The Model Context Protocol (MCP) is rapidly becoming the de facto standard for connecting LLMs to external systems, but implementation gaps are causing friction for autonomous coding assistants like Cline, Claude Desktop, and Cursor. In a significant contribution to the open-source community, engineer hrlpavan successfully merged two critical Merge Requests into GitLab Core that resolve handshake failures and prevent agent hallucinations. These updates ensure that AI agents can properly discover and subscribe to GitLab resources without triggering fatal 404 errors.

The Handshake Disconnect and Resource Discovery

The core issue stemmed from a capability mismatch during the initial JSON-RPC handshake. When modern MCP clients initialized a session with GitLab's server, they probed for context by sending requests to resources/list and resources/templates/list. Because GitLab had not implemented or advertised these endpoints, the server responded with error code -32601: "Method not found." This failure caused AI clients to either crash or disable context-awareness entirely, rendering them blind to project issues and repository files. Hrlpavan’s first MR, !260212, resolved this by updating the server_capabilities method to explicitly advertise resources and implementing the ResourcesListHandler and ResourceTemplatesListHandler classes within the Ruby on Rails monolith.

Hardening Search Against LLM Hallucinations

Beyond connectivity, the second MR, !259119, addressed a subtle but dangerous vulnerability in the search tool schema. Previously, the scope parameter was defined simply as type: string, allowing LLMs to hallucinate invalid scopes like "all," "code_and_issues," or "mr." These invalid inputs triggered server-side 500 or 400 errors, breaking the agent's workflow. The fix introduced strict enum constraints to the JSON Schema, limiting the scope to valid GitLab parameters such as blobs, issues, merge_requests, milestones, notes, projects, users, and wiki_blobs. This structural enforcement guarantees that models using structured function calling, including Claude 3.7 and GPT-4o, generate syntactically valid search parameters 100% of the time.

Navigating Enterprise-Grade CI Pipelines

Contributing to GitLab Core is not for the faint of heart, requiring engineers to navigate one of the most rigorous CI/CD pipelines in open source. Hrlpavan’s contributions had to pass checks from Danger Bot for changelog and license compliance, RuboCop for strict Ruby style enforcement, and Predictive RSpec, which dynamically selects relevant tests from tens of thousands of unit specs. The engineer also added comprehensive RSpec tests to cover both success cases and edge cases for the new handlers, ensuring zero regressions. Both MRs were approved by GitLab maintainers and merged into the main release, marking a significant milestone for community contributions to the platform's AI abstraction layer.

Key Takeaways

  • GitLab now supports MCP resource endpoints, allowing AI agents to discover projects, issues, and files via JSON-RPC.
  • Strict JSON Schema enums were added to the search tool to prevent LLMs from generating invalid search scopes.
  • The contributions passed GitLab’s rigorous CI pipeline, including Danger Bot, RuboCop, and Predictive RSpec checks.
  • Users can now configure agents like Cline or Claude Desktop to connect seamlessly using a GitLab Personal Access Token.

The Bottom Line

MCP adoption is stalling because of brittle handshakes and loose schemas, not lack of interest. GitLab's decision to harden its API with strict enums and proper resource discovery is a blueprint for how enterprise platforms should prepare for agentic AI.