@zereight/mcp-gitlab 2.1.15 → 2.1.17

package/README.md

@@ -647,6 +647,16 @@ Register the skill directory in your AI client to get optimal tool usage guidanc
 154. `search_group_code` - Search for code within a specific GitLab group (requires advanced search or exact code search to be enabled)
 155. `execute_graphql` - Execute a GitLab GraphQL query
 156. `list_merge_request_pipelines` - List pipelines for a merge request with pagination support
+157. `list_project_variables` - List CI/CD variables for a project with optional environment scope filter
+158. `get_project_variable` - Get a single CI/CD variable from a project by key, with optional environment scope filter
+159. `create_project_variable` - Create a new CI/CD variable in a project
+160. `update_project_variable` - Update an existing CI/CD variable in a project, with optional filter to disambiguate by environment scope
+161. `delete_project_variable` - Delete a CI/CD variable from a project, with optional filter to disambiguate by environment scope
+162. `list_group_variables` - List CI/CD variables for a group with optional environment scope filter
+163. `get_group_variable` - Get a single CI/CD variable from a group by key, with optional environment scope filter
+164. `create_group_variable` - Create a new CI/CD variable in a group
+165. `update_group_variable` - Update an existing CI/CD variable in a group, with optional filter to disambiguate by environment scope
+166. `delete_group_variable` - Delete a CI/CD variable from a group, with optional filter to disambiguate by environment scope
 
 <!-- TOOLS-END -->
 

package/build/index.js

@@ -128,6 +128,7 @@ import { createGitLabOAuthProvider } from "./oauth-proxy.js";
 import { mcpAuthRouter } from "@modelcontextprotocol/sdk/server/auth/router.js";
 import { normalizeGitLabApiUrl } from "./utils/url.js";
 import { estimateMergeCommitCount, filterDiffsByPatterns, summarizeWebhookEvents } from "./utils/helpers.js";
+import { sanitizeToolArguments } from "./utils/tool-args.js";
 import { parseSearchReplaceBlocks, applySearchReplace, applyUnifiedDiff, } from "./utils/patch-helper.js";
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
 import { GitLabClientPool } from "./gitlab-client-pool.js";
@@ -138,7 +139,7 @@ CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMerg
 GitLabDiscussionNoteSchema, // Added
 GitLabDiscussionSchema, 
 // Draft Notes Schemas
-GitLabDraftNoteSchema, GitLabForkSchema, GitLabBranchSchema, GitLabGroupSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestPipelineSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListBranchesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
+GitLabDraftNoteSchema, GitLabForkSchema, GitLabBranchSchema, GitLabGroupSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestPipelineSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListBranchesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, GitLabCiVariableSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
 GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, GitLabTagSchema, GitLabTagSignatureSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, ListWebhookEventsSchema, GetWebhookEventSchema, HealthCheckSchema, } from "./schemas.js";
 import { randomUUID, createCipheriv, createDecipheriv, randomBytes, createHash } from "node:crypto";
 import { pino } from "pino";
@@ -1275,6 +1276,12 @@ async function listMergeRequests(projectId, options = {}) {
                 // Handle array of labels
                 url.searchParams.append(key, value.join(","));
             }
+            else if (key === "approved_by_usernames" && Array.isArray(value)) {
+                // GitLab expects array-bracket form: approved_by_usernames[]=alice&approved_by_usernames[]=bob
+                for (const v of value) {
+                    url.searchParams.append(`${key}[]`, String(v));
+                }
+            }
             else {
                 url.searchParams.append(key, String(value));
             }
@@ -1382,16 +1389,9 @@ async function executeGraphQL(query, variables = {}) {
  * Resolve a project path and issue IID to a work item GraphQL GID.
  */
 async function resolveWorkItemGID(projectId, issueIid) {
-    projectId = decodeURIComponent(projectId);
-    const effectiveProjectId = getEffectiveProjectId(projectId);
-    // First get the project path via REST (needed for GraphQL namespace query)
-    const projectUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`);
-    const projectResponse = await fetch(projectUrl.toString(), {
-        ...getFetchConfig(),
-    });
-    await handleGitLabError(projectResponse);
-    const project = await projectResponse.json();
-    const projectPath = project.path_with_namespace;
+    // resolveProjectPath handles both project and group paths (including the
+    // group fallback), so work item tools work for group-level namespaces too.
+    const projectPath = await resolveProjectPath(projectId);
     // Resolve work item GID via GraphQL
     const data = await executeGraphQL(`query($path: ID!, $iid: String!) {
       namespace(fullPath: $path) {
@@ -1514,15 +1514,7 @@ async function removeIssueParent(projectId, issueIid) {
  * Requires Premium/Ultimate with configurable statuses enabled.
  */
 async function listIssueStatuses(projectId, workItemType = "issue") {
-    projectId = decodeURIComponent(projectId);
-    const effectiveProjectId = getEffectiveProjectId(projectId);
-    // Get project path
-    const projectUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`);
-    const projectResponse = await fetch(projectUrl.toString(), {
-        ...getFetchConfig(),
-    });
-    await handleGitLabError(projectResponse);
-    const project = await projectResponse.json();
+    const projectPath = await resolveProjectPath(projectId);
     const typeName = WORK_ITEM_TYPE_NAMES[workItemType] || "Issue";
     const data = await executeGraphQL(`query($path: ID!, $typeName: IssueType) {
       namespace(fullPath: $path) {
@@ -1550,7 +1542,7 @@ async function listIssueStatuses(projectId, workItemType = "issue") {
           }
         }
       }
-    }`, { path: project.path_with_namespace, typeName: typeName.replace(/ /g, "_").toUpperCase() });
+    }`, { path: projectPath, typeName: typeName.replace(/ /g, "_").toUpperCase() });
     const typeNodes = data.namespace?.workItemTypes?.nodes;
     if (!typeNodes || typeNodes.length === 0) {
         throw new Error(`Work item type '${typeName}' not found in project`);
@@ -1946,6 +1938,22 @@ async function resolveProjectPath(projectId) {
     const projectResponse = await fetch(projectUrl.toString(), {
         ...getFetchConfig(),
     });
+    // On project 404, fall back to groups — but only for path-like identifiers.
+    // Numeric IDs must not fall back: group and project IDs share no namespace,
+    // so a numeric project 404 should fail immediately rather than silently
+    // resolving to an unrelated group with the same integer ID.
+    if (projectResponse.status === 404 && !/^\d+$/.test(effectiveProjectId)) {
+        const groupUrl = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(effectiveProjectId)}`);
+        const groupResponse = await fetch(groupUrl.toString(), {
+            ...getFetchConfig(),
+        });
+        if (groupResponse.ok) {
+            const group = await groupResponse.json();
+            return group.full_path;
+        }
+        // Surface the group error
+        await handleGitLabError(groupResponse);
+    }
     await handleGitLabError(projectResponse);
     const project = await projectResponse.json();
     return project.path_with_namespace;
@@ -5734,6 +5742,139 @@ async function listGroupIterations(groupId, options = {}) {
     const data = await response.json();
     return z.array(GroupIteration).parse(data);
 }
+// --- CI/CD Variables ---
+async function listProjectVariables(projectId, options = {}) {
+    projectId = decodeURIComponent(projectId);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables`);
+    Object.entries(options).forEach(([key, value]) => {
+        if (value === undefined)
+            return;
+        if (key === "filter" && typeof value === "object" && value !== null) {
+            Object.entries(value).forEach(([fKey, fVal]) => {
+                url.searchParams.append(`filter[${fKey}]`, fVal);
+            });
+        }
+        else if (typeof value === "boolean") {
+            url.searchParams.append(key, value ? "true" : "false");
+        }
+        else {
+            url.searchParams.append(key, String(value));
+        }
+    });
+    const response = await fetch(url.toString(), getFetchConfig());
+    await handleGitLabError(response);
+    const data = await response.json();
+    return z.array(GitLabCiVariableSchema).parse(data);
+}
+async function getProjectVariable(projectId, key, filter) {
+    projectId = decodeURIComponent(projectId);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables/${encodeURIComponent(key)}`);
+    if (filter?.environment_scope) {
+        url.searchParams.append("filter[environment_scope]", filter.environment_scope);
+    }
+    const response = await fetch(url.toString(), getFetchConfig());
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabCiVariableSchema.parse(data);
+}
+async function createProjectVariable(projectId, options) {
+    projectId = decodeURIComponent(projectId);
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables`, { ...getFetchConfig(), method: "POST", body: JSON.stringify(options) });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabCiVariableSchema.parse(data);
+}
+async function updateProjectVariable(projectId, key, options) {
+    projectId = decodeURIComponent(projectId);
+    const { filter, ...body } = options;
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables/${encodeURIComponent(key)}`);
+    if (filter?.environment_scope) {
+        url.searchParams.append("filter[environment_scope]", filter.environment_scope);
+    }
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+        method: "PUT",
+        body: JSON.stringify(body),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabCiVariableSchema.parse(data);
+}
+async function deleteProjectVariable(projectId, key, filter) {
+    projectId = decodeURIComponent(projectId);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables/${encodeURIComponent(key)}`);
+    if (filter?.environment_scope) {
+        url.searchParams.append("filter[environment_scope]", filter.environment_scope);
+    }
+    const response = await fetch(url.toString(), { ...getFetchConfig(), method: "DELETE" });
+    await handleGitLabError(response);
+}
+async function listGroupVariables(groupId, options = {}) {
+    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables`);
+    Object.entries(options).forEach(([key, value]) => {
+        if (value === undefined)
+            return;
+        if (key === "filter" && typeof value === "object" && value !== null) {
+            Object.entries(value).forEach(([fKey, fVal]) => {
+                url.searchParams.append(`filter[${fKey}]`, fVal);
+            });
+        }
+        else if (typeof value === "boolean") {
+            url.searchParams.append(key, value ? "true" : "false");
+        }
+        else {
+            url.searchParams.append(key, String(value));
+        }
+    });
+    const response = await fetch(url.toString(), getFetchConfig());
+    await handleGitLabError(response);
+    const data = await response.json();
+    return z.array(GitLabCiVariableSchema).parse(data);
+}
+async function getGroupVariable(groupId, key, filter) {
+    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeURIComponent(key)}`);
+    if (filter?.environment_scope) {
+        url.searchParams.append("filter[environment_scope]", filter.environment_scope);
+    }
+    const response = await fetch(url.toString(), getFetchConfig());
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabCiVariableSchema.parse(data);
+}
+async function createGroupVariable(groupId, options) {
+    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const response = await fetch(`${getEffectiveApiUrl()}/groups/${encoded}/variables`, {
+        ...getFetchConfig(),
+        method: "POST",
+        body: JSON.stringify(options),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabCiVariableSchema.parse(data);
+}
+async function updateGroupVariable(groupId, key, options) {
+    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const { filter, ...body } = options;
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeURIComponent(key)}`);
+    if (filter?.environment_scope) {
+        url.searchParams.append("filter[environment_scope]", filter.environment_scope);
+    }
+    const response = await fetch(url.toString(), { ...getFetchConfig(), method: "PUT", body: JSON.stringify(body) });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabCiVariableSchema.parse(data);
+}
+async function deleteGroupVariable(groupId, key, filter) {
+    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeURIComponent(key)}`);
+    if (filter?.environment_scope) {
+        url.searchParams.append("filter[environment_scope]", filter.environment_scope);
+    }
+    const response = await fetch(url.toString(), { ...getFetchConfig(), method: "DELETE" });
+    await handleGitLabError(response);
+}
 /**
  * Upload a file to a GitLab project for use in markdown content.
  *
@@ -6126,6 +6267,9 @@ async function handleToolCall(params) {
                 args.iid = args.work_item_iid;
                 delete args.work_item_iid;
             }
+            if (!Array.isArray(args)) {
+                params.arguments = sanitizeToolArguments(params.name, args);
+            }
         }
         // Centralized read-only guard: reject write tools even if client bypasses list_tools filtering
         if (GITLAB_READ_ONLY_MODE && !readOnlyTools.has(params.name)) {
@@ -7701,6 +7845,82 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(iterations, null, 2) }],
                 };
             }
+            // --- CI/CD Variables ---
+            case "list_project_variables": {
+                const args = ListProjectVariablesSchema.parse(params.arguments);
+                const { project_id, ...options } = args;
+                const variables = await listProjectVariables(project_id, options);
+                return { content: [{ type: "text", text: JSON.stringify(variables, null, 2) }] };
+            }
+            case "get_project_variable": {
+                const args = GetProjectVariableSchema.parse(params.arguments);
+                const variable = await getProjectVariable(args.project_id, args.key, args.filter);
+                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+            }
+            case "create_project_variable": {
+                const args = CreateProjectVariableSchema.parse(params.arguments);
+                const { project_id, ...options } = args;
+                const variable = await createProjectVariable(project_id, options);
+                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+            }
+            case "update_project_variable": {
+                const args = UpdateProjectVariableSchema.parse(params.arguments);
+                const { project_id, key, ...options } = args;
+                const variable = await updateProjectVariable(project_id, key, options);
+                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+            }
+            case "delete_project_variable": {
+                const args = DeleteProjectVariableSchema.parse(params.arguments);
+                await deleteProjectVariable(args.project_id, args.key, args.filter);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({ status: "success", message: `Variable '${args.key}' deleted from project` }, null, 2),
+                        },
+                    ],
+                };
+            }
+            case "list_group_variables": {
+                rejectIfProjectScopedDeployment("list_group_variables");
+                const args = ListGroupVariablesSchema.parse(params.arguments);
+                const { group_id, ...options } = args;
+                const variables = await listGroupVariables(group_id, options);
+                return { content: [{ type: "text", text: JSON.stringify(variables, null, 2) }] };
+            }
+            case "get_group_variable": {
+                rejectIfProjectScopedDeployment("get_group_variable");
+                const args = GetGroupVariableSchema.parse(params.arguments);
+                const variable = await getGroupVariable(args.group_id, args.key, args.filter);
+                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+            }
+            case "create_group_variable": {
+                rejectIfProjectScopedDeployment("create_group_variable");
+                const args = CreateGroupVariableSchema.parse(params.arguments);
+                const { group_id, ...options } = args;
+                const variable = await createGroupVariable(group_id, options);
+                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+            }
+            case "update_group_variable": {
+                rejectIfProjectScopedDeployment("update_group_variable");
+                const args = UpdateGroupVariableSchema.parse(params.arguments);
+                const { group_id, key, ...options } = args;
+                const variable = await updateGroupVariable(group_id, key, options);
+                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+            }
+            case "delete_group_variable": {
+                rejectIfProjectScopedDeployment("delete_group_variable");
+                const args = DeleteGroupVariableSchema.parse(params.arguments);
+                await deleteGroupVariable(args.group_id, args.key, args.filter);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({ status: "success", message: `Variable '${args.key}' deleted from group` }, null, 2),
+                        },
+                    ],
+                };
+            }
             case "upload_markdown": {
                 if (IS_REMOTE) {
                     const args = MarkdownUploadRemoteSchema.parse(params.arguments);

package/build/schemas.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { omitIncompleteMergeRequestPosition } from "./utils/merge-request-position.js";
 // Helper: coerce a JSON-stringified array to an actual array.
 // LLMs sometimes send '["a", "b"]' (string) instead of ["a", "b"] (array).
 const coerceStringArray = z.preprocess((val) => {
@@ -1110,7 +1111,7 @@ export const GitLabMergeRequestSchema = z.object({
         .describe("Whether rebase is currently in progress for this merge request"),
     merge_when_pipeline_succeeds: z.coerce.boolean().optional(),
     squash: z.coerce.boolean().optional(),
-    labels: z.array(z.string()).optional(),
+    labels: z.array(GitLabLabelSchema).or(z.array(z.string())).optional(), // Support both label objects and strings
 });
 export const LineRangeSchema = z
     .object({
@@ -1823,6 +1824,9 @@ export const ListMergeRequestsSchema = z
         .string()
         .optional()
         .describe("Returns merge requests which have the user as a reviewer by username. Mutually exclusive with reviewer_id."),
+    approved_by_usernames: coerceStringArray
+        .optional()
+        .describe("Returns merge requests approved by the given usernames (array)."),
     created_after: z
         .string()
         .optional()
@@ -2254,6 +2258,7 @@ export const MergeRequestThreadPositionSchema = z.object({
         .optional()
         .describe("IMAGE DIFFS ONLY: Y coordinate on the image (for position_type='image')."),
 });
+const optionalMergeRequestThreadPosition = z.preprocess(omitIncompleteMergeRequestPosition, MergeRequestThreadPositionSchema.optional());
 // Draft Notes API schemas
 export const GitLabDraftNoteSchema = z
     .object({
@@ -2295,7 +2300,7 @@ export const CreateDraftNoteSchema = ProjectParamsSchema.extend({
         .string()
         .optional()
         .describe("The ID of a discussion the draft note replies to"),
-    position: MergeRequestThreadPositionSchema.optional().describe("Position when creating a diff note"),
+    position: optionalMergeRequestThreadPosition.describe("Position when creating a diff note"),
     resolve_discussion: z
         .coerce.boolean()
         .optional()
@@ -2306,7 +2311,7 @@ export const UpdateDraftNoteSchema = ProjectParamsSchema.extend({
     merge_request_iid: z.coerce.string().describe("The IID of a merge request"),
     draft_note_id: z.coerce.string().describe("The ID of the draft note"),
     body: z.string().optional().describe("The content of the draft note"),
-    position: MergeRequestThreadPositionSchema.optional().describe("Position when creating a diff note"),
+    position: optionalMergeRequestThreadPosition.describe("Position when creating a diff note"),
     resolve_discussion: z
         .coerce.boolean()
         .optional()
@@ -2330,7 +2335,7 @@ export const BulkPublishDraftNotesSchema = ProjectParamsSchema.extend({
 export const CreateMergeRequestThreadSchema = ProjectParamsSchema.extend({
     merge_request_iid: z.coerce.string().describe("The IID of a merge request"),
     body: z.string().describe("The content of the thread"),
-    position: MergeRequestThreadPositionSchema.optional().describe("Position when creating a diff note"),
+    position: optionalMergeRequestThreadPosition.describe("Position when creating a diff note"),
     created_at: z.string().optional().describe("Date the thread was created at (ISO 8601 format)"),
 });
 export const ResolveMergeRequestThreadSchema = ProjectParamsSchema.extend({
@@ -3052,14 +3057,15 @@ export const GitLabTagSignatureSchema = z.object({
 // --- Work item schemas (GraphQL-based) ---
 // Case-insensitive work item type enum (accepts "ISSUE", "Issue", "issue")
 const workItemTypeEnum = z.string().transform(v => v.toLowerCase()).pipe(z.enum(["issue", "task", "incident", "test_case", "epic", "key_result", "objective", "requirement", "ticket"]));
+const ProjectIdOrPathSchema = z.coerce.string().describe("Project ID, URL-encoded project path, or group path (e.g. 'group/subgroup' for group-level work items)");
 // Common params for work item tools
 const WorkItemParamsSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID (IID) of the work item"),
 });
 export const GetWorkItemSchema = WorkItemParamsSchema;
 export const ListWorkItemsSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     types: z
         .array(workItemTypeEnum)
         .optional()
@@ -3091,7 +3097,7 @@ export const ListWorkItemsSchema = z.object({
         .describe("Cursor for pagination (from previous response's endCursor)"),
 });
 export const CreateWorkItemSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     title: z.string().describe("Title of the work item"),
     type: workItemTypeEnum
         .optional()
@@ -3161,38 +3167,38 @@ export const UpdateWorkItemSchema = WorkItemParamsSchema.extend({
         .describe("Incident only: set escalation status"),
 });
 export const ConvertWorkItemTypeSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
     new_type: workItemTypeEnum.describe("The target work item type to convert to"),
 });
 export const ListWorkItemStatusesSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     work_item_type: workItemTypeEnum
         .optional()
         .default("issue")
         .describe("The work item type to list available statuses for. Defaults to 'issue'."),
 });
 export const ListWorkItemNotesSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
     page_size: z.coerce.number().optional().default(20).describe("Number of discussions to return (default 20)"),
     after: z.string().optional().describe("Cursor for pagination"),
     sort: z.enum(["CREATED_ASC", "CREATED_DESC"]).optional().default("CREATED_ASC").describe("Sort order for discussions"),
 });
 export const CreateWorkItemNoteSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
     body: z.string().describe("Note body (Markdown supported)"),
     internal: z.coerce.boolean().optional().default(false).describe("Create as internal/confidential note (only visible to project members)"),
     discussion_id: z.string().optional().describe("Discussion ID to reply to (for threaded replies). If omitted, creates a new top-level note."),
 });
 export const MoveWorkItemSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path of the source project"),
+    project_id: z.coerce.string().describe("Project ID, URL-encoded project path, or group path of the source namespace"),
     iid: z.coerce.number().describe("The internal ID of the work item to move"),
-    target_project_id: z.coerce.string().describe("Project ID or URL-encoded path of the target project"),
+    target_project_id: z.coerce.string().describe("Project ID, URL-encoded project path, or group path of the target namespace"),
 });
 export const ListCustomFieldDefinitionsSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     work_item_type: workItemTypeEnum
         .optional()
         .default("issue")
@@ -3244,23 +3250,23 @@ export const DeleteIssueNoteEmojiReactionSchema = ProjectParamsSchema.extend({
 });
 // --- Emoji Reaction schemas (GraphQL: Work Items) ---
 export const CreateWorkItemEmojiReactionSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
     name: emojiNameField,
 });
 export const DeleteWorkItemEmojiReactionSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
     name: emojiNameField,
 });
 export const CreateWorkItemNoteEmojiReactionSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
     note_id: z.string().describe("The GraphQL GID of the note (e.g. 'gid://gitlab/Note/123' from list_work_item_notes)"),
     name: emojiNameField,
 });
 export const DeleteWorkItemNoteEmojiReactionSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
     note_id: z.string().describe("The GraphQL GID of the note (e.g. 'gid://gitlab/Note/123' from list_work_item_notes)"),
     name: emojiNameField,
@@ -3282,11 +3288,11 @@ export const ListIssueNoteEmojiReactionsSchema = ProjectParamsSchema.extend({
     discussion_id: noteEmojiDiscussionField,
 });
 export const ListWorkItemEmojiReactionsSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
 });
 export const ListWorkItemNoteEmojiReactionsSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
     note_id: z.string().describe("The GraphQL GID of the note (e.g. 'gid://gitlab/Note/123' from list_work_item_notes)"),
 });
@@ -3372,3 +3378,128 @@ export const GetWebhookEventSchema = z
     message: "Provide exactly one of project_id or group_id",
 });
 export const HealthCheckSchema = z.object({});
+// --- CI/CD Variable types ---
+export const GitLabCiVariableSchema = z.object({
+    variable_type: z.enum(["env_var", "file"]).optional(),
+    key: z.string(),
+    value: z.string().nullable(),
+    protected: z.boolean().optional(),
+    masked: z.boolean().optional(),
+    hidden: z.boolean().optional(),
+    raw: z.boolean().optional(),
+    environment_scope: z.string().optional(),
+    description: z.string().nullable().optional(),
+});
+const ciVariableFields = {
+    key: z.string().describe("The key of the variable (must match /[a-zA-Z0-9_]+/)"),
+    value: z.string().describe("The value of the variable"),
+    variable_type: z
+        .enum(["env_var", "file"])
+        .optional()
+        .describe("The type of variable: 'env_var' (default) or 'file'"),
+    protected: z
+        .boolean()
+        .optional()
+        .describe("Whether the variable is only available on protected branches/tags"),
+    masked: z.boolean().optional().describe("Whether the variable value is masked in job logs"),
+    raw: z.boolean().optional().describe("Whether the variable is not expanded (treated as raw string)"),
+    environment_scope: z
+        .string()
+        .optional()
+        .describe("Environment scope (e.g. '*', 'production'). Default: '*'"),
+    description: z.string().optional().describe("Description of the variable"),
+};
+export const ListProjectVariablesSchema = z
+    .object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    filter: z
+        .object({ environment_scope: z.string() })
+        .optional()
+        .describe("Filter by environment scope (e.g. '*', 'production')"),
+})
+    .merge(PaginationOptionsSchema);
+export const GetProjectVariableSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    key: z.string().describe("The key of the variable"),
+    filter: z
+        .object({ environment_scope: z.string() })
+        .optional()
+        .describe("Filter by environment scope"),
+});
+export const CreateProjectVariableSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    ...ciVariableFields,
+});
+export const UpdateProjectVariableSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    key: z.string().describe("The key of the variable to update"),
+    value: z.string().describe("The new value of the variable"),
+    variable_type: z.enum(["env_var", "file"]).optional().describe("The type of variable"),
+    protected: z.boolean().optional().describe("Whether the variable is protected"),
+    masked: z.boolean().optional().describe("Whether the variable value is masked in job logs"),
+    raw: z.boolean().optional().describe("Whether the variable is not expanded"),
+    environment_scope: z
+        .string()
+        .optional()
+        .describe("New environment scope to assign to the variable (renames the scope, e.g. '*', 'production'). Use filter.environment_scope to identify which variable to update when multiple share the same key."),
+    description: z.string().optional().describe("Description of the variable"),
+    filter: z
+        .object({ environment_scope: z.string() })
+        .optional()
+        .describe("Identifies which variable to update when multiple variables share the same key across different environment scopes"),
+});
+export const DeleteProjectVariableSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    key: z.string().describe("The key of the variable to delete"),
+    filter: z
+        .object({ environment_scope: z.string() })
+        .optional()
+        .describe("Filter by environment scope to disambiguate when multiple variables share the same key"),
+});
+export const ListGroupVariablesSchema = z
+    .object({
+    group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
+    filter: z
+        .object({ environment_scope: z.string() })
+        .optional()
+        .describe("Filter by environment scope (e.g. '*', 'production')"),
+})
+    .merge(PaginationOptionsSchema);
+export const GetGroupVariableSchema = z.object({
+    group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
+    key: z.string().describe("The key of the variable"),
+    filter: z
+        .object({ environment_scope: z.string() })
+        .optional()
+        .describe("Filter by environment scope"),
+});
+export const CreateGroupVariableSchema = z.object({
+    group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
+    ...ciVariableFields,
+});
+export const UpdateGroupVariableSchema = z.object({
+    group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
+    key: z.string().describe("The key of the variable to update"),
+    value: z.string().describe("The new value of the variable"),
+    variable_type: z.enum(["env_var", "file"]).optional().describe("The type of variable"),
+    protected: z.boolean().optional().describe("Whether the variable is protected"),
+    masked: z.boolean().optional().describe("Whether the variable value is masked in job logs"),
+    raw: z.boolean().optional().describe("Whether the variable is not expanded"),
+    environment_scope: z
+        .string()
+        .optional()
+        .describe("New environment scope to assign to the variable (renames the scope, e.g. '*', 'production'). Use filter.environment_scope to identify which variable to update when multiple share the same key."),
+    description: z.string().optional().describe("Description of the variable"),
+    filter: z
+        .object({ environment_scope: z.string() })
+        .optional()
+        .describe("Identifies which variable to update when multiple variables share the same key across different environment scopes"),
+});
+export const DeleteGroupVariableSchema = z.object({
+    group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
+    key: z.string().describe("The key of the variable to delete"),
+    filter: z
+        .object({ environment_scope: z.string() })
+        .optional()
+        .describe("Filter by environment scope to disambiguate when multiple variables share the same key"),
+});