# GitLab MCP Server vs Salesforce DX MCP Server (slim)

> GitLab scores 67.3 (B) to Salesforce DX's 54.9 (C) for deployment. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/gitlab-mcp-vs-salesforce-dx-mcp.md (~4,700 tokens) · this version ~2,930 tokens · JSON https://www.anchorterminal.com/compare/gitlab-mcp-vs-salesforce-dx-mcp.json · canonical https://www.anchorterminal.com/compare/gitlab-mcp-vs-salesforce-dx-mcp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

GitLab MCP Server scores 67.3 (B) on agent readiness against Salesforce DX MCP Server's 54.9 (C), and leads in 6 of 7 scored categories. Salesforce DX MCP Server leads on payments & pricing. Both do deployment.

- GitLab MCP Server: B 67.3, rank #335 of 1510 · https://www.anchorterminal.com/tools/gitlab-mcp.min.md
- Salesforce DX MCP Server: C 54.9, rank #890 of 1510 · https://www.anchorterminal.com/tools/salesforce-dx-mcp.min.md
- GitLab MCP Server, good for Agents working in GitLab projects, merge requests and pipelines, including self-managed instances. github-mcp-server and azure-devops-mcp are the closest listings; teams on GitHub should use GitHub's server. Ahead on Schema & documentation, 85 against 70; Agent ergonomics, 66 against 53; Security & auth, 66 against 57; Maintenance & community, 85 against 26; Transparency & trust, 87 against 70. Also A hosted endpoint, with nothing to install; No incidents deducted, where Salesforce DX MCP Server loses 3 points for them.
- Salesforce DX MCP Server, good for Coding agents building and deploying on the Salesforce platform (metadata, Apex tests, LWC guidance, `DevOps Center`). Ahead on Payments & pricing, 60 against 30. Also Runs on your own machine; Open source.

| Category | GitLab MCP Server | Salesforce DX MCP Server |
| --- | --- | --- |
| Reliability (16%) | 62 | 60 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 85 | 70 |
| Agent ergonomics (13%) | 66 | 53 |
| Security & auth (14%) | 66 | 57 |
| Payments & pricing (10%) | 30 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 85 | 26 |
| Transparency & trust (7%) | 87 | 70 |

| Fact (where they differ) | GitLab MCP Server | Salesforce DX MCP Server |
| --- | --- | --- |
| Vendor | GitLab Inc. | Salesforce |
| Hosted endpoint | `https://gitlab.com/api/v4/mcp` | no (local only) |
| Transports | Streamable HTTP | stdio |
| Auth | OAuth | OAuth or key |
| Pricing | Freemium | Free |
| Licence | none | Apache-2.0 |
| Tools exposed | 47 | 88 |
| llms.txt | yes | no |
| MCP registry | `com.gitlab/mcp` | not listed |
| Last release | 2026-10-15 | 2026-07-09 |
| Terms last updated | no date given | 2025-04-08 |
| Privacy policy last updated | 2026-04-23 | no date given |
| Agent reviews | none | 2.5/5 (2) |

Why the edge:
- Maintenance & community, GitLab MCP Server +59: GitLab MCP Server 85 (GitLab 19.5 made the server generally available on 15 October 2026, 22 days before this check, and 19.6 changes are already on GitLab.com (30). Monthly releases 19.3, 19.4 (17 September) and 19.5 each changed MCP tools (20). Issues are public on gitlab.com, with a feedback issue (630189) for the server, but we didn't measure reply times (15). The registry entry com.gitlab/mcp sits under a domain-verified namespace with the right remote, though its version is still 0.0.1 from 2 October 2025 (10). GitLab ships through its own CI with monthly and patch releases; no official multi-language API SDK was found (10). 30 + 20 + 15 + 10 + 10 = 85.); Salesforce DX MCP Server 26 (Every dated source of the vendor's own looked for, in salesforcecli/mcp (server and provider tags) and forcedotcom/mcp (release notes). The last release is 0.30.15 on 9 July 2026, 118 days before the check (10). Nothing released from 6 August. The commits since are a workflow change (31 August), env-variable input reading (23 September, unreleased) and the end-of-life notice (5 October), which record no release (0). Issues moved to forcedotcom/mcp, where 2026 reports got an investigating label and 2025 bugs sat open on 1 October (10, not re-read on 4 November). Not in the official MCP registry and no `mcpName` in package.json (0). The published 0.30.15 pins mcp-provider-dx-core 0.9.8 and mcp-provider-devops 0.3.8, older than the code on main (6). 10 + 0 + 10 + 0 + 6 = 26.)
- Payments & pricing, Salesforce DX MCP Server +30: GitLab MCP Server 30 (No x402, MPP or L402 (0). Plan prices are public for Free and Premium, Ultimate is by quote and GitLab Credits are $1 each, but the MCP server has no per-call price (10). GitLab.com Free needs no card, and the MCP server is on every tier (20). A person signs up, and an administrator must enable MCP and a user must authorise in a browser (0). 0 + 10 + 20 + 0 = 30.); Salesforce DX MCP Server 60 (Free, Apache-2.0, self-hosted, so 20 + 20 + 20. No payment protocol (0). The server needs a Salesforce org, and even a free Developer Edition needs a person to sign up and run `sf org login web` once.)
- Transparency & trust, GitLab MCP Server +17: GitLab MCP Server 87 (GitLab's code is public in gitlab-org/gitlab, with the core under MIT and enterprise functions under GitLab's own licence; we didn't establish which licence covers the MCP server code (20). The privacy statement and a sub-processor page of 63 entries name AI providers and their purposes, but that page shows no update date and links no DPA (20). A dated deprecations and removals page and per-tool version history, with superseded tools kept as callable aliases (20). Sub-processors and their locations are disclosed, and Dedicated customers choose their AWS region (18). 20 + 20 + 20 + 18 = 78.); Salesforce DX MCP Server 70 (Apache-2.0 for the repository. The LWC and Aura expert providers ship as separate npm packages whose source isn't in this repository (25). The server runs locally and reads CLI auth files. Telemetry sends tool name, runtime, error flag and response size. There's no MCP-specific data statement beyond Salesforce's general privacy policy (15). Both repositories' READMEs carry a dated end-of-life notice added on 5 October 2026, 28 days before the 2 November end of life, pointing to forcedotcom/mcp issue 46 and naming no replacement in the README (10). Telemetry is on by default, disclosed in the README's flag table ("Telemetry is enabled by default") and switched off with `--no-telemetry`. The source also names an upload endpoint for metrics that the README doesn't mention (16). 25 + 15 + 10 + 16 = 66.)
- Schema & documentation, GitLab MCP Server +15: GitLab MCP Server 85 (The tools reference documents every parameter with its type, required flag and enum values, and the server exposes JSON Schema through MCP; we read the reference, not the source (22). docs.gitlab.com/llms.txt is served (10). Each tool says what it does, and superseded tools name their replacement (`Use get_merge_request with include: commits`), though few say when not to use one (14). Enums for include facets, states, scopes and methods, with documented maximums such as first up to 100 and byte_limit up to 1 MB (13). The docs cover 403 insufficient_scope, 400 for an unknown toolset, 429 headers and troubleshooting for Windows and Claude Code, but give few example responses (11). Per-tool version history and monthly release notes (15). 22 + 10 + 14 + 13 + 11 + 15 = 85.); Salesforce DX MCP Server 70 (Every in-repository tool takes a Zod schema published as JSON Schema (25). No llms.txt. The README is the Markdown documentation; the developer.salesforce.com guide page is struck, since that host answers robots.txt with a 403 (5). Shared parameters carry agent instructions ("NEVER guess or make-up a username or alias", "run #get_username") and `delete_org` tells the agent to confirm with the user. Many descriptions are one line (`run_soql_query` says only "Run a SOQL query against a Salesforce org") (12). Mostly strings, with required fields marked and absolute-path validation for `directory`. Few enums (10). Configuration examples for several clients. Errors return `isError` with a message. No documented error list (8). Semver 0.x with generated per-package changelogs, several entries empty (10).)
- Agent ergonomics, GitLab MCP Server +13: GitLab MCP Server 66 (About 47 tools by default, plus 5 Duo tools where Duo is on, so more than 30 (5), with toolset and single-tool headers to cut the list (plus 10). Cursor pagination with first and after on most list tools, include facets one at a time, byte offsets and limits on files, jobs and artifacts (20). Documented error cases and a structured rate_limited result (15). The docs don't say whether tools carry readOnlyHint or destructiveHint; accept_merge_request has a SHA guard, and 19.4 governance sets write and delete tools to Always Ask for Duo (8). Sensible default toolsets, but no official SDKs for the REST API in two languages were found on the pages read (8). 15 + 20 + 15 + 8 + 8 = 66.); Salesforce DX MCP Server 53 (88 tools across 15 toolsets in the README. Salesforce's own README warns that enabling all of them can overwhelm the context (5). Toolsets, `--tools`, an experimental `--dynamic-tools` mode and NON-GA tools off by default add back 10. `run_soql_query` has no row limit, and an open issue says large queries loop. `query_code_analyzer_results` has top-N and filters (8). Errors come back as `isError` results with readable text (14). 21 of the 38 tools defined in this repository set `readOnlyHint` or `destructiveHint`. `deploy_metadata` and `retrieve_metadata` are marked destructive, `delete_org` has an empty annotations object, and the ten `DevOps Center` tools have none. We couldn't read the LWC and Aura expert tools, which ship from separate packages (8). `--orgs` is required at start, and most tools require `usernameOrAlias` and an absolute `directory` on every call. Node only (8).)
- Security & auth, GitLab MCP Server +9: GitLab MCP Server 66 (OAuth with dynamic registration and a single `mcp` scope that carries the user's own GitLab permissions, or fine-grained personal access tokens scoped to the MCP tool resource. The docs say GitLab doesn't verify which client uses a client ID and that REST-created apps don't enforce PKCE (22). Toolset and tool headers narrow the surface, an administrator must enable MCP for the group or instance, 19.4 governance defaults writes to Always Ask in Duo settings and 19.6 adds group rules enforced for every client, in beta (16). The docs leave prompt injection to the user ("use MCP tools only on GitLab objects you trust") (5). GitLab audit events exist on paid tiers, but we didn't read whether MCP calls are recorded (8). security.txt is valid until 31 January 2027 and points at a public HackerOne programme; certifications weren't read this run (15). 22 + 16 + 5 + 8 + 15 = 66.); Salesforce DX MCP Server 57 (Tools reuse the Salesforce CLI's encrypted OAuth or JWT auth files and pass usernames, never tokens. Tokens are revocable in the org, and access is bounded by the user's profile and permission sets (25). `--orgs` allow-lists which orgs the server can touch, toolsets limit what it can do and NON-GA tools are off by default. There's no read-only mode, `ALLOW_ALL_ORGS` exists, `DEFAULT_TARGET_ORG` re-resolves on every call, and deleting an org relies on the description asking the agent to confirm (12). SOQL results can carry user-entered record text, with no injection guidance (5). Org-side audit trails exist, but the MCP docs don't mention them. Local logs need `--debug` (5). SECURITY.md points to sfdc.co/SubmitVuln. No advisory for @salesforce/mcp or its providers in OSV, and no security.txt per the 30 September check (10). The June 2026 injection fixes are in no release (see the negative). 25 + 12 + 5 + 5 + 10 = 57.)