@zereight/mcp-gitlab 2.1.0 → 2.1.1

package/build/auth-retry.js

@@ -0,0 +1,81 @@
+/**
+ * Pure helper functions for OAuth 401 auto-retry logic.
+ *
+ * Extracted into a separate module so they can be unit-tested without
+ * importing index.ts (which has heavy side effects: starts the MCP server,
+ * reads env vars, etc.).
+ */
+import { Headers } from "node-fetch";
+/**
+ * Convert various header representations to a plain Record<string, string>.
+ */
+export function headersToPlainObject(headers) {
+    if (!headers)
+        return {};
+    if (headers instanceof Headers) {
+        const obj = {};
+        headers.forEach((value, key) => { obj[key] = value; });
+        return obj;
+    }
+    if (Array.isArray(headers)) {
+        return Object.fromEntries(headers);
+    }
+    return headers;
+}
+/**
+ * Detect request bodies that cannot be replayed (streams, FormData).
+ */
+export function isNonReplayableBody(body) {
+    if (!body)
+        return false;
+    // Stream-like objects (has .pipe or .read)
+    if (typeof body.pipe === "function" || typeof body.read === "function")
+        return true;
+    // form-data instances (duck-type check since FormData is dynamically imported)
+    if (typeof body.getBuffer === "function" && typeof body.getBoundary === "function")
+        return true;
+    return false;
+}
+/**
+ * Wrap a fetch function with automatic OAuth token refresh on 401 responses.
+ * On a 401, force-refreshes the OAuth token and retries the request once.
+ * The retry calls baseFetch directly (not the wrapper), so infinite loops are impossible.
+ * In non-OAuth mode, the wrapper is a transparent pass-through.
+ *
+ * When called without `config`, falls back to module globals in index.ts.
+ * When called with `config` (tests), uses injected dependencies.
+ */
+export function wrapWithAuthRetry(baseFetch, config) {
+    let refreshLock = null;
+    const log = config.logger ?? { info: () => { }, error: () => { } };
+    return (async (url, options) => {
+        const response = await baseFetch(url, options);
+        if (response.status === 401 && config.isOAuthEnabled()) {
+            // Skip retry for non-replayable bodies (streams, FormData) since the first request consumed them
+            if (isNonReplayableBody(options?.body)) {
+                log.info("Received 401 but request body is not replayable (stream/FormData), skipping retry.");
+                return response;
+            }
+            log.info("Received 401, force-refreshing OAuth token and retrying...");
+            try {
+                // Mutex: coalesce concurrent refresh attempts into a single in-flight request
+                if (!refreshLock) {
+                    refreshLock = config.refreshToken(true).finally(() => {
+                        refreshLock = null;
+                    });
+                }
+                const token = await refreshLock;
+                config.onTokenRefreshed(token);
+                const retryOptions = {
+                    ...options,
+                    headers: { ...headersToPlainObject(options?.headers), ...config.buildAuthHeaders() },
+                };
+                return await baseFetch(url, retryOptions);
+            }
+            catch (refreshError) {
+                log.error("OAuth token refresh failed, returning original 401 response:", refreshError);
+            }
+        }
+        return response;
+    });
+}

package/build/index.js

@@ -23,8 +23,8 @@ import { estimateMergeCommitCount, filterDiffsByPatterns, summarizeWebhookEvents
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
 import { GitLabClientPool } from "./gitlab-client-pool.js";
 import { allTools, readOnlyTools, destructiveTools, parseEnabledToolsets, parseIndividualTools, buildFeatureFlagOverrides, isToolInEnabledToolset, TOOLSET_DEFINITIONS, ALL_TOOLSET_IDS, } from "./tools/registry.js";
-import { BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateLabelSchema, // Added
-CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateRepositorySchema, CreateWikiPageSchema, CreateGroupWikiPageSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteLabelSchema, DeleteProjectMilestoneSchema, DeleteWikiPageSchema, DeleteMergeRequestNoteSchema, EditProjectMilestoneSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetDraftNoteSchema, GetFileContentsSchema, GetIssueLinkSchema, GetIssueSchema, GetLabelSchema, GetMergeRequestDiffsSchema, GetMergeRequestSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetDeploymentSchema, GetEnvironmentSchema, GetNamespaceSchema, 
+import { BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, // Added
+CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateMergeRequestNoteEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateRepositorySchema, CreateWikiPageSchema, CreateGroupWikiPageSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteProjectMilestoneSchema, DeleteWikiPageSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, EditProjectMilestoneSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetDraftNoteSchema, GetFileContentsSchema, GetIssueLinkSchema, GetIssueSchema, GetLabelSchema, GetMergeRequestDiffsSchema, GetMergeRequestSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetDeploymentSchema, GetEnvironmentSchema, GetNamespaceSchema, 
 // pipeline job schemas
 GetPipelineJobOutputSchema, GetPipelineSchema, GetProjectMilestoneSchema, GetProjectSchema, GetRepositoryTreeSchema, GetUsersSchema, GetWikiPageSchema, GitLabCommitSchema, GitLabCompareResultSchema, GitLabContentSchema, GitLabCreateUpdateFileResponseSchema, GitLabDiffSchema, 
 // Discussion Schemas
@@ -32,7 +32,7 @@ GitLabDiscussionNoteSchema, // Added
 GitLabDiscussionSchema, 
 // Draft Notes Schemas
 GitLabDraftNoteSchema, GitLabForkSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
-GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateLabelSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, ListWebhookEventsSchema, GetWebhookEventSchema, } from "./schemas.js";
+GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateLabelSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, ListWebhookEventsSchema, GetWebhookEventSchema, } from "./schemas.js";
 import { randomUUID } from "node:crypto";
 import { pino } from "pino";
 const logger = pino({
@@ -546,9 +546,22 @@ const createCookieJar = async () => {
     }
     return jar;
 };
+// Auth retry helpers — extracted to auth-retry.ts for testability (no side effects)
+export { headersToPlainObject, isNonReplayableBody, wrapWithAuthRetry, } from "./auth-retry.js";
+import { wrapWithAuthRetry } from "./auth-retry.js";
+/** Build AuthRetryConfig from module globals (lazy — reads globals at call time). */
+function defaultAuthRetryConfig() {
+    return {
+        isOAuthEnabled: () => USE_OAUTH && oauthClient != null,
+        refreshToken: (force) => oauthClient.getAccessToken(force),
+        onTokenRefreshed: (token) => { OAUTH_ACCESS_TOKEN = token; },
+        buildAuthHeaders,
+        logger,
+    };
+}
 // Cookie jar and fetch - reloaded when cookie file changes
 let cookieJar = null;
-let fetch = nodeFetch;
+let fetch = wrapWithAuthRetry(nodeFetch, defaultAuthRetryConfig());
 let lastCookieMtime = 0;
 let cookieReloadLock = null; // Mutex to prevent parallel reloads
 // Auth proxies may redirect and set cookies on the first request. We make a throwaway
@@ -568,7 +581,7 @@ async function reloadCookiesIfChanged() {
                 lastCookieMtime = mtime;
                 const newJar = await createCookieJar();
                 cookieJar = newJar;
-                fetch = newJar ? fetchCookie(nodeFetch, newJar) : nodeFetch;
+                fetch = wrapWithAuthRetry(newJar ? fetchCookie(nodeFetch, newJar) : nodeFetch, defaultAuthRetryConfig());
                 initialSessionRequestMade = false;
             }
         }
@@ -577,7 +590,7 @@ async function reloadCookiesIfChanged() {
             if (cookieJar) {
                 logger.info("Cookie file removed, clearing cached cookies");
                 cookieJar = null;
-                fetch = nodeFetch;
+                fetch = wrapWithAuthRetry(nodeFetch, defaultAuthRetryConfig());
                 lastCookieMtime = 0;
                 initialSessionRequestMade = false;
             }
@@ -1477,6 +1490,39 @@ async function createWorkItemNote(projectId, iid, body, options = {}) {
     }
     return data.createNote.note;
 }
+// --- Emoji Reactions (GraphQL) ---
+async function addGraphQLAwardEmoji(awardableId, name) {
+    const data = await executeGraphQL(`mutation($awardableId: AwardableID!, $name: String!) {
+      awardEmojiAdd(input: { awardableId: $awardableId, name: $name }) {
+        awardEmoji { name user { username } }
+        errors
+      }
+    }`, { awardableId, name });
+    if (data.awardEmojiAdd.errors?.length > 0) {
+        throw new Error(`Failed to add emoji reaction: ${data.awardEmojiAdd.errors.join(", ")}`);
+    }
+    return data.awardEmojiAdd.awardEmoji;
+}
+async function listGraphQLAwardEmoji(awardableId) {
+    const data = await executeGraphQL(`query($id: AwardableID!) {
+      awardable(id: $id) {
+        awardEmoji { nodes { name user { username } } }
+      }
+    }`, { id: awardableId });
+    return data.awardable?.awardEmoji?.nodes ?? [];
+}
+async function removeGraphQLAwardEmoji(awardableId, name) {
+    const data = await executeGraphQL(`mutation($awardableId: AwardableID!, $name: String!) {
+      awardEmojiRemove(input: { awardableId: $awardableId, name: $name }) {
+        awardEmoji { name }
+        errors
+      }
+    }`, { awardableId, name });
+    if (data.awardEmojiRemove.errors?.length > 0) {
+        throw new Error(`Failed to remove emoji reaction: ${data.awardEmojiRemove.errors.join(", ")}`);
+    }
+    return data.awardEmojiRemove.awardEmoji;
+}
 // --- Incident Timeline Events ---
 /**
  * List timeline events for an incident.
@@ -2695,6 +2741,42 @@ async function deleteMergeRequestNote(projectId, mergeRequestIid, noteId) {
         throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
     }
 }
+// --- Emoji Reactions (REST) ---
+function buildAwardEmojiPath(entity, projectId, entityIid, opts) {
+    projectId = decodeURIComponent(projectId);
+    const pp = encodeURIComponent(getEffectiveProjectId(projectId));
+    let path = `${getEffectiveApiUrl()}/projects/${pp}/${entity}/${entityIid}`;
+    if (opts?.noteId) {
+        path = opts.discussionId
+            ? `${path}/discussions/${opts.discussionId}/notes/${opts.noteId}`
+            : `${path}/notes/${opts.noteId}`;
+    }
+    path += "/award_emoji";
+    if (opts?.awardId)
+        path += `/${opts.awardId}`;
+    return path;
+}
+async function createRestAwardEmoji(path, name) {
+    const response = await fetch(path, {
+        ...getFetchConfig(),
+        method: "POST",
+        body: JSON.stringify({ name }),
+    });
+    await handleGitLabError(response);
+    return response.json();
+}
+async function listRestAwardEmoji(path) {
+    const response = await fetch(path, getFetchConfig());
+    await handleGitLabError(response);
+    return response.json();
+}
+async function deleteRestAwardEmoji(path) {
+    const response = await fetch(path, {
+        ...getFetchConfig(),
+        method: "DELETE",
+    });
+    await handleGitLabError(response);
+}
 async function getMergeRequestNote(projectId, mergeRequestIid, noteId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/notes/${noteId}`);
@@ -4081,6 +4163,8 @@ async function listGroupProjects(options) {
         url.searchParams.append("with_custom_attributes", options.with_custom_attributes.toString());
     if (options.with_security_reports !== undefined)
         url.searchParams.append("with_security_reports", options.with_security_reports.toString());
+    if (options.topic)
+        url.searchParams.append("topic", options.topic);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5773,6 +5857,42 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(note, null, 2) }],
                 };
             }
+            case "list_merge_request_emoji_reactions": {
+                const args = ListMergeRequestEmojiReactionsSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid);
+                const result = await listRestAwardEmoji(path);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "list_merge_request_note_emoji_reactions": {
+                const args = ListMergeRequestNoteEmojiReactionsSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid, { noteId: args.note_id, discussionId: args.discussion_id });
+                const result = await listRestAwardEmoji(path);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "create_merge_request_emoji_reaction": {
+                const args = CreateMergeRequestEmojiReactionSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid);
+                const result = await createRestAwardEmoji(path, args.name);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "delete_merge_request_emoji_reaction": {
+                const args = DeleteMergeRequestEmojiReactionSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid, { awardId: args.award_id });
+                await deleteRestAwardEmoji(path);
+                return { content: [{ type: "text", text: "Merge request emoji reaction deleted successfully" }] };
+            }
+            case "create_merge_request_note_emoji_reaction": {
+                const args = CreateMergeRequestNoteEmojiReactionSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid, { noteId: args.note_id, discussionId: args.discussion_id });
+                const result = await createRestAwardEmoji(path, args.name);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "delete_merge_request_note_emoji_reaction": {
+                const args = DeleteMergeRequestNoteEmojiReactionSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid, { noteId: args.note_id, discussionId: args.discussion_id, awardId: args.award_id });
+                await deleteRestAwardEmoji(path);
+                return { content: [{ type: "text", text: "Merge request note emoji reaction deleted successfully" }] };
+            }
             case "update_issue_note": {
                 const args = UpdateIssueNoteSchema.parse(params.arguments);
                 const note = await updateIssueNote(args.project_id, args.issue_iid, args.discussion_id, args.note_id, args.body, args.resolved);
@@ -5787,6 +5907,42 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(note, null, 2) }],
                 };
             }
+            case "list_issue_emoji_reactions": {
+                const args = ListIssueEmojiReactionsSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid);
+                const result = await listRestAwardEmoji(path);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "list_issue_note_emoji_reactions": {
+                const args = ListIssueNoteEmojiReactionsSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid, { noteId: args.note_id, discussionId: args.discussion_id });
+                const result = await listRestAwardEmoji(path);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "create_issue_emoji_reaction": {
+                const args = CreateIssueEmojiReactionSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid);
+                const result = await createRestAwardEmoji(path, args.name);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "delete_issue_emoji_reaction": {
+                const args = DeleteIssueEmojiReactionSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid, { awardId: args.award_id });
+                await deleteRestAwardEmoji(path);
+                return { content: [{ type: "text", text: "Issue emoji reaction deleted successfully" }] };
+            }
+            case "create_issue_note_emoji_reaction": {
+                const args = CreateIssueNoteEmojiReactionSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid, { noteId: args.note_id, discussionId: args.discussion_id });
+                const result = await createRestAwardEmoji(path, args.name);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "delete_issue_note_emoji_reaction": {
+                const args = DeleteIssueNoteEmojiReactionSchema.parse(params.arguments);
+                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid, { noteId: args.note_id, discussionId: args.discussion_id, awardId: args.award_id });
+                await deleteRestAwardEmoji(path);
+                return { content: [{ type: "text", text: "Issue note emoji reaction deleted successfully" }] };
+            }
             case "get_merge_request": {
                 const args = GetMergeRequestSchema.parse(params.arguments);
                 const mergeRequest = await getMergeRequest(args.project_id, args.merge_request_iid, args.source_branch);
@@ -6236,6 +6392,39 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
                 };
             }
+            case "list_work_item_emoji_reactions": {
+                const args = ListWorkItemEmojiReactionsSchema.parse(params.arguments);
+                const { workItemGID } = await resolveWorkItemGID(args.project_id, args.iid);
+                const result = await listGraphQLAwardEmoji(workItemGID);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "list_work_item_note_emoji_reactions": {
+                const args = ListWorkItemNoteEmojiReactionsSchema.parse(params.arguments);
+                const result = await listGraphQLAwardEmoji(args.note_id);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "create_work_item_emoji_reaction": {
+                const args = CreateWorkItemEmojiReactionSchema.parse(params.arguments);
+                const { workItemGID } = await resolveWorkItemGID(args.project_id, args.iid);
+                const result = await addGraphQLAwardEmoji(workItemGID, args.name);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "delete_work_item_emoji_reaction": {
+                const args = DeleteWorkItemEmojiReactionSchema.parse(params.arguments);
+                const { workItemGID } = await resolveWorkItemGID(args.project_id, args.iid);
+                const result = await removeGraphQLAwardEmoji(workItemGID, args.name);
+                return { content: [{ type: "text", text: JSON.stringify(result ?? { status: "success", message: "Work item emoji reaction removed" }, null, 2) }] };
+            }
+            case "create_work_item_note_emoji_reaction": {
+                const args = CreateWorkItemNoteEmojiReactionSchema.parse(params.arguments);
+                const result = await addGraphQLAwardEmoji(args.note_id, args.name);
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "delete_work_item_note_emoji_reaction": {
+                const args = DeleteWorkItemNoteEmojiReactionSchema.parse(params.arguments);
+                const result = await removeGraphQLAwardEmoji(args.note_id, args.name);
+                return { content: [{ type: "text", text: JSON.stringify(result ?? { status: "success", message: "Work item note emoji reaction removed" }, null, 2) }] };
+            }
             case "get_timeline_events": {
                 const args = GetTimelineEventsSchema.parse(params.arguments);
                 const result = await getTimelineEvents(args.project_id, args.incident_iid);
@@ -7171,14 +7360,54 @@ async function startStreamableHTTPServer() {
         const gitlabBaseUrl = GITLAB_API_URL.replace(/\/api\/v4\/?$/, "").replace(/\/$/, "");
         const issuerUrl = new URL(MCP_SERVER_URL);
         const oauthProvider = createGitLabOAuthProvider(gitlabBaseUrl, GITLAB_OAUTH_APP_ID, "GitLab MCP Server", GITLAB_READ_ONLY_MODE, GITLAB_OAUTH_SCOPES);
-        // Mounts /.well-known/oauth-authorization-server,
-        //        /.well-known/oauth-protected-resource,
-        //        /authorize, /token, /register, /revoke
+        const scopesSupported = GITLAB_OAUTH_SCOPES ?? ["api", "read_api", "read_user"];
+        // When server URL has a path (e.g. behind Kong), the SDK's well-known metadata
+        // advertises root-level endpoints. Override to use path-prefixed endpoints.
+        const issuerPath = issuerUrl.pathname.replace(/\/$/, "");
+        if (issuerPath) {
+            const routedBaseUrl = `${issuerUrl.origin}${issuerPath}`;
+            const authorizationServerMetadata = {
+                issuer: issuerUrl.href,
+                authorization_endpoint: `${routedBaseUrl}/authorize`,
+                token_endpoint: `${routedBaseUrl}/token`,
+                registration_endpoint: `${routedBaseUrl}/register`,
+                revocation_endpoint: `${routedBaseUrl}/revoke`,
+                response_types_supported: ["code"],
+                code_challenge_methods_supported: ["S256"],
+                token_endpoint_auth_methods_supported: ["client_secret_post", "none"],
+                grant_types_supported: ["authorization_code", "refresh_token"],
+                scopes_supported: scopesSupported,
+                revocation_endpoint_auth_methods_supported: ["client_secret_post"],
+            };
+            const protectedResourceMetadata = {
+                resource: issuerUrl.href,
+                authorization_servers: [issuerUrl.href],
+                scopes_supported: scopesSupported,
+                resource_name: "GitLab MCP Server",
+            };
+            const authorizationMetadataRoutes = [
+                "/.well-known/oauth-authorization-server",
+                "/.well-known/oauth-authorization-server/*path",
+            ];
+            const protectedResourceRoutes = [
+                "/.well-known/oauth-protected-resource",
+                "/.well-known/oauth-protected-resource/*path",
+            ];
+            app.get(authorizationMetadataRoutes, (_req, res) => {
+                res.json(authorizationServerMetadata);
+            });
+            app.get(protectedResourceRoutes, (_req, res) => {
+                res.json(protectedResourceMetadata);
+            });
+            logger.info({ issuerPath }, "Serving path-aware OAuth metadata for reverse-proxy deployments");
+        }
+        // Mounts /.well-known/oauth-authorization-server (shadowed above when basePath set),
+        //        /.well-known/oauth-protected-resource, /authorize, /token, /register, /revoke
         app.use(mcpAuthRouter({
             provider: oauthProvider,
             issuerUrl,
             baseUrl: issuerUrl,
-            scopesSupported: GITLAB_OAUTH_SCOPES ?? ["api", "read_api", "read_user"],
+            scopesSupported,
             resourceName: "GitLab MCP Server",
         }));
         // Expose provider so the /mcp route middleware can reference it

package/build/oauth.js

@@ -459,15 +459,15 @@ export class GitLabOAuth {
     /**
      * Get a valid access token, refreshing if necessary
      */
-    async getAccessToken() {
+    async getAccessToken(force = false) {
         let tokenData = this.loadToken();
-        // If no token or expired, start OAuth flow or refresh
+        // If no token or expired (or forced), start OAuth flow or refresh
         if (!tokenData) {
             logger.info("No stored token found. Starting OAuth flow...");
             tokenData = await this.startOAuthFlow();
         }
-        else if (this.isTokenExpired(tokenData)) {
-            logger.info("Token expired. Refreshing...");
+        else if (force || this.isTokenExpired(tokenData)) {
+            logger.info(force && !this.isTokenExpired(tokenData) ? "Force-refreshing OAuth token..." : "Token expired. Refreshing...");
             if (tokenData.refresh_token) {
                 try {
                     tokenData = await this.refreshAccessToken(tokenData.refresh_token);

package/build/schemas.js

@@ -1689,6 +1689,7 @@ export const ListProjectsSchema = z
         .optional()
         .describe("Filter projects with merge requests feature enabled"),
     min_access_level: z.coerce.number().optional().describe("Filter by minimum access level"),
+    topic: z.string().optional().describe("Filter by topic (projects tagged with this topic)"),
 })
     .merge(PaginationOptionsSchema);
 // Label operation schemas
@@ -1760,6 +1761,7 @@ export const ListGroupProjectsSchema = z
     statistics: z.coerce.boolean().optional().describe("Include project statistics"),
     with_custom_attributes: z.coerce.boolean().optional().describe("Include custom attributes"),
     with_security_reports: z.coerce.boolean().optional().describe("Include security reports"),
+    topic: z.string().optional().describe("Filter by topic (projects tagged with this topic)"),
 })
     .merge(PaginationOptionsSchema);
 // Add wiki operation schemas
@@ -2273,8 +2275,8 @@ export const GitLabEventSchema = z
     created_at: z.string(),
     author: GitLabEventAuthorSchema,
     author_username: z.string(),
-    imported: z.coerce.boolean(),
-    imported_from: z.string(),
+    imported: z.coerce.boolean().optional(),
+    imported_from: z.string().nullable().optional(),
 })
     .passthrough(); // Allow additional fields
 // List events schema
@@ -2711,6 +2713,98 @@ export const ListCustomFieldDefinitionsSchema = z.object({
         .default("issue")
         .describe("The work item type to list custom field definitions for. Defaults to 'issue'."),
 });
+// --- Emoji Reaction schemas (REST: MRs and Issues) ---
+const emojiNameField = z.string().describe("Name of the emoji without colons (e.g. 'thumbsup', 'rocket', 'eyes')");
+const awardIdField = z.coerce.string().describe("The ID of the emoji reaction to delete");
+const noteEmojiDiscussionField = z.coerce.string().optional().describe("The ID of a discussion thread. Required for notes that are discussion replies; omit for top-level notes.");
+export const CreateMergeRequestEmojiReactionSchema = ProjectParamsSchema.extend({
+    merge_request_iid: z.coerce.string().describe("The IID of a merge request"),
+    name: emojiNameField,
+});
+export const DeleteMergeRequestEmojiReactionSchema = ProjectParamsSchema.extend({
+    merge_request_iid: z.coerce.string().describe("The IID of a merge request"),
+    award_id: awardIdField,
+});
+export const CreateMergeRequestNoteEmojiReactionSchema = ProjectParamsSchema.extend({
+    merge_request_iid: z.coerce.string().describe("The IID of a merge request"),
+    note_id: z.coerce.string().describe("The ID of a note (comment or thread reply)"),
+    discussion_id: noteEmojiDiscussionField,
+    name: emojiNameField,
+});
+export const DeleteMergeRequestNoteEmojiReactionSchema = ProjectParamsSchema.extend({
+    merge_request_iid: z.coerce.string().describe("The IID of a merge request"),
+    note_id: z.coerce.string().describe("The ID of a note (comment or thread reply)"),
+    discussion_id: noteEmojiDiscussionField,
+    award_id: awardIdField,
+});
+export const CreateIssueEmojiReactionSchema = ProjectParamsSchema.extend({
+    issue_iid: z.coerce.string().describe("The IID of an issue"),
+    name: emojiNameField,
+});
+export const DeleteIssueEmojiReactionSchema = ProjectParamsSchema.extend({
+    issue_iid: z.coerce.string().describe("The IID of an issue"),
+    award_id: awardIdField,
+});
+export const CreateIssueNoteEmojiReactionSchema = ProjectParamsSchema.extend({
+    issue_iid: z.coerce.string().describe("The IID of an issue"),
+    note_id: z.coerce.string().describe("The ID of a note (comment or thread reply)"),
+    discussion_id: noteEmojiDiscussionField,
+    name: emojiNameField,
+});
+export const DeleteIssueNoteEmojiReactionSchema = ProjectParamsSchema.extend({
+    issue_iid: z.coerce.string().describe("The IID of an issue"),
+    note_id: z.coerce.string().describe("The ID of a note (comment or thread reply)"),
+    discussion_id: noteEmojiDiscussionField,
+    award_id: awardIdField,
+});
+// --- Emoji Reaction schemas (GraphQL: Work Items) ---
+export const CreateWorkItemEmojiReactionSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    iid: z.coerce.number().describe("The internal ID of the work item"),
+    name: emojiNameField,
+});
+export const DeleteWorkItemEmojiReactionSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    iid: z.coerce.number().describe("The internal ID of the work item"),
+    name: emojiNameField,
+});
+export const CreateWorkItemNoteEmojiReactionSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    iid: z.coerce.number().describe("The internal ID of the work item"),
+    note_id: z.string().describe("The GraphQL GID of the note (e.g. 'gid://gitlab/Note/123' from list_work_item_notes)"),
+    name: emojiNameField,
+});
+export const DeleteWorkItemNoteEmojiReactionSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    iid: z.coerce.number().describe("The internal ID of the work item"),
+    note_id: z.string().describe("The GraphQL GID of the note (e.g. 'gid://gitlab/Note/123' from list_work_item_notes)"),
+    name: emojiNameField,
+});
+export const ListMergeRequestEmojiReactionsSchema = ProjectParamsSchema.extend({
+    merge_request_iid: z.coerce.string().describe("The IID of a merge request"),
+});
+export const ListMergeRequestNoteEmojiReactionsSchema = ProjectParamsSchema.extend({
+    merge_request_iid: z.coerce.string().describe("The IID of a merge request"),
+    note_id: z.coerce.string().describe("The ID of a note (comment or thread reply)"),
+    discussion_id: noteEmojiDiscussionField,
+});
+export const ListIssueEmojiReactionsSchema = ProjectParamsSchema.extend({
+    issue_iid: z.coerce.string().describe("The IID of an issue"),
+});
+export const ListIssueNoteEmojiReactionsSchema = ProjectParamsSchema.extend({
+    issue_iid: z.coerce.string().describe("The IID of an issue"),
+    note_id: z.coerce.string().describe("The ID of a note (comment or thread reply)"),
+    discussion_id: noteEmojiDiscussionField,
+});
+export const ListWorkItemEmojiReactionsSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    iid: z.coerce.number().describe("The internal ID of the work item"),
+});
+export const ListWorkItemNoteEmojiReactionsSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    iid: z.coerce.number().describe("The internal ID of the work item"),
+    note_id: z.string().describe("The GraphQL GID of the note (e.g. 'gid://gitlab/Note/123' from list_work_item_notes)"),
+});
 // --- Incident Timeline Event schemas ---
 export const GetTimelineEventsSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),

package/build/test/mcp-oauth-tests.js

@@ -139,6 +139,55 @@ describe("MCP OAuth — Discovery Endpoints", () => {
         assert.ok(body.resource, "Should have resource field");
         console.log("  ✓ Protected resource metadata returned");
     });
+    test("path-prefixed MCP_SERVER_URL serves path-aware discovery metadata", async () => {
+        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE + 25);
+        const prefixedMockGitLab = new MockGitLabServer({
+            port: mockPort,
+            validTokens: [MOCK_OAUTH_TOKEN],
+        });
+        await prefixedMockGitLab.start();
+        const scopedServers = [];
+        try {
+            const mockGitLabUrl = prefixedMockGitLab.getUrl();
+            addOAuthEndpoints(prefixedMockGitLab, MOCK_OAUTH_TOKEN, MOCK_CLIENT_ID, mockGitLabUrl);
+            const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE + 25);
+            const mcpBaseUrl = `http://${HOST}:${mcpPort}`;
+            const issuerPath = "/gitlab-mcp";
+            const prefixedServerUrl = `${mcpBaseUrl}${issuerPath}`;
+            const server = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port: mcpPort,
+                timeout: 5000,
+                env: {
+                    STREAMABLE_HTTP: "true",
+                    GITLAB_MCP_OAUTH: "true",
+                    GITLAB_OAUTH_APP_ID: "test-oauth-app-id",
+                    GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+                    MCP_SERVER_URL: prefixedServerUrl,
+                    MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL: "true",
+                },
+            });
+            scopedServers.push(server);
+            const authMetadataRes = await fetch(`${mcpBaseUrl}/.well-known/oauth-authorization-server${issuerPath}`);
+            assert.strictEqual(authMetadataRes.status, 200, "Should return 200");
+            const authMetadata = (await authMetadataRes.json());
+            assert.strictEqual(authMetadata.issuer, prefixedServerUrl);
+            assert.strictEqual(authMetadata.authorization_endpoint, `${prefixedServerUrl}/authorize`);
+            assert.strictEqual(authMetadata.token_endpoint, `${prefixedServerUrl}/token`);
+            assert.strictEqual(authMetadata.registration_endpoint, `${prefixedServerUrl}/register`);
+            assert.strictEqual(authMetadata.revocation_endpoint, `${prefixedServerUrl}/revoke`);
+            const resourceMetadataRes = await fetch(`${mcpBaseUrl}/.well-known/oauth-protected-resource${issuerPath}/mcp`);
+            assert.strictEqual(resourceMetadataRes.status, 200, "Should return 200");
+            const resourceMetadata = (await resourceMetadataRes.json());
+            assert.strictEqual(resourceMetadata.resource, prefixedServerUrl);
+            assert.deepStrictEqual(resourceMetadata.authorization_servers, [prefixedServerUrl]);
+            console.log("  ✓ Path-prefixed discovery metadata returned at RFC well-known URLs");
+        }
+        finally {
+            cleanupServers(scopedServers);
+            await prefixedMockGitLab.stop();
+        }
+    });
 });
 // ---------------------------------------------------------------------------
 // Test suite: /mcp auth enforcement

package/build/test/schema-tests.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env ts-node
-import { GetFileContentsSchema, GitLabFileContentSchema, CreatePipelineSchema, CreateIssueNoteSchema } from '../schemas.js';
+import { GetFileContentsSchema, GitLabFileContentSchema, CreatePipelineSchema, CreateIssueNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateIssueEmojiReactionSchema, DeleteMergeRequestEmojiReactionSchema, DeleteIssueEmojiReactionSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema } from '../schemas.js';
 function runGetFileContentsSchemaTests() {
     console.log('🧪 Testing GetFileContentsSchema...');
     const cases = [
@@ -371,13 +371,69 @@ function runCreateIssueNoteSchemaTests() {
     console.log(`\nResults: ${passed} passed, ${failed} failed`);
     return { passed, failed };
 }
+function runEmojiReactionSchemaTests() {
+    console.log('\n🧪 Testing Emoji Reaction Schemas...');
+    const cases = [
+        { name: 'schema:create_mr_emoji:valid', schema: CreateMergeRequestEmojiReactionSchema, input: { project_id: 'my/project', merge_request_iid: '42', name: 'thumbsup' }, expected: { project_id: 'my/project', merge_request_iid: '42', name: 'thumbsup' } },
+        { name: 'schema:create_mr_emoji:numeric-iid-coerced', schema: CreateMergeRequestEmojiReactionSchema, input: { project_id: 'my/project', merge_request_iid: 42, name: 'rocket' }, expected: { merge_request_iid: '42', name: 'rocket' } },
+        { name: 'schema:create_mr_emoji:reject-missing-name', schema: CreateMergeRequestEmojiReactionSchema, input: { project_id: 'my/project', merge_request_iid: '42' }, shouldFail: true },
+        { name: 'schema:delete_mr_emoji:valid', schema: DeleteMergeRequestEmojiReactionSchema, input: { project_id: 'my/project', merge_request_iid: '42', award_id: '123' }, expected: { merge_request_iid: '42', award_id: '123' } },
+        { name: 'schema:create_issue_emoji:valid', schema: CreateIssueEmojiReactionSchema, input: { project_id: 'my/project', issue_iid: '10', name: 'thumbsdown' }, expected: { issue_iid: '10', name: 'thumbsdown' } },
+        { name: 'schema:create_issue_emoji:reject-missing-name', schema: CreateIssueEmojiReactionSchema, input: { project_id: 'my/project', issue_iid: '10' }, shouldFail: true },
+        { name: 'schema:delete_issue_emoji:valid', schema: DeleteIssueEmojiReactionSchema, input: { project_id: 'my/project', issue_iid: '10', award_id: '99' }, expected: { issue_iid: '10', award_id: '99' } },
+        { name: 'schema:create_work_item_emoji:valid', schema: CreateWorkItemEmojiReactionSchema, input: { project_id: 'my/project', iid: 5, name: 'rocket' }, expected: { iid: 5, name: 'rocket' } },
+        { name: 'schema:create_work_item_emoji:reject-missing-name', schema: CreateWorkItemEmojiReactionSchema, input: { project_id: 'my/project', iid: 5 }, shouldFail: true },
+        { name: 'schema:create_work_item_note_emoji:valid', schema: CreateWorkItemNoteEmojiReactionSchema, input: { project_id: 'my/project', iid: 5, note_id: 'gid://gitlab/Note/123', name: 'thumbsup' }, expected: { iid: 5, note_id: 'gid://gitlab/Note/123', name: 'thumbsup' } },
+        { name: 'schema:create_work_item_note_emoji:reject-missing-note-id', schema: CreateWorkItemNoteEmojiReactionSchema, input: { project_id: 'my/project', iid: 5, name: 'thumbsup' }, shouldFail: true },
+    ];
+    let passed = 0;
+    let failed = 0;
+    cases.forEach(testCase => {
+        const result = { name: testCase.name, status: 'failed' };
+        const parsed = testCase.schema.safeParse(testCase.input);
+        if (testCase.shouldFail) {
+            if (parsed.success) {
+                result.error = 'Expected schema validation to fail';
+            }
+            else {
+                result.status = 'passed';
+            }
+        }
+        else if (parsed.success) {
+            const expected = testCase.expected || {};
+            const matches = Object.entries(expected).every(([key, value]) => {
+                return parsed.data[key] === value;
+            });
+            if (matches) {
+                result.status = 'passed';
+            }
+            else {
+                result.error = `Unexpected parsed result: ${JSON.stringify(parsed.data)}`;
+            }
+        }
+        else {
+            result.error = parsed.error?.message || 'Schema validation failed';
+        }
+        if (result.status === 'passed') {
+            passed++;
+            console.log(`✅ ${result.name}`);
+        }
+        else {
+            failed++;
+            console.log(`❌ ${result.name}: ${result.error}`);
+        }
+    });
+    console.log(`\nResults: ${passed} passed, ${failed} failed`);
+    return { passed, failed };
+}
 if (import.meta.url === `file://${process.argv[1]}`) {
     const getFileContentsResult = runGetFileContentsSchemaTests();
     const fileContentResult = runGitLabFileContentSchemaTests();
     const createPipelineResult = runCreatePipelineSchemaTests();
     const createIssueNoteResult = runCreateIssueNoteSchemaTests();
-    const totalPassed = getFileContentsResult.passed + fileContentResult.passed + createPipelineResult.passed + createIssueNoteResult.passed;
-    const totalFailed = getFileContentsResult.failed + fileContentResult.failed + createPipelineResult.failed + createIssueNoteResult.failed;
+    const emojiReactionResult = runEmojiReactionSchemaTests();
+    const totalPassed = getFileContentsResult.passed + fileContentResult.passed + createPipelineResult.passed + createIssueNoteResult.passed + emojiReactionResult.passed;
+    const totalFailed = getFileContentsResult.failed + fileContentResult.failed + createPipelineResult.failed + createIssueNoteResult.failed + emojiReactionResult.failed;
     console.log(`\nTotal Results: ${totalPassed} passed, ${totalFailed} failed`);
     if (totalFailed > 0) {
         process.exit(1);

package/build/test/test-auth-retry.js

@@ -0,0 +1,188 @@
+/**
+ * Auth Retry Tests
+ * Unit tests for headersToPlainObject, isNonReplayableBody, and wrapWithAuthRetry.
+ *
+ * These are pure-function / DI-based tests — no env vars or external services needed.
+ */
+import { describe, test } from "node:test";
+import assert from "node:assert";
+import { Headers, Response } from "node-fetch";
+import { headersToPlainObject, isNonReplayableBody, wrapWithAuthRetry, } from "../auth-retry.js";
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function mockFetch(status) {
+    return (async () => new Response("", { status }));
+}
+function mockFetchThenRetry() {
+    let callCount = 0;
+    return (async () => {
+        callCount++;
+        return new Response("", { status: callCount === 1 ? 401 : 200 });
+    });
+}
+function makeConfig(overrides) {
+    return {
+        isOAuthEnabled: () => true,
+        refreshToken: async () => "new-token",
+        onTokenRefreshed: () => { },
+        buildAuthHeaders: () => ({ Authorization: "Bearer new-token" }),
+        ...overrides,
+    };
+}
+// ---------------------------------------------------------------------------
+// headersToPlainObject
+// ---------------------------------------------------------------------------
+describe("headersToPlainObject", () => {
+    test("null returns empty object", () => {
+        assert.deepStrictEqual(headersToPlainObject(null), {});
+    });
+    test("undefined returns empty object", () => {
+        assert.deepStrictEqual(headersToPlainObject(undefined), {});
+    });
+    test("plain object passed through", () => {
+        const obj = { "Content-Type": "application/json", Accept: "text/html" };
+        assert.deepStrictEqual(headersToPlainObject(obj), obj);
+    });
+    test("Headers instance normalized", () => {
+        const h = new Headers();
+        h.set("x-custom", "value1");
+        h.set("authorization", "Bearer tok");
+        const result = headersToPlainObject(h);
+        assert.strictEqual(result["x-custom"], "value1");
+        assert.strictEqual(result["authorization"], "Bearer tok");
+    });
+    test("array of tuples normalized", () => {
+        const arr = [
+            ["x-foo", "bar"],
+            ["x-baz", "qux"],
+        ];
+        assert.deepStrictEqual(headersToPlainObject(arr), {
+            "x-foo": "bar",
+            "x-baz": "qux",
+        });
+    });
+});
+// ---------------------------------------------------------------------------
+// isNonReplayableBody
+// ---------------------------------------------------------------------------
+describe("isNonReplayableBody", () => {
+    test("null returns false", () => {
+        assert.strictEqual(isNonReplayableBody(null), false);
+    });
+    test("undefined returns false", () => {
+        assert.strictEqual(isNonReplayableBody(undefined), false);
+    });
+    test("empty string returns false", () => {
+        assert.strictEqual(isNonReplayableBody(""), false);
+    });
+    test("plain string returns false", () => {
+        assert.strictEqual(isNonReplayableBody("hello"), false);
+    });
+    test("object with .pipe() returns true (stream-like)", () => {
+        assert.strictEqual(isNonReplayableBody({ pipe: () => { } }), true);
+    });
+    test("object with .read() returns true (stream-like)", () => {
+        assert.strictEqual(isNonReplayableBody({ read: () => { } }), true);
+    });
+    test("object with .getBuffer() and .getBoundary() returns true (FormData-like)", () => {
+        assert.strictEqual(isNonReplayableBody({ getBuffer: () => { }, getBoundary: () => { } }), true);
+    });
+    test("object with only .getBuffer() (no .getBoundary()) returns false", () => {
+        assert.strictEqual(isNonReplayableBody({ getBuffer: () => { } }), false);
+    });
+});
+// ---------------------------------------------------------------------------
+// wrapWithAuthRetry
+// ---------------------------------------------------------------------------
+describe("wrapWithAuthRetry", () => {
+    test("non-401 response passes through unchanged", async () => {
+        const wrapped = wrapWithAuthRetry(mockFetch(200), makeConfig());
+        const res = await wrapped("http://example.com");
+        assert.strictEqual(res.status, 200);
+    });
+    test("401 when OAuth disabled passes through unchanged", async () => {
+        const config = makeConfig({ isOAuthEnabled: () => false });
+        const wrapped = wrapWithAuthRetry(mockFetch(401), config);
+        const res = await wrapped("http://example.com");
+        assert.strictEqual(res.status, 401);
+    });
+    test("401 with OAuth enabled triggers refresh and retry", async () => {
+        let refreshCalled = false;
+        let tokenSet = null;
+        const config = makeConfig({
+            refreshToken: async () => {
+                refreshCalled = true;
+                return "refreshed-token";
+            },
+            onTokenRefreshed: (token) => {
+                tokenSet = token;
+            },
+            buildAuthHeaders: () => ({ Authorization: "Bearer refreshed-token" }),
+        });
+        const base = mockFetchThenRetry();
+        const wrapped = wrapWithAuthRetry(base, config);
+        const res = await wrapped("http://example.com");
+        assert.strictEqual(res.status, 200);
+        assert.strictEqual(refreshCalled, true);
+        assert.strictEqual(tokenSet, "refreshed-token");
+    });
+    test("401 with non-replayable body skips retry", async () => {
+        let refreshCalled = false;
+        const config = makeConfig({
+            refreshToken: async () => {
+                refreshCalled = true;
+                return "tok";
+            },
+        });
+        const wrapped = wrapWithAuthRetry(mockFetch(401), config);
+        const res = await wrapped("http://example.com", {
+            body: { pipe: () => { } }, // stream-like
+        });
+        assert.strictEqual(res.status, 401);
+        assert.strictEqual(refreshCalled, false);
+    });
+    test("concurrent 401s only trigger one refresh (stampede test)", async () => {
+        let refreshCount = 0;
+        let resolveRefresh = () => { };
+        const config = makeConfig({
+            refreshToken: () => {
+                refreshCount++;
+                return new Promise((resolve) => {
+                    resolveRefresh = resolve;
+                });
+            },
+            buildAuthHeaders: () => ({ Authorization: "Bearer stamped" }),
+        });
+        // Each call returns 401 first, then 200 on retry
+        let callCount = 0;
+        const base = (async () => {
+            callCount++;
+            // First two calls are the initial requests (both 401)
+            // Next two are the retries (both 200)
+            return new Response("", { status: callCount <= 2 ? 401 : 200 });
+        });
+        const wrapped = wrapWithAuthRetry(base, config);
+        // Fire two concurrent requests
+        const p1 = wrapped("http://example.com/a");
+        const p2 = wrapped("http://example.com/b");
+        // Wait a tick for both to hit the refresh path
+        await new Promise((r) => setTimeout(r, 10));
+        // Resolve the single pending refresh
+        resolveRefresh("stamped-token");
+        const [r1, r2] = await Promise.all([p1, p2]);
+        assert.strictEqual(r1.status, 200);
+        assert.strictEqual(r2.status, 200);
+        assert.strictEqual(refreshCount, 1, "refresh should be called exactly once");
+    });
+    test("token refresh failure returns original 401 response", async () => {
+        const config = makeConfig({
+            refreshToken: async () => {
+                throw new Error("refresh exploded");
+            },
+        });
+        const wrapped = wrapWithAuthRetry(mockFetch(401), config);
+        const res = await wrapped("http://example.com");
+        assert.strictEqual(res.status, 401);
+    });
+});

package/build/test/test-search-code.js

@@ -71,8 +71,8 @@ describe("Search Code Tools", () => {
         if (mockGitLab)
             await mockGitLab.stop();
     });
-    // ---- 1. search toolset exposes exactly 3 tools ----
-    describe("search toolset exposes exactly 3 tools", () => {
+    // ---- 1. search toolset exposes exactly 4 tools ----
+    describe("search toolset exposes exactly 4 tools", () => {
         let server;
         let tools;
         before(async () => {
@@ -83,8 +83,8 @@ describe("Search Code Tools", () => {
             tools = await getToolNames(`http://${HOST}:${port}/mcp`);
         });
         after(() => cleanupServers([server]));
-        test("returns exactly 3 tools", () => {
-            assert.strictEqual(tools.length, 3, `Expected 3 tools but got ${tools.length}: ${tools.join(", ")}`);
+        test("returns exactly 4 tools", () => {
+            assert.strictEqual(tools.length, 4, `Expected 4 tools but got ${tools.length}: ${tools.join(", ")}`);
         });
         test("includes search_code", () => {
             assert.ok(tools.includes("search_code"), "Expected search_code to be present");
@@ -95,6 +95,9 @@ describe("Search Code Tools", () => {
         test("includes search_group_code", () => {
             assert.ok(tools.includes("search_group_code"), "Expected search_group_code to be present");
         });
+        test("includes discover_tools", () => {
+            assert.ok(tools.includes("discover_tools"), "Expected discover_tools to be present");
+        });
     });
     // ---- 2. search_code returns blob results ----
     describe("search_code returns blob results", () => {

package/build/test/test-token-optimizations.js

@@ -392,6 +392,9 @@ describe("Policy Edge Cases", { concurrency: 1 }, () => {
             "update_issue", "delete_issue", "create_issue_note", "update_issue_note",
             "list_issue_links", "list_issue_discussions", "get_issue_link",
             "create_issue_link", "delete_issue_link", "create_note",
+            "list_issue_emoji_reactions", "list_issue_note_emoji_reactions",
+            "create_issue_emoji_reaction", "delete_issue_emoji_reaction",
+            "create_issue_note_emoji_reaction", "delete_issue_note_emoji_reaction",
         ].join(",");
         const server = await launchMcp(mockGitLabUrl, {
             GITLAB_TOOLSETS: "issues",

package/build/test/test-toolset-filtering.js

@@ -16,8 +16,8 @@ const MOCK_PORT_BASE = 9200;
 const MCP_PORT_BASE = 3200;
 // Known tool counts per toolset (from TOOLSET_DEFINITIONS)
 const TOOLSET_TOOL_COUNTS = {
-    merge_requests: 34,
-    issues: 14,
+    merge_requests: 40,
+    issues: 20,
     repositories: 7,
     branches: 4,
     projects: 8,
@@ -28,7 +28,7 @@ const TOOLSET_TOOL_COUNTS = {
     releases: 7,
     users: 5,
     search: 3,
-    workitems: 12,
+    workitems: 18,
     webhooks: 3,
 };
 const DEFAULT_TOOLSETS = [
@@ -286,6 +286,8 @@ describe("Toolset Filtering", { concurrency: 1 }, () => {
             "list_issue_links",
             "list_issue_discussions",
             "get_issue_link",
+            "list_issue_emoji_reactions",
+            "list_issue_note_emoji_reactions",
         ];
         const writeIssueTools = [
             "create_issue",
@@ -296,6 +298,10 @@ describe("Toolset Filtering", { concurrency: 1 }, () => {
             "create_issue_link",
             "delete_issue_link",
             "create_note",
+            "create_issue_emoji_reaction",
+            "delete_issue_emoji_reaction",
+            "create_issue_note_emoji_reaction",
+            "delete_issue_note_emoji_reaction",
         ];
         before(async () => {
             const port = await nextMcpPort();

package/build/tools/registry.js

@@ -1,7 +1,7 @@
 import { zodToJsonSchema } from "zod-to-json-schema";
 import { toJSONSchema } from "../utils/schema.js";
 import { USE_GITLAB_WIKI, USE_MILESTONE, USE_PIPELINE, } from "../config.js";
-import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateLabelSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestNoteSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTimelineEventSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteWikiPageSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetDeploymentSchema, GetDraftNoteSchema, GetEnvironmentSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, GetPipelineSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTimelineEventsSchema, GetUsersSchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListCommitsSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ListPipelinesSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateLabelSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, } from "../schemas.js";
+import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTimelineEventSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetDeploymentSchema, GetDraftNoteSchema, GetEnvironmentSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, GetPipelineSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTimelineEventsSchema, GetUsersSchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListCommitsSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ListPipelinesSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateLabelSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, } from "../schemas.js";
 // Define all available tools
 export const allTools = [
     {
@@ -219,6 +219,37 @@ export const allTools = [
         description: "Publish all draft notes for a merge request",
         inputSchema: toJSONSchema(BulkPublishDraftNotesSchema),
     },
+    // --- Merge request emoji reaction tools ---
+    {
+        name: "list_merge_request_emoji_reactions",
+        description: "List all emoji reactions on a merge request",
+        inputSchema: toJSONSchema(ListMergeRequestEmojiReactionsSchema),
+    },
+    {
+        name: "list_merge_request_note_emoji_reactions",
+        description: "List all emoji reactions on a merge request note. Pass discussion_id for discussion thread replies.",
+        inputSchema: toJSONSchema(ListMergeRequestNoteEmojiReactionsSchema),
+    },
+    {
+        name: "create_merge_request_emoji_reaction",
+        description: "Add an emoji reaction to a merge request (e.g. thumbsup, rocket, eyes)",
+        inputSchema: toJSONSchema(CreateMergeRequestEmojiReactionSchema),
+    },
+    {
+        name: "delete_merge_request_emoji_reaction",
+        description: "Remove an emoji reaction from a merge request",
+        inputSchema: toJSONSchema(DeleteMergeRequestEmojiReactionSchema),
+    },
+    {
+        name: "create_merge_request_note_emoji_reaction",
+        description: "Add an emoji reaction to a merge request note. Pass discussion_id for discussion thread replies.",
+        inputSchema: toJSONSchema(CreateMergeRequestNoteEmojiReactionSchema),
+    },
+    {
+        name: "delete_merge_request_note_emoji_reaction",
+        description: "Remove an emoji reaction from a merge request note. Pass discussion_id for discussion thread replies.",
+        inputSchema: toJSONSchema(DeleteMergeRequestNoteEmojiReactionSchema),
+    },
     {
         name: "update_issue_note",
         description: "Modify an existing issue thread note",
@@ -229,6 +260,37 @@ export const allTools = [
         description: "Add a note to an issue, optionally replying to a discussion thread",
         inputSchema: toJSONSchema(CreateIssueNoteSchema),
     },
+    // --- Issue emoji reaction tools ---
+    {
+        name: "list_issue_emoji_reactions",
+        description: "List all emoji reactions on an issue",
+        inputSchema: toJSONSchema(ListIssueEmojiReactionsSchema),
+    },
+    {
+        name: "list_issue_note_emoji_reactions",
+        description: "List all emoji reactions on an issue note. Pass discussion_id for discussion thread replies.",
+        inputSchema: toJSONSchema(ListIssueNoteEmojiReactionsSchema),
+    },
+    {
+        name: "create_issue_emoji_reaction",
+        description: "Add an emoji reaction to an issue (e.g. thumbsup, rocket, eyes)",
+        inputSchema: toJSONSchema(CreateIssueEmojiReactionSchema),
+    },
+    {
+        name: "delete_issue_emoji_reaction",
+        description: "Remove an emoji reaction from an issue",
+        inputSchema: toJSONSchema(DeleteIssueEmojiReactionSchema),
+    },
+    {
+        name: "create_issue_note_emoji_reaction",
+        description: "Add an emoji reaction to an issue note. Pass discussion_id for discussion thread replies.",
+        inputSchema: toJSONSchema(CreateIssueNoteEmojiReactionSchema),
+    },
+    {
+        name: "delete_issue_note_emoji_reaction",
+        description: "Remove an emoji reaction from an issue note. Pass discussion_id for discussion thread replies.",
+        inputSchema: toJSONSchema(DeleteIssueNoteEmojiReactionSchema),
+    },
     {
         name: "list_issues",
         description: "List issues (default: created by current user; use scope='all' for all)",
@@ -670,6 +732,37 @@ export const allTools = [
         description: "Add a note to a work item (supports Markdown, internal notes, threads)",
         inputSchema: toJSONSchema(CreateWorkItemNoteSchema),
     },
+    // --- Work item emoji reaction tools (GraphQL-based) ---
+    {
+        name: "list_work_item_emoji_reactions",
+        description: "List all emoji reactions on a work item",
+        inputSchema: toJSONSchema(ListWorkItemEmojiReactionsSchema),
+    },
+    {
+        name: "list_work_item_note_emoji_reactions",
+        description: "List all emoji reactions on a work item note (comment, thread, or thread reply)",
+        inputSchema: toJSONSchema(ListWorkItemNoteEmojiReactionsSchema),
+    },
+    {
+        name: "create_work_item_emoji_reaction",
+        description: "Add an emoji reaction to a work item (e.g. thumbsup, rocket, eyes)",
+        inputSchema: toJSONSchema(CreateWorkItemEmojiReactionSchema),
+    },
+    {
+        name: "delete_work_item_emoji_reaction",
+        description: "Remove an emoji reaction from a work item",
+        inputSchema: toJSONSchema(DeleteWorkItemEmojiReactionSchema),
+    },
+    {
+        name: "create_work_item_note_emoji_reaction",
+        description: "Add an emoji reaction to a work item note (comment, thread, or thread reply)",
+        inputSchema: toJSONSchema(CreateWorkItemNoteEmojiReactionSchema),
+    },
+    {
+        name: "delete_work_item_note_emoji_reaction",
+        description: "Remove an emoji reaction from a work item note (comment, thread, or thread reply)",
+        inputSchema: toJSONSchema(DeleteWorkItemNoteEmojiReactionSchema),
+    },
     // --- Incident timeline event tools ---
     {
         name: "get_timeline_events",
@@ -805,6 +898,12 @@ export const readOnlyTools = new Set([
     "list_work_item_statuses",
     "list_custom_field_definitions",
     "list_work_item_notes",
+    "list_merge_request_emoji_reactions",
+    "list_merge_request_note_emoji_reactions",
+    "list_issue_emoji_reactions",
+    "list_issue_note_emoji_reactions",
+    "list_work_item_emoji_reactions",
+    "list_work_item_note_emoji_reactions",
     "get_timeline_events",
     "get_merge_request_conflicts",
     "list_webhooks",
@@ -823,6 +922,12 @@ export const destructiveTools = new Set([
     "delete_merge_request_note",
     "delete_merge_request_discussion_note",
     "delete_draft_note",
+    "delete_merge_request_emoji_reaction",
+    "delete_merge_request_note_emoji_reaction",
+    "delete_issue_emoji_reaction",
+    "delete_issue_note_emoji_reaction",
+    "delete_work_item_emoji_reaction",
+    "delete_work_item_note_emoji_reaction",
     "merge_merge_request",
     "push_files",
 ]);
@@ -913,6 +1018,12 @@ export const TOOLSET_DEFINITIONS = [
             "bulk_publish_draft_notes",
             "create_merge_request_thread",
             "resolve_merge_request_thread",
+            "list_merge_request_emoji_reactions",
+            "list_merge_request_note_emoji_reactions",
+            "create_merge_request_emoji_reaction",
+            "delete_merge_request_emoji_reaction",
+            "create_merge_request_note_emoji_reaction",
+            "delete_merge_request_note_emoji_reaction",
         ]),
     },
     {
@@ -933,6 +1044,12 @@ export const TOOLSET_DEFINITIONS = [
             "create_issue_link",
             "delete_issue_link",
             "create_note",
+            "list_issue_emoji_reactions",
+            "list_issue_note_emoji_reactions",
+            "create_issue_emoji_reaction",
+            "delete_issue_emoji_reaction",
+            "create_issue_note_emoji_reaction",
+            "delete_issue_note_emoji_reaction",
         ]),
     },
     {
@@ -1077,6 +1194,12 @@ export const TOOLSET_DEFINITIONS = [
             "move_work_item",
             "list_work_item_notes",
             "create_work_item_note",
+            "list_work_item_emoji_reactions",
+            "list_work_item_note_emoji_reactions",
+            "create_work_item_emoji_reaction",
+            "delete_work_item_emoji_reaction",
+            "create_work_item_note_emoji_reaction",
+            "delete_work_item_note_emoji_reaction",
             "get_timeline_events",
             "create_timeline_event",
         ]),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
     "gitlab",
@@ -48,10 +48,10 @@
     "changelog": "auto-changelog -p",
     "test": "npm run test:all",
     "test:all": "npm run build && npm run test:mock && npm run test:live",
-    "test:mock": "npx tsx --test test/remote-auth-simple-test.ts && npx tsx --test test/mcp-oauth-tests.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && tsx --test test/test-job-artifacts.ts && tsx --test test/test-deployment-tools.ts && tsx --test test/test-merge-request-approval-state-tools.ts && npx tsx --test test/test-search-code.ts && npx tsx --test test/test-toolset-filtering.ts",
-    "test:mcp-oauth": "npm run build && npx tsx --test test/mcp-oauth-tests.ts",
+    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-auth-retry.ts",
+    "test:mcp-oauth": "npm run build && node --import tsx/esm --test test/mcp-oauth-tests.ts",
     "test:live": "node test/validate-api.js",
-    "test:remote-auth": "npm run build && npx tsx --test test/remote-auth-simple-test.ts",
+    "test:remote-auth": "npm run build && node --import tsx/esm --test test/remote-auth-simple-test.ts",
     "test:schema": "tsx test/schema-tests.ts",
     "test:oauth": "tsx test/oauth-tests.ts",
     "test:list-merge-requests": "npm run build && tsx test/test-list-merge-requests.ts",