GitLab has released version 19.4, which expands its Model Context Protocol (MCP) server with new tools for continuous integration and delivery (CI/CD) pipelines, merge requests, repositories, work items, projects, and users. This update also introduces configurable governance settings for MCP tools within GitLab Duo, offering more control over how these tools are used. Additionally, the latest version enhances security testing capabilities, adds new features for developers, and improves license management for software dependencies. Previously, governance rules for tools used by the GitLab Duo Agent platform were limited to internal tools only. Tools accessible via the GitLab MCP server followed fixed rules that couldn’t be adjusted. Now, users can configure governance settings for MCP tools in the same place they manage internal tools. These tools are now visible alongside internal tools in GitLab Duo settings for groups and projects. Users can set a mode for each tool: Read-only tools default to "Always allow," while Write and Delete tools default to "Always ask." A new beta feature called MCP Server Access Restrictions allows users to control access to MCP servers by allowing or denying access to entire external servers or specific tools on those servers. This ensures that AI agents only access tools necessary for their tasks, limiting potential risks. These access controls apply consistently across different environments, including Agentic Chat, Flows, and IDE and CLI tools. The feature is currently in beta, and users are encouraged to provide feedback using ticket number 628378. GitLab’s Advanced Static Application Security Testing (SAST) now supports Kotlin, Dart, and Scala, using the same deep taint analysis as with Java and Python. For Kotlin, the update detects vulnerabilities in Android APIs related to SQL injection and unsafe WebView usage. Dart includes checks for Flutter and Dio frameworks, identifying issues like Server-Side Request Forgery (SSRF) and insecure HTTP traffic. Scala testing covers Play, Slick, and Akka frameworks for SQL injection and XSS vulnerabilities. These improvements were verified using intentionally vulnerable code repositories, with results presented as code flows from source to destination. GitLab now supports SPDX license expressions, including complex combinations like "MIT OR Apache-2.0" or "GPL-2.0-only WITH Classpath-exception-2.0." Previously, these expressions were marked as unknown in dependency lists and not considered in license approval policies. Now, they appear with their operators (AND, OR, WITH) in the dependency list, and policies can allow or reject them just like single-license dependencies. This update also includes support for CycloneDX Software Bill of Materials (SBOM) expressions, which were introduced in GitLab 19.3. Offline instances will receive these license expressions after downloading the updated v3 license data.