Security scan profiles

A security scan profile bundles a scanning configuration, such as secret detection or dependency scanning, that applies to the projects and groups it is attached to. security_scan_profile.attach takes the name of one of GitLab’s default profiles, or a persisted profile’s numeric ID, and attaches it; security_scan_profile.detach takes the persisted profile’s ID; security_scan_profile.list_project_statuses reports each profile’s status on a project.

Scan profiles need GitLab 18.7 or later, and each default profile has its own minimum release, which an attach refusal names. Every target must belong to a group namespace, all of one root namespace.

Sample questions

• “Attach the dependency scanning profile to project 42”
• “Which scan profiles are active on project 42?”
• “Detach the scan profile from these groups”

How to call it

• Dynamic, the default surface: call gitlab_execute_action with action set to the action’s ID, such as security_scan_profile.attach, and its parameters in params. gitlab_find_action finds an ID from a description of the task.
• Meta (GITLAB_MCP_TOOL_SURFACE=meta): call gitlab_security_scan_profile with action set to the action’s name, such as attach, and its parameters in params.
• Individual (GITLAB_MCP_TOOL_SURFACE=individual): call the action’s own tool, such as gitlab_attach_security_scan_profile, with its parameters as the arguments.

Availability

How many of these actions an instance serves at each tier, out of a total of 3:

• Free: 0
• Premium: 0
• Ultimate: 3

Read-only actions: 1 of 3, the ones a deployment in read-only mode keeps. A token with read_api and not api is served 1 of the 3.

Actions

The description of each action, and of each of its parameters, is the text the server serves for it on the default surface, quoted as served. The token lines say what GitLab 19.4.1 requires of a token for the requests each action sends; on an instance with Admin Mode turned on, an action only an administrator may run also needs admin_mode. A destructive action runs only once confirmed, unless GITLAB_MCP_YOLO_MODE (or AUTOPILOT) skips that step: the dynamic surface needs confirm: true on gitlab_execute_action, and the other two take a confirm parameter or the client’s prompt (Destructive actions).

Action	Individual
security_scan_profile.attach	gitlab_attach_security_scan_profile
security_scan_profile.detach	gitlab_detach_security_scan_profile
security_scan_profile.list_project_statuses	gitlab_list_project_scan_profile_statuses

security_scan_profile.attach

Attach a GitLab security scan profile to one or more projects and/or groups via GraphQL. Requires Ultimate. Returns: attach confirmation with the resolved profile and targets. See also: security_scan_profile.detach, security_scan_profile.list_project_statuses, project.get. API docs: https://docs.gitlab.com/api/graphql/reference/#mutationsecurityscanprofileattach

• Meta-tool: gitlab_security_scan_profile, action attach
• Individual tool: gitlab_attach_security_scan_profile
• Tier: Ultimate
• Classic or OAuth token: api
• Fine-grained token: Not reachable at this release: GitLab declares no fine-grained permission for the mutation securityScanProfileAttach, and refuses it (permissions page)
• Behavior: writes, not idempotent

Parameter	Type	Mandatory	Description
security_scan_profile_id	string	yes	Security scan profile identifier: the name of a GitLab default profile (secret_detection, sast, dependency_scanning, dependency_scanning_post_processing, triage_and_remediation_conservative, triage_and_remediation_standard, or triage_and_remediation_proactive), for which attach creates the namespace’s default profile on the fly, or the persisted profile’s numeric database ID (required by detach). A full gid:// global ID is also accepted. sast needs GitLab 18.10 and dependency_scanning needs 18.11, both behind a feature flag until 19.0, dependency_scanning_post_processing needs 19.2, and the triage_and_remediation presets need 19.4. container_scanning and business_logic have no default profile, and the bare triage_and_remediation names none of its presets, so attach refuses all three by name
group_ids	integer[]	no	Numeric IDs of the groups to attach the profile to
project_ids	integer[]	no	Numeric IDs of the projects to attach the profile to

Also needs at least one of: project_ids; group_ids.

security_scan_profile.detach

Detach a GitLab security scan profile from one or more projects and/or groups via GraphQL. Requires Ultimate. Returns: detach confirmation with the resolved profile and targets. See also: security_scan_profile.attach, security_scan_profile.list_project_statuses, project.get. API docs: https://docs.gitlab.com/api/graphql/reference/#mutationsecurityscanprofiledetach

• Meta-tool: gitlab_security_scan_profile, action detach
• Individual tool: gitlab_detach_security_scan_profile
• Tier: Ultimate
• Classic or OAuth token: api
• Fine-grained token: Not reachable at this release: GitLab declares no fine-grained permission for the mutation securityScanProfileDetach, and refuses it (permissions page)
• Behavior: writes, destructive (needs confirmation), idempotent

Parameter	Type	Mandatory	Description
security_scan_profile_id	string	yes	Persisted scan profile identifier: the profile’s numeric database ID (obtained from security_scan_profile.list_project_statuses) or a full gid:// global ID. A scan-type name (dependency_scanning, sast, …) is not accepted by detach
group_ids	integer[]	no	Numeric IDs of the groups to detach the profile from
project_ids	integer[]	no	Numeric IDs of the projects to detach the profile from

Also needs at least one of: project_ids; group_ids.

security_scan_profile.list_project_statuses

List the security scan profile statuses for a GitLab project via GraphQL. Requires Ultimate. Returns: per-scan-type profile status (NOT_CONFIGURED, PENDING, ACTIVE, WARNING, FAILED, or STALE). See also: security_scan_profile.attach, security_scan_profile.detach, project.get. API docs: https://docs.gitlab.com/api/graphql/reference/#project-scanprofilestatuses

• Meta-tool: gitlab_security_scan_profile, action list_project_statuses
• Individual tool: gitlab_list_project_scan_profile_statuses
• Tier: Ultimate
• Classic or OAuth token: read_api (or api)
• Fine-grained token: Not reachable at this release: GitLab declares no fine-grained permission for ScanProfileProjectStatus, which the answer is made of (permissions page)
• Behavior: read-only, idempotent

Parameter	Type	Mandatory	Description
project_full_path	string	yes	Full project path (namespace/project). Numeric project IDs are not accepted by the GraphQL project(fullPath:) field