Compliance policy settings

One administrator setting of the instance: the namespace that centrally manages security policies, held as csp_namespace_id. compliance_policy.get reads it and compliance_policy.update sets it.

Sample questions

• “Which namespace manages the instance’s security policies?”
• “Set the security policy namespace to group 12”

How to call it

• Dynamic, the default surface: call gitlab_execute_action with action set to the action’s ID, such as compliance_policy.get, and its parameters in params. gitlab_find_action finds an ID from a description of the task.
• Meta (GITLAB_MCP_TOOL_SURFACE=meta): call gitlab_compliance_policy with action set to the action’s name, such as get, and its parameters in params.
• Individual (GITLAB_MCP_TOOL_SURFACE=individual): call the action’s own tool, such as gitlab_get_compliance_policy_settings, with its parameters as the arguments.

Availability

How many of these actions an instance serves at each tier, out of a total of 2:

• Free: 0
• Premium: 0
• Ultimate: 2

Read-only actions: 1 of 2, the ones a deployment in read-only mode keeps. A token with read_api and not api is served 1 of the 2.

Actions

The description of each action, and of each of its parameters, is the text the server serves for it on the default surface, quoted as served. The token lines say what GitLab 19.4.1 requires of a token for the requests each action sends; on an instance with Admin Mode turned on, an action only an administrator may run also needs admin_mode.

Action	Individual
compliance_policy.get	gitlab_get_compliance_policy_settings
compliance_policy.update	gitlab_update_compliance_policy_settings

compliance_policy.get

Get the instance compliance policy settings. Returns: the centralized compliance security policy (CSP) namespace ID, or unset when no namespace hosts the compliance policy project. See also: compliance_policy.update, group.get.

• Meta-tool: gitlab_compliance_policy, action get
• Individual tool: gitlab_get_compliance_policy_settings
• Tier: Ultimate
• Classic or OAuth token: read_api (or api)
• Fine-grained token: Compliance Policy Setting: Read at instance (permissions page)
• Behavior: read-only, idempotent

No parameters.

compliance_policy.update

Update the instance compliance policy settings. Returns: the compliance policy settings with the newly bound centralized compliance security policy (CSP) namespace ID. See also: compliance_policy.get, group.get.

• Meta-tool: gitlab_compliance_policy, action update
• Individual tool: gitlab_update_compliance_policy_settings
• Tier: Ultimate
• Classic or OAuth token: api
• Fine-grained token: Compliance Policy Setting: Update at instance (permissions page)
• Behavior: writes, idempotent

Parameter	Type	Mandatory	Description
csp_namespace_id	integer	yes	Namespace ID for the compliance security policy project. Pass 0 to remove the designation. Every change locks the setting for ten minutes