Can an agent create a repository with GitLab.com?
Who does each step
Whether the agent handles it alone or a person has to step in.
- 01
Discover
Workaround · setupAn agent cannot find the job's interface, or how to call it, from the vendor's machine-readable documents; a person tells it once.
- 02
Authority
Approval · setupYou consent once to the agent's own client.
- 03
Onboard
MachineThe agent can register itself with no person.
- 04
Pay
Not applicableNothing to pay for the job.
- 05
Confirm
MachineA failure comes back typed, in its answer or as its spec declares, so an agent can tell a failure from a success.
- 06
Sustain
MachineThe agent can renew and revoke its own access.
A person once, at Discover: telling the agent where the interface is or how to call it.
You, once, at Authority: consenting to the agent's access.
Not A+ yet: a descriptor on about.gitlab.com for GitLab.com, with a spec that covers the job, would let an agent find it alone.
Agent surfaces
The probe
Each request it sent and what came back; the descriptors it read, counted, with what they named.
Discover18 descriptor reads4 facts
- Found
- OAuthgitlab.comOAuthgitlab.com/api/v4/mcpOAuthgitlab.comFor agentsdocs.gitlab.com/llms.txt
- From
- gitlab.com/.well-known/oauth-authorization-server · gitlab.com/.well-known/oauth-protected-resource · docs.gitlab.com/llms.txt
- This endpoint
- gitlab.com/api/v4 is named by none of them
Job requestPOST gitlab.com/api/v4/projects401100 ms
- Request
- POST https://gitlab.com/api/v4/projects
- Response
- 401 · application/json · 30 bytes
- Body
- sha256:51542f5c4584eb471dd661ca8245b813e7aed5ac9d1cbefdc7b60a8743d443bf
- Exchange
- sha256:e4cb7b48c15d5c059b45872a28caddd6550a2e0c3ff71f01492f5ce3b19f37a2
Resource metadataGET gitlab.com/.well-known/oauth-protected-resource/api/v4/projects302141 ms
- Request
- GET https://gitlab.com/.well-known/oauth-protected-resource/api/v4/projects
- Response
- 302 · text/html · 0 bytes
- Body
- sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
- Exchange
- sha256:3276b109c1ef6fb692051831d4882321d81b87b77c261d4b6ce34d0ba32b634e
Resource metadataGET gitlab.com/.well-known/oauth-protected-resource20036 ms
- Request
- GET https://gitlab.com/.well-known/oauth-protected-resource
- Response
- 200 · application/json · 118 bytes
- Body
- sha256:5cd69ba77ffd9cd5b27ce2079bf30f4559106292614a7e18c2ea61c679158c19
- Exchange
- sha256:584ab1770b3f62f6c34fc66a45ef0bd9c94fb3310354bd3e5881220dc8a5cec3
Authorization serverGET gitlab.com/.well-known/oauth-authorization-server20035 ms
- Request
- GET https://gitlab.com/.well-known/oauth-authorization-server
- Response
- 200 · application/json · 1691 bytes
- Body
- sha256:8e0e3c20992580fd1fdbe9a042baf0ed5b226343e804082fa553de87fab3bed0
- Exchange
- sha256:41b283bc7d42fd7cfe94777fe8b755d66326378372c1ae71480306fdb0dc5fb6
Client registrationPOST gitlab.com/oauth/register201133 ms
- Request
- POST https://gitlab.com/oauth/register
- Response
- 201 · application/json · 389 bytes
- Body
- sha256:b4fd347efe5722403640623189b88da8357636ee531e1bbe0256828bc0629498
- Exchange
- sha256:ff8b5e77fc6f7ba821c87635bd87b549169d030bce52aa3d331f2c59254c005a
AuthorizationGET gitlab.com/oauth/authorize?response_type=code&client_id=72c3c6609af54af52d78dced5f0df778fef6605deccb95abe6b30815eed542b4&redirect_uri=https%3A%2F%2Fapi.sourcey.com%2F.well-known%2Fagent-readiness%2Fcallback&state=12f3665d18a61502a7f7200abc1a38af&code_challenge=8kXv2QxP6s5pT6UBXQ6lQXCzuTEVWaGTxWeoMqOxg_E&code_challenge_method=S256&resource=https%3A%2F%2Fgitlab.com%2Fapi%2Fv4%2Fprojects&scope=mcp302117 ms
- Request
- GET https://gitlab.com/oauth/authorize?response_type=code&client_id=72c3c6609af54af52d78dced5f0df778fef6605deccb95abe6b30815eed542b4&redirect_uri=https%3A%2F%2Fapi.sourcey.com%2F.well-known%2Fagent-readiness%2Fcallback&state=12f3665d18a61502a7f7200abc1a38af&code_challenge=8kXv2QxP6s5pT6UBXQ6lQXCzuTEVWaGTxWeoMqOxg_E&code_challenge_method=S256&resource=https%3A%2F%2Fgitlab.com%2Fapi%2Fv4%2Fprojects&scope=mcp
- Response
- 302 · text/html · 0 bytes
- Body
- sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
- Exchange
- sha256:e71c3a582226a2f8aa4d783cfa5d975db29067409979b1adb64c0432b5dced10
Declared pageGET gitlab.com/users/sign_up404119 ms
- Request
- GET https://gitlab.com/users/sign_up
- Response
- 404 · application/json · 0 bytes
- Body
- sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
- Exchange
- sha256:598b1aaea8ccda49f53d3d8109090d79bf08cdf4daf02bba913e3e8f630efd62
GitLab on the startup-offers board
- Free Ultimate license for 1 year + 50% discount in Year 2 (up to 20 seats)GitLab for Startups - Seed Stage Program
- 50% offGitLab for Startups - Early Stage Program
The grade’s badge
One image that keeps itself current, linking here.
[](https://sourcey.com/c/gitlab/agent-readiness/gitlab-com/repository-create)Improve the report
Correct it, probe it again, or improve the path.
- Profile
- arp_01m4t96s3qz9595vf4g37skdrc
- Projection
- sha256:eed5c2c5544fd2b6b92ef7fb075e87644fafc3a57cbba79cb41dc88649389ef0
- Policy
- kind-2026-10-12.2 · sha256:b612172aad277b54461de84e006815126f2df566563954b02f4432a39cad89ac
A report or a reassessment request names this profile, its revision and its projection. How report cards are assessed →View the exact declaration