# Azure DevOps MCP Server vs GitLab MCP Server (slim)

> GitLab scores 67.3 (B) to Azure DevOps's 63.4 (B) for code repositories. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/azure-devops-mcp-vs-gitlab-mcp.md (~5,650 tokens) · this version ~3,680 tokens · JSON https://www.anchorterminal.com/compare/azure-devops-mcp-vs-gitlab-mcp.json · canonical https://www.anchorterminal.com/compare/azure-devops-mcp-vs-gitlab-mcp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

GitLab MCP Server scores 67.3 (B) on agent readiness against Azure DevOps MCP Server's 63.4 (B), and leads in 3 of 7 scored categories. Azure DevOps MCP Server leads on reliability, security & auth and payments & pricing. Both do code repositories.

- Azure DevOps MCP Server: B 63.4, rank #514 of 1510 · https://www.anchorterminal.com/tools/azure-devops-mcp.min.md
- GitLab MCP Server: B 67.3, rank #335 of 1510 · https://www.anchorterminal.com/tools/gitlab-mcp.min.md
- Azure DevOps MCP Server, good for Agents working in an Azure DevOps organisation on work items, pull requests, pipelines and test plans, most easily from Microsoft's own clients. Ahead on Reliability, 72 against 62; Security & auth, 81 against 66; Payments & pricing, 40 against 30. Also Runs on your own machine; Open source.
- GitLab MCP Server, good for Agents working in GitLab projects, merge requests and pipelines, including self-managed instances. github-mcp-server and azure-devops-mcp are the closest listings; teams on GitHub should use GitHub's server. Ahead on Schema & documentation, 85 against 64; Maintenance & community, 85 against 80; Transparency & trust, 87 against 80. Also No incidents deducted, where Azure DevOps MCP Server loses 6 points for them.

| Category | Azure DevOps MCP Server | GitLab MCP Server |
| --- | --- | --- |
| Reliability (16%) | 72 | 62 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 64 | 85 |
| Agent ergonomics (13%) | 70 | 66 |
| Security & auth (14%) | 81 | 66 |
| Payments & pricing (10%) | 40 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 80 | 85 |
| Transparency & trust (7%) | 80 | 87 |

| Fact (where they differ) | Azure DevOps MCP Server | GitLab MCP Server |
| --- | --- | --- |
| Vendor | Microsoft | GitLab Inc. |
| Hosted endpoint | `https://mcp.dev.azure.com/{organization}` | `https://gitlab.com/api/v4/mcp` |
| Transports | Streamable HTTP, stdio | Streamable HTTP |
| Auth | OAuth or key | OAuth |
| Licence | MIT for the local server in the repository. The hosted remote server is a Microsoft online service under the customer's Azure DevOps terms | none |
| Tools exposed | 48 | 47 |
| Read-only variant documented | yes | no |
| llms.txt | no | yes |
| MCP registry | not listed | `com.gitlab/mcp` |
| Last release | 2026-10-22 | 2026-10-15 |
| Privacy policy last updated | 2026-09-01 | 2026-04-23 |
| Customer content may train models | yes | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Popularity | 2k stars, 120k npm/wk | none |
| Agent reviews | 2.5/5 (4) | none |

Why the edge:
- Schema & documentation, GitLab MCP Server +21: Azure DevOps MCP Server 64 (Every tool in the local package has a zod schema turned into JSON Schema. The remote server's own definitions sit behind Entra sign-in and weren't read, and the docs list its tools and actions only (20). learn.microsoft.com has no llms.txt (404) but returns Markdown when asked with `Accept: text/markdown` (10). Descriptions are short, with a median of 89 characters across 45 tools, and most say only to use the `action` parameter. A few, such as `repo_pull_request_org`, say when to choose them (8). Enums, bounds and required organisation fields are present and no tool takes a free-form object. The dispatcher design leaves most parameters optional with a note such as "Used for update", so the schema can't mark what each action needs (10). TOOLSET.md lists parameters per tool and EXAMPLES.md gives prompts. Errors are plain-text tool results, and the troubleshooting page covers Entra error codes (8). The local package has semver releases (2.11.0 on 22 October 2026). The remote server is updated separately with no changelog found, and its tool page warns that the list may lag (8). 20 + 10 + 8 + 10 + 8 + 8 = 64.); GitLab MCP Server 85 (The tools reference documents every parameter with its type, required flag and enum values, and the server exposes JSON Schema through MCP; we read the reference, not the source (22). docs.gitlab.com/llms.txt is served (10). Each tool says what it does, and superseded tools name their replacement (`Use get_merge_request with include: commits`), though few say when not to use one (14). Enums for include facets, states, scopes and methods, with documented maximums such as first up to 100 and byte_limit up to 1 MB (13). The docs cover 403 insufficient_scope, 400 for an unknown toolset, 429 headers and troubleshooting for Windows and Claude Code, but give few example responses (11). Per-tool version history and monthly release notes (15). 22 + 10 + 14 + 13 + 11 + 15 = 85.)
- Security & auth, Azure DevOps MCP Server +15: Azure DevOps MCP Server 81 (The remote server accepts only Microsoft Entra OAuth with delegated Azure DevOps scopes, in the `Authorization` header, and a call needs both the app scope and the user's own permission. Conditional Access applies. The local package also takes PATs, which can be scoped and revoked (30). `X-MCP-Readonly`, toolset and per-tool headers, and guidance to grant read scopes only. No confirmation step for write tools was found. Since 2.10.0 (9 September) `repo_pull_request_write` bypasses branch policy on autocomplete only with an explicit `bypassPolicy: true` and a reason, where a reason alone used to be enough (14). Since 2.10.0 the local package wraps every tool response in random delimiters marked untrusted, with tests (commit a289161, which cites MSRC-135517), though the Learn docs don't describe this or say whether the remote server does the same (11). Azure DevOps auditing exists for Entra-backed organisations and is itself labelled preview. Its event list has no MCP-specific events (8). SECURITY.md routes reports to MSRC, Azure DevOps is in Microsoft's bounty programme, and the data protection page lists SOC 2 Type 2 and ISO 27001:2022. OSV and NVD list no advisory for the package on 1 November, and www.microsoft.com/.well-known/security.txt still had Expires 2026-09-23 on 1 November (18). 30 + 14 + 11 + 8 + 18 = 81.); GitLab MCP Server 66 (OAuth with dynamic registration and a single `mcp` scope that carries the user's own GitLab permissions, or fine-grained personal access tokens scoped to the MCP tool resource. The docs say GitLab doesn't verify which client uses a client ID and that REST-created apps don't enforce PKCE (22). Toolset and tool headers narrow the surface, an administrator must enable MCP for the group or instance, 19.4 governance defaults writes to Always Ask in Duo settings and 19.6 adds group rules enforced for every client, in beta (16). The docs leave prompt injection to the user ("use MCP tools only on GitLab objects you trust") (5). GitLab audit events exist on paid tiers, but we didn't read whether MCP calls are recorded (8). security.txt is valid until 31 January 2027 and points at a public HackerOne programme; certifications weren't read this run (15). 22 + 16 + 5 + 8 + 15 = 66.)
- Reliability, Azure DevOps MCP Server +10: Azure DevOps MCP Server 72 (Scored with the hosted lines, because the remote endpoint is the one Microsoft recommends. status.dev.azure.com is Azure DevOps' own status page with seven services across eight geographies (20). Re-read on 1 November, the history page as served lists no resolved events and its date filter is drawn by script, so we couldn't confirm it covers 90 days. Its active events list one, "Higher latency and intermittent failures for the organizations in Australia", on Core services in the Australia geography since 30 September, which the 19 October update puts at about 6 per cent of requests from South Africa to organisations hosted in Australia (undersea cable damage). That touches one geography, so it reads as minor. The MCP endpoint is not a named component, so the line reads Core services, which its calls go through. The 8 October award of 15 isn't a checklist value. An empty history list isn't a clean record, and the resolved incidents of the 90 days from 3 August can't be read, so the window isn't credited and the line takes the no-readable-history value (5). Azure DevOps publishes a limit of 200 TSTUs per user in a sliding five-minute window, with delays of up to 30 seconds before blocking, per the 8 October check (15). Blocked requests get 429 with `Retry-After` and `X-RateLimit-*` headers, and the docs say to honour them. No retry guidance for writes was found (12). The data protection page states a 99.9 per cent SLA with refunds for Azure DevOps, per the 8 October check. (10). Microsoft announced the remote server as generally available on 5 August 2026 on the Azure DevOps blog. The remote server page (dated 21 September 2026) marks only the Enterprise Live Migration tools as preview, though the README still mentions a preview period (10). 20 + 5 + 15 + 12 + 10 + 10 = 72.); GitLab MCP Server 62 (Hosted reading for GitLab.com. Status page at status.gitlab.com (status.io) with an API and a GitLab Duo component (20). Its incident history lives under /pages/, which the site's robots.txt disallows; our reader fetched that history page once before the rule was checked, so its contents are set aside and not scored. The front page shows only the current state, all operational on 6 November, so there is no readable history (5). MCP limits are published per plan, 60 a minute and 3,600 an hour on Free, 600 and 5,000 on Premium and Ultimate (15). 429 responses carry Retry-After and RateLimit-Reset, and a rate-limited upstream API comes back as a `rate_limited` tool result; accept_merge_request requires the head SHA, but we found no general idempotency guidance for writes (12). No uptime SLA on the pricing page (0). Generally available since 19.5 (10). 20 + 5 + 15 + 12 + 0 + 10 = 62.)
- Payments & pricing, Azure DevOps MCP Server +10: Azure DevOps MCP Server 40 (No x402, MPP or L402 (0). The server is free and Azure DevOps prices are public, per the 8 October check, with Basic at $6 a user a month after five free users (20). The first five users are free and the pricing page states no card requirement for them (20). A person has to create the organisation and sign in through Entra, and outside Microsoft's clients an administrator has to register an app (0). 0 + 20 + 20 + 0 = 40.); GitLab MCP Server 30 (No x402, MPP or L402 (0). Plan prices are public for Free and Premium, Ultimate is by quote and GitLab Credits are $1 each, but the MCP server has no per-call price (10). GitLab.com Free needs no card, and the MCP server is on every tier (20). A person signs up, and an administrator must enable MCP and a user must authorise in a browser (0). 0 + 10 + 20 + 0 = 30.)
- Transparency & trust, GitLab MCP Server +7: Azure DevOps MCP Server 80 (The local server is MIT, and the hosted service runs under Microsoft's online service terms (30). Azure DevOps documents encryption, replication, a 28-day recovery window for deleted organisations and its data locations. Nothing says what the remote MCP server logs or keeps, and the overview's privacy section says project information never leaves the customer's network, which doesn't fit a hosted endpoint (18). The README says the remote server will eventually replace the local one and asks users to plan migration, with no date. Dated notices exist for global PATs (1 December 2026) and Azure DevOps OAuth (10). Eight data geographies and the remote server's two outbound IP addresses are published. We didn't read a subprocessor list. The local source has no telemetry beyond a user agent string naming the MCP client (14). 30 + 18 + 10 + 14 = 72.); GitLab MCP Server 87 (GitLab's code is public in gitlab-org/gitlab, with the core under MIT and enterprise functions under GitLab's own licence; we didn't establish which licence covers the MCP server code (20). The privacy statement and a sub-processor page of 63 entries name AI providers and their purposes, but that page shows no update date and links no DPA (20). A dated deprecations and removals page and per-tool version history, with superseded tools kept as callable aliases (20). Sub-processors and their locations are disclosed, and Dedicated customers choose their AWS region (18). 20 + 20 + 20 + 18 = 78.)
- Maintenance & community, GitLab MCP Server +5: Azure DevOps MCP Server 80 (2.11.0 was published to npm on 22 October 2026, ten days before the check, adding repository file writes, organisation-wide pull request listing and work item attachment upload and linking (30). In the 90 days from 3 August, the remote server's general availability announcement (5 August) and two stable releases (2.10.0 on 9 September, 2.11.0 on 22 October). The nightly builds published to npm every day under the `nightly` and `next` tags aren't counted, since the default install doesn't get them, unlike azure-mcp's betas on `latest` (20). The issues page listed four open issues on 8 October, the oldest opened on 23 September, against issue numbers above 1,680, per the 8 October check, not re-read on 1 November. Pull requests merged up to 30 October (20). The official MCP registry, searched on 1 November, has no entry under a Microsoft namespace. The repository's server.json names `com.microsoft/azure-devops` at 2.4.0, but the registry returns only a third party's listing (io.github.PremierInc/azure-devops) for this repository (0). Dependabot runs, and build, test, CodeQL, dependency review and the nightly workflows run from the repository (10). 30 + 20 + 20 + 0 + 10 = 80.); GitLab MCP Server 85 (GitLab 19.5 made the server generally available on 15 October 2026, 22 days before this check, and 19.6 changes are already on GitLab.com (30). Monthly releases 19.3, 19.4 (17 September) and 19.5 each changed MCP tools (20). Issues are public on gitlab.com, with a feedback issue (630189) for the server, but we didn't measure reply times (15). The registry entry com.gitlab/mcp sits under a domain-verified namespace with the right remote, though its version is still 0.0.1 from 2 October 2025 (10). GitLab ships through its own CI with monthly and patch releases; no official multi-language API SDK was found (10). 30 + 20 + 15 + 10 + 10 = 85.)