Skip to main content

​
Overview

Connecting GitLab lets Rootly AI look at what shipped before an incident started. When an alert fires shortly after a deploy, Rootly AI can pull the merge requests that landed, the pipelines that ran, and the diffs they contained — without a responder switching to GitLab and piecing the timeline together by hand. Every query is read-only. Rootly AI can read merge requests, pipelines, and code but cannot create branches, comment, merge, or trigger pipelines.

​
Before You Start

GitLab serves its MCP endpoint through the GitLab Duo Agent Platform, so several things must be in place before Rootly AI can read anything. If any of the Duo or group requirements below are missing, OAuth can still succeed while GitLab queries return nothing.
  • A top-level group. Duo Agent Platform is configured per group. A personal namespace will not work.
  • GitLab Duo Agent Platform turned on for that group, under Settings → GitLab Duo → Configuration.
  • GitLab Duo Core turned on — “Allow users without a GitLab Duo Pro or Enterprise seat to access GitLab Duo Agent Platform features.”
  • Experiment and beta features turned on, under Feature preview on the same page. The MCP server is an experimental feature and stays hidden without this.
  • At least one project in the group. MCP will not serve tools against an empty group.
  • Permission to authorize third-party applications on your GitLab account.
Works with GitLab.com and self-managed instances running GitLab 19.2 or later. A self-managed instance must be reachable by Rootly at a public HTTPS URL. Private and internal-only addresses are blocked.

​
Setup

1

Open the GitLab connector card

Go to AI & Agents → Connectors and click Connect on the GitLab card.
2

Confirm your GitLab instance

The instance URL is pre-filled with https://gitlab.com. If you self-host, replace it with your instance’s base URL — for example https://gitlab.your-company.com. For self-managed GitLab, you can leave OAuth client ID blank to use dynamic client registration or enter an instance-owned public OAuth application’s ID. An explicit client ID is required when your instance disables dynamic registration.To use an explicit client ID, create an instance-owned public OAuth application with the mcp scope and this redirect URI:
Enter its Application ID in OAuth client ID. If Rootly support gave you a different Rootly environment, use that environment’s base URL with the same /account/ai/agent/data/remote_mcp_sources/callback path.
3

Authorize Rootly on GitLab

You are redirected to GitLab’s authorization screen. Sign in if prompted and approve the request.
4

Confirm the connection

GitLab returns you to Rootly after OAuth succeeds, and the card shows Connected. This confirms authorization only; run a GitLab query to verify that the MCP prerequisites above are enabled and projects are available.
Rootly AI sees the projects your GitLab account can see. To narrow what it can read, connect with an account whose project access is already scoped appropriately.

​
What Rootly AI Can Read

  • Merge requests — open and merged MRs, their commits, diffs, pipelines, and discussion notes.
  • Pipelines and jobs — pipeline runs and status, job results, and per-job outcomes for builds around the incident window.
  • Code — individual commits, file contents at a revision, and the repository file tree across connected projects.
  • Ownership — project members and their roles, for “who owns this?”
  • Work tracking — issues, work items, labels, and their notes.
  • Wikis and search — project wiki pages and cross-project search.
Write tools are excluded from the connection entirely. Rootly AI cannot create issues or merge requests, comment, push branches, or start and cancel pipelines.
GitLab is at its most useful for “what changed right before this broke?” Pair it with an observability connector: the observability tool shows the symptom, GitLab shows the change that likely caused it.

​
Best Practices

  • Connect with an account scoped to the right projects. Rootly AI inherits the authorizing account’s visibility, so an account with access to every project gives the AI access to every project.
  • Use a durable, scoped identity. Where your GitLab plan supports one, authorize with a service or bot account that has only the project access Rootly AI needs. Otherwise, choose an account with stable group membership so the connector does not stop working when a person changes roles or leaves.
  • Keep the authorizing account’s access current. If the account loses access to a project, Rootly AI loses it too — usually surfacing as “no recent merge requests found” rather than an error.
  • Pair with your CI connector. GitLab pipelines cover GitLab CI; if you also run builds elsewhere, connect that tool too so the deploy picture is complete.

​
Troubleshooting

A popup blocker is the usual cause. Allow popups for your Rootly domain and click Connect again.
Confirm you are signed in to the selected GitLab instance with an account permitted to authorize third-party applications. Some GitLab groups restrict this — a group owner may need to allow it.
Almost always a missing prerequisite rather than a broken connection. GitLab returns 404 — not a permission or billing error — when the MCP server is not available to your account, so Rootly shows the card as Connected while nothing works. Re-check every item under Before You Start, in particular that experiment and beta features are on and that the group contains at least one project.
This can occur when a self-managed instance uses OAuth dynamic client registration. GitLab creates a public client when you connect and may describe it as an “unverified dynamic application.” GitLab.com uses Rootly’s pre-registered public client and should not show this warning. To avoid the warning or when dynamic registration is disabled, configure an instance-owned public OAuth application and enter its Application ID when connecting.
Rootly AI only sees what the authorizing account sees. Confirm that account has at least Reporter access to the projects in question, then disconnect and reconnect the card.
Supported. Enter your instance’s base URL when connecting and Rootly derives the MCP endpoint from it. Your instance must be reachable from Rootly over HTTPS, and the same Duo Agent Platform prerequisites apply on your instance as on GitLab.com.