Loading
GitLab scores 65 out of 100 on the Agent Readiness Index
GitLab reaches level 3, Connectable. Discoverability is the strongest area at 89 out of 100. Protocol access is the weakest at 44.
GitLab was scanned on October 3, 2026. Its score is 65 out of 100, level 3, Connectable. An agent can connect through an MCP server or a public API program. To reach level 4, Trusted: Let customers authorize agents: OAuth with PKCE, a registration path and documented delegate controls.
Website: gitlab.com
Score by area
| Area | Score | What it asks |
|---|---|---|
| Discoverability | 89 out of 100, worth 15 points | Can an agent find and read your pages? |
| Protocol access | 44 out of 100, worth 20 points | Can an agent connect to you through MCP or an API? |
| Identity and delegation | 68 out of 100, worth 20 points | Can a customer give an agent limited access without sharing a password? |
| Web experience | 60 out of 100, worth 15 points | Does your site work when an agent uses it? |
| Voice and IVR | Not measured yet | What happens when an agent calls your phone line? |
| Policy and governance | 75 out of 100, worth 10 points | Do your terms allow agents that act for customers? |
What is holding GitLab back
- Developer and data sharing program, 4 points lost. No developer portal or data sharing program was found on public pages. Fix: Document the program, the standard in use for example FDX in US banking, the supported partners and a sandbox.
- Documented delegate and data sharing controls, 4 points lost. No public page on delegate access or connected app controls was found. Fix: Publish a help page on delegate access and add a connected apps screen where customers revoke access.
- Sign in page loads for a declared agent in a browser, 4 points lost. The sign in page did not load for an agent or a standard automated browser. Fix: Serve the sign in page to verified agent browsers, and use signed agent identity to separate them from attackers.
- MCP server, 3 points lost. The official MCP registry lists com.gitlab/mcp, but the scan did not reach a live endpoint. Fix: Publish a remote MCP server with OAuth. Start with read only tools such as account status, orders or location search, and publish a server card at /.well known/mcp/server card.
What already works
- OAuth and OpenID metadata
- llms.txt guide for agents
- Content available without running scripts
How GitLab compares
The average score for software is 61.4 out of 100 across 124 organizations. The average across all 1,420 scored organizations is 42.2 out of 100.
Similar organizations
- Snowflake, 69 out of 100
- Adobe, 68 out of 100
- Perplexity, 68 out of 100
- Writer, 63 out of 100
- Avalara, 62 out of 100
- Paychex, 62 out of 100