That split is the useful thing to know up front: browsing, reading files and inspecting a project's build all work anonymously, and the README says that is enough for most code discovery. Code search, LHCb stack search, issue search and wikis are the ones that will fail without CERNGITLAB_TOKEN — and CERN GitLab is the side enforcing that, not the server.
A reader for gitlab.cern.ch aimed at high-energy-physics code discovery: it searches projects, reads files and READMEs, inspects build systems and dependencies for Python and C++, and knows about LHCb software stacks.
- Discovery without a token: `search_projects`, `get_project_info`, `list_branches`, `list_project_files`, `get_file_content`, `get_project_readme`
- `inspect_project` analyses structure, build system, dependencies and CI configuration in one call
- Releases and tags: `list_releases`, `get_release`, `list_tags`
- `test_connectivity` confirms the instance is reachable before you debug anything else
- With a token: `search_code` across a project or globally, `search_lhcb_stack` which resolves the right Git ref for a named stack, `search_issues`, and `get_wiki_pages`
- Binary detection for .root files, so a search does not hand you an unreadable blob
Python 3.10+ and the PyPI package cerngitlab-mcp, version 0.3.0, run with uvx and no install step. Public repositories work with no credentials. A personal access token with the read_api scope, set as CERNGITLAB_TOKEN, unlocks code search, issue search and wikis. For a shared deployment there is an HTTP mode using CERN SSO plus a GitLab OAuth application, where GitLab's own permissions decide what each user sees; sessions expire after 2 hours.
One command — uvx cerngitlab-mcp