{ "data": { "a": { "slug": "gitlab-mcp", "name": "GitLab MCP Server", "vendor": "GitLab Inc.", "vendorUrl": "https://about.gitlab.com", "kind": "mcp", "category": "code", "summary": "GitLab's official MCP server, built into GitLab at /api/v4/mcp, gives MCP clients tools for projects, merge requests, work items, repositories, CI/CD pipelines and GitLab Duo agents, on GitLab.com, Self-Managed and Dedicated.", "url": "https://www.anchorterminal.com/tools/gitlab-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/gitlab-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/gitlab-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/gitlab-mcp.json", "dns": "gitlab-mcp.grade.anchorterminal.com", "repo": "https://gitlab.com/gitlab-org/gitlab", "transports": [ "streamable-http" ], "remoteUrl": "https://gitlab.com/api/v4/mcp", "packages": [], "auth": "oauth", "authNotes": "OAuth 2.0 access token with the `mcp` scope, through dynamic client registration (10 registrations an hour per IP) or a pre-registered OAuth application, or a fine-grained personal access token with the MCP tool resource and Execute permission. Legacy, project and group access tokens are refused with 403 `insufficient_scope`. An administrator must first allow MCP access for the top-level group (GitLab.com) or the instance. Pre-registered apps created through the REST API don't enforce PKCE. The endpoint answers 401 with RFC 9728 resource metadata naming gitlab.com as authorisation server.", "pricing": "freemium", "pricingNotes": "The MCP server is on Free, Premium and Ultimate since GitLab 19.2. GitLab.com Free is $0 for up to 5 users per top-level group with no card; Premium is $29 a user a month billed annually; Ultimate is by quote. Duo Agent Platform tools need Premium or Ultimate with Duo, or GitLab Credits at $1 each.", "priceSummary": "$1 / credit", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the MCP server or the pricing page (checked 2026-11-06).", "endpoints": [] }, "toolCount": 47, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.gitlab.com/user/model_context_protocol/mcp_server/", "llmsTxt": "https://docs.gitlab.com/llms.txt", "registryName": "com.gitlab/mcp", "capabilities": [ "code.repo", "code.git", "code.deploy" ], "tags": [ "hosted", "self-hosted", "freemium", "mcp", "remote-mcp", "oauth", "mcp-registry", "llms-txt", "toolsets", "gitlab", "ci-cd" ], "lastRelease": "2026-10-15", "graded": true, "anchor": { "graded": true, "score": 67.3, "grade": "B", "agentReady": false, "rank": 335, "ranked": true, "rankOf": 1510, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 66, "maintenance": 85, "payments": 30, "reliability": 62, "schema": 85, "security": 66, "transparency": 87 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "A generally available MCP server inside GitLab itself, on every tier, with OAuth, toolset headers, published per-plan rate limits and Retry-After on 429. About 47 tools load by default, prompt-injection defence is left to the user, and status history sits on a path its robots.txt closes to us.", "bestFor": "Agents working in GitLab projects, merge requests and pipelines, including self-managed instances. github-mcp-server and azure-devops-mcp are the closest listings; teams on GitHub should use GitHub's server.", "strengths": [ "Generally available since GitLab 19.5 (15 October 2026) on Free, Premium and Ultimate, on GitLab.com, Self-Managed and Dedicated", "OAuth with the `mcp` scope or fine-grained personal access tokens; legacy tokens are refused", "Toolset and per-tool headers cut the default list, and unknown names fail with 400", "Per-plan MCP rate limits with Retry-After and RateLimit-Reset on 429", "Cursor pagination, include facets and byte limits keep responses small" ], "weaknesses": [ "About 47 tools load by default before any toolset header", "The docs leave prompt injection to the user and say to use tools only on trusted objects", "GitLab doesn't verify which client uses a client ID, and REST-created OAuth apps don't enforce PKCE", "No uptime SLA found on the pricing page", "MCP registry entry is still version 0.0.1 from October 2025" ], "agentNotes": [ "Send X-Gitlab-Enabled-Mcp-Server-Toolsets with only the toolsets the task needs, such as core,merge_requests", "Ask an administrator to allow MCP access for the top-level group before the first connection", "Pass the head SHA to accept_merge_request, and confirm with the user before merging or committing", "On 429 wait for Retry-After; per-minute rejections still count towards the hourly limit", "Treat issue, merge request and file content as untrusted input; GitLab doesn't filter it" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.3 } ], "editorialScores": { "ergonomics": 66, "maintenance": 85, "payments": 30, "reliability": 62, "schema": 85, "security": 66, "transparency": 78 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "claudeCode": "claude mcp add --transport http GitLab https://gitlab.com/api/v4/mcp", "config": { "mcpServers": { "GitLab": { "type": "http", "url": "https://gitlab.com/api/v4/mcp" } } } }, "letme": { "capability": "https://letme.dev/code.repo", "tool": "https://letme.dev/gitlab-mcp" }, "area": "developer", "unitPrices": [ { "item": "Premium", "unit": "user-month", "usd": 29, "note": "Billed annually" }, { "item": "GitLab Credit", "unit": "credit", "usd": 1, "note": "For Duo Agent Platform use; volume discounts with an annual commitment" } ], "provenance": { "legalEntity": "GitLab Inc.", "domain": "gitlab.com", "domainRegistered": "2004-01-15", "endpointOnVendorDomain": true, "terms": "https://about.gitlab.com/terms/", "privacy": "https://about.gitlab.com/privacy/", "statusPage": "https://status.gitlab.com", "changelog": "https://docs.gitlab.com/releases/19/", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "about.gitlab.com/company names GitLab Inc. as the company listed on the Nasdaq Global Market under GTLB.", "gitlab.com/.well-known/security.txt is PGP-signed, points to HackerOne and about.gitlab.com/security/disclosure, and expires 2027-01-31.", "about.gitlab.com/robots.txt names ClaudeBot and anthropic-ai and disallows only /search/, /api/, /exp/ and one resources folder for them.", "The sub-processor page lists 63 entries, including Google, AWS, Anthropic, OpenAI and Fireworks.ai for AI functions and HiddenLayer for prompt-injection security, with locations, and no visible update date.", "RDAP gives gitlab.com a registration date of 15 January 2004." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/gitlab-mcp.json", "live": { "slug": "gitlab-mcp", "probe": { "target": "https://gitlab.com/api/v4/mcp", "method": "mcp-initialize", "lastAt": "2026-11-07T19:22:08.765215305Z", "lastOk": true, "lastStatus": 401, "lastMs": 181, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 195, "p95ms24h": 315, "samples24h": 210, "samples30d": 210, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 197, "ok": 197 } ] }, "vendorStatus": { "page": "https://status.gitlab.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:50.529753137Z" }, "versions": [ { "registry": "mcp-registry", "name": "com.gitlab/mcp", "version": "0.0.1", "seenAt": "2026-11-07T18:16:28.95801333Z" } ], "securityTxt": { "url": "https://gitlab.com/.well-known/security.txt", "state": "valid", "expires": "2027-01-31T05:00:00.000Z", "checkedAt": "2026-11-07T16:00:35.978160451Z" }, "llmsTxt": { "url": "https://docs.gitlab.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:35.836590435Z" }, "pages": [ { "url": "https://docs.gitlab.com/releases/19/", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:06:25.949810739Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e555fad0fadb" }, { "url": "https://about.gitlab.com/privacy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T13:58:29.597957724Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "205ffc09f256" }, { "url": "https://about.gitlab.com/terms/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T13:58:31.769260175Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "33bec44fb3b9" } ], "mcpTools": { "url": "https://gitlab.com/api/v4/mcp", "checkedAt": "2026-11-07T01:44:49.273162786Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:44:49.273162786Z" }, "updatedAt": "2026-11-07T19:22:08.765215305Z" } }, "answer": "GitLab MCP Server scores 67.3 (B) on agent readiness against TokenEconomizer's 63.7 (B), and leads in 4 of 7 scored categories. TokenEconomizer leads on agent ergonomics, security \u0026 auth and payments \u0026 pricing.", "b": { "slug": "tokeneconomizer", "name": "TokenEconomizer", "vendor": "Microsoft", "vendorUrl": "https://tokeneconomizer.github.io/", "kind": "framework", "category": "code", "summary": "TokenEconomizer is an Apache-2.0 plugin from Microsoft Research and UC Berkeley that cuts repeat coding-agent cost in a repository by injecting learned facts, pruning unused tools and redirecting stuck turns. It runs in Claude Code, Codex, Copilot CLI and Pi.", "url": "https://www.anchorterminal.com/tools/tokeneconomizer", "markdownUrl": "https://www.anchorterminal.com/tools/tokeneconomizer.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/tokeneconomizer.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/tokeneconomizer.json", "dns": "tokeneconomizer.grade.anchorterminal.com", "repo": "https://github.com/microsoft/TokenEconomizer", "license": "Apache-2.0", "transports": [], "packages": [], "auth": "none", "authNotes": "No account, key or login of its own. It runs inside Claude Code, Codex, the Copilot CLI or Pi, and its own model calls go through that agent's CLI on whatever plan or login the person already has.", "pricing": "free", "pricingNotes": "Free under Apache 2.0, with nothing to buy. Its loop-guard judge, the redirect writer and the optional micro-skills proposer make model calls billed on the person's agent plan, Haiku by default on Claude Code, and `te status` reports that cost.", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "Local software with nothing to buy. No x402, MPP or L402 in the repository or on the project page, checked 30 October 2026.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 976, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-30" }, "docsUrl": "https://github.com/microsoft/TokenEconomizer/blob/main/plugin/README.md", "capabilities": [ "code.repo" ], "tags": [ "open-source", "apache-2.0", "local", "free", "python", "claude-code-plugin", "hooks", "pre-1.0" ], "lastRelease": "2026-10-26", "graded": true, "anchor": { "graded": true, "score": 63.7, "grade": "B", "agentReady": false, "rank": 507, "ranked": true, "rankOf": 1510, "categoryRank": 9, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 76, "maintenance": 53, "payments": 60, "reliability": 47, "schema": 66, "security": 71, "transparency": 76 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": 0, "verdict": "A standard-library Python plugin that keeps learned state on the machine, documents each hook, makes every action reversible and merges outside fixes within days. It is version 0.1.0 with no changelog, installs from a git clone of main, and the 18.4 to 30.9 per cent savings are the paper's SWE-Bench figures, measured with settings unlike the plugin's defaults.", "bestFor": "Lowering the repeat cost of coding agents in repositories they work in often", "strengths": [ "No API key or credentials of its own; its model calls go through the agent CLI the person is already signed in to, on the same plan", "Learned state stays under ~/.tokeneconomizer with 0700 and 0600 permissions, and only masked digests of commands and errors go to a model", "Every action can be undone. `toolprune restore` returns pruned tools, contradicted facts are dropped, and the loop guard never stops a turn itself", "Public CI runs the test suite on Ubuntu and Windows with Python 3.10 and 3.13, plus a Codex CLI end-to-end job pinned to 0.164.0 on both systems", "Apache-2.0 and standard-library only, with docs/PLUGIN.md recording how each agent's hooks and settings were verified to behave" ], "weaknesses": [ "Version 0.1.0 (tagged 26 October 2026) with no changelog or release notes found; updating means a `git pull` of main, which is 67 commits past the tag", "Not in any official plugin marketplace. Claude Code, Codex and Copilot install from a local clone, and Codex asks the person to trust all hooks", "Supported agent versions are narrow (Claude Code 2.1.300 to 2.1.310, Codex 0.153.1 to 0.164.0), and newer versions are untested", "The headline savings come from the paper's runs with micro-skills on and side calls on the agent's own model; the plugin defaults micro-skills off and uses Haiku on Claude Code", "Learned facts derive from command output a repository controls, and the proposer's facts are free text; the docs say to keep micro-skills off in untrusted repositories" ], "agentNotes": [ "Check the agent's version against the README's supported range before installing; versions outside it are untested or unsupported.", "Keep micro-skills off, or set microskills=envfacts, in a repository whose command output you don't trust.", "If a tool you need is missing, run the `toolprune` command to see what was left out and `toolprune restore` to bring it back.", "Run the plugin's commands from a terminal with ~/.tokeneconomizer/bin/te; inside the agent each command costs a model turn.", "Start the agent with TE_DISABLE=1 to run one session without the plugin." ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 63.7 } ], "editorialScores": { "ergonomics": 76, "maintenance": 53, "payments": 60, "reliability": 47, "schema": 66, "security": 71, "transparency": 84 }, "provenanceScore": 67, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "git clone https://github.com/microsoft/TokenEconomizer.git \u0026\u0026 claude plugin marketplace add \"$PWD/TokenEconomizer\"\n# Pi:\npi install git:github.com/microsoft/TokenEconomizer", "claudeCode": "claude plugin install tokeneconomizer@tokeneconomizer" }, "letme": { "capability": "https://letme.dev/code.repo", "tool": "https://letme.dev/tokeneconomizer" }, "sameCompany": [ "azure-openai", "azure-foundry-fine-tuning", "azure-ai-content-safety", "azure-speech-to-text", "azure-text-to-speech", "microsoft-agent-framework", "microsoft-execution-containers", "microsoft-entra-agent-id", "azure-key-vault", "bing-grounding", "azure-document-intelligence", "azure-devops-mcp", "microsoft-learn-mcp", "playwright-mcp", "azure-mcp", "azure-maps", "azure-translator", "microsoft-graph-calendar", "azure-blob-storage", "onedrive-sharepoint", "microsoft-teams", "dynamics-365-sales", "copilot-studio-mcp", "power-automate", "foundry-local", "microsoft-decision-1", "microsoft-advertising-api", "microsoft-excel-graph", "outlook-mail-graph", "microsoft-graph-people", "mage-vl-cowork" ], "area": "developer", "provenance": { "legalEntity": "Microsoft Corporation (repository in the microsoft GitHub organisation with Microsoft's SECURITY.md); co-authors at UC Berkeley", "domain": "microsoft.com", "domainRegistered": "1991-05-02", "endpointOnVendorDomain": null, "terms": "https://github.com/microsoft/TokenEconomizer/blob/main/LICENSE", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "expired", "checked": "2026-10-30", "notes": [ "The README, the project page and arXiv 2610.22732 name the same 11 authors from UC Berkeley, Microsoft Research and Microsoft Security. The plugin manifests name \"TokenEconomizer authors\" and the repository https://github.com/microsoft/TokenEconomizer.", "domainRegistered for microsoft.com is from the other Microsoft listings (power-automate, azure-mcp) and wasn't re-read.", "www.microsoft.com/.well-known/security.txt, read on 30 October 2026, names MSRC as contact and has Expires 2026-09-23T16:00:00.000Z.", "No terms or privacy statement for the plugin. The Apache 2.0 licence stands in for terms, and docs/PLUGIN.md section 4 describes state and what leaves the machine.", "Local software, so there is no endpoint or status page.", "firstReleased is 25 October 2026, from EveryDev's listing (datePublished 2026-10-25T21:00Z) of the public repository. The arXiv v1 of 15 October 2026 has no repository link, and GitHub's creation date couldn't be read." ], "score": 67 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/tokeneconomizer.json", "live": { "slug": "tokeneconomizer", "versions": [ { "registry": "github", "name": "microsoft/TokenEconomizer", "version": "v0.1.0", "released": "2026-10-26", "seenAt": "2026-11-07T00:12:22.876578132Z" } ], "githubStars": 4894, "securityTxt": { "url": "https://microsoft.com/.well-known/security.txt", "state": "valid", "expires": "2027-10-27T16:00:00.000Z", "checkedAt": "2026-11-07T16:02:01.196666056Z" }, "domain": { "domain": "microsoft.com", "registered": "1991-05-02", "source": "https://rdap.verisign.com/com/v1/domain/microsoft.com", "checkedAt": "2026-11-01T14:14:19.336136409Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/microsoft/TokenEconomizer/main/LICENSE", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:21:41.896892668Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "839fbbcddc72" } ], "github": { "repo": "microsoft/tokeneconomizer", "checkedAt": "2026-11-02T08:22:11.636908009Z", "stars": 4218, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-01T22:29:27Z", "openIssues": 6, "openPRs": 10, "issuesOpened90d": 50, "issuesClosed90d": 44, "prsMerged90d": 21, "ci": { "branch": "main", "runs": 23, "success": 22, "failure": 1, "other": 0, "latest": "success", "latestAt": "2026-11-01T22:31:39Z" }, "replies": { "sampled": 25, "unanswered": 0, "medianDays": 0 } }, "updatedAt": "2026-11-07T16:02:01.196666056Z" } }, "edges": [ { "by": 32, "category": "maintenance", "leads": "gitlab-mcp", "name": "Maintenance \u0026 community", "reasons": { "a": "GitLab 19.5 made the server generally available on 15 October 2026, 22 days before this check, and 19.6 changes are already on GitLab.com (30). Monthly releases 19.3, 19.4 (17 September) and 19.5 each changed MCP tools (20). Issues are public on gitlab.com, with a feedback issue (630189) for the server, but we didn't measure reply times (15). The registry entry com.gitlab/mcp sits under a domain-verified namespace with the right remote, though its version is still 0.0.1 from 2 October 2025 (10). GitLab ships through its own CI with monthly and patch releases; no official multi-language API SDK was found (10). 30 + 20 + 15 + 10 + 10 = 85.", "b": "The clone shows one tag, v0.1.0 (annotated \"TokenEconomizer 0.1.0\", 26 October 2026), and 67 commits on main after it, the newest merged on 1 November 2026. GitHub's releases page couldn't be read. Recency rests on the 26 October tag, within 30 days (30). One release and no dated changelog entries in 90 days (0). Outside pull requests are merged within about a day, among them #84 and #88 on 30 October, #24 on 30 October (closing issue #86), and #93, #98, #101, #102 and #103 on 1 November. Open issue counts and reply times are unread, as GitHub's pages answer 403 in our session (15 of 25, as letsfg). Not an MCP server and in no official plugin marketplace (0). Standard-library only with no runtime dependencies, CI on push and pull requests, and the Codex version pinned in CI on purpose (8 of 10). 30 + 0 + 15 + 0 + 8 = 53." }, "scores": { "a": 85, "b": 53 } }, { "by": 30, "category": "payments", "leads": "tokeneconomizer", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices are public for Free and Premium, Ultimate is by quote and GitLab Credits are $1 each, but the MCP server has no per-call price (10). GitLab.com Free needs no card, and the MCP server is on every tier (20). A person signs up, and an administrator must enable MCP and a user must authorise in a browser (0). 0 + 10 + 20 + 0 = 30.", "b": "Self-hosted rule. No payment protocol (0). Free under Apache-2.0 with nothing to buy (20). No card or account (20). An agent can be given it with no sign-up, through its own plugin manager (20). Its judge and proposer calls are billed on the person's agent plan, and `te status` reports that cost. 60 in all." }, "scores": { "a": 30, "b": 60 } }, { "by": 19, "category": "schema", "leads": "gitlab-mcp", "name": "Schema \u0026 documentation", "reasons": { "a": "The tools reference documents every parameter with its type, required flag and enum values, and the server exposes JSON Schema through MCP; we read the reference, not the source (22). docs.gitlab.com/llms.txt is served (10). Each tool says what it does, and superseded tools name their replacement (`Use get_merge_request with include: commits`), though few say when not to use one (14). Enums for include facets, states, scopes and methods, with documented maximums such as first up to 100 and byte_limit up to 1 MB (13). The docs cover 403 insufficient_scope, 400 for an unknown toolset, 429 headers and troubleshooting for Windows and Claude Code, but give few example responses (11). Per-tool version history and monthly release notes (15). 22 + 10 + 14 + 13 + 11 + 15 = 85.", "b": "Framework reading, docs a model can follow, as superpowers was read. JSON plugin manifests for Claude Code, Codex and Copilot, a hooks.json per agent, slash-command files and a settings table with names, defaults and environment variables, and `--json` on two `te` commands, but no schema for its state or output (12 of 25). README, plugin/README.md, docs/PLUGIN.md and docs/ARCHITECTURE.md are Markdown in the repository; no llms.txt (10). The README says what each mechanism does and when it acts, and docs/PLUGIN.md has a known-limitations section and says when to keep micro-skills off (17 of 20). Mechanisms take on, off, propose or envfacts, numeric settings have stated defaults and minimums, and the config code checks choices (10 of 15). Command examples per agent, a troubleshooting section, `te doctor` and an errors.log, with few documented error outputs (12 of 15). A version number in every manifest but no public changelog (5 of 15). 66 in all." }, "scores": { "a": 85, "b": 66 } }, { "by": 15, "category": "reliability", "leads": "gitlab-mcp", "name": "Reliability", "reasons": { "a": "Hosted reading for GitLab.com. Status page at status.gitlab.com (status.io) with an API and a GitLab Duo component (20). Its incident history lives under /pages/, which the site's robots.txt disallows; our reader fetched that history page once before the rule was checked, so its contents are set aside and not scored. The front page shows only the current state, all operational on 6 November, so there is no readable history (5). MCP limits are published per plan, 60 a minute and 3,600 an hour on Free, 600 and 5,000 on Premium and Ultimate (15). 429 responses carry Retry-After and RateLimit-Reset, and a rate-limited upstream API comes back as a `rate_limited` tool result; accept_merge_request requires the head SHA, but we found no general idempotency guidance for writes (12). No uptime SLA on the pricing page (0). Generally available since 19.5 (10). 20 + 5 + 15 + 12 + 0 + 10 = 62.", "b": "Local-package reading, as for superpowers and impeccable. Installs from a git clone through each agent's own plugin manager (a local marketplace on Claude Code, Codex and Copilot, `pi install git:` on Pi, a built local plugin on Cursor), not from a registry or an official marketplace, with Python 3.10 or later and a supported-versions table per agent (14 of 20). .github/workflows/tests.yml runs pytest on push to main and on pull requests, on Ubuntu and Windows with Python 3.10 and 3.13, plus a Codex end-to-end job pinned to 0.164.0 on Ubuntu and Windows. 25 test files in tests/ on 2 November, up from 14 at the v0.1.0 tag. Whether the runs pass wasn't checked, as github.com refuses our reader, so 15 of 25, the value this run gives when the pass state is unread (vibe-trading, berth, cloudflare-cli). The Wayback Machine's copy of the repository page of 30 October 2026 shows 1 open issue and 5 open pull requests, few for a project weeks old, with replies unchecked (15 of 25). No changelog or release notes found; renamed settings keep their old names as aliases and a state migration is described in docs/PLUGIN.md (3 of 15). Version 0.1.0 (0). 14 + 15 + 15 + 3 + 0 = 47." }, "scores": { "a": 62, "b": 47 } }, { "by": 11, "category": "transparency", "leads": "gitlab-mcp", "name": "Transparency \u0026 trust", "reasons": { "a": "GitLab's code is public in gitlab-org/gitlab, with the core under MIT and enterprise functions under GitLab's own licence; we didn't establish which licence covers the MCP server code (20). The privacy statement and a sub-processor page of 63 entries name AI providers and their purposes, but that page shows no update date and links no DPA (20). A dated deprecations and removals page and per-tool version history, with superseded tools kept as callable aliases (20). Sub-processors and their locations are disclosed, and Dedicated customers choose their AWS region (18). 20 + 20 + 20 + 18 = 78.", "b": "Apache-2.0, an OSI licence (30). docs/PLUGIN.md section 4 and the README agree that learned state stays local and name which model calls leave the machine and what they carry, and the package source has no network code of its own. No privacy statement is linked from the repository (24 of 30). Old setting names and environment variables are still read, and a migration of state keys after 0.1.0 is documented, but there's no written deprecation policy (10 of 20). No telemetry found in the source or docs, and the outbound model calls are disclosed with switches to turn each off (20). 84 in all." }, "scores": { "a": 87, "b": 76 } }, { "by": 10, "category": "ergonomics", "leads": "tokeneconomizer", "name": "Agent ergonomics", "reasons": { "a": "About 47 tools by default, plus 5 Duo tools where Duo is on, so more than 30 (5), with toolset and single-tool headers to cut the list (plus 10). Cursor pagination with first and after on most list tools, include facets one at a time, byte offsets and limits on files, jobs and artifacts (20). Documented error cases and a structured rate_limited result (15). The docs don't say whether tools carry readOnlyHint or destructiveHint; accept_merge_request has a SHA guard, and 19.4 governance sets write and delete tools to Always Ask for Duo (8). Sensible default toolsets, but no official SDKs for the REST API in two languages were found on the pages read (8). 15 + 20 + 15 + 8 + 8 = 66.", "b": "Framework reading, how much a coding agent has to carry. The plugin's job is to shrink context. It adds up to four facts from failures (the proposer's facts are not capped) and one-line notices, while the loop guard's judge and the proposer are extra model calls, each Codex side call carrying Codex's base prompt of about 25,000 tokens by the code's own note (18 of 25). Each mechanism has its own switch and settings, a propose mode for tool pruning and per-session environment variables (15 of 20). Hooks fail open to `{}`, failures go to errors.log and `te doctor`, and the session start says why a deny list stayed a proposal (15 of 20). Writes are atomic under a file lock, the deny-list writer touches only its own entries and refuses symlinks out of the repository, and pruned tools come back with one command (18 of 20). Sensible defaults (micro-skills off, pruning and the guard on); a Python package with TypeScript extensions for Pi and opencode, not SDKs in two languages (10 of 15). 76 in all." }, "scores": { "a": 66, "b": 76 } } ], "facts": [ { "a": "MCP server", "b": "Agent framework", "name": "Kind" }, { "a": "GitLab Inc.", "b": "Microsoft", "name": "Vendor" }, { "a": "https://gitlab.com/api/v4/mcp", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "Streamable HTTP", "b": "", "name": "Transports" }, { "a": "OAuth", "b": "None", "name": "Auth" }, { "a": "Freemium", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "Apache-2.0", "name": "Licence" }, { "a": "47", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "com.gitlab/mcp", "b": "not listed", "name": "MCP registry" }, { "a": "2026-10-15", "b": "2026-10-26", "name": "Last release" }, { "a": "no date given", "b": "no date given", "name": "Terms last updated" }, { "a": "2026-04-23", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "976 stars", "name": "Popularity" } ], "faq": [ { "answer": "GitLab MCP Server scores 67.3 (B) on agent readiness against TokenEconomizer's 63.7 (B), and leads in 4 of 7 scored categories. TokenEconomizer leads on agent ergonomics, security \u0026 auth and payments \u0026 pricing.", "question": "Which is better for AI agents, GitLab MCP Server or TokenEconomizer?" }, { "answer": "GitLab MCP Server has a hosted endpoint at https://gitlab.com/api/v4/mcp. No hosted endpoint is listed for TokenEconomizer.", "question": "Can an agent call GitLab MCP Server and TokenEconomizer without installing anything?" }, { "answer": "No open-source release is listed for GitLab MCP Server. TokenEconomizer is open source (Apache-2.0).", "question": "Are GitLab MCP Server and TokenEconomizer open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 62 against 47", "Schema \u0026 documentation, 85 against 66", "Maintenance \u0026 community, 85 against 53", "Transparency \u0026 trust, 87 against 76" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "Agents working in GitLab projects, merge requests and pipelines, including self-managed instances. github-mcp-server and azure-devops-mcp are the closest listings; teams on GitHub should use GitHub's server.", "slug": "gitlab-mcp", "watchFor": "About 47 tools load by default before any toolset header" }, { "aheadOn": [ "Agent ergonomics, 76 against 66", "Security \u0026 auth, 71 against 66", "Payments \u0026 pricing, 60 against 30" ], "also": [ "No key needed to call it", "Open source" ], "goodFor": "Lowering the repeat cost of coding agents in repositories they work in often", "slug": "tokeneconomizer", "watchFor": "Version 0.1.0 (tagged 26 October 2026) with no changelog or release notes found; updating means a `git pull` of main, which is 67 commits past the tag" } ], "history": { "gitlab-mcp": null, "tokeneconomizer": [ { "causes": [ "evidence", "correction" ], "date": "2026-11-02", "delta": 1.1, "from": 62.6, "fromGrade": "B", "to": 63.7, "toGrade": "B" } ] }, "job": { "capability": "code.repo", "name": "Code repositories" }, "others": [ { "json": "https://www.anchorterminal.com/compare/azure-devops-mcp-vs-gitlab-mcp.json", "title": "Azure DevOps MCP Server vs GitLab MCP Server", "url": "https://www.anchorterminal.com/compare/azure-devops-mcp-vs-gitlab-mcp" }, { "json": "https://www.anchorterminal.com/compare/azure-devops-mcp-vs-tokeneconomizer.json", "title": "Azure DevOps MCP Server vs TokenEconomizer", "url": "https://www.anchorterminal.com/compare/azure-devops-mcp-vs-tokeneconomizer" }, { "json": "https://www.anchorterminal.com/compare/entire-vs-gitlab-mcp.json", "title": "Entire vs GitLab MCP Server", "url": "https://www.anchorterminal.com/compare/entire-vs-gitlab-mcp" }, { "json": "https://www.anchorterminal.com/compare/entire-vs-tokeneconomizer.json", "title": "Entire vs TokenEconomizer", "url": "https://www.anchorterminal.com/compare/entire-vs-tokeneconomizer" }, { "json": "https://www.anchorterminal.com/compare/github-mcp-server-vs-gitlab-mcp.json", "title": "GitHub MCP Server vs GitLab MCP Server", "url": "https://www.anchorterminal.com/compare/github-mcp-server-vs-gitlab-mcp" }, { "json": "https://www.anchorterminal.com/compare/github-mcp-server-vs-tokeneconomizer.json", "title": "GitHub MCP Server vs TokenEconomizer", "url": "https://www.anchorterminal.com/compare/github-mcp-server-vs-tokeneconomizer" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-gitmcp.json", "title": "GitLab MCP Server vs GitMCP", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-gitmcp" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-graft.json", "title": "GitLab MCP Server vs graft", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-graft" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-graphify.json", "title": "GitLab MCP Server vs Graphify", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-graphify" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-sourcegraph-mcp.json", "title": "GitLab MCP Server vs Sourcegraph MCP Server", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-sourcegraph-mcp" }, { "json": "https://www.anchorterminal.com/compare/gitmcp-vs-tokeneconomizer.json", "title": "GitMCP vs TokenEconomizer", "url": "https://www.anchorterminal.com/compare/gitmcp-vs-tokeneconomizer" }, { "json": "https://www.anchorterminal.com/compare/graft-vs-tokeneconomizer.json", "title": "graft vs TokenEconomizer", "url": "https://www.anchorterminal.com/compare/graft-vs-tokeneconomizer" }, { "json": "https://www.anchorterminal.com/compare/graphify-vs-tokeneconomizer.json", "title": "Graphify vs TokenEconomizer", "url": "https://www.anchorterminal.com/compare/graphify-vs-tokeneconomizer" }, { "json": "https://www.anchorterminal.com/compare/sourcegraph-mcp-vs-tokeneconomizer.json", "title": "Sourcegraph MCP Server vs TokenEconomizer", "url": "https://www.anchorterminal.com/compare/sourcegraph-mcp-vs-tokeneconomizer" }, { "json": "https://www.anchorterminal.com/compare/git-reference-server-vs-gitlab-mcp.json", "title": "Git (MCP reference server) vs GitLab MCP Server", "url": "https://www.anchorterminal.com/compare/git-reference-server-vs-gitlab-mcp" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-superpowers.json", "title": "GitLab MCP Server vs Superpowers", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-superpowers" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-salesforce-dx-mcp.json", "title": "GitLab MCP Server vs Salesforce DX MCP Server", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-salesforce-dx-mcp" }, { "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-void.json", "title": "GitLab MCP Server vs Void", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-void" } ], "panel": null, "scores": [ { "by": 15, "edge": "gitlab-mcp", "gitlab-mcp": 62, "key": "reliability", "name": "Reliability", "tokeneconomizer": 47, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 19, "edge": "gitlab-mcp", "gitlab-mcp": 85, "key": "schema", "name": "Schema \u0026 documentation", "tokeneconomizer": 66, "weight": 13 }, { "by": 10, "edge": "tokeneconomizer", "gitlab-mcp": 66, "key": "ergonomics", "name": "Agent ergonomics", "tokeneconomizer": 76, "weight": 13 }, { "by": 5, "edge": "tokeneconomizer", "gitlab-mcp": 66, "key": "security", "name": "Security \u0026 auth", "tokeneconomizer": 71, "weight": 14 }, { "by": 30, "edge": "tokeneconomizer", "gitlab-mcp": 30, "key": "payments", "name": "Payments \u0026 pricing", "tokeneconomizer": 60, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 32, "edge": "gitlab-mcp", "gitlab-mcp": 85, "key": "maintenance", "name": "Maintenance \u0026 community", "tokeneconomizer": 53, "weight": 7 }, { "by": 11, "edge": "gitlab-mcp", "gitlab-mcp": 87, "key": "transparency", "name": "Transparency \u0026 trust", "tokeneconomizer": 76, "weight": 7 } ], "summary": "GitLab MCP Server scores 67.3 (B) on agent readiness against TokenEconomizer's 63.7 (B), and leads in 4 of 7 scored categories. TokenEconomizer leads on agent ergonomics, security \u0026 auth and payments \u0026 pricing. Both do code repositories.", "tasks": null, "tutorials": [], "verdicts": { "gitlab-mcp": "A generally available MCP server inside GitLab itself, on every tier, with OAuth, toolset headers, published per-plan rate limits and Retry-After on 429. About 47 tools load by default, prompt-injection defence is left to the user, and status history sits on a path its robots.txt closes to us.", "tokeneconomizer": "A standard-library Python plugin that keeps learned state on the machine, documents each hook, makes every action reversible and merges outside fixes within days. It is version 0.1.0 with no changelog, installs from a git clone of main, and the 18.4 to 30.9 per cent savings are the paper's SWE-Bench figures, measured with settings unlike the plugin's defaults." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-tokeneconomizer", "json": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-tokeneconomizer.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-tokeneconomizer.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-tokeneconomizer.min.md" }, "markdown": "GitLab MCP Server scores 67.3 (B) on agent readiness against TokenEconomizer's 63.7 (B), and leads in 4 of 7 scored categories. TokenEconomizer leads on agent ergonomics, security \u0026 auth and payments \u0026 pricing. Both do code repositories.\n\n- GitLab MCP Server: grade B, 67.3/100, rank #335 of 1510. Markdown https://www.anchorterminal.com/tools/gitlab-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/gitlab-mcp.json\n- TokenEconomizer: grade B, 63.7/100, rank #507 of 1510. Markdown https://www.anchorterminal.com/tools/tokeneconomizer.md · JSON https://www.anchorterminal.com/api/v1/tools/tokeneconomizer.json\n- Best code, repository and documentation tools for AI agents: https://www.anchorterminal.com/best/code/index.md\n- All 70 code comparisons: https://www.anchorterminal.com/compare/code/index.md\n\n## Which one, for what\n\n### GitLab MCP Server (B)\n\nGood for: Agents working in GitLab projects, merge requests and pipelines, including self-managed instances. github-mcp-server and azure-devops-mcp are the closest listings; teams on GitHub should use GitHub's server.\n\nAhead on:\n- Reliability, 62 against 47\n- Schema \u0026 documentation, 85 against 66\n- Maintenance \u0026 community, 85 against 53\n- Transparency \u0026 trust, 87 against 76\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: About 47 tools load by default before any toolset header\n\n### TokenEconomizer (B)\n\nGood for: Lowering the repeat cost of coding agents in repositories they work in often\n\nAhead on:\n- Agent ergonomics, 76 against 66\n- Security \u0026 auth, 71 against 66\n- Payments \u0026 pricing, 60 against 30\n\nAlso in its favour:\n- No key needed to call it\n- Open source\n\nWatch for: Version 0.1.0 (tagged 26 October 2026) with no changelog or release notes found; updating means a `git pull` of main, which is 67 commits past the tag\n\n\n## Why the edge\n\n### Maintenance \u0026 community: GitLab MCP Server +32\n\n- GitLab MCP Server (85): GitLab 19.5 made the server generally available on 15 October 2026, 22 days before this check, and 19.6 changes are already on GitLab.com (30). Monthly releases 19.3, 19.4 (17 September) and 19.5 each changed MCP tools (20). Issues are public on gitlab.com, with a feedback issue (630189) for the server, but we didn't measure reply times (15). The registry entry com.gitlab/mcp sits under a domain-verified namespace with the right remote, though its version is still 0.0.1 from 2 October 2025 (10). GitLab ships through its own CI with monthly and patch releases; no official multi-language API SDK was found (10). 30 + 20 + 15 + 10 + 10 = 85.\n- TokenEconomizer (53): The clone shows one tag, v0.1.0 (annotated \"TokenEconomizer 0.1.0\", 26 October 2026), and 67 commits on main after it, the newest merged on 1 November 2026. GitHub's releases page couldn't be read. Recency rests on the 26 October tag, within 30 days (30). One release and no dated changelog entries in 90 days (0). Outside pull requests are merged within about a day, among them #84 and #88 on 30 October, #24 on 30 October (closing issue #86), and #93, #98, #101, #102 and #103 on 1 November. Open issue counts and reply times are unread, as GitHub's pages answer 403 in our session (15 of 25, as letsfg). Not an MCP server and in no official plugin marketplace (0). Standard-library only with no runtime dependencies, CI on push and pull requests, and the Codex version pinned in CI on purpose (8 of 10). 30 + 0 + 15 + 0 + 8 = 53.\n\n### Payments \u0026 pricing: TokenEconomizer +30\n\n- GitLab MCP Server (30): No x402, MPP or L402 (0). Plan prices are public for Free and Premium, Ultimate is by quote and GitLab Credits are $1 each, but the MCP server has no per-call price (10). GitLab.com Free needs no card, and the MCP server is on every tier (20). A person signs up, and an administrator must enable MCP and a user must authorise in a browser (0). 0 + 10 + 20 + 0 = 30.\n- TokenEconomizer (60): Self-hosted rule. No payment protocol (0). Free under Apache-2.0 with nothing to buy (20). No card or account (20). An agent can be given it with no sign-up, through its own plugin manager (20). Its judge and proposer calls are billed on the person's agent plan, and `te status` reports that cost. 60 in all.\n\n### Schema \u0026 documentation: GitLab MCP Server +19\n\n- GitLab MCP Server (85): The tools reference documents every parameter with its type, required flag and enum values, and the server exposes JSON Schema through MCP; we read the reference, not the source (22). docs.gitlab.com/llms.txt is served (10). Each tool says what it does, and superseded tools name their replacement (`Use get_merge_request with include: commits`), though few say when not to use one (14). Enums for include facets, states, scopes and methods, with documented maximums such as first up to 100 and byte_limit up to 1 MB (13). The docs cover 403 insufficient_scope, 400 for an unknown toolset, 429 headers and troubleshooting for Windows and Claude Code, but give few example responses (11). Per-tool version history and monthly release notes (15). 22 + 10 + 14 + 13 + 11 + 15 = 85.\n- TokenEconomizer (66): Framework reading, docs a model can follow, as superpowers was read. JSON plugin manifests for Claude Code, Codex and Copilot, a hooks.json per agent, slash-command files and a settings table with names, defaults and environment variables, and `--json` on two `te` commands, but no schema for its state or output (12 of 25). README, plugin/README.md, docs/PLUGIN.md and docs/ARCHITECTURE.md are Markdown in the repository; no llms.txt (10). The README says what each mechanism does and when it acts, and docs/PLUGIN.md has a known-limitations section and says when to keep micro-skills off (17 of 20). Mechanisms take on, off, propose or envfacts, numeric settings have stated defaults and minimums, and the config code checks choices (10 of 15). Command examples per agent, a troubleshooting section, `te doctor` and an errors.log, with few documented error outputs (12 of 15). A version number in every manifest but no public changelog (5 of 15). 66 in all.\n\n### Reliability: GitLab MCP Server +15\n\n- GitLab MCP Server (62): Hosted reading for GitLab.com. Status page at status.gitlab.com (status.io) with an API and a GitLab Duo component (20). Its incident history lives under /pages/, which the site's robots.txt disallows; our reader fetched that history page once before the rule was checked, so its contents are set aside and not scored. The front page shows only the current state, all operational on 6 November, so there is no readable history (5). MCP limits are published per plan, 60 a minute and 3,600 an hour on Free, 600 and 5,000 on Premium and Ultimate (15). 429 responses carry Retry-After and RateLimit-Reset, and a rate-limited upstream API comes back as a `rate_limited` tool result; accept_merge_request requires the head SHA, but we found no general idempotency guidance for writes (12). No uptime SLA on the pricing page (0). Generally available since 19.5 (10). 20 + 5 + 15 + 12 + 0 + 10 = 62.\n- TokenEconomizer (47): Local-package reading, as for superpowers and impeccable. Installs from a git clone through each agent's own plugin manager (a local marketplace on Claude Code, Codex and Copilot, `pi install git:` on Pi, a built local plugin on Cursor), not from a registry or an official marketplace, with Python 3.10 or later and a supported-versions table per agent (14 of 20). .github/workflows/tests.yml runs pytest on push to main and on pull requests, on Ubuntu and Windows with Python 3.10 and 3.13, plus a Codex end-to-end job pinned to 0.164.0 on Ubuntu and Windows. 25 test files in tests/ on 2 November, up from 14 at the v0.1.0 tag. Whether the runs pass wasn't checked, as github.com refuses our reader, so 15 of 25, the value this run gives when the pass state is unread (vibe-trading, berth, cloudflare-cli). The Wayback Machine's copy of the repository page of 30 October 2026 shows 1 open issue and 5 open pull requests, few for a project weeks old, with replies unchecked (15 of 25). No changelog or release notes found; renamed settings keep their old names as aliases and a state migration is described in docs/PLUGIN.md (3 of 15). Version 0.1.0 (0). 14 + 15 + 15 + 3 + 0 = 47.\n\n### Transparency \u0026 trust: GitLab MCP Server +11\n\n- GitLab MCP Server (87): GitLab's code is public in gitlab-org/gitlab, with the core under MIT and enterprise functions under GitLab's own licence; we didn't establish which licence covers the MCP server code (20). The privacy statement and a sub-processor page of 63 entries name AI providers and their purposes, but that page shows no update date and links no DPA (20). A dated deprecations and removals page and per-tool version history, with superseded tools kept as callable aliases (20). Sub-processors and their locations are disclosed, and Dedicated customers choose their AWS region (18). 20 + 20 + 20 + 18 = 78.\n- TokenEconomizer (76): Apache-2.0, an OSI licence (30). docs/PLUGIN.md section 4 and the README agree that learned state stays local and name which model calls leave the machine and what they carry, and the package source has no network code of its own. No privacy statement is linked from the repository (24 of 30). Old setting names and environment variables are still read, and a migration of state keys after 0.1.0 is documented, but there's no written deprecation policy (10 of 20). No telemetry found in the source or docs, and the outbound model calls are disclosed with switches to turn each off (20). 84 in all.\n\n### Agent ergonomics: TokenEconomizer +10\n\n- GitLab MCP Server (66): About 47 tools by default, plus 5 Duo tools where Duo is on, so more than 30 (5), with toolset and single-tool headers to cut the list (plus 10). Cursor pagination with first and after on most list tools, include facets one at a time, byte offsets and limits on files, jobs and artifacts (20). Documented error cases and a structured rate_limited result (15). The docs don't say whether tools carry readOnlyHint or destructiveHint; accept_merge_request has a SHA guard, and 19.4 governance sets write and delete tools to Always Ask for Duo (8). Sensible default toolsets, but no official SDKs for the REST API in two languages were found on the pages read (8). 15 + 20 + 15 + 8 + 8 = 66.\n- TokenEconomizer (76): Framework reading, how much a coding agent has to carry. The plugin's job is to shrink context. It adds up to four facts from failures (the proposer's facts are not capped) and one-line notices, while the loop guard's judge and the proposer are extra model calls, each Codex side call carrying Codex's base prompt of about 25,000 tokens by the code's own note (18 of 25). Each mechanism has its own switch and settings, a propose mode for tool pruning and per-session environment variables (15 of 20). Hooks fail open to `{}`, failures go to errors.log and `te doctor`, and the session start says why a deny list stayed a proposal (15 of 20). Writes are atomic under a file lock, the deny-list writer touches only its own entries and refuses symlinks out of the repository, and pruned tools come back with one command (18 of 20). Sensible defaults (micro-skills off, pruning and the guard on); a Python package with TypeScript extensions for Pi and opencode, not SDKs in two languages (10 of 15). 76 in all.\n\n## Score by category\n\n| Category | Weight | GitLab MCP Server | TokenEconomizer | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 62 | 47 | GitLab MCP Server +15 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 66 | GitLab MCP Server +19 |\n| Agent ergonomics | 13% (16.2 this run) | 66 | 76 | TokenEconomizer +10 |\n| Security \u0026 auth | 14% (17.5 this run) | 66 | 71 | TokenEconomizer +5 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 60 | TokenEconomizer +30 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 85 | 53 | GitLab MCP Server +32 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 87 | 76 | GitLab MCP Server +11 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **67.3 · B** | **63.7 · B** | |\n\n## Facts side by side\n\n| Fact | GitLab MCP Server | TokenEconomizer |\n| --- | --- | --- |\n| Kind | MCP server | Agent framework |\n| Vendor | GitLab Inc. | Microsoft |\n| Hosted endpoint | `https://gitlab.com/api/v4/mcp` | no (local only) |\n| Transports | Streamable HTTP | |\n| Auth | OAuth | None |\n| Pricing | Freemium | Free |\n| x402 | no | no |\n| Licence | none | Apache-2.0 |\n| Tools exposed | 47 | none |\n| Read-only variant documented | no | no |\n| llms.txt | yes | no |\n| MCP registry | `com.gitlab/mcp` | not listed |\n| Last release | 2026-10-15 | 2026-10-26 |\n| Terms last updated | no date given | no date given |\n| Privacy policy last updated | 2026-04-23 | no document linked |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Popularity | none | 976 stars |\n\n## How the scores have moved\n\n### GitLab MCP Server\n\nNo score change since it was listed.\n\n### TokenEconomizer\n\n- +1.1 on 2 November 2026: new evidence, correction\n\n## Verdicts\n\n**GitLab MCP Server.** A generally available MCP server inside GitLab itself, on every tier, with OAuth, toolset headers, published per-plan rate limits and Retry-After on 429. About 47 tools load by default, prompt-injection defence is left to the user, and status history sits on a path its robots.txt closes to us.\n\n**TokenEconomizer.** A standard-library Python plugin that keeps learned state on the machine, documents each hook, makes every action reversible and merges outside fixes within days. It is version 0.1.0 with no changelog, installs from a git clone of main, and the 18.4 to 30.9 per cent savings are the paper's SWE-Bench figures, measured with settings unlike the plugin's defaults.\n\n## Before you call either\n\n### GitLab MCP Server\n\n1. Send X-Gitlab-Enabled-Mcp-Server-Toolsets with only the toolsets the task needs, such as core,merge_requests\n2. Ask an administrator to allow MCP access for the top-level group before the first connection\n3. Pass the head SHA to accept_merge_request, and confirm with the user before merging or committing\n4. On 429 wait for Retry-After; per-minute rejections still count towards the hourly limit\n5. Treat issue, merge request and file content as untrusted input; GitLab doesn't filter it\n\n### TokenEconomizer\n\n1. Check the agent's version against the README's supported range before installing; versions outside it are untested or unsupported.\n2. Keep micro-skills off, or set microskills=envfacts, in a repository whose command output you don't trust.\n3. If a tool you need is missing, run the `toolprune` command to see what was left out and `toolprune restore` to bring it back.\n4. Run the plugin's commands from a terminal with ~/.tokeneconomizer/bin/te; inside the agent each command costs a model turn.\n5. Start the agent with TE_DISABLE=1 to run one session without the plugin.\n\n## Questions\n\n### Which is better for AI agents, GitLab MCP Server or TokenEconomizer?\n\nGitLab MCP Server scores 67.3 (B) on agent readiness against TokenEconomizer's 63.7 (B), and leads in 4 of 7 scored categories. TokenEconomizer leads on agent ergonomics, security \u0026 auth and payments \u0026 pricing.\n\n### Can an agent call GitLab MCP Server and TokenEconomizer without installing anything?\n\nGitLab MCP Server has a hosted endpoint at https://gitlab.com/api/v4/mcp. No hosted endpoint is listed for TokenEconomizer.\n\n### Are GitLab MCP Server and TokenEconomizer open source?\n\nNo open-source release is listed for GitLab MCP Server. TokenEconomizer is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/gitlab-mcp-vs-tokeneconomizer.json, and with the fewest tokens: https://www.anchorterminal.com/compare/gitlab-mcp-vs-tokeneconomizer.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"gitlab-mcp\", \"b\": \"tokeneconomizer\"}`. From a terminal: `anchor compare gitlab-mcp tokeneconomizer`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/gitlab-mcp.json and https://www.anchorterminal.com/api/v1/tools/tokeneconomizer.json\n\n## Other comparisons with GitLab MCP Server or TokenEconomizer\n\n- [Azure DevOps MCP Server vs GitLab MCP Server](https://www.anchorterminal.com/compare/azure-devops-mcp-vs-gitlab-mcp.md)\n- [Azure DevOps MCP Server vs TokenEconomizer](https://www.anchorterminal.com/compare/azure-devops-mcp-vs-tokeneconomizer.md)\n- [Entire vs GitLab MCP Server](https://www.anchorterminal.com/compare/entire-vs-gitlab-mcp.md)\n- [Entire vs TokenEconomizer](https://www.anchorterminal.com/compare/entire-vs-tokeneconomizer.md)\n- [GitHub MCP Server vs GitLab MCP Server](https://www.anchorterminal.com/compare/github-mcp-server-vs-gitlab-mcp.md)\n- [GitHub MCP Server vs TokenEconomizer](https://www.anchorterminal.com/compare/github-mcp-server-vs-tokeneconomizer.md)\n- [GitLab MCP Server vs GitMCP](https://www.anchorterminal.com/compare/gitlab-mcp-vs-gitmcp.md)\n- [GitLab MCP Server vs graft](https://www.anchorterminal.com/compare/gitlab-mcp-vs-graft.md)\n- [GitLab MCP Server vs Graphify](https://www.anchorterminal.com/compare/gitlab-mcp-vs-graphify.md)\n- [GitLab MCP Server vs Sourcegraph MCP Server](https://www.anchorterminal.com/compare/gitlab-mcp-vs-sourcegraph-mcp.md)\n- [GitMCP vs TokenEconomizer](https://www.anchorterminal.com/compare/gitmcp-vs-tokeneconomizer.md)\n- [graft vs TokenEconomizer](https://www.anchorterminal.com/compare/graft-vs-tokeneconomizer.md)\n- [Graphify vs TokenEconomizer](https://www.anchorterminal.com/compare/graphify-vs-tokeneconomizer.md)\n- [Sourcegraph MCP Server vs TokenEconomizer](https://www.anchorterminal.com/compare/sourcegraph-mcp-vs-tokeneconomizer.md)\n- [Git (MCP reference server) vs GitLab MCP Server](https://www.anchorterminal.com/compare/git-reference-server-vs-gitlab-mcp.md)\n- [GitLab MCP Server vs Superpowers](https://www.anchorterminal.com/compare/gitlab-mcp-vs-superpowers.md)\n- [GitLab MCP Server vs Salesforce DX MCP Server](https://www.anchorterminal.com/compare/gitlab-mcp-vs-salesforce-dx-mcp.md)\n- [GitLab MCP Server vs Void](https://www.anchorterminal.com/compare/gitlab-mcp-vs-void.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "GitLab MCP Server vs TokenEconomizer", "url": "" } ], "description": "GitLab scores 67.3 (B) to TokenEconomizer's 63.7 (B) for code repositories. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "GitLab MCP Server B 67.3", "TokenEconomizer B 63.7", "scores" ], "h1": "GitLab MCP Server vs TokenEconomizer", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/gitlab-mcp-vs-tokeneconomizer", "published": "2026-10-01", "section": "tools", "title": "GitLab vs TokenEconomizer for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/gitlab-mcp-vs-tokeneconomizer" }, "tokens": { "markdown": 4850, "slim": 2980 }, "version": 1 }