done. | Capability | Result | API | MCP | CLI | UI | |---|---|---|---|---|---| | Add a label to an issue | Not tried | Not tried | Not offered | Not tried | Not tried | | Add a milestone to a project | Not tried | Not tried | Not offered | Not offered | Not tried | | Group issues into an epic | Not tried | Not tried | Not offered | Not offered | Not tried | | Create an issue board (Kanban) | Not tried | Not tried | Not offered | Not offered | Not tried | | Log time spent on an issue | Not tried | Not tried | Not offered | Not tried | Not tried | | Search across projects and code | Not tried | Not tried | Not tried | Not tried | Not tried | | Semantic code search | Not tried | Not offered | Not offered | Not offered | Not tried | | Request approval on a merge request | Not tried | Not tried | Not offered | Not tried | Not tried | | Create a wiki page | Not tried | Not tried | Not offered | Not offered | Not tried | | Publish a static site with GitLab Pages | Not tried | Not tried | Not offered | Not offered | Not tried | | Publish a package to the Package/Container Registry | Not tried | Not tried | Not offered | Not tried | Not tried | | Export project data | Not tried | Not tried | Not offered | Not offered | Not tried | | Import a repository from another tool | Not tried | Not tried | Not offered | Not tried | Not tried | | Register a webhook | Not tried | Not tried | Not offered | Not offered | Not tried | | View DORA / analytics dashboards | Not tried | Not tried | Not offered | Not offered | Not tried | | Manage feature flags | Not tried | Not tried | Not offered | Not offered | Not tried | | Manage incidents | Not tried | Not tried | Not offered | Not offered | Not tried | | Manage Kubernetes cluster agents | Not tried | Not tried | Not offered | Not tried | Not tried | | Invite a member to a project or group | Not tried | Not tried | Not offered | Not tried | Not tried | | Set a member's role/permissions | Not tried | Not tried | Not offered | Not offered | Not tried | | Create an API personal access token | Not tried | Not tried | Not offered | Not offered | Not tried | | Configure SAML SSO | Not tried | Not offered | Not offered | Not offered | Not tried | | Enable two-factor authentication | Not tried | Not offered | Not offered | Not offered | Not tried | | Read the audit log | Not tried | Not tried | Not offered | Not offered | Not tried | | Change the subscription plan | Not tried | Not offered | Not offered | Not offered | Not tried | | Query GitLab Orbit knowledge graph | Not tried | Not tried | Not tried | Not tried | Not offered | | Build a workspace in the browser (Web IDE / Remote Development) | Not tried | Not tried | Not offered | Not offered | Not tried | What it can't, and why: - Create a GitLab.com account: Arkose Labs puzzle on both sign-up forms - Call the public REST API or MCP server without an account: robots.txt disallows /api/v* for all user agents - Any capability in the map (projects, issues, MRs, pipelines, releases): no account could be made ## GitLab, drive by drive The same level in both drives. | Drive | Level | Stopped at | Agent | |---|---|---|---| | 19 Oct 2026 | L1 | Sign up | Version 4 | | 19 Oct 2026 | L1 | Sign up | Version 4 | Every drive and move as data: https://agentdrives.com/api/tools/gitlab/changes.json ## How an agent connects - **MCP server**: yes. Official server. HTTP at /api/v4/mcp, OAuth + DCR · id srf_01m59bvv69vs2fxwgjj6hdh3n2 - **API**: yes. REST v4 + GraphQL, documented · id srf_01m59bvv692j68447k4sqhstb7 - **OpenAPI**: yes. docs say OpenAPI 3.0 (openapi_v3.yaml in the monorepo); raw file disallowed by robots.txt, declared field not read - **CLI**: yes. glab · id srf_01m59bvv69yt360tm29kmqjb3x - **SDK**: none found - **Agent payments**: yes. Stripe Projects - **llms.txt**: yes ## Does GitLab have an MCP server, and can an agent connect to it? Yes. GitLab has an official MCP server. A new agent can't get in on its own: in the drive of 19 Oct 2026, our agent stopped at sign up (it needs a person). ## How does an AI agent get a GitLab API key? Not reached: in the drive of 19 Oct 2026, sign-up stopped our agent first (it needs a person). Not reached: no account. Docs offer personal access tokens, OAuth device grant and DCR for MCP. ## Paying the agent way Payment not reached. The checkout: The checkout wasn't reached: Premium, $29 a year. Ways to pay it offers an agent: Stripe Projects (on its own domain). What would let agents pay on their own: - Accept x402 or MPP on your API: Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card. Ways to pay checked 19 Oct 2026. Is this your product? Claim it free to reply next to the result and see how many things this drive found to fix. An Audit Drive ($499) gives you your fix list with how to make each fix, the whole drive here for 12 months, and new drives after your fixes: https://agentdrives.com/pricing?via=md#audit. Fixed something? Tell us in your account and our agent drives it again for free, up to twice a year. ## Behind the level - Agent-ready setup: llms.txt found, OpenAPI found, MCP server found, CLI found - Not measured in this drive: Holds up, Docs match ## The docs 425 of 3,738 pages read. Complete. - A getting-started page - An auth page - Errors listed with their codes - Code examples on some pages - Newest page updated 19 Oct 2026 - A page for 10 of 10 core tasks ## GitLab in Project management Not ranked in Project management: our agent couldn't get in on its own. 4 products are ranked. 4 of the 15 products we drove in Project management are higher; 10 others share L1. As of 22 Oct 2026. Products by level: L0 0, L1 11, L2 0, L3 0, L4 4, L5 0. Also stopped at sign up: - [Asana](https://agentdrives.com/tools/asana.md?via=md): L1 · Needs a person, driven 17 Oct 2026 - [Basecamp](https://agentdrives.com/tools/basecamp.md?via=md): L1 · Needs a person, driven 22 Oct 2026 - [ClickUp](https://agentdrives.com/tools/clickup.md?via=md): L1 · Needs a person, driven 16 Oct 2026 - [GitHub](https://agentdrives.com/tools/github.md?via=md): L1 · Needs a person, driven 20 Oct 2026 - [Jira](https://agentdrives.com/tools/atlassian.md?via=md): L1 · Needs a person, driven 14 Oct 2026 - [Linear](https://agentdrives.com/tools/linear.md?via=md): L1 · Needs a person, driven 16 Oct 2026 All of Project management, by level: https://agentdrives.com/categories/project-management?via=md ## Tips for agent builders - A person must create the GitLab.com account (Arkose puzzle); after that use the official MCP server at https://gitlab.com/api/v4/mcp (OAuth, DCR, scope mcp) or REST with a token. - glab and the OAuth device grant (/oauth/authorize_device) give browser-free credentials once an account exists. ## As data - JSON: https://agentdrives.com/api/tools/gitlab.json?via=md - Markdown: https://agentdrives.com/tools/gitlab.md?via=md - Changes: https://agentdrives.com/api/tools/gitlab/changes.json - Stable id: prd_01m57vgtgxgnzbkf6we4em96b1 (https://agentdrives.com/id/prd_01m57vgtgxgnzbkf6we4em96b1) - MCP: get_tool {"slug":"gitlab"}