@zereight/mcp-gitlab 2.0.35 → 2.1.0

package/build/oauth-proxy.js

@@ -82,11 +82,16 @@ class GitLabOAuthServerProvider {
     _resourceName;
     _requiredScopes;
     _clientCache = new BoundedClientCache(CLIENT_CACHE_MAX_SIZE);
-    constructor(gitlabBaseUrl, gitlabAppId, resourceName, readOnly) {
+    constructor(gitlabBaseUrl, gitlabAppId, resourceName, readOnly, customScopes) {
         this._gitlabBaseUrl = gitlabBaseUrl;
         this._gitlabAppId = gitlabAppId;
         this._resourceName = resourceName;
-        this._requiredScopes = readOnly ? REQUIRED_GITLAB_SCOPES_RO : REQUIRED_GITLAB_SCOPES_RW;
+        this._requiredScopes =
+            customScopes && customScopes.length > 0
+                ? customScopes
+                : readOnly
+                    ? REQUIRED_GITLAB_SCOPES_RO
+                    : REQUIRED_GITLAB_SCOPES_RW;
     }
     // ---- Client store (local DCR) ------------------------------------------
     get clientsStore() {
@@ -251,7 +256,9 @@ class GitLabOAuthServerProvider {
  * @param gitlabBaseUrl  Root URL of the GitLab instance (no trailing slash, no /api/v4).
  * @param gitlabAppId    Client ID of the pre-registered GitLab OAuth application.
  * @param resourceName   Human-readable name shown on the GitLab consent screen.
+ * @param readOnly       When true and customScopes is not set, restricts to read_api scope.
+ * @param customScopes   Explicit list of GitLab scopes to require. Overrides readOnly when set.
  */
-export function createGitLabOAuthProvider(gitlabBaseUrl, gitlabAppId, resourceName = "GitLab MCP Server", readOnly = false) {
-    return new GitLabOAuthServerProvider(gitlabBaseUrl, gitlabAppId, resourceName, readOnly);
+export function createGitLabOAuthProvider(gitlabBaseUrl, gitlabAppId, resourceName = "GitLab MCP Server", readOnly = false, customScopes) {
+    return new GitLabOAuthServerProvider(gitlabBaseUrl, gitlabAppId, resourceName, readOnly, customScopes);
 }

package/build/schemas.js

@@ -1,4 +1,17 @@
 import { z } from "zod";
+// Helper: coerce a JSON-stringified array to an actual array.
+// LLMs sometimes send '["a", "b"]' (string) instead of ["a", "b"] (array).
+const coerceStringArray = z.preprocess((val) => {
+    if (typeof val === "string") {
+        try {
+            const parsed = JSON.parse(val);
+            if (Array.isArray(parsed))
+                return parsed;
+        }
+        catch { /* not JSON, fall through */ }
+    }
+    return val;
+}, z.array(z.string()));
 // Base schemas for common types
 export const GitLabAuthorSchema = z.object({
     name: z.string(),
@@ -904,7 +917,7 @@ export const GitLabMergeRequestSchema = z.object({
         .optional()
         .describe("Number of commits the source branch is behind the target branch"),
     rebase_in_progress: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Whether rebase is currently in progress for this merge request"),
     merge_when_pipeline_succeeds: z.coerce.boolean().optional(),
@@ -1116,10 +1129,10 @@ export const UpdateIssueNoteSchema = ProjectParamsSchema.extend({
     .refine(data => !(data.body !== undefined && data.resolved !== undefined), {
     message: "Only one of 'body' or 'resolved' can be provided, not both",
 });
-// Input schema for adding a note to an existing issue discussion
+// Input schema for adding a note to an issue (top-level comment or discussion reply)
 export const CreateIssueNoteSchema = ProjectParamsSchema.extend({
     issue_iid: z.coerce.string().describe("The IID of an issue"),
-    discussion_id: z.coerce.string().describe("The ID of a thread"),
+    discussion_id: z.coerce.string().optional().describe("The ID of a thread. If provided, replies to that thread; otherwise creates a top-level note"),
     body: z.string().describe("The content of the note or reply"),
     created_at: z.string().optional().describe("Date the note was created at (ISO 8601 format)"),
 });
@@ -1135,9 +1148,17 @@ export const CreateOrUpdateFileSchema = ProjectParamsSchema.extend({
 });
 export const SearchRepositoriesSchema = z
     .object({
-    search: z.string().describe("Search query"), // Changed from query to match GitLab API
+    search: z.string().optional().describe("Search query"),
+    query: z.string().optional().describe("Search query (alias for 'search')"),
 })
-    .merge(PaginationOptionsSchema);
+    .merge(PaginationOptionsSchema)
+    .transform((data) => {
+    const search = data.search || data.query;
+    if (!search) {
+        throw new Error("Either 'search' or 'query' must be provided");
+    }
+    return { ...data, search, query: undefined };
+});
 export const CreateRepositorySchema = z.object({
     name: z.string().describe("Repository name"),
     description: z.string().optional().describe("Repository description"),
@@ -1222,12 +1243,12 @@ const MergeRequestOptionsSchema = {
     draft: z.coerce.boolean().optional().describe("Create as draft merge request"),
     allow_collaboration: z.coerce.boolean().optional().describe("Allow commits from upstream members"),
     remove_source_branch: z
-        .boolean()
+        .coerce.boolean()
         .nullable()
         .optional()
         .describe("Flag indicating if a merge request should remove the source branch when merging."),
     squash: z
-        .boolean()
+        .coerce.boolean()
         .nullable()
         .optional()
         .describe("If true, squash all commits into a single commit on merge."),
@@ -1246,7 +1267,7 @@ export const GetBranchDiffsSchema = ProjectParamsSchema.extend({
     from: z.string().describe("The base branch or commit SHA to compare from"),
     to: z.string().describe("The target branch or commit SHA to compare to"),
     straight: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Comparison method: false for '...' (default), true for '--'"),
     excluded_file_patterns: z
@@ -1273,7 +1294,7 @@ export const UpdateMergeRequestSchema = GetMergeRequestSchema.extend({
         .optional()
         .describe("New state (close/reopen) for the MR"),
     remove_source_branch: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Flag indicating if the source branch should be removed"),
     squash: z.coerce.boolean().optional().describe("Squash commits into a single commit when merging"),
@@ -1281,24 +1302,24 @@ export const UpdateMergeRequestSchema = GetMergeRequestSchema.extend({
 });
 export const MergeMergeRequestSchema = ProjectParamsSchema.extend({
     merge_request_iid: z.coerce.string().optional().describe("The IID of a merge request"),
-    auto_merge: z
+    auto_merge: z.coerce
         .boolean()
         .optional()
         .default(false)
         .describe("If true, the merge request merges when the pipeline succeeds."),
     merge_commit_message: z.string().optional().describe("Custom merge commit message"),
-    merge_when_pipeline_succeeds: z
+    merge_when_pipeline_succeeds: z.coerce
         .boolean()
         .optional()
         .default(false)
         .describe("If true, the merge request merges when the pipeline succeeds.in GitLab 17.11. Use"),
-    should_remove_source_branch: z
+    should_remove_source_branch: z.coerce
         .boolean()
         .optional()
         .default(false)
         .describe("Remove source branch after merge"),
     squash_commit_message: z.string().optional().describe("Custom squash commit message"),
-    squash: z
+    squash: z.coerce
         .boolean()
         .optional()
         .default(false)
@@ -1394,7 +1415,7 @@ export const ListMergeRequestDiffsSchema = GetMergeRequestSchema.extend({
     page: z.coerce.number().optional().describe("Page number for pagination (default: 1)"),
     per_page: z.coerce.number().optional().describe("Number of items per page (max: 100, default: 20)"),
     unidiff: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Present diffs in the unified diff format. Default is false. Introduced in GitLab 16.5."),
 });
@@ -1410,7 +1431,7 @@ export const GetMergeRequestFileDiffSchema = GetMergeRequestSchema.extend({
         .describe("List of file paths to retrieve diffs for (e.g. ['src/api/users.ts', 'src/repo/user.go']). " +
         "Call list_merge_request_changed_files first to get the full list of changed paths."),
     unidiff: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Present diff in the unified diff format. Default is false."),
 });
@@ -1421,7 +1442,7 @@ export const ListMergeRequestVersionsSchema = ProjectParamsSchema.extend({
 export const GetMergeRequestVersionSchema = ListMergeRequestVersionsSchema.extend({
     version_id: z.coerce.string().describe("The ID of the merge request diff version"),
     unidiff: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Present diffs in the unified diff format. Default is false. Introduced in GitLab 16.5."),
 });
@@ -1579,14 +1600,11 @@ export const UpdateIssueSchema = z.object({
     confidential: z.coerce.boolean().optional().describe("Set the issue to be confidential"),
     discussion_locked: z.coerce.boolean().optional().describe("Flag to lock discussions"),
     due_date: z.string().optional().describe("Date the issue is due (YYYY-MM-DD)"),
-    labels: z.array(z.string()).optional().describe("Array of label names"),
+    labels: coerceStringArray.optional().describe("Array of label names"),
     milestone_id: z.coerce.string().optional().describe("Milestone ID to assign"),
     state_event: z.enum(["close", "reopen"]).optional().describe("Update issue state (close/reopen)"),
     weight: z.coerce.number().optional().describe("Weight of the issue (numeric, typically hours of work)"),
-    issue_type: z
-        .enum(["issue", "incident", "test_case", "task"])
-        .optional()
-        .describe("The type of issue. One of issue, incident, test_case or task."),
+    issue_type: z.preprocess((val) => (typeof val === "string" ? val.toLowerCase() : val), z.enum(["issue", "incident", "test_case", "task"]).optional()).describe("The type of issue. One of issue, incident, test_case or task."),
 });
 export const DeleteIssueSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
@@ -1645,7 +1663,7 @@ export const ListProjectsSchema = z
     search_namespaces: z.coerce.boolean().optional().describe("Needs to be true if search is full path"),
     owned: z.coerce.boolean().optional().describe("Filter for projects owned by current user"),
     membership: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Filter for projects where current user is a member"),
     simple: z.coerce.boolean().optional().describe("Return only limited fields"),
@@ -1663,11 +1681,11 @@ export const ListProjectsSchema = z
         .optional()
         .describe("Return projects sorted in ascending or descending order"),
     with_issues_enabled: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Filter projects with issues feature enabled"),
     with_merge_requests_enabled: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Filter projects with merge requests feature enabled"),
     min_access_level: z.coerce.number().optional().describe("Filter by minimum access level"),
@@ -1677,7 +1695,7 @@ export const ListProjectsSchema = z
 export const ListLabelsSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     with_counts: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Whether or not to include issue and merge request counts"),
     include_ancestor_groups: z.coerce.boolean().optional().describe("Include ancestor groups"),
@@ -1729,11 +1747,11 @@ export const ListGroupProjectsSchema = z
         .optional()
         .describe("Filter by project visibility"),
     with_issues_enabled: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Filter projects with issues feature enabled"),
     with_merge_requests_enabled: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Filter projects with merge requests feature enabled"),
     min_access_level: z.coerce.number().optional().describe("Filter by minimum access level"),
@@ -1785,7 +1803,7 @@ export const GitLabWikiPageSchema = z.object({
 export const ListGroupWikiPagesSchema = z
     .object({
     group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
-    with_content: z.boolean().optional().describe("Include content of the wiki pages"),
+    with_content: z.coerce.boolean().optional().describe("Include content of the wiki pages"),
 })
     .merge(PaginationOptionsSchema);
 export const GetGroupWikiPageSchema = z.object({
@@ -1966,7 +1984,7 @@ export const CreateDraftNoteSchema = ProjectParamsSchema.extend({
         .describe("The ID of a discussion the draft note replies to"),
     position: MergeRequestThreadPositionSchema.optional().describe("Position when creating a diff note"),
     resolve_discussion: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Whether to resolve the discussion when publishing"),
 });
@@ -1977,7 +1995,7 @@ export const UpdateDraftNoteSchema = ProjectParamsSchema.extend({
     body: z.string().optional().describe("The content of the draft note"),
     position: MergeRequestThreadPositionSchema.optional().describe("Position when creating a diff note"),
     resolve_discussion: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Whether to resolve the discussion when publishing"),
 });
@@ -2085,7 +2103,7 @@ export const ListCommitsSchema = z.object({
     all: z.coerce.boolean().optional().describe("Retrieve every commit from the repository"),
     with_stats: z.coerce.boolean().optional().describe("Stats about each commit are added to the response"),
     first_parent: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Follow only the first parent commit upon seeing a merge commit"),
     order: z.enum(["default", "topo"]).optional().describe("List commits in order"),
@@ -2102,7 +2120,7 @@ export const GetCommitDiffSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or complete URL-encoded path to project"),
     sha: z.string().describe("The commit hash or name of a repository branch or tag"),
     full_diff: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Whether to return the full diff or only first page (default: false)"),
 });
@@ -2145,7 +2163,7 @@ export const ListProjectMembersSchema = z.object({
     user_ids: z.array(z.coerce.number()).optional().describe("Filter by user IDs"),
     skip_users: z.array(z.coerce.number()).optional().describe("User IDs to exclude"),
     include_inheritance: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Include inherited members. Defaults to false."),
     per_page: z.coerce.number().optional().describe("Number of items per page (default: 20, max: 100)"),
@@ -2216,11 +2234,11 @@ export const ListGroupIterationsSchema = z
         .optional()
         .describe("Fields in which fuzzy search should be performed with the query given in the argument search. The available options are title and cadence_title. Default is [title]."),
     include_ancestors: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Include iterations for group and its ancestors. Defaults to true."),
     include_descendants: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Include iterations for group and its descendants. Defaults to false."),
     updated_before: z
@@ -2419,7 +2437,7 @@ export const ListReleasesSchema = z
         .optional()
         .describe("The direction of the order. Either desc (default) for descending order or asc for ascending order."),
     include_html_description: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("If true, a response includes HTML rendered Markdown of the release description."),
 })
@@ -2428,7 +2446,7 @@ export const GetReleaseSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     tag_name: z.string().describe("The Git tag the release is associated with"),
     include_html_description: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("If true, a response includes HTML rendered Markdown of the release description."),
 });
@@ -2511,7 +2529,7 @@ export const ListJobArtifactsSchema = z.object({
         .optional()
         .describe("Directory path within the artifacts archive (defaults to root)"),
     recursive: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("Whether to list artifacts recursively"),
 });
@@ -2593,8 +2611,8 @@ export const CreateWorkItemSchema = z.object({
         .default("issue")
         .describe("Type of work item to create. Defaults to 'issue'."),
     description: z.string().optional().describe("Description of the work item (Markdown supported)"),
-    labels: z.array(z.string()).optional().describe("Array of label names to assign"),
-    assignee_usernames: z.array(z.string()).optional().describe("Array of usernames to assign"),
+    labels: coerceStringArray.optional().describe("Array of label names to assign"),
+    assignee_usernames: coerceStringArray.optional().describe("Array of usernames to assign"),
     parent_iid: z.coerce.number().optional().describe("IID of the parent work item to set hierarchy"),
     weight: z.coerce.number().optional().describe("Weight of the work item"),
     health_status: z.enum(["onTrack", "needsAttention", "atRisk"]).optional().describe("Set health status"),
@@ -2607,9 +2625,9 @@ export const CreateWorkItemSchema = z.object({
 export const UpdateWorkItemSchema = WorkItemParamsSchema.extend({
     title: z.string().optional().describe("New title"),
     description: z.string().optional().describe("New description (Markdown supported)"),
-    add_labels: z.array(z.string()).optional().describe("Label names to add"),
-    remove_labels: z.array(z.string()).optional().describe("Label names to remove"),
-    assignee_usernames: z.array(z.string()).optional().describe("Set assignees by username (replaces existing)"),
+    add_labels: coerceStringArray.optional().describe("Label names to add"),
+    remove_labels: coerceStringArray.optional().describe("Label names to remove"),
+    assignee_usernames: coerceStringArray.optional().describe("Set assignees by username (replaces existing)"),
     state_event: z.enum(["close", "reopen"]).optional().describe("Close or reopen the work item"),
     weight: z.coerce.number().optional().describe("Set weight (issues, tasks, epics only)"),
     status: z.string().optional().describe("Set status by ID. Use list_work_item_statuses to get available status IDs."),
@@ -2617,11 +2635,11 @@ export const UpdateWorkItemSchema = WorkItemParamsSchema.extend({
     parent_project_id: z.coerce.string().optional().describe("Project ID or path of the parent work item (defaults to same project as the work item)"),
     remove_parent: z.coerce.boolean().optional().describe("Set to true to remove the parent from hierarchy"),
     children_to_add: z.array(z.object({
-        project_id: z.coerce.string().describe("Project ID or path of the child work item"),
+        project_id: z.coerce.string().optional().describe("Project ID or path of the child work item. Defaults to the parent work item's project if omitted."),
         iid: z.coerce.number().describe("IID of the child work item"),
     })).optional().describe("Array of children to add to this work item's hierarchy"),
     children_to_remove: z.array(z.object({
-        project_id: z.coerce.string().describe("Project ID or path of the child work item"),
+        project_id: z.coerce.string().optional().describe("Project ID or path of the child work item. Defaults to the parent work item's project if omitted."),
         iid: z.coerce.number().describe("IID of the child work item"),
     })).optional().describe("Array of children to remove from this work item's hierarchy"),
     health_status: z.enum(["onTrack", "needsAttention", "atRisk"]).optional().describe("Set health status on issues and epics"),
@@ -2631,12 +2649,12 @@ export const UpdateWorkItemSchema = WorkItemParamsSchema.extend({
     iteration_id: z.string().optional().describe("Iteration ID (e.g. 'gid://gitlab/Iteration/123' or numeric ID). Use list_group_iterations to find available iterations."),
     confidential: z.coerce.boolean().optional().describe("Set confidentiality"),
     linked_items_to_add: z.array(z.object({
-        project_id: z.coerce.string().describe("Project ID or path of the work item to link"),
+        project_id: z.coerce.string().optional().describe("Project ID or path of the work item to link. Defaults to the same project if omitted."),
         iid: z.coerce.number().describe("IID of the work item to link"),
         link_type: z.enum(["RELATED", "BLOCKED_BY", "BLOCKS"]).optional().default("RELATED").describe("Link type: RELATED, BLOCKED_BY, or BLOCKS. Defaults to RELATED."),
     })).optional().describe("Work items to link"),
     linked_items_to_remove: z.array(z.object({
-        project_id: z.coerce.string().describe("Project ID or path of the linked work item to remove"),
+        project_id: z.coerce.string().optional().describe("Project ID or path of the linked work item to remove. Defaults to the same project if omitted."),
         iid: z.coerce.number().describe("IID of the linked work item to remove"),
     })).optional().describe("Linked work items to remove"),
     custom_fields: z.array(z.object({
@@ -2740,7 +2758,7 @@ export const ListWebhookEventsSchema = z
         .optional()
         .describe("Filter by response status code (e.g. 200, 500) or category: successful, client_failure, server_failure"),
     summary: z
-        .boolean()
+        .coerce.boolean()
         .optional()
         .describe("If true, return only summary fields (id, url, trigger, response_status, execution_duration) without full request/response payloads. Recommended for overview queries to avoid huge responses."),
     per_page: z

package/build/test/mcp-oauth-tests.js

@@ -15,6 +15,8 @@ import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server
 // ---------------------------------------------------------------------------
 const MOCK_OAUTH_TOKEN = "ya29.mock-oauth-token-abcdef123456";
 const MOCK_CLIENT_ID = "mock-app-uid-from-dcr";
+const MOCK_PAT_TOKEN = "glpat-mockpat-testtoken-abcdef12"; // ≥20 chars, valid charset
+const MOCK_JOB_TOKEN = "mockjobtoken-testenv-1234567890"; // ≥20 chars, valid charset
 const MOCK_GITLAB_PORT_BASE = 9200;
 const MCP_SERVER_PORT_BASE = 3200;
 // ---------------------------------------------------------------------------
@@ -441,3 +443,110 @@ describe("MCP OAuth — createGitLabOAuthProvider", () => {
         console.log(`  ✓ client_name annotated: ${registered.client_name}`);
     });
 });
+// ---------------------------------------------------------------------------
+// Test suite: Header auth fallback within GITLAB_MCP_OAUTH mode
+// ---------------------------------------------------------------------------
+describe("MCP OAuth — Header Auth Fallback", () => {
+    let mcpUrl;
+    let mcpBaseUrl;
+    let mockGitLab;
+    let servers = [];
+    before(async () => {
+        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE + 150);
+        mockGitLab = new MockGitLabServer({
+            port: mockPort,
+            // Include both OAuth token and raw tokens so GitLab API calls succeed
+            validTokens: [MOCK_OAUTH_TOKEN, MOCK_PAT_TOKEN, MOCK_JOB_TOKEN],
+        });
+        await mockGitLab.start();
+        const mockGitLabUrl = mockGitLab.getUrl();
+        // OAuth endpoints needed for server startup AS metadata
+        addOAuthEndpoints(mockGitLab, MOCK_OAUTH_TOKEN, MOCK_CLIENT_ID, mockGitLabUrl);
+        const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE + 150);
+        mcpBaseUrl = `http://${HOST}:${mcpPort}`;
+        mcpUrl = `${mcpBaseUrl}/mcp`;
+        const server = await launchServer({
+            mode: TransportMode.STREAMABLE_HTTP,
+            port: mcpPort,
+            timeout: 5000,
+            env: {
+                STREAMABLE_HTTP: "true",
+                GITLAB_MCP_OAUTH: "true",
+                GITLAB_OAUTH_APP_ID: "test-oauth-app-id",
+                GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+                MCP_SERVER_URL: mcpBaseUrl,
+                MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL: "true",
+            },
+        });
+        servers.push(server);
+        console.log(`Mock GitLab (header-auth): ${mockGitLabUrl}`);
+        console.log(`MCP Server  (header-auth): ${mcpBaseUrl}`);
+    });
+    after(async () => {
+        cleanupServers(servers);
+        if (mockGitLab) {
+            await mockGitLab.stop();
+        }
+    });
+    const initBody = JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: {
+            protocolVersion: "2024-11-05",
+            capabilities: {},
+            clientInfo: { name: "test-client", version: "1.0.0" },
+        },
+    });
+    test("POST /mcp with Private-Token header bypasses OAuth and is accepted", async () => {
+        const res = await fetch(mcpUrl, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json, text/event-stream",
+                "Private-Token": MOCK_PAT_TOKEN,
+            },
+            body: initBody,
+        });
+        assert.notStrictEqual(res.status, 401, "Should not return 401 with valid Private-Token");
+        assert.notStrictEqual(res.status, 403, "Should not return 403 with valid Private-Token");
+        console.log(`  ✓ Private-Token header accepted (status: ${res.status})`);
+    });
+    test("POST /mcp with JOB-TOKEN header bypasses OAuth and is accepted", async () => {
+        const res = await fetch(mcpUrl, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json, text/event-stream",
+                "job-token": MOCK_JOB_TOKEN,
+            },
+            body: initBody,
+        });
+        assert.notStrictEqual(res.status, 401, "Should not return 401 with valid JOB-TOKEN");
+        assert.notStrictEqual(res.status, 403, "Should not return 403 with valid JOB-TOKEN");
+        console.log(`  ✓ JOB-TOKEN header accepted (status: ${res.status})`);
+    });
+    test("POST /mcp with valid OAuth Bearer token still works normally", async () => {
+        const res = await fetch(mcpUrl, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json, text/event-stream",
+                Authorization: `Bearer ${MOCK_OAUTH_TOKEN}`,
+            },
+            body: initBody,
+        });
+        assert.notStrictEqual(res.status, 401, "OAuth Bearer should still work alongside header auth");
+        assert.notStrictEqual(res.status, 403, "Should not return 403 with valid OAuth token");
+        console.log(`  ✓ OAuth Bearer token still accepted (status: ${res.status})`);
+    });
+    test("POST /mcp with no auth still returns 401", async () => {
+        const res = await fetch(mcpUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: initBody,
+        });
+        assert.strictEqual(res.status, 401, "Should return 401 with no auth");
+        console.log("  ✓ No auth still returns 401");
+    });
+});

package/build/test/schema-tests.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env ts-node
-import { GetFileContentsSchema, GitLabFileContentSchema, CreatePipelineSchema } from '../schemas.js';
+import { GetFileContentsSchema, GitLabFileContentSchema, CreatePipelineSchema, CreateIssueNoteSchema } from '../schemas.js';
 function runGetFileContentsSchemaTests() {
     console.log('🧪 Testing GetFileContentsSchema...');
     const cases = [
@@ -298,12 +298,86 @@ function runCreatePipelineSchemaTests() {
     console.log(`\nResults: ${passed} passed, ${failed} failed`);
     return { passed, failed };
 }
+function runCreateIssueNoteSchemaTests() {
+    console.log('\n🧪 Testing CreateIssueNoteSchema...');
+    const cases = [
+        {
+            name: 'schema:create_issue_note:top-level-note-without-discussion-id',
+            input: { project_id: 'my/project', issue_iid: '42', body: 'A comment' },
+            expected: { project_id: 'my/project', issue_iid: '42', body: 'A comment', discussion_id: undefined }
+        },
+        {
+            name: 'schema:create_issue_note:reply-with-discussion-id',
+            input: { project_id: 'my/project', issue_iid: '42', discussion_id: 'abc123', body: 'A reply' },
+            expected: { project_id: 'my/project', issue_iid: '42', discussion_id: 'abc123', body: 'A reply' }
+        },
+        {
+            name: 'schema:create_issue_note:with-created-at',
+            input: { project_id: 'my/project', issue_iid: '7', body: 'Note', created_at: '2025-01-01T00:00:00Z' },
+            expected: { project_id: 'my/project', issue_iid: '7', body: 'Note', created_at: '2025-01-01T00:00:00Z' }
+        },
+        {
+            name: 'schema:create_issue_note:numeric-issue-iid-coerced',
+            input: { project_id: 'my/project', issue_iid: 99, body: 'Coerced' },
+            expected: { project_id: 'my/project', issue_iid: '99', body: 'Coerced' }
+        },
+        {
+            name: 'schema:create_issue_note:reject-missing-body',
+            input: { project_id: 'my/project', issue_iid: '1' },
+            shouldFail: true
+        }
+    ];
+    let passed = 0;
+    let failed = 0;
+    cases.forEach(testCase => {
+        const result = {
+            name: testCase.name,
+            status: 'failed'
+        };
+        const parsed = CreateIssueNoteSchema.safeParse(testCase.input);
+        if (testCase.shouldFail) {
+            if (parsed.success) {
+                result.error = 'Expected schema validation to fail';
+            }
+            else {
+                result.status = 'passed';
+            }
+        }
+        else if (parsed.success) {
+            const expected = testCase.expected || {};
+            const matches = Object.entries(expected).every(([key, value]) => {
+                const actual = parsed.data[key];
+                return actual === value;
+            });
+            if (matches) {
+                result.status = 'passed';
+            }
+            else {
+                result.error = `Unexpected parsed result: ${JSON.stringify(parsed.data)}`;
+            }
+        }
+        else {
+            result.error = parsed.error?.message || 'Schema validation failed';
+        }
+        if (result.status === 'passed') {
+            passed++;
+            console.log(`✅ ${result.name}`);
+        }
+        else {
+            failed++;
+            console.log(`❌ ${result.name}: ${result.error}`);
+        }
+    });
+    console.log(`\nResults: ${passed} passed, ${failed} failed`);
+    return { passed, failed };
+}
 if (import.meta.url === `file://${process.argv[1]}`) {
     const getFileContentsResult = runGetFileContentsSchemaTests();
     const fileContentResult = runGitLabFileContentSchemaTests();
     const createPipelineResult = runCreatePipelineSchemaTests();
-    const totalPassed = getFileContentsResult.passed + fileContentResult.passed + createPipelineResult.passed;
-    const totalFailed = getFileContentsResult.failed + fileContentResult.failed + createPipelineResult.failed;
+    const createIssueNoteResult = runCreateIssueNoteSchemaTests();
+    const totalPassed = getFileContentsResult.passed + fileContentResult.passed + createPipelineResult.passed + createIssueNoteResult.passed;
+    const totalFailed = getFileContentsResult.failed + fileContentResult.failed + createPipelineResult.failed + createIssueNoteResult.failed;
     console.log(`\nTotal Results: ${totalPassed} passed, ${totalFailed} failed`);
     if (totalFailed > 0) {
         process.exit(1);