Dependencies and SBOM

The dependency list GitLab builds from a project’s dependency scanning, filtered by package manager, and the software bill of materials it exports from a pipeline: dependency.export_create starts a CycloneDX export, dependency.export_get reports whether it is ready, and dependency.export_download fetches the document.

Sample questions

• “List the npm dependencies of project 42”
• “Export an SBOM for pipeline 1234”
• “Download the finished SBOM export”

How to call it

• Dynamic, the default surface: call gitlab_execute_action with action set to the action’s ID, such as dependency.export_create, and its parameters in params. gitlab_find_action finds an ID from a description of the task.
• Meta (GITLAB_MCP_TOOL_SURFACE=meta): call gitlab_dependency with action set to the action’s name, such as export_create, and its parameters in params.
• Individual (GITLAB_MCP_TOOL_SURFACE=individual): call the action’s own tool, such as gitlab_create_dependency_list_export, with its parameters as the arguments.

Availability

How many of these actions an instance serves at each tier, out of a total of 4:

• Free: 0
• Premium: 0
• Ultimate: 4

Read-only actions: 3 of 4, the ones a deployment in read-only mode keeps. A token with read_api and not api is served 3 of the 4.

Actions

The description of each action, and of each of its parameters, is the text the server serves for it on the default surface, quoted as served. The token lines say what GitLab 19.4.1 requires of a token for the requests each action sends; on an instance with Admin Mode turned on, an action only an administrator may run also needs admin_mode.

Action	Individual
dependency.export_create	gitlab_create_dependency_list_export
dependency.export_download	gitlab_download_dependency_list_export
dependency.export_get	gitlab_get_dependency_list_export
dependency.list	gitlab_list_project_dependencies

dependency.export_create

Create a dependency list export from a pipeline.

• Meta-tool: gitlab_dependency, action export_create
• Individual tool: gitlab_create_dependency_list_export
• Tier: Ultimate
• Classic or OAuth token: api
• Fine-grained token: Dependency List Export: Create at project (permissions page)
• Behavior: writes, not idempotent

Parameter	Type	Mandatory	Description
pipeline_id	integer	yes	Pipeline ID to export dependencies from
export_type	string	no	Export type (default: sbom)

dependency.export_download

Download generated dependency list export content whole. An export over 32 MiB is refused with the GitLab route to fetch it directly, never cut short.

• Meta-tool: gitlab_dependency, action export_download
• Individual tool: gitlab_download_dependency_list_export
• Tier: Ultimate
• Classic or OAuth token: read_api (or api)
• Fine-grained token: Dependency List Export: Read at project or group (permissions page)
• Behavior: read-only, idempotent

Parameter	Type	Mandatory	Description
export_id	integer	yes	Dependency list export ID

dependency.export_get

Get a dependency list export’s status (created, running, finished or failed), its type and its expiry. Poll it until the status is finished before fetching the content.

• Meta-tool: gitlab_dependency, action export_get
• Individual tool: gitlab_get_dependency_list_export
• Tier: Ultimate
• Classic or OAuth token: read_api (or api)
• Fine-grained token: Dependency List Export: Read at project or group (permissions page)
• Behavior: read-only, idempotent

Parameter	Type	Mandatory	Description
export_id	integer	yes	Dependency list export ID

dependency.list

List project dependency inventory.

• Meta-tool: gitlab_dependency, action list
• Individual tool: gitlab_list_project_dependencies
• Tier: Ultimate
• Classic or OAuth token: read_api (or api)
• Fine-grained token: Dependency: Read at project (permissions page)
• Behavior: read-only, idempotent

Parameter	Type	Mandatory	Description
project_id	string/integer	yes	Project ID or URL-encoded path
order_by	string	no	Column to order keyset-paginated results by
package_manager	string (bundler, composer, conan, go, gradle, maven, npm, nuget, pip, pipenv, pnpm, yarn, sbt, setuptools)	no	Filter by package manager (bundler, composer, conan, go, gradle, maven, npm, nuget, pip, pipenv, pnpm, yarn, sbt, setuptools)
page	integer	no	Page number to fetch, 1-based. Defaults to 1. Use the next_page field from the previous response to paginate forward.
page_token	string	no	Next page of a keyset listing: the next_page_token of the previous response of this action, passed back unchanged. It carries the position and every filter of the listing as GitLab read them, and those are what the next page is asked with, whatever filters are sent beside it. Leave it empty for the first page.
pagination	string	no	Pagination method: ‘keyset’ for keyset-based pagination on large ordered result sets, or ‘offset’ (the default). Keyset avoids deep-offset cost, and a keyset page names the next one in next_page_token rather than next_page.
per_page	integer	no	Items per page. Defaults to 20, minimum 1, maximum 100. Use 100 to minimize round trips when the result set is large.
sort	string (asc, desc)	no	Sort order for keyset-paginated results: asc or desc