{ "data": { "a": { "slug": "gitlab-mcp", "name": "GitLab MCP Server", "vendor": "GitLab Inc.", "vendorUrl": "https://about.gitlab.com", "kind": "mcp", "category": "code", "summary": "GitLab's official MCP server, built into GitLab at /api/v4/mcp, gives MCP clients tools for projects, merge requests, work items, repositories, CI/CD pipelines and GitLab Duo agents, on GitLab.com, Self-Managed and Dedicated.", "url": "https://www.anchorterminal.com/tools/gitlab-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/gitlab-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/gitlab-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/gitlab-mcp.json", "dns": "gitlab-mcp.grade.anchorterminal.com", "repo": "https://gitlab.com/gitlab-org/gitlab", "transports": [ "streamable-http" ], "remoteUrl": "https://gitlab.com/api/v4/mcp", "packages": [], "auth": "oauth", "authNotes": "OAuth 2.0 access token with the `mcp` scope, through dynamic client registration (10 registrations an hour per IP) or a pre-registered OAuth application, or a fine-grained personal access token with the MCP tool resource and Execute permission. Legacy, project and group access tokens are refused with 403 `insufficient_scope`. An administrator must first allow MCP access for the top-level group (GitLab.com) or the instance. Pre-registered apps created through the REST API don't enforce PKCE. The endpoint answers 401 with RFC 9728 resource metadata naming gitlab.com as authorisation server.", "pricing": "freemium", "pricingNotes": "The MCP server is on Free, Premium and Ultimate since GitLab 19.2. GitLab.com Free is $0 for up to 5 users per top-level group with no card; Premium is $29 a user a month billed annually; Ultimate is by quote. Duo Agent Platform tools need Premium or Ultimate with Duo, or GitLab Credits at $1 each.", "priceSummary": "$1 / credit", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the MCP server or the pricing page (checked 2026-11-06).", "endpoints": [] }, "toolCount": 47, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.gitlab.com/user/model_context_protocol/mcp_server/", "llmsTxt": "https://docs.gitlab.com/llms.txt", "registryName": "com.gitlab/mcp", "capabilities": [ "code.repo", "code.git", "code.deploy" ], "tags": [ "hosted", "self-hosted", "freemium", "mcp", "remote-mcp", "oauth", "mcp-registry", "llms-txt", "toolsets", "gitlab", "ci-cd" ], "lastRelease": "2026-10-15", "graded": true, "anchor": { "graded": true, "score": 67.3, "grade": "B", "agentReady": false, "rank": 334, "ranked": true, "rankOf": 1486, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 66, "maintenance": 85, "payments": 30, "reliability": 62, "schema": 85, "security": 66, "transparency": 87 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "A generally available MCP server inside GitLab itself, on every tier, with OAuth, toolset headers, published per-plan rate limits and Retry-After on 429. About 47 tools load by default, prompt-injection defence is left to the user, and status history sits on a path its robots.txt closes to us.", "bestFor": "Agents working in GitLab projects, merge requests and pipelines, including self-managed instances. github-mcp-server and azure-devops-mcp are the closest listings; teams on GitHub should use GitHub's server.", "strengths": [ "Generally available since GitLab 19.5 (15 October 2026) on Free, Premium and Ultimate, on GitLab.com, Self-Managed and Dedicated", "OAuth with the `mcp` scope or fine-grained personal access tokens; legacy tokens are refused", "Toolset and per-tool headers cut the default list, and unknown names fail with 400", "Per-plan MCP rate limits with Retry-After and RateLimit-Reset on 429", "Cursor pagination, include facets and byte limits keep responses small" ], "weaknesses": [ "About 47 tools load by default before any toolset header", "The docs leave prompt injection to the user and say to use tools only on trusted objects", "GitLab doesn't verify which client uses a client ID, and REST-created OAuth apps don't enforce PKCE", "No uptime SLA found on the pricing page", "MCP registry entry is still version 0.0.1 from October 2025" ], "agentNotes": [ "Send X-Gitlab-Enabled-Mcp-Server-Toolsets with only the toolsets the task needs, such as core,merge_requests", "Ask an administrator to allow MCP access for the top-level group before the first connection", "Pass the head SHA to accept_merge_request, and confirm with the user before merging or committing", "On 429 wait for Retry-After; per-minute rejections still count towards the hourly limit", "Treat issue, merge request and file content as untrusted input; GitLab doesn't filter it" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.3 } ], "editorialScores": { "ergonomics": 66, "maintenance": 85, "payments": 30, "reliability": 62, "schema": 85, "security": 66, "transparency": 78 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "claudeCode": "claude mcp add --transport http GitLab https://gitlab.com/api/v4/mcp", "config": { "mcpServers": { "GitLab": { "type": "http", "url": "https://gitlab.com/api/v4/mcp" } } } }, "letme": { "capability": "https://letme.dev/code.repo", "tool": "https://letme.dev/gitlab-mcp" }, "area": "developer", "unitPrices": [ { "item": "Premium", "unit": "user-month", "usd": 29, "note": "Billed annually" }, { "item": "GitLab Credit", "unit": "credit", "usd": 1, "note": "For Duo Agent Platform use; volume discounts with an annual commitment" } ], "provenance": { "legalEntity": "GitLab Inc.", "domain": "gitlab.com", "domainRegistered": "2004-01-15", "endpointOnVendorDomain": true, "terms": "https://about.gitlab.com/terms/", "privacy": "https://about.gitlab.com/privacy/", "statusPage": "https://status.gitlab.com", "changelog": "https://docs.gitlab.com/releases/19/", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "about.gitlab.com/company names GitLab Inc. as the company listed on the Nasdaq Global Market under GTLB.", "gitlab.com/.well-known/security.txt is PGP-signed, points to HackerOne and about.gitlab.com/security/disclosure, and expires 2027-01-31.", "about.gitlab.com/robots.txt names ClaudeBot and anthropic-ai and disallows only /search/, /api/, /exp/ and one resources folder for them.", "The sub-processor page lists 63 entries, including Google, AWS, Anthropic, OpenAI and Fireworks.ai for AI functions and HiddenLayer for prompt-injection security, with locations, and no visible update date.", "RDAP gives gitlab.com a registration date of 15 January 2004." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/gitlab-mcp.json", "live": { "slug": "gitlab-mcp", "probe": { "target": "https://gitlab.com/api/v4/mcp", "method": "mcp-initialize", "lastAt": "2026-11-07T18:20:27.082866325Z", "lastOk": true, "lastStatus": 401, "lastMs": 287, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 196, "p95ms24h": 315, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.gitlab.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:50.529753137Z" }, "versions": [ { "registry": "mcp-registry", "name": "com.gitlab/mcp", "version": "0.0.1", "seenAt": "2026-11-07T18:16:28.95801333Z" } ], "securityTxt": { "url": "https://gitlab.com/.well-known/security.txt", "state": "valid", "expires": "2027-01-31T05:00:00.000Z", "checkedAt": "2026-11-07T16:00:35.978160451Z" }, "llmsTxt": { "url": "https://docs.gitlab.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:35.836590435Z" }, "pages": [ { "url": "https://docs.gitlab.com/releases/19/", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:06:25.949810739Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e555fad0fadb" }, { "url": "https://about.gitlab.com/privacy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T13:58:29.597957724Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "205ffc09f256" }, { "url": "https://about.gitlab.com/terms/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T13:58:31.769260175Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "33bec44fb3b9" } ], "mcpTools": { "url": "https://gitlab.com/api/v4/mcp", "checkedAt": "2026-11-07T01:44:49.273162786Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:44:49.273162786Z" }, "updatedAt": "2026-11-07T18:20:27.082866325Z" } }, "answer": "GitLab MCP Server scores 67.3 (B) on agent readiness against Superpowers's 64.5 (B), and leads in 4 of 7 scored categories. Superpowers leads on reliability, agent ergonomics and payments \u0026 pricing.", "b": { "slug": "superpowers", "name": "Superpowers", "vendor": "Prime Radiant", "vendorUrl": "https://primeradiant.com/superpowers/", "kind": "framework", "category": "code", "summary": "Superpowers is an MIT-licensed library of 15 agent skills and a session-start bootstrap that steer coding agents through brainstorming, a design, a plan, test-driven implementation by subagents and code review. Its README gives install steps for 16 coding agents.", "url": "https://www.anchorterminal.com/tools/superpowers", "markdownUrl": "https://www.anchorterminal.com/tools/superpowers.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/superpowers.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/superpowers.json", "dns": "superpowers.grade.anchorterminal.com", "repo": "https://github.com/obra/superpowers", "license": "MIT (Copyright (c) 2025 Jesse Vincent)", "transports": [], "packages": [], "auth": "none", "authNotes": "No account, key or login of its own. It installs through each coding agent's plugin manager (Claude Code's official marketplace, the Codex, Cursor, Grok and Kimi marketplaces, or a git install from the repository) and runs with whatever model access and permissions that agent already has.", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing to buy. Model usage is billed by the coding agent's provider, and the skills dispatch a subagent per task plus reviewers, which adds model calls. Prime Radiant takes enquiries for enterprise support at sales@primeradiant.com, with no published price.", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "No machine payment protocol in the repository or on primeradiant.com, read on 2026-10-30. The project sells nothing per call.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 309222, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-30" }, "docsUrl": "https://github.com/obra/superpowers#readme", "capabilities": [ "code.git", "agent.multi-agent" ], "tags": [ "open-source", "mit", "local", "free", "agent-skills", "framework", "claude-code-plugin" ], "lastRelease": "2026-10-21", "graded": true, "anchor": { "graded": true, "score": 64.5, "grade": "B", "agentReady": false, "rank": 465, "ranked": true, "rankOf": 1486, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 71, "maintenance": 83, "payments": 60, "reliability": 68, "schema": 71, "security": 58, "transparency": 68 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": -3, "negativeNotes": [ "-2: until v6.0.0 of 16 June 2026 the brainstorming visual companion, a local web server, had no authentication. The release notes say anyone who could reach the port on a shared or remote machine could read the session or inject events the agent treats as the person's input (issue #1014). Fixed with a per-session key and documented, with no report of exploitation found, so the deduction is small (https://github.com/obra/superpowers/blob/main/RELEASE-NOTES.md)", "-1: until v7.0.0 of 9 October 2026, run-hook.cmd on Windows could run a `bash.cmd` or `where.bat` planted in the current directory at session start, per the release notes. Fixed and documented (https://github.com/obra/superpowers/blob/main/RELEASE-NOTES.md)" ], "verdict": "Fifteen MIT-licensed skills that make a coding agent design, plan, test first and review before it finishes, with five releases in 90 days and dated release notes. It has no CI workflow or security policy, its bootstrap insists a skill be invoked before any reply, and its optional visual companion loads a logo from Prime Radiant's site unless disabled.", "bestFor": "A test-first development method for coding agents", "strengths": [ "Installs in one command or a marketplace click in 16 coding agents, including Claude Code's official marketplace, where it is marked Anthropic verified", "Five releases between 12 August and 21 October 2026, each with dated notes that name breaking changes, fixes and the reporters credited", "Discarding work needs the typed word 'discard', merges are confirmed first, and force pushes never happen on the agent's own initiative", "Plans, task briefs, review diffs and a progress ledger are written to files, so a controller that loses context can resume without redoing work", "Zero third-party dependencies by design, MIT licence, and the one outbound request is disclosed in the README with three opt-out variables" ], "weaknesses": [ "No CI workflow in the repository; the test suites in tests/ run only on a contributor's machine", "No SECURITY.md or published advisories, though two security fixes in 2026 (the visual companion key, a Windows hook path) are documented in release notes", "The bootstrap is injected on every session start and compaction and tells the model to invoke skills before any reply, including simple questions", "Skills are long Markdown instructions (subagent-driven-development is 19,506 bytes), with no typed inputs beyond the frontmatter name and description", "194 issues and 181 pull requests were open on 30 October 2026; 13 of the 25 newest open issues had no comment" ], "agentNotes": [ "Install it once per coding agent; each harness has its own install command, and the README says a second harness needs a second install.", "Expect brainstorming to start before any code on a build request. Say so plainly if your human partner wants a quick change done without a design document.", "Name a model on every subagent dispatch, as the skill asks; an unnamed subagent inherits the session's most expensive model.", "Set SUPERPOWERS_DISABLE_TELEMETRY=1 before using the visual companion if no request may leave the machine.", "Keep `.superpowers/sdd/` out of `git clean -fdx`; it holds the progress ledger a resumed run reads." ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.5 } ], "editorialScores": { "ergonomics": 71, "maintenance": 83, "payments": 60, "reliability": 68, "schema": 71, "security": 58, "transparency": 77 }, "provenanceScore": 58, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "claudeCode": "/plugin install superpowers@claude-plugins-official" }, "letme": { "capability": "https://letme.dev/code.git", "tool": "https://letme.dev/superpowers" }, "area": "developer", "provenance": { "legalEntity": "Prime Radiant (no legal form or registration found on its pages); the MIT LICENSE names Jesse Vincent", "domain": "primeradiant.com", "domainRegistered": "2002-05-14", "endpointOnVendorDomain": false, "terms": "https://github.com/obra/superpowers/blob/main/LICENSE", "privacy": "", "statusPage": "", "changelog": "https://github.com/obra/superpowers/blob/main/RELEASE-NOTES.md", "securityTxt": "none", "checked": "2026-10-30", "notes": [ "The README says Superpowers is built by Jesse Vincent and the rest of the folks at Prime Radiant, and the plugin manifests name Jesse Vincent as author. The LICENSE reads Copyright (c) 2025 Jesse Vincent.", "RDAP for primeradiant.com gives a registration date of 2002-05-14 and a last change on 2026-06-16; the registration may predate the company.", "No terms or privacy policy on primeradiant.com (/privacy/ and /terms/ answer 404). The MIT licence stands in for terms.", "primeradiant.com/.well-known/security.txt and /security.txt answer 404. GitHub's security page for the repository says no security policy is set up and no advisories are published, and shows a Report a vulnerability link.", "The software runs inside the person's coding agent, so there is no vendor endpoint or status page.", "firstReleased is 9 October 2025, the date of the announcement post with install steps and the repository's creation date (created_at 2025-10-09T19:45:18Z). The earliest tag, v3.1.0, is dated 17 October 2025, and RELEASE-NOTES.md has v2.0.1 on 12 October 2025." ], "score": 58 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/superpowers.json", "live": { "slug": "superpowers", "versions": [ { "registry": "github", "name": "obra/superpowers", "version": "v7.0.2", "released": "2026-11-03", "seenAt": "2026-11-07T00:09:32.207038944Z" } ], "githubStars": 313600, "securityTxt": { "url": "https://primeradiant.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:27.899323537Z" }, "domain": { "domain": "primeradiant.com", "registered": "2002-05-14", "source": "https://rdap.verisign.com/com/v1/domain/primeradiant.com", "checkedAt": "2026-11-01T14:07:24.013667754Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/obra/superpowers/main/RELEASE-NOTES.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:22:23.124480705Z", "changedAt": "2026-11-04T08:34:38.14246492Z", "fingerprint": "65e828b1938d" }, { "url": "https://raw.githubusercontent.com/obra/superpowers/main/LICENSE", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:22:21.215939058Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "89b846adb1df" } ], "github": { "repo": "obra/superpowers", "checkedAt": "2026-11-02T08:22:29.415076696Z", "stars": 310829, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-29T23:35:34Z", "openIssues": 196, "openPRs": 181, "issuesOpened90d": 252, "issuesClosed90d": 193, "prsMerged90d": 78, "replies": { "sampled": 25, "unanswered": 17, "medianDays": 0.5 } }, "updatedAt": "2026-11-07T16:01:27.899323537Z" } }, "edges": [ { "by": 30, "category": "payments", "leads": "superpowers", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices are public for Free and Premium, Ultimate is by quote and GitLab Credits are $1 each, but the MCP server has no per-call price (10). GitLab.com Free needs no card, and the MCP server is on every tier (20). A person signs up, and an administrator must enable MCP and a user must authorise in a browser (0). 0 + 10 + 20 + 0 = 30.", "b": "Self-hosted rule. No payment protocol (0). Free under MIT with nothing to buy (20). Free to use with no card (20). An agent can install it in its own harness with no account or sign-up (20). Model usage is billed by the coding agent's provider, and the enterprise support Prime Radiant mentions has no published price. 60 in all." }, "scores": { "a": 30, "b": 60 } }, { "by": 19, "category": "transparency", "leads": "gitlab-mcp", "name": "Transparency \u0026 trust", "reasons": { "a": "GitLab's code is public in gitlab-org/gitlab, with the core under MIT and enterprise functions under GitLab's own licence; we didn't establish which licence covers the MCP server code (20). The privacy statement and a sub-processor page of 63 entries name AI providers and their purposes, but that page shows no update date and links no DPA (20). A dated deprecations and removals page and per-tool version history, with superseded tools kept as callable aliases (20). Sub-processors and their locations are disclosed, and Dedicated customers choose their AWS region (18). 20 + 20 + 20 + 18 = 78.", "b": "MIT, an OSI licence (30). The README and the source agree on the one outbound request and what it carries, git-ignored scratch files stay in the working tree, and diagnosing-superpowers has a written redaction policy and approval gates. Prime Radiant publishes no privacy policy covering the logo request, which reaches its site with the visitor's address (15 of 30). Breaking changes are dated in the release notes, the legacy slash commands showed deprecation notices in v5.0.0 (9 March 2026) before removal in v5.1.0 (30 April 2026), but no written deprecation policy (12 of 20). Telemetry disclosed in the README with three opt-out variables, read in server.cjs (20). 77 in all." }, "scores": { "a": 87, "b": 68 } }, { "by": 14, "category": "schema", "leads": "gitlab-mcp", "name": "Schema \u0026 documentation", "reasons": { "a": "The tools reference documents every parameter with its type, required flag and enum values, and the server exposes JSON Schema through MCP; we read the reference, not the source (22). docs.gitlab.com/llms.txt is served (10). Each tool says what it does, and superseded tools name their replacement (`Use get_merge_request with include: commits`), though few say when not to use one (14). Enums for include facets, states, scopes and methods, with documented maximums such as first up to 100 and byte_limit up to 1 MB (13). The docs cover 403 insufficient_scope, 400 for an unknown toolset, 429 headers and troubleshooting for Windows and Claude Code, but give few example responses (11). Per-tool version history and monthly release notes (15). 22 + 10 + 14 + 13 + 11 + 15 = 85.", "b": "Framework reading, docs a model can follow. Each skill has name and description frontmatter and every harness gets a JSON plugin manifest, but the skills are prose with no typed interface or API reference (12 of 25). All docs are Markdown in the repository, which an agent reads directly; no llms.txt (10). Every description starts with \"Use when\", using-superpowers sets skill priority and a subagent stop rule, and executing-plans says when to prefer subagent-driven development. When not to use a skill is stated in fewer places (17 of 20). Skills take no typed parameters; the helper scripts have fixed arguments and documented exit codes, such as review-package's exit 3 for an empty range (6 of 15). Worked examples in the debugging and TDD skills, troubleshooting in the OpenCode install guide and a diagnosing skill for failed sessions, with few documented error outputs (11 of 15). Semver releases and a dated RELEASE-NOTES.md (15). 71 in all." }, "scores": { "a": 85, "b": 71 } }, { "by": 8, "category": "security", "leads": "gitlab-mcp", "name": "Security \u0026 auth", "reasons": { "a": "OAuth with dynamic registration and a single `mcp` scope that carries the user's own GitLab permissions, or fine-grained personal access tokens scoped to the MCP tool resource. The docs say GitLab doesn't verify which client uses a client ID and that REST-created apps don't enforce PKCE (22). Toolset and tool headers narrow the surface, an administrator must enable MCP for the group or instance, 19.4 governance defaults writes to Always Ask in Duo settings and 19.6 adds group rules enforced for every client, in beta (16). The docs leave prompt injection to the user (\"use MCP tools only on GitLab objects you trust\") (5). GitLab audit events exist on paid tiers, but we didn't read whether MCP calls are recorded (8). security.txt is valid until 31 January 2027 and points at a public HackerOne programme; certifications weren't read this run (15). 22 + 16 + 5 + 8 + 15 = 66.", "b": "Harness reading of the framework checklist, the one harness2 and agent-zero used. 30 for what leaves the machine and credentials, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No credentials of its own and no network access in the hooks or plugins. The visual companion's logo request carries the version to primeradiant.com by default, disclosed with opt-outs, and some installs (OpenCode's git+https spec, git installs) follow main unless pinned, so new hook code runs at the next session start (22). Worktrees isolate work, reviewers are read-only, merges are confirmed, a discard needs the typed word, force pushes need the person, and issues are filed only after approval. No sandbox of its own, and plan execution runs for hours without check-ins (12). The companion has a per-session key and refuses symlinks and path escapes since 16 June 2026, the Windows hook ignores planted bash.cmd since 9 October 2026, and diagnosing-superpowers treats transcripts as evidence, not instructions. No guidance on untrusted content in repositories or fetched pages (7). Plans, briefs, reports, review diffs and a ledger are written to files, and the diagnosing skill cites path:line for each finding (11). No SECURITY.md, no security.txt and no advisories; GitHub shows a Report a vulnerability link, and both 2026 security fixes are credited in the release notes (6). 58 in all." }, "scores": { "a": 66, "b": 58 } }, { "by": 6, "category": "reliability", "leads": "superpowers", "name": "Reliability", "reasons": { "a": "Hosted reading for GitLab.com. Status page at status.gitlab.com (status.io) with an API and a GitLab Duo component (20). Its incident history lives under /pages/, which the site's robots.txt disallows; our reader fetched that history page once before the rule was checked, so its contents are set aside and not scored. The front page shows only the current state, all operational on 6 November, so there is no readable history (5). MCP limits are published per plan, 60 a minute and 3,600 an hour on Free, 600 and 5,000 on Premium and Ultimate (15). 429 responses carry Retry-After and RateLimit-Reset, and a rate-limited upstream API comes back as a `rate_limited` tool result; accept_merge_request requires the head SHA, but we found no general idempotency guidance for writes (12). No uptime SLA on the pricing page (0). Generally available since 19.5 (10). 20 + 5 + 15 + 12 + 0 + 10 = 62.", "b": "Local-package reading, as for ai-job-search and the other skill workflows. Installs through official plugin channels (Claude Code's official marketplace, the Codex, Cursor, Grok and Kimi marketplaces) or a git install in 16 coding agents, with harness versions stated for OpenCode 2.0.4 and Claude Code's hook quirks, but bash and Node needs are spread across the docs rather than stated once (17 of 20). Still no .github/workflows directory on 2 November, so no public CI. About 60 test files in tests/ cover the hooks, plugin manifests and the visual companion server, run locally, with LLM evals in a separate repository (8 of 25). 194 issues open on 30 October 2026; 25 issues were closed between 10 and 22 October, each with a reply, while 13 of the 25 newest open issues had no comment, per the 30 October check, not re-read on 2 November (13 of 25). Dated release notes with Breaking Changes and Visible Changes sections and semver majors for them (15). Version 7.0.1 (15). 68 in all." }, "scores": { "a": 62, "b": 68 } }, { "by": 5, "category": "ergonomics", "leads": "superpowers", "name": "Agent ergonomics", "reasons": { "a": "About 47 tools by default, plus 5 Duo tools where Duo is on, so more than 30 (5), with toolset and single-tool headers to cut the list (plus 10). Cursor pagination with first and after on most list tools, include facets one at a time, byte offsets and limits on files, jobs and artifacts (20). Documented error cases and a structured rate_limited result (15). The docs don't say whether tools carry readOnlyHint or destructiveHint; accept_merge_request has a SHA guard, and 19.4 governance sets write and delete tools to Always Ask for Duo (8). Sensible default toolsets, but no official SDKs for the REST API in two languages were found on the pages read (8). 15 + 20 + 15 + 8 + 8 = 66.", "b": "Framework reading, how much a tool-calling agent has to carry. The bootstrap (3,192 bytes) is injected at every startup, clear and compaction, and 15 skill descriptions add about 2,500 characters. Bodies load on demand and long guidance moved to references/ in v7.0.1, but single skills run to 19,506 bytes and the bootstrap asks for a skill before any reply (17 of 25). The work can be sized. Brainstorming does a quick task at once and writes a design only for a project, execution can be inline (cheapest) or one subagent per task, and every dispatch must name a model (15 of 20). Implementers report DONE, DONE_WITH_CONCERNS, BLOCKED or NEEDS_CONTEXT and the controller acts on each; review-package rejects bad ranges (14 of 20). A progress ledger and task-done records let a run resume, work happens in a worktree, merges are confirmed and a discard needs the typed word (15 of 20). Skills trigger without a command and install in one step per harness; no SDK applies (10 of 15). 71 in all." }, "scores": { "a": 66, "b": 71 } } ], "facts": [ { "a": "MCP server", "b": "Agent framework", "name": "Kind" }, { "a": "GitLab Inc.", "b": "Prime Radiant", "name": "Vendor" }, { "a": "https://gitlab.com/api/v4/mcp", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "Streamable HTTP", "b": "", "name": "Transports" }, { "a": "OAuth", "b": "None", "name": "Auth" }, { "a": "Freemium", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "MIT (Copyright (c) 2025 Jesse Vincent)", "name": "Licence" }, { "a": "47", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "com.gitlab/mcp", "b": "not listed", "name": "MCP registry" }, { "a": "2026-10-15", "b": "2026-10-21", "name": "Last release" }, { "a": "no date given", "b": "couldn't be read", "name": "Terms last updated" }, { "a": "2026-04-23", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "309k stars", "name": "Popularity" } ], "faq": [ { "answer": "GitLab MCP Server scores 67.3 (B) on agent readiness against Superpowers's 64.5 (B), and leads in 4 of 7 scored categories. Superpowers leads on reliability, agent ergonomics and payments \u0026 pricing.", "question": "Which is better for AI agents, GitLab MCP Server or Superpowers?" }, { "answer": "GitLab MCP Server has a hosted endpoint at https://gitlab.com/api/v4/mcp. No hosted endpoint is listed for Superpowers.", "question": "Can an agent call GitLab MCP Server and Superpowers without installing anything?" }, { "answer": "No open-source release is listed for GitLab MCP Server. Superpowers is open source (MIT (Copyright (c) 2025 Jesse Vincent)).", "question": "Are GitLab MCP Server and Superpowers open source?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 85 against 71", "Security \u0026 auth, 66 against 58", "Transparency \u0026 trust, 87 against 68" ], "also": [ "A hosted endpoint, with nothing to install", "No incidents deducted, where Superpowers loses 3 points for them" ], "goodFor": "Agents working in GitLab projects, merge requests and pipelines, including self-managed instances. github-mcp-server and azure-devops-mcp are the closest listings; teams on GitHub should use GitHub's server.", "slug": "gitlab-mcp", "watchFor": "About 47 tools load by default before any toolset header" }, { "aheadOn": [ "Reliability, 68 against 62", "Agent ergonomics, 71 against 66", "Payments \u0026 pricing, 60 against 30" ], "also": [ "No key needed to call it", "Open source" ], "goodFor": "A test-first development method for coding agents", "slug": "superpowers", "watchFor": "No CI workflow in the repository; the test suites in tests/ run only on a contributor's machine" } ], "history": null, "job": { "capability": "code.git", "name": "Git operations" }, "others": [ { "json": "https://www.anchorterminal.com/compare/azure-devops-mcp-vs-gitlab-mcp.json", "title": "Azure DevOps MCP Server vs GitLab MCP Server", "url": "https://www.anchorterminal.com/compare/azure-devops-mcp-vs-gitlab-mcp" }, { "json": "https://www.anchorterminal.com/compare/entire-vs-gitlab-mcp.json", "title": "Entire vs GitLab MCP Server", "url": "https://www.anchorterminal.com/compare/entire-vs-gitlab-mcp" }, { "json": "https://www.anchorterminal.com/compare/github-mcp-server-vs-gitlab-mcp.json", "title": "GitHub MCP Server vs GitLab MCP Server", "url": "https://www.anchorterminal.com/compare/github-mcp-server-vs-gitlab-mcp" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-gitmcp.json", "title": "GitLab MCP Server vs GitMCP", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-gitmcp" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-graft.json", "title": "GitLab MCP Server vs graft", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-graft" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-graphify.json", "title": "GitLab MCP Server vs Graphify", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-graphify" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-sourcegraph-mcp.json", "title": "GitLab MCP Server vs Sourcegraph MCP Server", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-sourcegraph-mcp" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-tokeneconomizer.json", "title": "GitLab MCP Server vs TokenEconomizer", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-tokeneconomizer" }, { "json": "https://www.anchorterminal.com/compare/entire-vs-superpowers.json", "title": "Entire vs Superpowers", "url": "https://www.anchorterminal.com/compare/entire-vs-superpowers" }, { "json": "https://www.anchorterminal.com/compare/git-reference-server-vs-gitlab-mcp.json", "title": "Git (MCP reference server) vs GitLab MCP Server", "url": "https://www.anchorterminal.com/compare/git-reference-server-vs-gitlab-mcp" }, { "json": "https://www.anchorterminal.com/compare/git-reference-server-vs-superpowers.json", "title": "Git (MCP reference server) vs Superpowers", "url": "https://www.anchorterminal.com/compare/git-reference-server-vs-superpowers" }, { "json": "https://www.anchorterminal.com/compare/graft-vs-superpowers.json", "title": "graft vs Superpowers", "url": "https://www.anchorterminal.com/compare/graft-vs-superpowers" }, { "json": "https://www.anchorterminal.com/compare/graphify-vs-superpowers.json", "title": "Graphify vs Superpowers", "url": "https://www.anchorterminal.com/compare/graphify-vs-superpowers" }, { "json": "https://www.anchorterminal.com/compare/sourcegraph-mcp-vs-superpowers.json", "title": "Sourcegraph MCP Server vs Superpowers", "url": "https://www.anchorterminal.com/compare/sourcegraph-mcp-vs-superpowers" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-salesforce-dx-mcp.json", "title": "GitLab MCP Server vs Salesforce DX MCP Server", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-salesforce-dx-mcp" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-void.json", "title": "GitLab MCP Server vs Void", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-void" } ], "panel": null, "scores": [ { "by": 6, "edge": "superpowers", "gitlab-mcp": 62, "key": "reliability", "name": "Reliability", "superpowers": 68, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 14, "edge": "gitlab-mcp", "gitlab-mcp": 85, "key": "schema", "name": "Schema \u0026 documentation", "superpowers": 71, "weight": 13 }, { "by": 5, "edge": "superpowers", "gitlab-mcp": 66, "key": "ergonomics", "name": "Agent ergonomics", "superpowers": 71, "weight": 13 }, { "by": 8, "edge": "gitlab-mcp", "gitlab-mcp": 66, "key": "security", "name": "Security \u0026 auth", "superpowers": 58, "weight": 14 }, { "by": 30, "edge": "superpowers", "gitlab-mcp": 30, "key": "payments", "name": "Payments \u0026 pricing", "superpowers": 60, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 2, "edge": "gitlab-mcp", "gitlab-mcp": 85, "key": "maintenance", "name": "Maintenance \u0026 community", "superpowers": 83, "weight": 7 }, { "by": 19, "edge": "gitlab-mcp", "gitlab-mcp": 87, "key": "transparency", "name": "Transparency \u0026 trust", "superpowers": 68, "weight": 7 } ], "summary": "GitLab MCP Server scores 67.3 (B) on agent readiness against Superpowers's 64.5 (B), and leads in 4 of 7 scored categories. Superpowers leads on reliability, agent ergonomics and payments \u0026 pricing. Both do git operations.", "tasks": null, "tutorials": [], "verdicts": { "gitlab-mcp": "A generally available MCP server inside GitLab itself, on every tier, with OAuth, toolset headers, published per-plan rate limits and Retry-After on 429. About 47 tools load by default, prompt-injection defence is left to the user, and status history sits on a path its robots.txt closes to us.", "superpowers": "Fifteen MIT-licensed skills that make a coding agent design, plan, test first and review before it finishes, with five releases in 90 days and dated release notes. It has no CI workflow or security policy, its bootstrap insists a skill be invoked before any reply, and its optional visual companion loads a logo from Prime Radiant's site unless disabled." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-superpowers", "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-superpowers.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-superpowers.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-superpowers.min.md" }, "markdown": "GitLab MCP Server scores 67.3 (B) on agent readiness against Superpowers's 64.5 (B), and leads in 4 of 7 scored categories. Superpowers leads on reliability, agent ergonomics and payments \u0026 pricing. Both do git operations.\n\n- GitLab MCP Server: grade B, 67.3/100, rank #334 of 1486. Markdown https://www.anchorterminal.com/tools/gitlab-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/gitlab-mcp.json\n- Superpowers: grade B, 64.5/100, rank #465 of 1486. Markdown https://www.anchorterminal.com/tools/superpowers.md · JSON https://www.anchorterminal.com/api/v1/tools/superpowers.json\n- Best code, repository and documentation tools for AI agents: https://www.anchorterminal.com/best/code/index.md\n- All 62 code comparisons: https://www.anchorterminal.com/compare/code/index.md\n\n## Which one, for what\n\n### GitLab MCP Server (B)\n\nGood for: Agents working in GitLab projects, merge requests and pipelines, including self-managed instances. github-mcp-server and azure-devops-mcp are the closest listings; teams on GitHub should use GitHub's server.\n\nAhead on:\n- Schema \u0026 documentation, 85 against 71\n- Security \u0026 auth, 66 against 58\n- Transparency \u0026 trust, 87 against 68\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- No incidents deducted, where Superpowers loses 3 points for them\n\nWatch for: About 47 tools load by default before any toolset header\n\n### Superpowers (B)\n\nGood for: A test-first development method for coding agents\n\nAhead on:\n- Reliability, 68 against 62\n- Agent ergonomics, 71 against 66\n- Payments \u0026 pricing, 60 against 30\n\nAlso in its favour:\n- No key needed to call it\n- Open source\n\nWatch for: No CI workflow in the repository; the test suites in tests/ run only on a contributor's machine\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Superpowers +30\n\n- GitLab MCP Server (30): No x402, MPP or L402 (0). Plan prices are public for Free and Premium, Ultimate is by quote and GitLab Credits are $1 each, but the MCP server has no per-call price (10). GitLab.com Free needs no card, and the MCP server is on every tier (20). A person signs up, and an administrator must enable MCP and a user must authorise in a browser (0). 0 + 10 + 20 + 0 = 30.\n- Superpowers (60): Self-hosted rule. No payment protocol (0). Free under MIT with nothing to buy (20). Free to use with no card (20). An agent can install it in its own harness with no account or sign-up (20). Model usage is billed by the coding agent's provider, and the enterprise support Prime Radiant mentions has no published price. 60 in all.\n\n### Transparency \u0026 trust: GitLab MCP Server +19\n\n- GitLab MCP Server (87): GitLab's code is public in gitlab-org/gitlab, with the core under MIT and enterprise functions under GitLab's own licence; we didn't establish which licence covers the MCP server code (20). The privacy statement and a sub-processor page of 63 entries name AI providers and their purposes, but that page shows no update date and links no DPA (20). A dated deprecations and removals page and per-tool version history, with superseded tools kept as callable aliases (20). Sub-processors and their locations are disclosed, and Dedicated customers choose their AWS region (18). 20 + 20 + 20 + 18 = 78.\n- Superpowers (68): MIT, an OSI licence (30). The README and the source agree on the one outbound request and what it carries, git-ignored scratch files stay in the working tree, and diagnosing-superpowers has a written redaction policy and approval gates. Prime Radiant publishes no privacy policy covering the logo request, which reaches its site with the visitor's address (15 of 30). Breaking changes are dated in the release notes, the legacy slash commands showed deprecation notices in v5.0.0 (9 March 2026) before removal in v5.1.0 (30 April 2026), but no written deprecation policy (12 of 20). Telemetry disclosed in the README with three opt-out variables, read in server.cjs (20). 77 in all.\n\n### Schema \u0026 documentation: GitLab MCP Server +14\n\n- GitLab MCP Server (85): The tools reference documents every parameter with its type, required flag and enum values, and the server exposes JSON Schema through MCP; we read the reference, not the source (22). docs.gitlab.com/llms.txt is served (10). Each tool says what it does, and superseded tools name their replacement (`Use get_merge_request with include: commits`), though few say when not to use one (14). Enums for include facets, states, scopes and methods, with documented maximums such as first up to 100 and byte_limit up to 1 MB (13). The docs cover 403 insufficient_scope, 400 for an unknown toolset, 429 headers and troubleshooting for Windows and Claude Code, but give few example responses (11). Per-tool version history and monthly release notes (15). 22 + 10 + 14 + 13 + 11 + 15 = 85.\n- Superpowers (71): Framework reading, docs a model can follow. Each skill has name and description frontmatter and every harness gets a JSON plugin manifest, but the skills are prose with no typed interface or API reference (12 of 25). All docs are Markdown in the repository, which an agent reads directly; no llms.txt (10). Every description starts with \"Use when\", using-superpowers sets skill priority and a subagent stop rule, and executing-plans says when to prefer subagent-driven development. When not to use a skill is stated in fewer places (17 of 20). Skills take no typed parameters; the helper scripts have fixed arguments and documented exit codes, such as review-package's exit 3 for an empty range (6 of 15). Worked examples in the debugging and TDD skills, troubleshooting in the OpenCode install guide and a diagnosing skill for failed sessions, with few documented error outputs (11 of 15). Semver releases and a dated RELEASE-NOTES.md (15). 71 in all.\n\n### Security \u0026 auth: GitLab MCP Server +8\n\n- GitLab MCP Server (66): OAuth with dynamic registration and a single `mcp` scope that carries the user's own GitLab permissions, or fine-grained personal access tokens scoped to the MCP tool resource. The docs say GitLab doesn't verify which client uses a client ID and that REST-created apps don't enforce PKCE (22). Toolset and tool headers narrow the surface, an administrator must enable MCP for the group or instance, 19.4 governance defaults writes to Always Ask in Duo settings and 19.6 adds group rules enforced for every client, in beta (16). The docs leave prompt injection to the user (\"use MCP tools only on GitLab objects you trust\") (5). GitLab audit events exist on paid tiers, but we didn't read whether MCP calls are recorded (8). security.txt is valid until 31 January 2027 and points at a public HackerOne programme; certifications weren't read this run (15). 22 + 16 + 5 + 8 + 15 = 66.\n- Superpowers (58): Harness reading of the framework checklist, the one harness2 and agent-zero used. 30 for what leaves the machine and credentials, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No credentials of its own and no network access in the hooks or plugins. The visual companion's logo request carries the version to primeradiant.com by default, disclosed with opt-outs, and some installs (OpenCode's git+https spec, git installs) follow main unless pinned, so new hook code runs at the next session start (22). Worktrees isolate work, reviewers are read-only, merges are confirmed, a discard needs the typed word, force pushes need the person, and issues are filed only after approval. No sandbox of its own, and plan execution runs for hours without check-ins (12). The companion has a per-session key and refuses symlinks and path escapes since 16 June 2026, the Windows hook ignores planted bash.cmd since 9 October 2026, and diagnosing-superpowers treats transcripts as evidence, not instructions. No guidance on untrusted content in repositories or fetched pages (7). Plans, briefs, reports, review diffs and a ledger are written to files, and the diagnosing skill cites path:line for each finding (11). No SECURITY.md, no security.txt and no advisories; GitHub shows a Report a vulnerability link, and both 2026 security fixes are credited in the release notes (6). 58 in all.\n\n### Reliability: Superpowers +6\n\n- GitLab MCP Server (62): Hosted reading for GitLab.com. Status page at status.gitlab.com (status.io) with an API and a GitLab Duo component (20). Its incident history lives under /pages/, which the site's robots.txt disallows; our reader fetched that history page once before the rule was checked, so its contents are set aside and not scored. The front page shows only the current state, all operational on 6 November, so there is no readable history (5). MCP limits are published per plan, 60 a minute and 3,600 an hour on Free, 600 and 5,000 on Premium and Ultimate (15). 429 responses carry Retry-After and RateLimit-Reset, and a rate-limited upstream API comes back as a `rate_limited` tool result; accept_merge_request requires the head SHA, but we found no general idempotency guidance for writes (12). No uptime SLA on the pricing page (0). Generally available since 19.5 (10). 20 + 5 + 15 + 12 + 0 + 10 = 62.\n- Superpowers (68): Local-package reading, as for ai-job-search and the other skill workflows. Installs through official plugin channels (Claude Code's official marketplace, the Codex, Cursor, Grok and Kimi marketplaces) or a git install in 16 coding agents, with harness versions stated for OpenCode 2.0.4 and Claude Code's hook quirks, but bash and Node needs are spread across the docs rather than stated once (17 of 20). Still no .github/workflows directory on 2 November, so no public CI. About 60 test files in tests/ cover the hooks, plugin manifests and the visual companion server, run locally, with LLM evals in a separate repository (8 of 25). 194 issues open on 30 October 2026; 25 issues were closed between 10 and 22 October, each with a reply, while 13 of the 25 newest open issues had no comment, per the 30 October check, not re-read on 2 November (13 of 25). Dated release notes with Breaking Changes and Visible Changes sections and semver majors for them (15). Version 7.0.1 (15). 68 in all.\n\n### Agent ergonomics: Superpowers +5\n\n- GitLab MCP Server (66): About 47 tools by default, plus 5 Duo tools where Duo is on, so more than 30 (5), with toolset and single-tool headers to cut the list (plus 10). Cursor pagination with first and after on most list tools, include facets one at a time, byte offsets and limits on files, jobs and artifacts (20). Documented error cases and a structured rate_limited result (15). The docs don't say whether tools carry readOnlyHint or destructiveHint; accept_merge_request has a SHA guard, and 19.4 governance sets write and delete tools to Always Ask for Duo (8). Sensible default toolsets, but no official SDKs for the REST API in two languages were found on the pages read (8). 15 + 20 + 15 + 8 + 8 = 66.\n- Superpowers (71): Framework reading, how much a tool-calling agent has to carry. The bootstrap (3,192 bytes) is injected at every startup, clear and compaction, and 15 skill descriptions add about 2,500 characters. Bodies load on demand and long guidance moved to references/ in v7.0.1, but single skills run to 19,506 bytes and the bootstrap asks for a skill before any reply (17 of 25). The work can be sized. Brainstorming does a quick task at once and writes a design only for a project, execution can be inline (cheapest) or one subagent per task, and every dispatch must name a model (15 of 20). Implementers report DONE, DONE_WITH_CONCERNS, BLOCKED or NEEDS_CONTEXT and the controller acts on each; review-package rejects bad ranges (14 of 20). A progress ledger and task-done records let a run resume, work happens in a worktree, merges are confirmed and a discard needs the typed word (15 of 20). Skills trigger without a command and install in one step per harness; no SDK applies (10 of 15). 71 in all.\n\n## Score by category\n\n| Category | Weight | GitLab MCP Server | Superpowers | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 62 | 68 | Superpowers +6 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 71 | GitLab MCP Server +14 |\n| Agent ergonomics | 13% (16.2 this run) | 66 | 71 | Superpowers +5 |\n| Security \u0026 auth | 14% (17.5 this run) | 66 | 58 | GitLab MCP Server +8 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 60 | Superpowers +30 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 85 | 83 | GitLab MCP Server +2 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 87 | 68 | GitLab MCP Server +19 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **67.3 · B** | **64.5 · B** | |\n\n## Facts side by side\n\n| Fact | GitLab MCP Server | Superpowers |\n| --- | --- | --- |\n| Kind | MCP server | Agent framework |\n| Vendor | GitLab Inc. | Prime Radiant |\n| Hosted endpoint | `https://gitlab.com/api/v4/mcp` | no (local only) |\n| Transports | Streamable HTTP | |\n| Auth | OAuth | None |\n| Pricing | Freemium | Free |\n| x402 | no | no |\n| Licence | none | MIT (Copyright (c) 2025 Jesse Vincent) |\n| Tools exposed | 47 | none |\n| Read-only variant documented | no | no |\n| llms.txt | yes | no |\n| MCP registry | `com.gitlab/mcp` | not listed |\n| Last release | 2026-10-15 | 2026-10-21 |\n| Terms last updated | no date given | couldn't be read |\n| Privacy policy last updated | 2026-04-23 | no document linked |\n| Customer content may train models | not found in the text | couldn't be read |\n| Terms restrict automated access | not found in the text | couldn't be read |\n| Terms restrict benchmarking | not found in the text | couldn't be read |\n| Terms or service can change without notice | not found in the text | couldn't be read |\n| Arbitration or class-action waiver | not found in the text | couldn't be read |\n| Popularity | none | 309k stars |\n\n## Verdicts\n\n**GitLab MCP Server.** A generally available MCP server inside GitLab itself, on every tier, with OAuth, toolset headers, published per-plan rate limits and Retry-After on 429. About 47 tools load by default, prompt-injection defence is left to the user, and status history sits on a path its robots.txt closes to us.\n\n**Superpowers.** Fifteen MIT-licensed skills that make a coding agent design, plan, test first and review before it finishes, with five releases in 90 days and dated release notes. It has no CI workflow or security policy, its bootstrap insists a skill be invoked before any reply, and its optional visual companion loads a logo from Prime Radiant's site unless disabled.\n\n## Before you call either\n\n### GitLab MCP Server\n\n1. Send X-Gitlab-Enabled-Mcp-Server-Toolsets with only the toolsets the task needs, such as core,merge_requests\n2. Ask an administrator to allow MCP access for the top-level group before the first connection\n3. Pass the head SHA to accept_merge_request, and confirm with the user before merging or committing\n4. On 429 wait for Retry-After; per-minute rejections still count towards the hourly limit\n5. Treat issue, merge request and file content as untrusted input; GitLab doesn't filter it\n\n### Superpowers\n\n1. Install it once per coding agent; each harness has its own install command, and the README says a second harness needs a second install.\n2. Expect brainstorming to start before any code on a build request. Say so plainly if your human partner wants a quick change done without a design document.\n3. Name a model on every subagent dispatch, as the skill asks; an unnamed subagent inherits the session's most expensive model.\n4. Set SUPERPOWERS_DISABLE_TELEMETRY=1 before using the visual companion if no request may leave the machine.\n5. Keep `.superpowers/sdd/` out of `git clean -fdx`; it holds the progress ledger a resumed run reads.\n\n## Questions\n\n### Which is better for AI agents, GitLab MCP Server or Superpowers?\n\nGitLab MCP Server scores 67.3 (B) on agent readiness against Superpowers's 64.5 (B), and leads in 4 of 7 scored categories. Superpowers leads on reliability, agent ergonomics and payments \u0026 pricing.\n\n### Can an agent call GitLab MCP Server and Superpowers without installing anything?\n\nGitLab MCP Server has a hosted endpoint at https://gitlab.com/api/v4/mcp. No hosted endpoint is listed for Superpowers.\n\n### Are GitLab MCP Server and Superpowers open source?\n\nNo open-source release is listed for GitLab MCP Server. Superpowers is open source (MIT (Copyright (c) 2025 Jesse Vincent)).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/gitlab-mcp-vs-superpowers.json, and with the fewest tokens: https://www.anchorterminal.com/compare/gitlab-mcp-vs-superpowers.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"gitlab-mcp\", \"b\": \"superpowers\"}`. From a terminal: `anchor compare gitlab-mcp superpowers`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/gitlab-mcp.json and https://www.anchorterminal.com/api/v1/tools/superpowers.json\n\n## Other comparisons with GitLab MCP Server or Superpowers\n\n- [Azure DevOps MCP Server vs GitLab MCP Server](https://www.anchorterminal.com/compare/azure-devops-mcp-vs-gitlab-mcp.md)\n- [Entire vs GitLab MCP Server](https://www.anchorterminal.com/compare/entire-vs-gitlab-mcp.md)\n- [GitHub MCP Server vs GitLab MCP Server](https://www.anchorterminal.com/compare/github-mcp-server-vs-gitlab-mcp.md)\n- [GitLab MCP Server vs GitMCP](https://www.anchorterminal.com/compare/gitlab-mcp-vs-gitmcp.md)\n- [GitLab MCP Server vs graft](https://www.anchorterminal.com/compare/gitlab-mcp-vs-graft.md)\n- [GitLab MCP Server vs Graphify](https://www.anchorterminal.com/compare/gitlab-mcp-vs-graphify.md)\n- [GitLab MCP Server vs Sourcegraph MCP Server](https://www.anchorterminal.com/compare/gitlab-mcp-vs-sourcegraph-mcp.md)\n- [GitLab MCP Server vs TokenEconomizer](https://www.anchorterminal.com/compare/gitlab-mcp-vs-tokeneconomizer.md)\n- [Entire vs Superpowers](https://www.anchorterminal.com/compare/entire-vs-superpowers.md)\n- [Git (MCP reference server) vs GitLab MCP Server](https://www.anchorterminal.com/compare/git-reference-server-vs-gitlab-mcp.md)\n- [Git (MCP reference server) vs Superpowers](https://www.anchorterminal.com/compare/git-reference-server-vs-superpowers.md)\n- [graft vs Superpowers](https://www.anchorterminal.com/compare/graft-vs-superpowers.md)\n- [Graphify vs Superpowers](https://www.anchorterminal.com/compare/graphify-vs-superpowers.md)\n- [Sourcegraph MCP Server vs Superpowers](https://www.anchorterminal.com/compare/sourcegraph-mcp-vs-superpowers.md)\n- [GitLab MCP Server vs Salesforce DX MCP Server](https://www.anchorterminal.com/compare/gitlab-mcp-vs-salesforce-dx-mcp.md)\n- [GitLab MCP Server vs Void](https://www.anchorterminal.com/compare/gitlab-mcp-vs-void.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "GitLab MCP Server vs Superpowers", "url": "" } ], "description": "GitLab scores 67.3 (B) to Superpowers's 64.5 (B) for git operations. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "GitLab MCP Server B 67.3", "Superpowers B 64.5", "scores" ], "h1": "GitLab MCP Server vs Superpowers", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/gitlab-mcp-vs-superpowers", "published": "2026-10-01", "section": "tools", "title": "GitLab vs Superpowers for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-superpowers" }, "tokens": { "markdown": 4900, "slim": 3280 }, "version": 1 }