@zereight/mcp-gitlab 2.1.14 → 2.1.16

package/build/index.js

@@ -128,6 +128,7 @@ import { createGitLabOAuthProvider } from "./oauth-proxy.js";
 import { mcpAuthRouter } from "@modelcontextprotocol/sdk/server/auth/router.js";
 import { normalizeGitLabApiUrl } from "./utils/url.js";
 import { estimateMergeCommitCount, filterDiffsByPatterns, summarizeWebhookEvents } from "./utils/helpers.js";
+import { sanitizeToolArguments } from "./utils/tool-args.js";
 import { parseSearchReplaceBlocks, applySearchReplace, applyUnifiedDiff, } from "./utils/patch-helper.js";
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
 import { GitLabClientPool } from "./gitlab-client-pool.js";
@@ -1275,6 +1276,12 @@ async function listMergeRequests(projectId, options = {}) {
                 // Handle array of labels
                 url.searchParams.append(key, value.join(","));
             }
+            else if (key === "approved_by_usernames" && Array.isArray(value)) {
+                // GitLab expects array-bracket form: approved_by_usernames[]=alice&approved_by_usernames[]=bob
+                for (const v of value) {
+                    url.searchParams.append(`${key}[]`, String(v));
+                }
+            }
             else {
                 url.searchParams.append(key, String(value));
             }
@@ -6126,6 +6133,9 @@ async function handleToolCall(params) {
                 args.iid = args.work_item_iid;
                 delete args.work_item_iid;
             }
+            if (!Array.isArray(args)) {
+                params.arguments = sanitizeToolArguments(params.name, args);
+            }
         }
         // Centralized read-only guard: reject write tools even if client bypasses list_tools filtering
         if (GITLAB_READ_ONLY_MODE && !readOnlyTools.has(params.name)) {

package/build/schemas.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { omitIncompleteMergeRequestPosition } from "./utils/merge-request-position.js";
 // Helper: coerce a JSON-stringified array to an actual array.
 // LLMs sometimes send '["a", "b"]' (string) instead of ["a", "b"] (array).
 const coerceStringArray = z.preprocess((val) => {
@@ -1110,7 +1111,7 @@ export const GitLabMergeRequestSchema = z.object({
         .describe("Whether rebase is currently in progress for this merge request"),
     merge_when_pipeline_succeeds: z.coerce.boolean().optional(),
     squash: z.coerce.boolean().optional(),
-    labels: z.array(z.string()).optional(),
+    labels: z.array(GitLabLabelSchema).or(z.array(z.string())).optional(), // Support both label objects and strings
 });
 export const LineRangeSchema = z
     .object({
@@ -1823,6 +1824,9 @@ export const ListMergeRequestsSchema = z
         .string()
         .optional()
         .describe("Returns merge requests which have the user as a reviewer by username. Mutually exclusive with reviewer_id."),
+    approved_by_usernames: coerceStringArray
+        .optional()
+        .describe("Returns merge requests approved by the given usernames (array)."),
     created_after: z
         .string()
         .optional()
@@ -2254,6 +2258,7 @@ export const MergeRequestThreadPositionSchema = z.object({
         .optional()
         .describe("IMAGE DIFFS ONLY: Y coordinate on the image (for position_type='image')."),
 });
+const optionalMergeRequestThreadPosition = z.preprocess(omitIncompleteMergeRequestPosition, MergeRequestThreadPositionSchema.optional());
 // Draft Notes API schemas
 export const GitLabDraftNoteSchema = z
     .object({
@@ -2295,7 +2300,7 @@ export const CreateDraftNoteSchema = ProjectParamsSchema.extend({
         .string()
         .optional()
         .describe("The ID of a discussion the draft note replies to"),
-    position: MergeRequestThreadPositionSchema.optional().describe("Position when creating a diff note"),
+    position: optionalMergeRequestThreadPosition.describe("Position when creating a diff note"),
     resolve_discussion: z
         .coerce.boolean()
         .optional()
@@ -2306,7 +2311,7 @@ export const UpdateDraftNoteSchema = ProjectParamsSchema.extend({
     merge_request_iid: z.coerce.string().describe("The IID of a merge request"),
     draft_note_id: z.coerce.string().describe("The ID of the draft note"),
     body: z.string().optional().describe("The content of the draft note"),
-    position: MergeRequestThreadPositionSchema.optional().describe("Position when creating a diff note"),
+    position: optionalMergeRequestThreadPosition.describe("Position when creating a diff note"),
     resolve_discussion: z
         .coerce.boolean()
         .optional()
@@ -2330,7 +2335,7 @@ export const BulkPublishDraftNotesSchema = ProjectParamsSchema.extend({
 export const CreateMergeRequestThreadSchema = ProjectParamsSchema.extend({
     merge_request_iid: z.coerce.string().describe("The IID of a merge request"),
     body: z.string().describe("The content of the thread"),
-    position: MergeRequestThreadPositionSchema.optional().describe("Position when creating a diff note"),
+    position: optionalMergeRequestThreadPosition.describe("Position when creating a diff note"),
     created_at: z.string().optional().describe("Date the thread was created at (ISO 8601 format)"),
 });
 export const ResolveMergeRequestThreadSchema = ProjectParamsSchema.extend({
@@ -2580,7 +2585,7 @@ export const GitLabProjectMemberSchema = z.object({
 });
 // Markdown upload schemas
 export const GitLabMarkdownUploadSchema = z.object({
-    id: z.coerce.number(),
+    id: z.preprocess((val) => (val == null ? undefined : val), z.coerce.number().optional()),
     alt: z.string(),
     url: z.string(),
     full_path: z.string(),

package/build/test/nullish-tool-arguments-schema.test.js

@@ -0,0 +1,99 @@
+import assert from "node:assert/strict";
+import { describe, test } from "node:test";
+import { CreateDraftNoteSchema, CreateLabelSchema, ExecuteGraphQLSchema, GetBranchDiffsSchema, UpdateMergeRequestDiscussionNoteSchema, } from "../schemas.js";
+import { sanitizeToolArguments } from "../utils/tool-args.js";
+const PROJECT_ID = "group/project";
+const MERGE_REQUEST_IID = "1";
+function parseAfterSanitize(toolName, raw, parse) {
+    return parse(sanitizeToolArguments(toolName, raw));
+}
+describe("When validating tool arguments after sanitization", () => {
+    describe("with create_draft_note", () => {
+        test("should accept position with null SHAs after sanitize and schema preprocess", () => {
+            const parsed = parseAfterSanitize("create_draft_note", {
+                project_id: PROJECT_ID,
+                merge_request_iid: MERGE_REQUEST_IID,
+                body: "Test note",
+                position: {
+                    base_sha: null,
+                    head_sha: null,
+                    start_sha: null,
+                    position_type: "text",
+                },
+            }, value => CreateDraftNoteSchema.parse(value));
+            assert.equal(parsed.position, undefined);
+        });
+        test("should accept position with nullable old_line after sanitize", () => {
+            const parsed = parseAfterSanitize("create_draft_note", {
+                project_id: PROJECT_ID,
+                merge_request_iid: MERGE_REQUEST_IID,
+                body: "Test note",
+                position: {
+                    base_sha: "base",
+                    head_sha: "head",
+                    start_sha: "start",
+                    position_type: "text",
+                    new_path: "file.ts",
+                    old_line: null,
+                    new_line: 10,
+                },
+            }, value => CreateDraftNoteSchema.parse(value));
+            assert.equal(parsed.position?.old_line, null);
+            assert.equal(parsed.position?.new_line, 10);
+        });
+    });
+    describe("with update_merge_request_discussion_note", () => {
+        test("should accept body plus resolved null after sanitize", () => {
+            const parsed = parseAfterSanitize("update_merge_request_discussion_note", {
+                project_id: PROJECT_ID,
+                merge_request_iid: MERGE_REQUEST_IID,
+                discussion_id: "d1",
+                note_id: "n1",
+                body: "updated",
+                resolved: null,
+            }, value => UpdateMergeRequestDiscussionNoteSchema.parse(value));
+            assert.equal(parsed.body, "updated");
+            assert.equal(parsed.resolved, undefined);
+        });
+        test("should reject when only resolved null remains after sanitize", () => {
+            assert.throws(() => parseAfterSanitize("update_merge_request_discussion_note", {
+                project_id: PROJECT_ID,
+                merge_request_iid: MERGE_REQUEST_IID,
+                discussion_id: "d1",
+                note_id: "n1",
+                resolved: null,
+            }, value => UpdateMergeRequestDiscussionNoteSchema.parse(value)), /At least one of 'body' or 'resolved'/);
+        });
+    });
+    describe("with get_branch_diffs", () => {
+        test("should ignore unknown commit null field from older clients", () => {
+            const parsed = parseAfterSanitize("get_branch_diffs", {
+                project_id: PROJECT_ID,
+                from: "main",
+                to: "dev",
+                commit: null,
+            }, value => GetBranchDiffsSchema.parse(value));
+            assert.equal(Object.hasOwn(parsed, "commit"), false);
+        });
+    });
+    describe("with execute_graphql", () => {
+        test("should preserve explicit null variable values after sanitize", () => {
+            const parsed = parseAfterSanitize("execute_graphql", {
+                query: "mutation($id: ID) { updateProject(input: { id: $id }) { project { id } } }",
+                variables: { id: null },
+            }, value => ExecuteGraphQLSchema.parse(value));
+            assert.equal(parsed.variables?.id, null);
+        });
+    });
+    describe("with create_label", () => {
+        test("should preserve explicit null priority after sanitize", () => {
+            const parsed = parseAfterSanitize("create_label", {
+                project_id: PROJECT_ID,
+                name: "priority-null",
+                color: "#112233",
+                priority: null,
+            }, value => CreateLabelSchema.parse(value));
+            assert.equal(parsed.priority, null);
+        });
+    });
+});

package/build/test/schema-tests.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env ts-node
-import { GetFileContentsSchema, GitLabFileContentSchema, GitLabRepositorySchema, CreatePipelineSchema, CreateCommitStatusSchema, ListCommitStatusesSchema, CreateIssueNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateIssueEmojiReactionSchema, DeleteMergeRequestEmojiReactionSchema, DeleteIssueEmojiReactionSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, CreateIssueSchema, ListIssuesSchema, ListMergeRequestsSchema, ListLabelsSchema, GitLabMergeRequestSchema, GitLabTreeItemSchema, GetMergeRequestSchema, ListMergeRequestPipelinesSchema, GetRepositoryTreeSchema, GitLabUserFullSchema } from '../schemas.js';
+import { GetFileContentsSchema, GitLabFileContentSchema, GitLabRepositorySchema, CreatePipelineSchema, CreateCommitStatusSchema, ListCommitStatusesSchema, CreateIssueNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateIssueEmojiReactionSchema, DeleteMergeRequestEmojiReactionSchema, DeleteIssueEmojiReactionSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, CreateIssueSchema, ListIssuesSchema, ListMergeRequestsSchema, ListLabelsSchema, GitLabMergeRequestSchema, GitLabTreeItemSchema, GetMergeRequestSchema, ListMergeRequestPipelinesSchema, GetRepositoryTreeSchema, GitLabUserFullSchema, GitLabMarkdownUploadSchema, } from '../schemas.js';
 function runGetFileContentsSchemaTests() {
     console.log('🧪 Testing GetFileContentsSchema...');
     const cases = [
@@ -723,6 +723,54 @@ function runGitLabMergeRequestSchemaTests() {
             },
             validate: (data) => data.milestone === undefined,
         },
+        {
+            name: 'schema:gitlab_merge_request:labels-string-array',
+            input: {
+                ...baseMergeRequest,
+                labels: ['bug', 'enhancement'],
+            },
+            validate: (data) => Array.isArray(data.labels) &&
+                data.labels.length === 2 &&
+                data.labels[0] === 'bug' &&
+                data.labels[1] === 'enhancement',
+        },
+        {
+            name: 'schema:gitlab_merge_request:labels-object-array',
+            input: {
+                ...baseMergeRequest,
+                labels: [
+                    {
+                        id: 1,
+                        name: 'bug',
+                        color: '#ff0000',
+                        text_color: '#ffffff',
+                        description: null,
+                        description_html: null,
+                    },
+                    {
+                        id: 2,
+                        name: 'enhancement',
+                        color: '#00ff00',
+                        text_color: '#000000',
+                        description: 'Improvements',
+                        description_html: '<p>Improvements</p>',
+                    },
+                ],
+            },
+            validate: (data) => Array.isArray(data.labels) &&
+                data.labels.length === 2 &&
+                data.labels[0].name === 'bug' &&
+                data.labels[0].id === '1' &&
+                data.labels[1].name === 'enhancement' &&
+                data.labels[1].id === '2',
+        },
+        {
+            name: 'schema:gitlab_merge_request:labels-omitted',
+            input: {
+                ...baseMergeRequest,
+            },
+            validate: (data) => data.labels === undefined,
+        },
     ];
     let passed = 0;
     let failed = 0;
@@ -955,6 +1003,71 @@ function runLabelsCoercionSchemaTests() {
     console.log(`\nResults: ${passed} passed, ${failed} failed`);
     return { passed, failed };
 }
+function runApprovedByUsernamesSchemaTests() {
+    console.log('\n=== ListMergeRequestsSchema approved_by_usernames Tests ===');
+    const cases = [
+        {
+            name: 'schema:list_merge_requests:approved_by_usernames-native-array',
+            input: { approved_by_usernames: ['alice', 'bob'] },
+            expected: ['alice', 'bob'],
+        },
+        {
+            name: 'schema:list_merge_requests:approved_by_usernames-stringified-array',
+            input: { approved_by_usernames: '["alice","bob"]' },
+            expected: ['alice', 'bob'],
+        },
+        {
+            name: 'schema:list_merge_requests:approved_by_usernames-omitted',
+            input: {},
+            expected: undefined,
+        },
+    ];
+    let passed = 0;
+    let failed = 0;
+    cases.forEach(testCase => {
+        const result = { name: testCase.name, status: 'failed' };
+        const parsed = ListMergeRequestsSchema.safeParse(testCase.input);
+        if (testCase.shouldFail) {
+            if (parsed.success) {
+                result.error = 'Expected schema validation to fail';
+            }
+            else {
+                result.status = 'passed';
+            }
+        }
+        else if (!parsed.success) {
+            result.error = parsed.error?.message || 'Schema validation failed';
+        }
+        else {
+            const actual = parsed.data['approved_by_usernames'];
+            if (testCase.expected === undefined) {
+                result.status = actual === undefined ? 'passed' : 'failed';
+                if (actual !== undefined) {
+                    result.error = `Expected approved_by_usernames to be undefined, got ${JSON.stringify(actual)}`;
+                }
+            }
+            else {
+                const match = Array.isArray(actual) &&
+                    actual.length === testCase.expected.length &&
+                    testCase.expected.every((v, i) => actual[i] === v);
+                result.status = match ? 'passed' : 'failed';
+                if (!match) {
+                    result.error = `Expected ${JSON.stringify(testCase.expected)}, got ${JSON.stringify(actual)}`;
+                }
+            }
+        }
+        if (result.status === 'passed') {
+            passed++;
+            console.log(`✅ ${result.name}`);
+        }
+        else {
+            failed++;
+            console.log(`❌ ${result.name}: ${result.error}`);
+        }
+    });
+    console.log(`\nResults: ${passed} passed, ${failed} failed`);
+    return { passed, failed };
+}
 function runListLabelsSchemaTests() {
     console.log('\n=== List Labels Schema Tests ===');
     const cases = [
@@ -1122,6 +1235,75 @@ function runGetRepositoryTreeSchemaTests() {
     console.log(`\nResults: ${passed} passed, ${failed} failed`);
     return { passed, failed };
 }
+function runGitLabMarkdownUploadSchemaTests() {
+    console.log('\n=== GitLabMarkdownUpload Schema Tests ===');
+    const idlessUpload = {
+        alt: 'report.md',
+        url: '/uploads/c617e74a47dfb1a6dd59d419619b725d/report.md',
+        full_path: '/group/project/uploads/c617e74a47dfb1a6dd59d419619b725d/report.md',
+        markdown: '[report.md](/uploads/c617e74a47dfb1a6dd59d419619b725d/report.md)',
+    };
+    const cases = [
+        {
+            name: 'schema:markdown_upload:accepts-idless-response',
+            input: idlessUpload,
+            expectedId: 'absent',
+        },
+        {
+            name: 'schema:markdown_upload:accepts-numeric-id',
+            input: { ...idlessUpload, id: 42 },
+            expectedId: 42,
+        },
+        {
+            name: 'schema:markdown_upload:coerces-string-id',
+            input: { ...idlessUpload, id: '99' },
+            expectedId: 99,
+        },
+        {
+            name: 'schema:markdown_upload:treats-null-id-as-absent',
+            input: { ...idlessUpload, id: null },
+            expectedId: 'absent',
+        },
+        {
+            name: 'schema:markdown_upload:rejects-invalid-id',
+            input: { ...idlessUpload, id: 'not-a-number' },
+            shouldFail: true,
+        },
+    ];
+    let passed = 0;
+    let failed = 0;
+    cases.forEach(testCase => {
+        const result = { name: testCase.name, status: 'failed' };
+        const parsed = GitLabMarkdownUploadSchema.safeParse(testCase.input);
+        if (testCase.shouldFail) {
+            result.status = parsed.success ? 'failed' : 'passed';
+            if (parsed.success)
+                result.error = 'Expected schema validation to fail';
+        }
+        else if (!parsed.success) {
+            result.error = parsed.error?.message || 'Schema validation failed';
+        }
+        else if (testCase.expectedId === 'absent' && parsed.data.id !== undefined) {
+            result.error = `Expected id undefined, got ${parsed.data.id}`;
+        }
+        else if (typeof testCase.expectedId === 'number' && parsed.data.id !== testCase.expectedId) {
+            result.error = `Expected id ${testCase.expectedId}, got ${parsed.data.id}`;
+        }
+        else {
+            result.status = 'passed';
+        }
+        if (result.status === 'passed') {
+            passed++;
+            console.log(`✅ ${result.name}`);
+        }
+        else {
+            failed++;
+            console.log(`❌ ${result.name}: ${result.error}`);
+        }
+    });
+    console.log(`\nResults: ${passed} passed, ${failed} failed`);
+    return { passed, failed };
+}
 function runGitLabUserFullSchemaTests() {
     console.log('🧪 Testing GitLabUserFullSchema...');
     const adminResponse = {
@@ -1215,12 +1397,14 @@ if (import.meta.url === `file://${process.argv[1]}`) {
     const emojiReactionResult = runEmojiReactionSchemaTests();
     const repositorySchemaResult = runGitLabRepositorySchemaTests();
     const labelsCoercionResult = runLabelsCoercionSchemaTests();
+    const approvedByUsernamesResult = runApprovedByUsernamesSchemaTests();
     const listLabelsResult = runListLabelsSchemaTests();
     const treeItemResult = runGitLabTreeItemSchemaTests();
     const repositoryTreeResult = runGetRepositoryTreeSchemaTests();
     const gitLabUserFullResult = runGitLabUserFullSchemaTests();
-    const totalPassed = getFileContentsResult.passed + fileContentResult.passed + createPipelineResult.passed + commitStatusResult.passed + createIssueNoteResult.passed + getMergeRequestResult.passed + listMergeRequestPipelinesResult.passed + gitLabMergeRequestResult.passed + emojiReactionResult.passed + repositorySchemaResult.passed + labelsCoercionResult.passed + listLabelsResult.passed + treeItemResult.passed + repositoryTreeResult.passed + gitLabUserFullResult.passed;
-    const totalFailed = getFileContentsResult.failed + fileContentResult.failed + createPipelineResult.failed + commitStatusResult.failed + createIssueNoteResult.failed + getMergeRequestResult.failed + listMergeRequestPipelinesResult.failed + gitLabMergeRequestResult.failed + emojiReactionResult.failed + repositorySchemaResult.failed + labelsCoercionResult.failed + listLabelsResult.failed + treeItemResult.failed + repositoryTreeResult.failed + gitLabUserFullResult.failed;
+    const gitLabMarkdownUploadResult = runGitLabMarkdownUploadSchemaTests();
+    const totalPassed = getFileContentsResult.passed + fileContentResult.passed + createPipelineResult.passed + commitStatusResult.passed + createIssueNoteResult.passed + getMergeRequestResult.passed + listMergeRequestPipelinesResult.passed + gitLabMergeRequestResult.passed + emojiReactionResult.passed + repositorySchemaResult.passed + labelsCoercionResult.passed + approvedByUsernamesResult.passed + listLabelsResult.passed + treeItemResult.passed + repositoryTreeResult.passed + gitLabUserFullResult.passed + gitLabMarkdownUploadResult.passed;
+    const totalFailed = getFileContentsResult.failed + fileContentResult.failed + createPipelineResult.failed + commitStatusResult.failed + createIssueNoteResult.failed + getMergeRequestResult.failed + listMergeRequestPipelinesResult.failed + gitLabMergeRequestResult.failed + emojiReactionResult.failed + repositorySchemaResult.failed + labelsCoercionResult.failed + approvedByUsernamesResult.failed + listLabelsResult.failed + treeItemResult.failed + repositoryTreeResult.failed + gitLabUserFullResult.failed + gitLabMarkdownUploadResult.failed;
     console.log(`\nTotal Results: ${totalPassed} passed, ${totalFailed} failed`);
     if (totalFailed > 0) {
         process.exit(1);

package/build/test/test-list-merge-requests.js

@@ -103,4 +103,23 @@ describe('list_merge_requests', () => {
         assert.ok(Array.isArray(mrs), 'Response should be an array');
         assert.strictEqual(mrs.length, 2, 'Should return 2 mock MRs');
     });
+    test('forwards approved_by_usernames in bracket-array form', async () => {
+        let capturedUrl;
+        mockGitLab.addMockHandler('get', '/merge_requests', (req, res) => {
+            capturedUrl = req.originalUrl;
+            res.json([]);
+        });
+        try {
+            await callListMergeRequests({ approved_by_usernames: ['alice', 'bob'] }, {
+                GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+                GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+            });
+            assert.ok(capturedUrl, 'Mock handler should have received a request');
+            assert.match(capturedUrl, /approved_by_usernames%5B%5D=alice/, 'Request URL should contain approved_by_usernames[]=alice (URL-encoded)');
+            assert.match(capturedUrl, /approved_by_usernames%5B%5D=bob/, 'Request URL should contain approved_by_usernames[]=bob (URL-encoded)');
+        }
+        finally {
+            mockGitLab.clearCustomHandlers();
+        }
+    });
 });

package/build/test/test-upload-markdown.js

@@ -1,4 +1,4 @@
-import { describe, test, before, after } from 'node:test';
+import { describe, test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert';
 import { spawn } from 'node:child_process';
 import fs from 'node:fs';
@@ -55,12 +55,18 @@ const MOCK_UPLOAD_RESPONSE = {
     full_path: '/test-group/test-project/uploads/abc123secret/test-file.txt',
     markdown: '[test-file.txt](/uploads/abc123secret/test-file.txt)',
 };
+let uploadResponse = MOCK_UPLOAD_RESPONSE;
 describe('upload_markdown', () => {
     let mockGitLab;
     let env;
     // Captured per-request state, reset before each invocation via the handler
     let lastContentType;
     let lastRawBody;
+    beforeEach(() => {
+        uploadResponse = MOCK_UPLOAD_RESPONSE;
+        lastContentType = undefined;
+        lastRawBody = undefined;
+    });
     before(async () => {
         const port = await findMockServerPort(9200);
         mockGitLab = new MockGitLabServer({ port, validTokens: [MOCK_TOKEN] });
@@ -75,7 +81,7 @@ describe('upload_markdown', () => {
             req.on('data', (chunk) => chunks.push(chunk));
             req.on('end', () => {
                 lastRawBody = Buffer.concat(chunks).toString('binary');
-                res.status(201).json(MOCK_UPLOAD_RESPONSE);
+                res.status(201).json(uploadResponse);
             });
         });
     });
@@ -139,6 +145,27 @@ describe('upload_markdown', () => {
             fs.unlinkSync(tmpFile);
         }
     });
+    test('accepts upload responses without id from older self-hosted GitLab', async () => {
+        const { id: _id, ...idlessUploadResponse } = MOCK_UPLOAD_RESPONSE;
+        uploadResponse = idlessUploadResponse;
+        const tmpFile = path.join(os.tmpdir(), 'mcp-upload-idless-response-test.txt');
+        fs.writeFileSync(tmpFile, 'idless response field test');
+        try {
+            const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: tmpFile }, env);
+            assert.ok(!raw.error, `Unexpected RPC error: ${raw.error?.message}`);
+            const text = raw.result?.content?.[0]?.text;
+            assert.ok(text, 'Result should contain a text content block');
+            const parsed = JSON.parse(text);
+            assert.strictEqual(parsed.id, undefined);
+            assert.strictEqual(parsed.markdown, MOCK_UPLOAD_RESPONSE.markdown);
+            assert.strictEqual(parsed.url, MOCK_UPLOAD_RESPONSE.url);
+            assert.strictEqual(parsed.alt, MOCK_UPLOAD_RESPONSE.alt);
+            assert.strictEqual(parsed.full_path, MOCK_UPLOAD_RESPONSE.full_path);
+        }
+        finally {
+            fs.unlinkSync(tmpFile);
+        }
+    });
     test('returns an error when the file does not exist', async () => {
         const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: '/nonexistent/no-such-file.txt' }, env);
         const hasError = typeof raw.error?.message === 'string' ||

package/build/test/utils/merge-request-position.test.js

@@ -0,0 +1,57 @@
+import assert from "node:assert/strict";
+import { describe, test } from "node:test";
+import { CreateDraftNoteSchema } from "../../schemas.js";
+import { omitIncompleteMergeRequestPosition } from "../../utils/merge-request-position.js";
+describe("When omitIncompleteMergeRequestPosition runs", () => {
+    describe("with MCP null-injected SHAs", () => {
+        test("should return undefined when all commit SHAs are nullish", () => {
+            assert.equal(omitIncompleteMergeRequestPosition({
+                base_sha: null,
+                head_sha: null,
+                start_sha: null,
+                position_type: "text",
+            }), undefined);
+        });
+        test("should return undefined for null and undefined", () => {
+            assert.equal(omitIncompleteMergeRequestPosition(null), undefined);
+            assert.equal(omitIncompleteMergeRequestPosition(undefined), undefined);
+        });
+    });
+    describe("with complete position input", () => {
+        test("should return position when all required SHAs are strings", () => {
+            const position = {
+                base_sha: "abc",
+                head_sha: "def",
+                start_sha: "ghi",
+                position_type: "text",
+                old_line: null,
+                new_line: 4,
+            };
+            assert.deepEqual(omitIncompleteMergeRequestPosition(position), position);
+        });
+    });
+    describe("with partially invalid position input", () => {
+        test("should pass position through for schema validation to reject", () => {
+            const position = {
+                base_sha: "abc",
+                head_sha: null,
+                start_sha: "ghi",
+                position_type: "text",
+            };
+            assert.deepEqual(omitIncompleteMergeRequestPosition(position), position);
+        });
+        test("should fail schema parse when a required SHA is missing", () => {
+            assert.throws(() => CreateDraftNoteSchema.parse({
+                project_id: "g/p",
+                merge_request_iid: "1",
+                body: "note",
+                position: omitIncompleteMergeRequestPosition({
+                    base_sha: "abc",
+                    head_sha: null,
+                    start_sha: "ghi",
+                    position_type: "text",
+                }),
+            }), /Expected string, received null/);
+        });
+    });
+});

package/build/test/utils/tool-args.test.js

@@ -0,0 +1,75 @@
+import assert from "node:assert/strict";
+import { describe, test } from "node:test";
+import { sanitizeToolArguments } from "../../utils/tool-args.js";
+describe("When sanitizeToolArguments runs", () => {
+    describe("with top-level null optionals", () => {
+        test("should omit null and undefined keys for generic tools", () => {
+            const result = sanitizeToolArguments("create_draft_note", {
+                project_id: "g/p",
+                merge_request_iid: "1",
+                body: "note",
+                position: null,
+                resolve_discussion: undefined,
+            });
+            assert.deepEqual(result, {
+                project_id: "g/p",
+                merge_request_iid: "1",
+                body: "note",
+            });
+        });
+    });
+    describe("with nested objects", () => {
+        test("should not strip nulls inside nested position objects", () => {
+            const position = {
+                base_sha: "abc",
+                head_sha: "def",
+                start_sha: "ghi",
+                position_type: "text",
+                old_line: null,
+                new_line: 12,
+            };
+            const result = sanitizeToolArguments("create_draft_note", {
+                project_id: "g/p",
+                merge_request_iid: "1",
+                body: "note",
+                position,
+            });
+            assert.deepEqual(result.position, position);
+        });
+        test("should preserve null entries inside execute_graphql variables", () => {
+            const variables = { milestoneId: null, title: "x" };
+            const result = sanitizeToolArguments("execute_graphql", {
+                query: "query { project { id } }",
+                variables,
+            });
+            assert.deepEqual(result.variables, variables);
+        });
+    });
+    describe("with meaningful falsy values", () => {
+        test("should preserve false and zero", () => {
+            const result = sanitizeToolArguments("update_merge_request_discussion_note", {
+                resolved: false,
+                straight: false,
+                count: 0,
+                label: "",
+            });
+            assert.deepEqual(result, {
+                resolved: false,
+                straight: false,
+                count: 0,
+                label: "",
+            });
+        });
+    });
+    describe("with create_label", () => {
+        test("should preserve explicit null priority", () => {
+            const result = sanitizeToolArguments("create_label", {
+                project_id: "g/p",
+                name: "bug",
+                color: "#ff0000",
+                priority: null,
+            });
+            assert.equal(result.priority, null);
+        });
+    });
+});

package/build/utils/merge-request-position.js

@@ -0,0 +1,29 @@
+function isShaNullish(value) {
+    return value === null || value === undefined;
+}
+/**
+ * Normalize optional merge request thread position input before Zod validation.
+ * Omits position only when it was not provided or all commit SHAs are nullish (MCP null injection).
+ * Partial or invalid SHA sets are passed through so schema validation can reject them.
+ */
+export function omitIncompleteMergeRequestPosition(value) {
+    if (value === null || value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "object" || Array.isArray(value)) {
+        return value;
+    }
+    const record = value;
+    const { base_sha, head_sha, start_sha } = record;
+    const hasAllRequiredShas = typeof base_sha === "string" &&
+        typeof head_sha === "string" &&
+        typeof start_sha === "string";
+    if (hasAllRequiredShas) {
+        return value;
+    }
+    const allShasNullish = isShaNullish(base_sha) && isShaNullish(head_sha) && isShaNullish(start_sha);
+    if (allShasNullish) {
+        return undefined;
+    }
+    return value;
+}

package/build/utils/tool-args.js

@@ -0,0 +1,22 @@
+const TOOL_PRESERVE_TOP_LEVEL_NULL_KEYS = {
+    create_label: ["priority"],
+    update_label: ["priority"],
+};
+/**
+ * Remove omitted optional fields injected as top-level null/undefined by MCP clients.
+ * Does not recurse into nested objects so intentional nulls (diff line numbers, GraphQL variables) stay intact.
+ */
+export function sanitizeToolArguments(toolName, args) {
+    const preserveNullKeys = new Set(TOOL_PRESERVE_TOP_LEVEL_NULL_KEYS[toolName] ?? []);
+    const result = {};
+    for (const [key, value] of Object.entries(args)) {
+        if (value === undefined) {
+            continue;
+        }
+        if (value === null && !preserveNullKeys.has(key)) {
+            continue;
+        }
+        result[key] = value;
+    }
+    return result;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.14",
+  "version": "2.1.16",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
@@ -51,7 +51,7 @@
     "changelog": "auto-changelog -p",
     "test": "npm run test:all",
     "test:all": "npm run build && npm run test:mock && npm run test:live",
-    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts",
+    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts",
     "test:stateless": "npm run build && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts",
     "test:mcp-oauth": "npm run build && node --import tsx/esm --test test/mcp-oauth-tests.ts",
     "test:live": "node test/validate-api.js",