@zereight/mcp-gitlab 2.1.16 → 2.1.17

package/README.md

@@ -647,6 +647,16 @@ Register the skill directory in your AI client to get optimal tool usage guidanc
 154. `search_group_code` - Search for code within a specific GitLab group (requires advanced search or exact code search to be enabled)
 155. `execute_graphql` - Execute a GitLab GraphQL query
 156. `list_merge_request_pipelines` - List pipelines for a merge request with pagination support
+157. `list_project_variables` - List CI/CD variables for a project with optional environment scope filter
+158. `get_project_variable` - Get a single CI/CD variable from a project by key, with optional environment scope filter
+159. `create_project_variable` - Create a new CI/CD variable in a project
+160. `update_project_variable` - Update an existing CI/CD variable in a project, with optional filter to disambiguate by environment scope
+161. `delete_project_variable` - Delete a CI/CD variable from a project, with optional filter to disambiguate by environment scope
+162. `list_group_variables` - List CI/CD variables for a group with optional environment scope filter
+163. `get_group_variable` - Get a single CI/CD variable from a group by key, with optional environment scope filter
+164. `create_group_variable` - Create a new CI/CD variable in a group
+165. `update_group_variable` - Update an existing CI/CD variable in a group, with optional filter to disambiguate by environment scope
+166. `delete_group_variable` - Delete a CI/CD variable from a group, with optional filter to disambiguate by environment scope
 
 <!-- TOOLS-END -->
 

package/build/index.js

@@ -139,7 +139,7 @@ CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMerg
 GitLabDiscussionNoteSchema, // Added
 GitLabDiscussionSchema, 
 // Draft Notes Schemas
-GitLabDraftNoteSchema, GitLabForkSchema, GitLabBranchSchema, GitLabGroupSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestPipelineSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListBranchesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
+GitLabDraftNoteSchema, GitLabForkSchema, GitLabBranchSchema, GitLabGroupSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestPipelineSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListBranchesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, GitLabCiVariableSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
 GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, GitLabTagSchema, GitLabTagSignatureSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, ListWebhookEventsSchema, GetWebhookEventSchema, HealthCheckSchema, } from "./schemas.js";
 import { randomUUID, createCipheriv, createDecipheriv, randomBytes, createHash } from "node:crypto";
 import { pino } from "pino";
@@ -1389,16 +1389,9 @@ async function executeGraphQL(query, variables = {}) {
  * Resolve a project path and issue IID to a work item GraphQL GID.
  */
 async function resolveWorkItemGID(projectId, issueIid) {
-    projectId = decodeURIComponent(projectId);
-    const effectiveProjectId = getEffectiveProjectId(projectId);
-    // First get the project path via REST (needed for GraphQL namespace query)
-    const projectUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`);
-    const projectResponse = await fetch(projectUrl.toString(), {
-        ...getFetchConfig(),
-    });
-    await handleGitLabError(projectResponse);
-    const project = await projectResponse.json();
-    const projectPath = project.path_with_namespace;
+    // resolveProjectPath handles both project and group paths (including the
+    // group fallback), so work item tools work for group-level namespaces too.
+    const projectPath = await resolveProjectPath(projectId);
     // Resolve work item GID via GraphQL
     const data = await executeGraphQL(`query($path: ID!, $iid: String!) {
       namespace(fullPath: $path) {
@@ -1521,15 +1514,7 @@ async function removeIssueParent(projectId, issueIid) {
  * Requires Premium/Ultimate with configurable statuses enabled.
  */
 async function listIssueStatuses(projectId, workItemType = "issue") {
-    projectId = decodeURIComponent(projectId);
-    const effectiveProjectId = getEffectiveProjectId(projectId);
-    // Get project path
-    const projectUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`);
-    const projectResponse = await fetch(projectUrl.toString(), {
-        ...getFetchConfig(),
-    });
-    await handleGitLabError(projectResponse);
-    const project = await projectResponse.json();
+    const projectPath = await resolveProjectPath(projectId);
     const typeName = WORK_ITEM_TYPE_NAMES[workItemType] || "Issue";
     const data = await executeGraphQL(`query($path: ID!, $typeName: IssueType) {
       namespace(fullPath: $path) {
@@ -1557,7 +1542,7 @@ async function listIssueStatuses(projectId, workItemType = "issue") {
           }
         }
       }
-    }`, { path: project.path_with_namespace, typeName: typeName.replace(/ /g, "_").toUpperCase() });
+    }`, { path: projectPath, typeName: typeName.replace(/ /g, "_").toUpperCase() });
     const typeNodes = data.namespace?.workItemTypes?.nodes;
     if (!typeNodes || typeNodes.length === 0) {
         throw new Error(`Work item type '${typeName}' not found in project`);
@@ -1953,6 +1938,22 @@ async function resolveProjectPath(projectId) {
     const projectResponse = await fetch(projectUrl.toString(), {
         ...getFetchConfig(),
     });
+    // On project 404, fall back to groups — but only for path-like identifiers.
+    // Numeric IDs must not fall back: group and project IDs share no namespace,
+    // so a numeric project 404 should fail immediately rather than silently
+    // resolving to an unrelated group with the same integer ID.
+    if (projectResponse.status === 404 && !/^\d+$/.test(effectiveProjectId)) {
+        const groupUrl = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(effectiveProjectId)}`);
+        const groupResponse = await fetch(groupUrl.toString(), {
+            ...getFetchConfig(),
+        });
+        if (groupResponse.ok) {
+            const group = await groupResponse.json();
+            return group.full_path;
+        }
+        // Surface the group error
+        await handleGitLabError(groupResponse);
+    }
     await handleGitLabError(projectResponse);
     const project = await projectResponse.json();
     return project.path_with_namespace;
@@ -5741,6 +5742,139 @@ async function listGroupIterations(groupId, options = {}) {
     const data = await response.json();
     return z.array(GroupIteration).parse(data);
 }
+// --- CI/CD Variables ---
+async function listProjectVariables(projectId, options = {}) {
+    projectId = decodeURIComponent(projectId);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables`);
+    Object.entries(options).forEach(([key, value]) => {
+        if (value === undefined)
+            return;
+        if (key === "filter" && typeof value === "object" && value !== null) {
+            Object.entries(value).forEach(([fKey, fVal]) => {
+                url.searchParams.append(`filter[${fKey}]`, fVal);
+            });
+        }
+        else if (typeof value === "boolean") {
+            url.searchParams.append(key, value ? "true" : "false");
+        }
+        else {
+            url.searchParams.append(key, String(value));
+        }
+    });
+    const response = await fetch(url.toString(), getFetchConfig());
+    await handleGitLabError(response);
+    const data = await response.json();
+    return z.array(GitLabCiVariableSchema).parse(data);
+}
+async function getProjectVariable(projectId, key, filter) {
+    projectId = decodeURIComponent(projectId);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables/${encodeURIComponent(key)}`);
+    if (filter?.environment_scope) {
+        url.searchParams.append("filter[environment_scope]", filter.environment_scope);
+    }
+    const response = await fetch(url.toString(), getFetchConfig());
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabCiVariableSchema.parse(data);
+}
+async function createProjectVariable(projectId, options) {
+    projectId = decodeURIComponent(projectId);
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables`, { ...getFetchConfig(), method: "POST", body: JSON.stringify(options) });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabCiVariableSchema.parse(data);
+}
+async function updateProjectVariable(projectId, key, options) {
+    projectId = decodeURIComponent(projectId);
+    const { filter, ...body } = options;
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables/${encodeURIComponent(key)}`);
+    if (filter?.environment_scope) {
+        url.searchParams.append("filter[environment_scope]", filter.environment_scope);
+    }
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+        method: "PUT",
+        body: JSON.stringify(body),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabCiVariableSchema.parse(data);
+}
+async function deleteProjectVariable(projectId, key, filter) {
+    projectId = decodeURIComponent(projectId);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables/${encodeURIComponent(key)}`);
+    if (filter?.environment_scope) {
+        url.searchParams.append("filter[environment_scope]", filter.environment_scope);
+    }
+    const response = await fetch(url.toString(), { ...getFetchConfig(), method: "DELETE" });
+    await handleGitLabError(response);
+}
+async function listGroupVariables(groupId, options = {}) {
+    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables`);
+    Object.entries(options).forEach(([key, value]) => {
+        if (value === undefined)
+            return;
+        if (key === "filter" && typeof value === "object" && value !== null) {
+            Object.entries(value).forEach(([fKey, fVal]) => {
+                url.searchParams.append(`filter[${fKey}]`, fVal);
+            });
+        }
+        else if (typeof value === "boolean") {
+            url.searchParams.append(key, value ? "true" : "false");
+        }
+        else {
+            url.searchParams.append(key, String(value));
+        }
+    });
+    const response = await fetch(url.toString(), getFetchConfig());
+    await handleGitLabError(response);
+    const data = await response.json();
+    return z.array(GitLabCiVariableSchema).parse(data);
+}
+async function getGroupVariable(groupId, key, filter) {
+    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeURIComponent(key)}`);
+    if (filter?.environment_scope) {
+        url.searchParams.append("filter[environment_scope]", filter.environment_scope);
+    }
+    const response = await fetch(url.toString(), getFetchConfig());
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabCiVariableSchema.parse(data);
+}
+async function createGroupVariable(groupId, options) {
+    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const response = await fetch(`${getEffectiveApiUrl()}/groups/${encoded}/variables`, {
+        ...getFetchConfig(),
+        method: "POST",
+        body: JSON.stringify(options),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabCiVariableSchema.parse(data);
+}
+async function updateGroupVariable(groupId, key, options) {
+    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const { filter, ...body } = options;
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeURIComponent(key)}`);
+    if (filter?.environment_scope) {
+        url.searchParams.append("filter[environment_scope]", filter.environment_scope);
+    }
+    const response = await fetch(url.toString(), { ...getFetchConfig(), method: "PUT", body: JSON.stringify(body) });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabCiVariableSchema.parse(data);
+}
+async function deleteGroupVariable(groupId, key, filter) {
+    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeURIComponent(key)}`);
+    if (filter?.environment_scope) {
+        url.searchParams.append("filter[environment_scope]", filter.environment_scope);
+    }
+    const response = await fetch(url.toString(), { ...getFetchConfig(), method: "DELETE" });
+    await handleGitLabError(response);
+}
 /**
  * Upload a file to a GitLab project for use in markdown content.
  *
@@ -7711,6 +7845,82 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(iterations, null, 2) }],
                 };
             }
+            // --- CI/CD Variables ---
+            case "list_project_variables": {
+                const args = ListProjectVariablesSchema.parse(params.arguments);
+                const { project_id, ...options } = args;
+                const variables = await listProjectVariables(project_id, options);
+                return { content: [{ type: "text", text: JSON.stringify(variables, null, 2) }] };
+            }
+            case "get_project_variable": {
+                const args = GetProjectVariableSchema.parse(params.arguments);
+                const variable = await getProjectVariable(args.project_id, args.key, args.filter);
+                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+            }
+            case "create_project_variable": {
+                const args = CreateProjectVariableSchema.parse(params.arguments);
+                const { project_id, ...options } = args;
+                const variable = await createProjectVariable(project_id, options);
+                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+            }
+            case "update_project_variable": {
+                const args = UpdateProjectVariableSchema.parse(params.arguments);
+                const { project_id, key, ...options } = args;
+                const variable = await updateProjectVariable(project_id, key, options);
+                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+            }
+            case "delete_project_variable": {
+                const args = DeleteProjectVariableSchema.parse(params.arguments);
+                await deleteProjectVariable(args.project_id, args.key, args.filter);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({ status: "success", message: `Variable '${args.key}' deleted from project` }, null, 2),
+                        },
+                    ],
+                };
+            }
+            case "list_group_variables": {
+                rejectIfProjectScopedDeployment("list_group_variables");
+                const args = ListGroupVariablesSchema.parse(params.arguments);
+                const { group_id, ...options } = args;
+                const variables = await listGroupVariables(group_id, options);
+                return { content: [{ type: "text", text: JSON.stringify(variables, null, 2) }] };
+            }
+            case "get_group_variable": {
+                rejectIfProjectScopedDeployment("get_group_variable");
+                const args = GetGroupVariableSchema.parse(params.arguments);
+                const variable = await getGroupVariable(args.group_id, args.key, args.filter);
+                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+            }
+            case "create_group_variable": {
+                rejectIfProjectScopedDeployment("create_group_variable");
+                const args = CreateGroupVariableSchema.parse(params.arguments);
+                const { group_id, ...options } = args;
+                const variable = await createGroupVariable(group_id, options);
+                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+            }
+            case "update_group_variable": {
+                rejectIfProjectScopedDeployment("update_group_variable");
+                const args = UpdateGroupVariableSchema.parse(params.arguments);
+                const { group_id, key, ...options } = args;
+                const variable = await updateGroupVariable(group_id, key, options);
+                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+            }
+            case "delete_group_variable": {
+                rejectIfProjectScopedDeployment("delete_group_variable");
+                const args = DeleteGroupVariableSchema.parse(params.arguments);
+                await deleteGroupVariable(args.group_id, args.key, args.filter);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({ status: "success", message: `Variable '${args.key}' deleted from group` }, null, 2),
+                        },
+                    ],
+                };
+            }
             case "upload_markdown": {
                 if (IS_REMOTE) {
                     const args = MarkdownUploadRemoteSchema.parse(params.arguments);

package/build/schemas.js

@@ -3057,14 +3057,15 @@ export const GitLabTagSignatureSchema = z.object({
 // --- Work item schemas (GraphQL-based) ---
 // Case-insensitive work item type enum (accepts "ISSUE", "Issue", "issue")
 const workItemTypeEnum = z.string().transform(v => v.toLowerCase()).pipe(z.enum(["issue", "task", "incident", "test_case", "epic", "key_result", "objective", "requirement", "ticket"]));
+const ProjectIdOrPathSchema = z.coerce.string().describe("Project ID, URL-encoded project path, or group path (e.g. 'group/subgroup' for group-level work items)");
 // Common params for work item tools
 const WorkItemParamsSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID (IID) of the work item"),
 });
 export const GetWorkItemSchema = WorkItemParamsSchema;
 export const ListWorkItemsSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     types: z
         .array(workItemTypeEnum)
         .optional()
@@ -3096,7 +3097,7 @@ export const ListWorkItemsSchema = z.object({
         .describe("Cursor for pagination (from previous response's endCursor)"),
 });
 export const CreateWorkItemSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     title: z.string().describe("Title of the work item"),
     type: workItemTypeEnum
         .optional()
@@ -3166,38 +3167,38 @@ export const UpdateWorkItemSchema = WorkItemParamsSchema.extend({
         .describe("Incident only: set escalation status"),
 });
 export const ConvertWorkItemTypeSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
     new_type: workItemTypeEnum.describe("The target work item type to convert to"),
 });
 export const ListWorkItemStatusesSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     work_item_type: workItemTypeEnum
         .optional()
         .default("issue")
         .describe("The work item type to list available statuses for. Defaults to 'issue'."),
 });
 export const ListWorkItemNotesSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
     page_size: z.coerce.number().optional().default(20).describe("Number of discussions to return (default 20)"),
     after: z.string().optional().describe("Cursor for pagination"),
     sort: z.enum(["CREATED_ASC", "CREATED_DESC"]).optional().default("CREATED_ASC").describe("Sort order for discussions"),
 });
 export const CreateWorkItemNoteSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
     body: z.string().describe("Note body (Markdown supported)"),
     internal: z.coerce.boolean().optional().default(false).describe("Create as internal/confidential note (only visible to project members)"),
     discussion_id: z.string().optional().describe("Discussion ID to reply to (for threaded replies). If omitted, creates a new top-level note."),
 });
 export const MoveWorkItemSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path of the source project"),
+    project_id: z.coerce.string().describe("Project ID, URL-encoded project path, or group path of the source namespace"),
     iid: z.coerce.number().describe("The internal ID of the work item to move"),
-    target_project_id: z.coerce.string().describe("Project ID or URL-encoded path of the target project"),
+    target_project_id: z.coerce.string().describe("Project ID, URL-encoded project path, or group path of the target namespace"),
 });
 export const ListCustomFieldDefinitionsSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     work_item_type: workItemTypeEnum
         .optional()
         .default("issue")
@@ -3249,23 +3250,23 @@ export const DeleteIssueNoteEmojiReactionSchema = ProjectParamsSchema.extend({
 });
 // --- Emoji Reaction schemas (GraphQL: Work Items) ---
 export const CreateWorkItemEmojiReactionSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
     name: emojiNameField,
 });
 export const DeleteWorkItemEmojiReactionSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
     name: emojiNameField,
 });
 export const CreateWorkItemNoteEmojiReactionSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
     note_id: z.string().describe("The GraphQL GID of the note (e.g. 'gid://gitlab/Note/123' from list_work_item_notes)"),
     name: emojiNameField,
 });
 export const DeleteWorkItemNoteEmojiReactionSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
     note_id: z.string().describe("The GraphQL GID of the note (e.g. 'gid://gitlab/Note/123' from list_work_item_notes)"),
     name: emojiNameField,
@@ -3287,11 +3288,11 @@ export const ListIssueNoteEmojiReactionsSchema = ProjectParamsSchema.extend({
     discussion_id: noteEmojiDiscussionField,
 });
 export const ListWorkItemEmojiReactionsSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
 });
 export const ListWorkItemNoteEmojiReactionsSchema = z.object({
-    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    project_id: ProjectIdOrPathSchema,
     iid: z.coerce.number().describe("The internal ID of the work item"),
     note_id: z.string().describe("The GraphQL GID of the note (e.g. 'gid://gitlab/Note/123' from list_work_item_notes)"),
 });
@@ -3377,3 +3378,128 @@ export const GetWebhookEventSchema = z
     message: "Provide exactly one of project_id or group_id",
 });
 export const HealthCheckSchema = z.object({});
+// --- CI/CD Variable types ---
+export const GitLabCiVariableSchema = z.object({
+    variable_type: z.enum(["env_var", "file"]).optional(),
+    key: z.string(),
+    value: z.string().nullable(),
+    protected: z.boolean().optional(),
+    masked: z.boolean().optional(),
+    hidden: z.boolean().optional(),
+    raw: z.boolean().optional(),
+    environment_scope: z.string().optional(),
+    description: z.string().nullable().optional(),
+});
+const ciVariableFields = {
+    key: z.string().describe("The key of the variable (must match /[a-zA-Z0-9_]+/)"),
+    value: z.string().describe("The value of the variable"),
+    variable_type: z
+        .enum(["env_var", "file"])
+        .optional()
+        .describe("The type of variable: 'env_var' (default) or 'file'"),
+    protected: z
+        .boolean()
+        .optional()
+        .describe("Whether the variable is only available on protected branches/tags"),
+    masked: z.boolean().optional().describe("Whether the variable value is masked in job logs"),
+    raw: z.boolean().optional().describe("Whether the variable is not expanded (treated as raw string)"),
+    environment_scope: z
+        .string()
+        .optional()
+        .describe("Environment scope (e.g. '*', 'production'). Default: '*'"),
+    description: z.string().optional().describe("Description of the variable"),
+};
+export const ListProjectVariablesSchema = z
+    .object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    filter: z
+        .object({ environment_scope: z.string() })
+        .optional()
+        .describe("Filter by environment scope (e.g. '*', 'production')"),
+})
+    .merge(PaginationOptionsSchema);
+export const GetProjectVariableSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    key: z.string().describe("The key of the variable"),
+    filter: z
+        .object({ environment_scope: z.string() })
+        .optional()
+        .describe("Filter by environment scope"),
+});
+export const CreateProjectVariableSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    ...ciVariableFields,
+});
+export const UpdateProjectVariableSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    key: z.string().describe("The key of the variable to update"),
+    value: z.string().describe("The new value of the variable"),
+    variable_type: z.enum(["env_var", "file"]).optional().describe("The type of variable"),
+    protected: z.boolean().optional().describe("Whether the variable is protected"),
+    masked: z.boolean().optional().describe("Whether the variable value is masked in job logs"),
+    raw: z.boolean().optional().describe("Whether the variable is not expanded"),
+    environment_scope: z
+        .string()
+        .optional()
+        .describe("New environment scope to assign to the variable (renames the scope, e.g. '*', 'production'). Use filter.environment_scope to identify which variable to update when multiple share the same key."),
+    description: z.string().optional().describe("Description of the variable"),
+    filter: z
+        .object({ environment_scope: z.string() })
+        .optional()
+        .describe("Identifies which variable to update when multiple variables share the same key across different environment scopes"),
+});
+export const DeleteProjectVariableSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    key: z.string().describe("The key of the variable to delete"),
+    filter: z
+        .object({ environment_scope: z.string() })
+        .optional()
+        .describe("Filter by environment scope to disambiguate when multiple variables share the same key"),
+});
+export const ListGroupVariablesSchema = z
+    .object({
+    group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
+    filter: z
+        .object({ environment_scope: z.string() })
+        .optional()
+        .describe("Filter by environment scope (e.g. '*', 'production')"),
+})
+    .merge(PaginationOptionsSchema);
+export const GetGroupVariableSchema = z.object({
+    group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
+    key: z.string().describe("The key of the variable"),
+    filter: z
+        .object({ environment_scope: z.string() })
+        .optional()
+        .describe("Filter by environment scope"),
+});
+export const CreateGroupVariableSchema = z.object({
+    group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
+    ...ciVariableFields,
+});
+export const UpdateGroupVariableSchema = z.object({
+    group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
+    key: z.string().describe("The key of the variable to update"),
+    value: z.string().describe("The new value of the variable"),
+    variable_type: z.enum(["env_var", "file"]).optional().describe("The type of variable"),
+    protected: z.boolean().optional().describe("Whether the variable is protected"),
+    masked: z.boolean().optional().describe("Whether the variable value is masked in job logs"),
+    raw: z.boolean().optional().describe("Whether the variable is not expanded"),
+    environment_scope: z
+        .string()
+        .optional()
+        .describe("New environment scope to assign to the variable (renames the scope, e.g. '*', 'production'). Use filter.environment_scope to identify which variable to update when multiple share the same key."),
+    description: z.string().optional().describe("Description of the variable"),
+    filter: z
+        .object({ environment_scope: z.string() })
+        .optional()
+        .describe("Identifies which variable to update when multiple variables share the same key across different environment scopes"),
+});
+export const DeleteGroupVariableSchema = z.object({
+    group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
+    key: z.string().describe("The key of the variable to delete"),
+    filter: z
+        .object({ environment_scope: z.string() })
+        .optional()
+        .describe("Filter by environment scope to disambiguate when multiple variables share the same key"),
+});

package/build/test/test-ci-variables.js

@@ -0,0 +1,306 @@
+import { describe, test, before, after } from "node:test";
+import assert from "node:assert";
+import { spawn } from "child_process";
+import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
+const MOCK_TOKEN = "glpat-mock-token-ci-variables";
+const TEST_PROJECT_ID = "123";
+const TEST_GROUP_ID = "my-group";
+const TEST_VAR_KEY = "DB_URL";
+const TEST_GROUP_VAR_KEY = "SHARED_SECRET";
+const TEST_HIDDEN_VAR_KEY = "HIDDEN_VAR";
+const TEST_SCOPE = "production";
+const MOCK_PROJECT_VARIABLE = {
+    variable_type: "env_var",
+    key: TEST_VAR_KEY,
+    value: "postgres://localhost/db",
+    protected: false,
+    masked: true,
+    raw: false,
+    environment_scope: "*",
+    description: "Database connection URL",
+};
+const MOCK_GROUP_VARIABLE = {
+    variable_type: "env_var",
+    key: TEST_GROUP_VAR_KEY,
+    value: "s3cr3t",
+    protected: false,
+    masked: true,
+    raw: false,
+    environment_scope: "*",
+    description: null,
+};
+const MOCK_HIDDEN_PROJECT_VARIABLE = {
+    ...MOCK_PROJECT_VARIABLE,
+    key: TEST_HIDDEN_VAR_KEY,
+    value: null,
+    hidden: true,
+    description: null,
+};
+async function callTool(toolName, args, env) {
+    return new Promise((resolve, reject) => {
+        const proc = spawn("node", ["build/index.js"], {
+            stdio: ["pipe", "pipe", "pipe"],
+            env: { ...process.env, ...env },
+        });
+        let output = "";
+        let errorOutput = "";
+        proc.stdout?.on("data", (d) => (output += d));
+        proc.stderr?.on("data", (d) => (errorOutput += d));
+        proc.on("close", code => {
+            if (code !== 0) {
+                return reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
+            }
+            const line = output.split("\n").find(l => l.startsWith("{"));
+            if (!line)
+                return reject(new Error("No JSON output found"));
+            try {
+                const response = JSON.parse(line);
+                if (response.error) {
+                    reject(new Error(response.error?.message ?? String(response.error)));
+                }
+                else {
+                    const content = response.result?.content?.[0]?.text;
+                    resolve(content ? JSON.parse(content) : response.result);
+                }
+            }
+            catch (e) {
+                reject(e);
+            }
+        });
+        proc.stdin?.end(JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "tools/call",
+            params: { name: toolName, arguments: args },
+        }) + "\n");
+    });
+}
+describe("CI/CD variable tools", () => {
+    let mockServer;
+    let mockPort;
+    let baseEnv;
+    let lastReceivedFilterScope;
+    before(async () => {
+        mockPort = await findMockServerPort();
+        mockServer = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN] });
+        // --- Project variable endpoints ---
+        mockServer.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/variables`, (_req, res) => {
+            res.json([MOCK_PROJECT_VARIABLE]);
+        });
+        mockServer.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/variables/${TEST_VAR_KEY}`, (req, res) => {
+            const scope = req.query["filter[environment_scope]"];
+            lastReceivedFilterScope = scope;
+            res.json({ ...MOCK_PROJECT_VARIABLE, environment_scope: scope ?? "*" });
+        });
+        mockServer.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/variables/${TEST_HIDDEN_VAR_KEY}`, (_req, res) => {
+            res.json(MOCK_HIDDEN_PROJECT_VARIABLE);
+        });
+        mockServer.addMockHandler("post", `/projects/${TEST_PROJECT_ID}/variables`, (req, res) => {
+            res.status(201).json({ ...MOCK_PROJECT_VARIABLE, ...req.body });
+        });
+        mockServer.addMockHandler("put", `/projects/${TEST_PROJECT_ID}/variables/${TEST_VAR_KEY}`, (req, res) => {
+            const scope = req.query["filter[environment_scope]"];
+            lastReceivedFilterScope = scope;
+            res.json({ ...MOCK_PROJECT_VARIABLE, ...req.body, environment_scope: scope ?? "*" });
+        });
+        mockServer.addMockHandler("delete", `/projects/${TEST_PROJECT_ID}/variables/${TEST_VAR_KEY}`, (req, res) => {
+            lastReceivedFilterScope = req.query["filter[environment_scope]"];
+            res.status(204).send();
+        });
+        // --- Group variable endpoints ---
+        mockServer.addMockHandler("get", `/groups/${TEST_GROUP_ID}/variables`, (_req, res) => {
+            res.json([MOCK_GROUP_VARIABLE]);
+        });
+        mockServer.addMockHandler("get", `/groups/${TEST_GROUP_ID}/variables/${TEST_GROUP_VAR_KEY}`, (_req, res) => {
+            res.json(MOCK_GROUP_VARIABLE);
+        });
+        mockServer.addMockHandler("post", `/groups/${TEST_GROUP_ID}/variables`, (req, res) => {
+            res.status(201).json({ ...MOCK_GROUP_VARIABLE, ...req.body });
+        });
+        mockServer.addMockHandler("put", `/groups/${TEST_GROUP_ID}/variables/${TEST_GROUP_VAR_KEY}`, (req, res) => {
+            res.json({ ...MOCK_GROUP_VARIABLE, ...req.body });
+        });
+        mockServer.addMockHandler("delete", `/groups/${TEST_GROUP_ID}/variables/${TEST_GROUP_VAR_KEY}`, (_req, res) => {
+            res.status(204).send();
+        });
+        await mockServer.start();
+        baseEnv = {
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+            GITLAB_API_URL: `http://localhost:${mockPort}/api/v4`,
+            GITLAB_TOOLSETS: "variables",
+        };
+    });
+    after(async () => {
+        await mockServer.stop();
+    });
+    // --- Project variable tests ---
+    test("list_project_variables returns variable array", async () => {
+        const result = await callTool("list_project_variables", { project_id: TEST_PROJECT_ID }, baseEnv);
+        assert.ok(Array.isArray(result));
+        assert.strictEqual(result.length, 1);
+        assert.strictEqual(result[0].key, TEST_VAR_KEY);
+        assert.strictEqual(result[0].value, MOCK_PROJECT_VARIABLE.value);
+        assert.strictEqual(result[0].masked, true);
+    });
+    test("get_project_variable returns single variable", async () => {
+        const result = await callTool("get_project_variable", { project_id: TEST_PROJECT_ID, key: TEST_VAR_KEY }, baseEnv);
+        assert.strictEqual(result.key, TEST_VAR_KEY);
+        assert.strictEqual(result.environment_scope, "*");
+        assert.strictEqual(result.variable_type, "env_var");
+    });
+    test("get_project_variable returns hidden variable with null value", async () => {
+        const result = await callTool("get_project_variable", { project_id: TEST_PROJECT_ID, key: TEST_HIDDEN_VAR_KEY }, baseEnv);
+        assert.strictEqual(result.key, TEST_HIDDEN_VAR_KEY);
+        assert.strictEqual(result.value, null);
+        assert.strictEqual(result.hidden, true);
+    });
+    test("create_project_variable returns created variable", async () => {
+        const result = await callTool("create_project_variable", {
+            project_id: TEST_PROJECT_ID,
+            key: TEST_VAR_KEY,
+            value: "new-value",
+            masked: true,
+        }, baseEnv);
+        assert.strictEqual(result.key, TEST_VAR_KEY);
+        assert.strictEqual(result.value, "new-value");
+    });
+    test("update_project_variable returns updated variable", async () => {
+        const result = await callTool("update_project_variable", {
+            project_id: TEST_PROJECT_ID,
+            key: TEST_VAR_KEY,
+            value: "updated-value",
+        }, baseEnv);
+        assert.strictEqual(result.value, "updated-value");
+    });
+    test("delete_project_variable returns success status", async () => {
+        const result = await callTool("delete_project_variable", { project_id: TEST_PROJECT_ID, key: TEST_VAR_KEY }, baseEnv);
+        assert.strictEqual(result.status, "success");
+        assert.ok(result.message.includes(TEST_VAR_KEY));
+    });
+    // --- Group variable tests ---
+    test("list_group_variables returns variable array", async () => {
+        const result = await callTool("list_group_variables", { group_id: TEST_GROUP_ID }, baseEnv);
+        assert.ok(Array.isArray(result));
+        assert.strictEqual(result.length, 1);
+        assert.strictEqual(result[0].key, TEST_GROUP_VAR_KEY);
+        assert.strictEqual(result[0].masked, true);
+    });
+    test("get_group_variable returns single variable", async () => {
+        const result = await callTool("get_group_variable", { group_id: TEST_GROUP_ID, key: TEST_GROUP_VAR_KEY }, baseEnv);
+        assert.strictEqual(result.key, TEST_GROUP_VAR_KEY);
+        assert.strictEqual(result.variable_type, "env_var");
+    });
+    test("create_group_variable returns created variable", async () => {
+        const result = await callTool("create_group_variable", {
+            group_id: TEST_GROUP_ID,
+            key: TEST_GROUP_VAR_KEY,
+            value: "new-secret",
+            masked: true,
+        }, baseEnv);
+        assert.strictEqual(result.key, TEST_GROUP_VAR_KEY);
+        assert.strictEqual(result.value, "new-secret");
+    });
+    test("update_group_variable returns updated variable", async () => {
+        const result = await callTool("update_group_variable", {
+            group_id: TEST_GROUP_ID,
+            key: TEST_GROUP_VAR_KEY,
+            value: "updated-secret",
+        }, baseEnv);
+        assert.strictEqual(result.value, "updated-secret");
+    });
+    test("delete_group_variable returns success status", async () => {
+        const result = await callTool("delete_group_variable", { group_id: TEST_GROUP_ID, key: TEST_GROUP_VAR_KEY }, baseEnv);
+        assert.strictEqual(result.status, "success");
+        assert.ok(result.message.includes(TEST_GROUP_VAR_KEY));
+    });
+    // --- filter[environment_scope] tests ---
+    test("get_project_variable passes filter[environment_scope] to GitLab", async () => {
+        lastReceivedFilterScope = undefined;
+        const result = await callTool("get_project_variable", { project_id: TEST_PROJECT_ID, key: TEST_VAR_KEY, filter: { environment_scope: TEST_SCOPE } }, baseEnv);
+        assert.strictEqual(lastReceivedFilterScope, TEST_SCOPE);
+        assert.strictEqual(result.environment_scope, TEST_SCOPE);
+    });
+    test("update_project_variable passes filter[environment_scope] to GitLab", async () => {
+        lastReceivedFilterScope = undefined;
+        const result = await callTool("update_project_variable", {
+            project_id: TEST_PROJECT_ID,
+            key: TEST_VAR_KEY,
+            value: "scoped-value",
+            filter: { environment_scope: TEST_SCOPE },
+        }, baseEnv);
+        assert.strictEqual(lastReceivedFilterScope, TEST_SCOPE);
+        assert.strictEqual(result.environment_scope, TEST_SCOPE);
+    });
+    test("delete_project_variable passes filter[environment_scope] to GitLab", async () => {
+        lastReceivedFilterScope = undefined;
+        const result = await callTool("delete_project_variable", { project_id: TEST_PROJECT_ID, key: TEST_VAR_KEY, filter: { environment_scope: TEST_SCOPE } }, baseEnv);
+        assert.strictEqual(lastReceivedFilterScope, TEST_SCOPE);
+        assert.strictEqual(result.status, "success");
+    });
+    // --- Toolset behaviour ---
+    test("variables tools are absent when toolset is not activated", async () => {
+        return new Promise((resolve, reject) => {
+            const proc = spawn("node", ["build/index.js"], {
+                stdio: ["pipe", "pipe", "pipe"],
+                env: {
+                    ...process.env,
+                    GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+                    GITLAB_API_URL: `http://localhost:${mockPort}/api/v4`,
+                    // No GITLAB_TOOLSETS — default toolsets only
+                },
+            });
+            let output = "";
+            proc.stdout?.on("data", (d) => (output += d));
+            proc.on("close", () => {
+                try {
+                    const line = output.split("\n").find(l => l.startsWith("{"));
+                    if (!line)
+                        return reject(new Error("No JSON output found"));
+                    const response = JSON.parse(line);
+                    const names = (response.result?.tools ?? []).map((t) => t.name);
+                    assert.ok(!names.includes("list_project_variables"), "tool should not be in default toolset");
+                    assert.ok(!names.includes("create_project_variable"), "tool should not be in default toolset");
+                    assert.ok(!names.includes("list_group_variables"), "tool should not be in default toolset");
+                    resolve();
+                }
+                catch (e) {
+                    reject(e);
+                }
+            });
+            proc.stdin?.end(JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list", params: {} }) + "\n");
+        });
+    });
+    test("write tools are absent from tools/list in read-only mode", async () => {
+        return new Promise((resolve, reject) => {
+            const proc = spawn("node", ["build/index.js"], {
+                stdio: ["pipe", "pipe", "pipe"],
+                env: { ...process.env, ...baseEnv, GITLAB_READ_ONLY_MODE: "true" },
+            });
+            let output = "";
+            proc.stdout?.on("data", (d) => (output += d));
+            proc.on("close", () => {
+                try {
+                    const line = output.split("\n").find(l => l.startsWith("{"));
+                    if (!line)
+                        return reject(new Error("No JSON output found"));
+                    const response = JSON.parse(line);
+                    const names = (response.result?.tools ?? []).map((t) => t.name);
+                    assert.ok(!names.includes("create_project_variable"), "create should be absent in read-only mode");
+                    assert.ok(!names.includes("update_project_variable"), "update should be absent in read-only mode");
+                    assert.ok(!names.includes("delete_project_variable"), "delete should be absent in read-only mode");
+                    assert.ok(!names.includes("create_group_variable"), "create should be absent in read-only mode");
+                    assert.ok(!names.includes("delete_group_variable"), "delete should be absent in read-only mode");
+                    assert.ok(names.includes("list_project_variables"), "list should be present in read-only mode");
+                    assert.ok(names.includes("get_project_variable"), "get should be present in read-only mode");
+                    assert.ok(names.includes("list_group_variables"), "list should be present in read-only mode");
+                    assert.ok(names.includes("get_group_variable"), "get should be present in read-only mode");
+                    resolve();
+                }
+                catch (e) {
+                    reject(e);
+                }
+            });
+            proc.stdin?.end(JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list", params: {} }) + "\n");
+        });
+    });
+});

package/build/test/test-geteffectiveprojectid.js

@@ -271,6 +271,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                     REMOTE_AUTHORIZATION: 'true',
                     GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
                     GITLAB_PROJECT_ID: DEFAULT_PROJECT_ID,
+                    GITLAB_TOOLSETS: 'variables',
                 }
             });
             servers.push(server);
@@ -317,6 +318,26 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                 assert.ok(error.message.includes('create_group is not allowed'), 'Should mention create_group');
             }
         });
+        test('should reject list_group_variables when GITLAB_PROJECT_ID is set', async () => {
+            try {
+                await client.callTool('list_group_variables', { group_id: 'my-group' });
+                assert.fail('Should have rejected list_group_variables');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('list_group_variables is not allowed'), 'Should mention list_group_variables');
+            }
+        });
+        test('should reject get_group_variable when GITLAB_PROJECT_ID is set', async () => {
+            try {
+                await client.callTool('get_group_variable', { group_id: 'my-group', key: 'SHARED_SECRET' });
+                assert.fail('Should have rejected get_group_variable');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('get_group_variable is not allowed'), 'Should mention get_group_variable');
+            }
+        });
         test('should allow get_project (non-mutator) when GITLAB_PROJECT_ID is set', async () => {
             const result = await client.callTool('get_project', { project_id: '' });
             assert.ok(result.content, 'Should have content');
@@ -348,6 +369,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                     REMOTE_AUTHORIZATION: 'true',
                     GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
                     GITLAB_ALLOWED_PROJECT_IDS: DEFAULT_PROJECT_ID,
+                    GITLAB_TOOLSETS: 'variables',
                 }
             });
             servers.push(server);
@@ -394,6 +416,26 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                 assert.ok(error.message.includes('create_group is not allowed'), 'Should mention create_group');
             }
         });
+        test('should reject list_group_variables with GITLAB_ALLOWED_PROJECT_IDS', async () => {
+            try {
+                await client.callTool('list_group_variables', { group_id: 'my-group' });
+                assert.fail('Should have rejected list_group_variables');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('list_group_variables is not allowed'), 'Should mention list_group_variables');
+            }
+        });
+        test('should reject get_group_variable with GITLAB_ALLOWED_PROJECT_IDS', async () => {
+            try {
+                await client.callTool('get_group_variable', { group_id: 'my-group', key: 'SHARED_SECRET' });
+                assert.fail('Should have rejected get_group_variable');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('get_group_variable is not allowed'), 'Should mention get_group_variable');
+            }
+        });
         test('should allow get_project (non-mutator) with GITLAB_ALLOWED_PROJECT_IDS', async () => {
             const result = await client.callTool('get_project', { project_id: '' });
             assert.ok(result.content, 'Should have content');

package/build/test/test-toolset-filtering.js

@@ -33,6 +33,7 @@ const TOOLSET_TOOL_COUNTS = {
     workitems: 18,
     webhooks: 3,
     groups: 1,
+    variables: 10,
 };
 const LEGACY_PIPELINE_TOOL_COUNT = TOOLSET_TOOL_COUNTS.pipelines + TOOLSET_TOOL_COUNTS.ci;
 const DEFAULT_TOOLSETS = [
@@ -55,6 +56,7 @@ const NON_DEFAULT_TOOLSETS = [
     "workitems",
     "webhooks",
     "search",
+    "variables",
 ];
 // discover_tools meta-tool is always force-injected (Step 5.5)
 const DISCOVER_TOOLS_COUNT = 1;
@@ -78,6 +80,7 @@ const TOOLSET_SAMPLE_TOOLS = {
     search: ["search_code", "search_project_code", "search_group_code"],
     webhooks: ["list_webhooks", "list_webhook_events", "get_webhook_event"],
     groups: ["create_group"],
+    variables: ["list_project_variables", "create_project_variable", "delete_project_variable", "list_group_variables", "create_group_variable", "delete_group_variable"],
 };
 // --- Helpers ---
 async function launchMcpServer(mockGitLabUrl, mcpPort, extraEnv = {}) {

package/build/tools/registry.js

@@ -1,7 +1,7 @@
 import { zodToJsonSchema } from "zod-to-json-schema";
 import { toJSONSchema } from "../utils/schema.js";
 import { USE_GITLAB_WIKI, USE_MILESTONE, USE_PIPELINE, SSE, STREAMABLE_HTTP, } from "../config.js";
-import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteBranchSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadAttachmentRemoteSchema, DownloadJobArtifactsSchema, DownloadJobArtifactsRemoteSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, HealthCheckSchema, GetBranchSchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GetDeploymentSchema, GetDraftNoteSchema, GetEnvironmentSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, GetPipelineSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetTimelineEventsSchema, GetUsersSchema, GetUserSchema, WhoAmISchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListBranchesSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListPipelinesSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, } from "../schemas.js";
+import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteBranchSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadAttachmentRemoteSchema, DownloadJobArtifactsSchema, DownloadJobArtifactsRemoteSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, HealthCheckSchema, GetBranchSchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GetDeploymentSchema, GetDraftNoteSchema, GetEnvironmentSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, GetPipelineSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetTimelineEventsSchema, GetUsersSchema, GetUserSchema, WhoAmISchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListBranchesSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListPipelinesSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, } from "../schemas.js";
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
 // Define all available tools
 export const allTools = [
@@ -931,6 +931,57 @@ export const allTools = [
         description: "Search for code within a specific group (requires advanced search or Zoekt)",
         inputSchema: toJSONSchema(SearchGroupCodeSchema),
     },
+    // --- CI/CD Variable tools ---
+    {
+        name: "list_project_variables",
+        description: "List CI/CD variables for a project",
+        inputSchema: toJSONSchema(ListProjectVariablesSchema),
+    },
+    {
+        name: "get_project_variable",
+        description: "Get a single CI/CD variable from a project",
+        inputSchema: toJSONSchema(GetProjectVariableSchema),
+    },
+    {
+        name: "create_project_variable",
+        description: "Create a CI/CD variable for a project",
+        inputSchema: toJSONSchema(CreateProjectVariableSchema),
+    },
+    {
+        name: "update_project_variable",
+        description: "Update an existing CI/CD variable in a project",
+        inputSchema: toJSONSchema(UpdateProjectVariableSchema),
+    },
+    {
+        name: "delete_project_variable",
+        description: "Delete a CI/CD variable from a project",
+        inputSchema: toJSONSchema(DeleteProjectVariableSchema),
+    },
+    {
+        name: "list_group_variables",
+        description: "List CI/CD variables for a group",
+        inputSchema: toJSONSchema(ListGroupVariablesSchema),
+    },
+    {
+        name: "get_group_variable",
+        description: "Get a single CI/CD variable from a group",
+        inputSchema: toJSONSchema(GetGroupVariableSchema),
+    },
+    {
+        name: "create_group_variable",
+        description: "Create a CI/CD variable for a group",
+        inputSchema: toJSONSchema(CreateGroupVariableSchema),
+    },
+    {
+        name: "update_group_variable",
+        description: "Update an existing CI/CD variable in a group",
+        inputSchema: toJSONSchema(UpdateGroupVariableSchema),
+    },
+    {
+        name: "delete_group_variable",
+        description: "Delete a CI/CD variable from a group",
+        inputSchema: toJSONSchema(DeleteGroupVariableSchema),
+    },
     // --- Meta tool: Dynamic tool discovery ---
     {
         name: "discover_tools",
@@ -1050,6 +1101,10 @@ export const readOnlyTools = new Set([
     "list_webhooks",
     "list_webhook_events",
     "get_webhook_event",
+    "list_project_variables",
+    "get_project_variable",
+    "list_group_variables",
+    "get_group_variable",
 ]);
 // Define which tools are destructive (data loss potential)
 export const destructiveTools = new Set([
@@ -1073,7 +1128,8 @@ export const destructiveTools = new Set([
     "delete_branch",
     "merge_merge_request",
     "push_files",
-    "delete_branch",
+    "delete_project_variable",
+    "delete_group_variable",
 ]);
 // Define which tools are related to wiki and can be toggled by USE_GITLAB_WIKI
 export const wikiToolNames = new Set([
@@ -1401,6 +1457,22 @@ export const TOOLSET_DEFINITIONS = [
         isDefault: false,
         tools: new Set(["search_code", "search_project_code", "search_group_code"]),
     },
+    {
+        id: "variables",
+        isDefault: false,
+        tools: new Set([
+            "list_project_variables",
+            "get_project_variable",
+            "create_project_variable",
+            "update_project_variable",
+            "delete_project_variable",
+            "list_group_variables",
+            "get_group_variable",
+            "create_group_variable",
+            "update_group_variable",
+            "delete_group_variable",
+        ]),
+    },
 ];
 // Derived lookup: tool name → toolset ID
 export const TOOLSET_BY_TOOL_NAME = new Map();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.16",
+  "version": "2.1.17",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
@@ -51,7 +51,7 @@
     "changelog": "auto-changelog -p",
     "test": "npm run test:all",
     "test:all": "npm run build && npm run test:mock && npm run test:live",
-    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts",
+    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts && node --import tsx/esm --test test/test-ci-variables.ts",
     "test:stateless": "npm run build && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts",
     "test:mcp-oauth": "npm run build && node --import tsx/esm --test test/mcp-oauth-tests.ts",
     "test:live": "node test/validate-api.js",