@zereight/mcp-gitlab 2.1.16 → 2.1.18

package/build/test/test-ci-variables.js

@@ -0,0 +1,306 @@
+import { describe, test, before, after } from "node:test";
+import assert from "node:assert";
+import { spawn } from "child_process";
+import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
+const MOCK_TOKEN = "glpat-mock-token-ci-variables";
+const TEST_PROJECT_ID = "123";
+const TEST_GROUP_ID = "my-group";
+const TEST_VAR_KEY = "DB_URL";
+const TEST_GROUP_VAR_KEY = "SHARED_SECRET";
+const TEST_HIDDEN_VAR_KEY = "HIDDEN_VAR";
+const TEST_SCOPE = "production";
+const MOCK_PROJECT_VARIABLE = {
+    variable_type: "env_var",
+    key: TEST_VAR_KEY,
+    value: "postgres://localhost/db",
+    protected: false,
+    masked: true,
+    raw: false,
+    environment_scope: "*",
+    description: "Database connection URL",
+};
+const MOCK_GROUP_VARIABLE = {
+    variable_type: "env_var",
+    key: TEST_GROUP_VAR_KEY,
+    value: "s3cr3t",
+    protected: false,
+    masked: true,
+    raw: false,
+    environment_scope: "*",
+    description: null,
+};
+const MOCK_HIDDEN_PROJECT_VARIABLE = {
+    ...MOCK_PROJECT_VARIABLE,
+    key: TEST_HIDDEN_VAR_KEY,
+    value: null,
+    hidden: true,
+    description: null,
+};
+async function callTool(toolName, args, env) {
+    return new Promise((resolve, reject) => {
+        const proc = spawn("node", ["build/index.js"], {
+            stdio: ["pipe", "pipe", "pipe"],
+            env: { ...process.env, ...env },
+        });
+        let output = "";
+        let errorOutput = "";
+        proc.stdout?.on("data", (d) => (output += d));
+        proc.stderr?.on("data", (d) => (errorOutput += d));
+        proc.on("close", code => {
+            if (code !== 0) {
+                return reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
+            }
+            const line = output.split("\n").find(l => l.startsWith("{"));
+            if (!line)
+                return reject(new Error("No JSON output found"));
+            try {
+                const response = JSON.parse(line);
+                if (response.error) {
+                    reject(new Error(response.error?.message ?? String(response.error)));
+                }
+                else {
+                    const content = response.result?.content?.[0]?.text;
+                    resolve(content ? JSON.parse(content) : response.result);
+                }
+            }
+            catch (e) {
+                reject(e);
+            }
+        });
+        proc.stdin?.end(JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "tools/call",
+            params: { name: toolName, arguments: args },
+        }) + "\n");
+    });
+}
+describe("CI/CD variable tools", () => {
+    let mockServer;
+    let mockPort;
+    let baseEnv;
+    let lastReceivedFilterScope;
+    before(async () => {
+        mockPort = await findMockServerPort();
+        mockServer = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN] });
+        // --- Project variable endpoints ---
+        mockServer.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/variables`, (_req, res) => {
+            res.json([MOCK_PROJECT_VARIABLE]);
+        });
+        mockServer.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/variables/${TEST_VAR_KEY}`, (req, res) => {
+            const scope = req.query["filter[environment_scope]"];
+            lastReceivedFilterScope = scope;
+            res.json({ ...MOCK_PROJECT_VARIABLE, environment_scope: scope ?? "*" });
+        });
+        mockServer.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/variables/${TEST_HIDDEN_VAR_KEY}`, (_req, res) => {
+            res.json(MOCK_HIDDEN_PROJECT_VARIABLE);
+        });
+        mockServer.addMockHandler("post", `/projects/${TEST_PROJECT_ID}/variables`, (req, res) => {
+            res.status(201).json({ ...MOCK_PROJECT_VARIABLE, ...req.body });
+        });
+        mockServer.addMockHandler("put", `/projects/${TEST_PROJECT_ID}/variables/${TEST_VAR_KEY}`, (req, res) => {
+            const scope = req.query["filter[environment_scope]"];
+            lastReceivedFilterScope = scope;
+            res.json({ ...MOCK_PROJECT_VARIABLE, ...req.body, environment_scope: scope ?? "*" });
+        });
+        mockServer.addMockHandler("delete", `/projects/${TEST_PROJECT_ID}/variables/${TEST_VAR_KEY}`, (req, res) => {
+            lastReceivedFilterScope = req.query["filter[environment_scope]"];
+            res.status(204).send();
+        });
+        // --- Group variable endpoints ---
+        mockServer.addMockHandler("get", `/groups/${TEST_GROUP_ID}/variables`, (_req, res) => {
+            res.json([MOCK_GROUP_VARIABLE]);
+        });
+        mockServer.addMockHandler("get", `/groups/${TEST_GROUP_ID}/variables/${TEST_GROUP_VAR_KEY}`, (_req, res) => {
+            res.json(MOCK_GROUP_VARIABLE);
+        });
+        mockServer.addMockHandler("post", `/groups/${TEST_GROUP_ID}/variables`, (req, res) => {
+            res.status(201).json({ ...MOCK_GROUP_VARIABLE, ...req.body });
+        });
+        mockServer.addMockHandler("put", `/groups/${TEST_GROUP_ID}/variables/${TEST_GROUP_VAR_KEY}`, (req, res) => {
+            res.json({ ...MOCK_GROUP_VARIABLE, ...req.body });
+        });
+        mockServer.addMockHandler("delete", `/groups/${TEST_GROUP_ID}/variables/${TEST_GROUP_VAR_KEY}`, (_req, res) => {
+            res.status(204).send();
+        });
+        await mockServer.start();
+        baseEnv = {
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+            GITLAB_API_URL: `http://localhost:${mockPort}/api/v4`,
+            GITLAB_TOOLSETS: "variables",
+        };
+    });
+    after(async () => {
+        await mockServer.stop();
+    });
+    // --- Project variable tests ---
+    test("list_project_variables returns variable array", async () => {
+        const result = await callTool("list_project_variables", { project_id: TEST_PROJECT_ID }, baseEnv);
+        assert.ok(Array.isArray(result));
+        assert.strictEqual(result.length, 1);
+        assert.strictEqual(result[0].key, TEST_VAR_KEY);
+        assert.strictEqual(result[0].value, MOCK_PROJECT_VARIABLE.value);
+        assert.strictEqual(result[0].masked, true);
+    });
+    test("get_project_variable returns single variable", async () => {
+        const result = await callTool("get_project_variable", { project_id: TEST_PROJECT_ID, key: TEST_VAR_KEY }, baseEnv);
+        assert.strictEqual(result.key, TEST_VAR_KEY);
+        assert.strictEqual(result.environment_scope, "*");
+        assert.strictEqual(result.variable_type, "env_var");
+    });
+    test("get_project_variable returns hidden variable with null value", async () => {
+        const result = await callTool("get_project_variable", { project_id: TEST_PROJECT_ID, key: TEST_HIDDEN_VAR_KEY }, baseEnv);
+        assert.strictEqual(result.key, TEST_HIDDEN_VAR_KEY);
+        assert.strictEqual(result.value, null);
+        assert.strictEqual(result.hidden, true);
+    });
+    test("create_project_variable returns created variable", async () => {
+        const result = await callTool("create_project_variable", {
+            project_id: TEST_PROJECT_ID,
+            key: TEST_VAR_KEY,
+            value: "new-value",
+            masked: true,
+        }, baseEnv);
+        assert.strictEqual(result.key, TEST_VAR_KEY);
+        assert.strictEqual(result.value, "new-value");
+    });
+    test("update_project_variable returns updated variable", async () => {
+        const result = await callTool("update_project_variable", {
+            project_id: TEST_PROJECT_ID,
+            key: TEST_VAR_KEY,
+            value: "updated-value",
+        }, baseEnv);
+        assert.strictEqual(result.value, "updated-value");
+    });
+    test("delete_project_variable returns success status", async () => {
+        const result = await callTool("delete_project_variable", { project_id: TEST_PROJECT_ID, key: TEST_VAR_KEY }, baseEnv);
+        assert.strictEqual(result.status, "success");
+        assert.ok(result.message.includes(TEST_VAR_KEY));
+    });
+    // --- Group variable tests ---
+    test("list_group_variables returns variable array", async () => {
+        const result = await callTool("list_group_variables", { group_id: TEST_GROUP_ID }, baseEnv);
+        assert.ok(Array.isArray(result));
+        assert.strictEqual(result.length, 1);
+        assert.strictEqual(result[0].key, TEST_GROUP_VAR_KEY);
+        assert.strictEqual(result[0].masked, true);
+    });
+    test("get_group_variable returns single variable", async () => {
+        const result = await callTool("get_group_variable", { group_id: TEST_GROUP_ID, key: TEST_GROUP_VAR_KEY }, baseEnv);
+        assert.strictEqual(result.key, TEST_GROUP_VAR_KEY);
+        assert.strictEqual(result.variable_type, "env_var");
+    });
+    test("create_group_variable returns created variable", async () => {
+        const result = await callTool("create_group_variable", {
+            group_id: TEST_GROUP_ID,
+            key: TEST_GROUP_VAR_KEY,
+            value: "new-secret",
+            masked: true,
+        }, baseEnv);
+        assert.strictEqual(result.key, TEST_GROUP_VAR_KEY);
+        assert.strictEqual(result.value, "new-secret");
+    });
+    test("update_group_variable returns updated variable", async () => {
+        const result = await callTool("update_group_variable", {
+            group_id: TEST_GROUP_ID,
+            key: TEST_GROUP_VAR_KEY,
+            value: "updated-secret",
+        }, baseEnv);
+        assert.strictEqual(result.value, "updated-secret");
+    });
+    test("delete_group_variable returns success status", async () => {
+        const result = await callTool("delete_group_variable", { group_id: TEST_GROUP_ID, key: TEST_GROUP_VAR_KEY }, baseEnv);
+        assert.strictEqual(result.status, "success");
+        assert.ok(result.message.includes(TEST_GROUP_VAR_KEY));
+    });
+    // --- filter[environment_scope] tests ---
+    test("get_project_variable passes filter[environment_scope] to GitLab", async () => {
+        lastReceivedFilterScope = undefined;
+        const result = await callTool("get_project_variable", { project_id: TEST_PROJECT_ID, key: TEST_VAR_KEY, filter: { environment_scope: TEST_SCOPE } }, baseEnv);
+        assert.strictEqual(lastReceivedFilterScope, TEST_SCOPE);
+        assert.strictEqual(result.environment_scope, TEST_SCOPE);
+    });
+    test("update_project_variable passes filter[environment_scope] to GitLab", async () => {
+        lastReceivedFilterScope = undefined;
+        const result = await callTool("update_project_variable", {
+            project_id: TEST_PROJECT_ID,
+            key: TEST_VAR_KEY,
+            value: "scoped-value",
+            filter: { environment_scope: TEST_SCOPE },
+        }, baseEnv);
+        assert.strictEqual(lastReceivedFilterScope, TEST_SCOPE);
+        assert.strictEqual(result.environment_scope, TEST_SCOPE);
+    });
+    test("delete_project_variable passes filter[environment_scope] to GitLab", async () => {
+        lastReceivedFilterScope = undefined;
+        const result = await callTool("delete_project_variable", { project_id: TEST_PROJECT_ID, key: TEST_VAR_KEY, filter: { environment_scope: TEST_SCOPE } }, baseEnv);
+        assert.strictEqual(lastReceivedFilterScope, TEST_SCOPE);
+        assert.strictEqual(result.status, "success");
+    });
+    // --- Toolset behaviour ---
+    test("variables tools are absent when toolset is not activated", async () => {
+        return new Promise((resolve, reject) => {
+            const proc = spawn("node", ["build/index.js"], {
+                stdio: ["pipe", "pipe", "pipe"],
+                env: {
+                    ...process.env,
+                    GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+                    GITLAB_API_URL: `http://localhost:${mockPort}/api/v4`,
+                    // No GITLAB_TOOLSETS — default toolsets only
+                },
+            });
+            let output = "";
+            proc.stdout?.on("data", (d) => (output += d));
+            proc.on("close", () => {
+                try {
+                    const line = output.split("\n").find(l => l.startsWith("{"));
+                    if (!line)
+                        return reject(new Error("No JSON output found"));
+                    const response = JSON.parse(line);
+                    const names = (response.result?.tools ?? []).map((t) => t.name);
+                    assert.ok(!names.includes("list_project_variables"), "tool should not be in default toolset");
+                    assert.ok(!names.includes("create_project_variable"), "tool should not be in default toolset");
+                    assert.ok(!names.includes("list_group_variables"), "tool should not be in default toolset");
+                    resolve();
+                }
+                catch (e) {
+                    reject(e);
+                }
+            });
+            proc.stdin?.end(JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list", params: {} }) + "\n");
+        });
+    });
+    test("write tools are absent from tools/list in read-only mode", async () => {
+        return new Promise((resolve, reject) => {
+            const proc = spawn("node", ["build/index.js"], {
+                stdio: ["pipe", "pipe", "pipe"],
+                env: { ...process.env, ...baseEnv, GITLAB_READ_ONLY_MODE: "true" },
+            });
+            let output = "";
+            proc.stdout?.on("data", (d) => (output += d));
+            proc.on("close", () => {
+                try {
+                    const line = output.split("\n").find(l => l.startsWith("{"));
+                    if (!line)
+                        return reject(new Error("No JSON output found"));
+                    const response = JSON.parse(line);
+                    const names = (response.result?.tools ?? []).map((t) => t.name);
+                    assert.ok(!names.includes("create_project_variable"), "create should be absent in read-only mode");
+                    assert.ok(!names.includes("update_project_variable"), "update should be absent in read-only mode");
+                    assert.ok(!names.includes("delete_project_variable"), "delete should be absent in read-only mode");
+                    assert.ok(!names.includes("create_group_variable"), "create should be absent in read-only mode");
+                    assert.ok(!names.includes("delete_group_variable"), "delete should be absent in read-only mode");
+                    assert.ok(names.includes("list_project_variables"), "list should be present in read-only mode");
+                    assert.ok(names.includes("get_project_variable"), "get should be present in read-only mode");
+                    assert.ok(names.includes("list_group_variables"), "list should be present in read-only mode");
+                    assert.ok(names.includes("get_group_variable"), "get should be present in read-only mode");
+                    resolve();
+                }
+                catch (e) {
+                    reject(e);
+                }
+            });
+            proc.stdin?.end(JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list", params: {} }) + "\n");
+        });
+    });
+});

package/build/test/test-dependency-proxy.js

@@ -0,0 +1,191 @@
+import { describe, test, before, after } from "node:test";
+import assert from "node:assert";
+import { spawn } from "child_process";
+import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
+const MOCK_TOKEN = "glpat-mock-token-dependency-proxy";
+const TEST_GROUP_PATH = "my-group";
+async function callTool(toolName, args, env) {
+    return new Promise((resolve, reject) => {
+        const proc = spawn("node", ["build/index.js"], {
+            stdio: ["pipe", "pipe", "pipe"],
+            env: { ...process.env, ...env },
+        });
+        let output = "";
+        let errorOutput = "";
+        proc.stdout?.on("data", (d) => (output += d));
+        proc.stderr?.on("data", (d) => (errorOutput += d));
+        proc.on("close", code => {
+            if (code !== 0) {
+                return reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
+            }
+            const line = output.split("\n").find(l => l.startsWith("{"));
+            if (!line)
+                return reject(new Error("No JSON output found"));
+            try {
+                const response = JSON.parse(line);
+                if (response.error) {
+                    reject(new Error(response.error?.message ?? String(response.error)));
+                }
+                else {
+                    const content = response.result?.content?.[0]?.text;
+                    resolve(content ? JSON.parse(content) : response.result);
+                }
+            }
+            catch (e) {
+                reject(e);
+            }
+        });
+        proc.stdin?.end(JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "tools/call",
+            params: { name: toolName, arguments: args },
+        }) + "\n");
+    });
+}
+describe("dependency proxy tools", () => {
+    let mockServer;
+    let mockPort;
+    let baseEnv;
+    before(async () => {
+        mockPort = await findMockServerPort();
+        mockServer = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN] });
+        // Mock GraphQL endpoint for get/list operations
+        mockServer.addRootHandler("post", "/api/graphql", (req, res) => {
+            const { query } = req.body;
+            if (query.includes("updateDependencyProxySettings")) {
+                res.json({ data: { updateDependencyProxySettings: { errors: [] } } });
+            }
+            else if (query.includes("dependencyProxySetting")) {
+                res.json({
+                    data: {
+                        group: {
+                            dependencyProxySetting: { enabled: true },
+                            dependencyProxyBlobCount: 3,
+                            dependencyProxyTotalSize: "15728640",
+                            dependencyProxyImagePrefix: `localhost:${mockPort}/my-group/dependency_proxy/containers`,
+                            dependencyProxyImageTtlPolicy: { enabled: true, ttl: 90 },
+                        },
+                    },
+                });
+            }
+            else if (query.includes("dependencyProxyBlobs")) {
+                res.json({
+                    data: {
+                        group: {
+                            dependencyProxyBlobs: {
+                                nodes: [
+                                    { fileName: "sha256:abc123", size: "5 MiB", createdAt: "2026-01-01T00:00:00Z" },
+                                    { fileName: "sha256:def456", size: "10 MiB", createdAt: "2026-01-02T00:00:00Z" },
+                                ],
+                                pageInfo: { hasNextPage: false, endCursor: null },
+                            },
+                        },
+                    },
+                });
+            }
+            else {
+                res.status(400).json({ errors: [{ message: "Unexpected GraphQL query" }] });
+            }
+        });
+        // Mock REST endpoint for purge
+        mockServer.addMockHandler("delete", `/groups/${TEST_GROUP_PATH}/dependency_proxy/cache`, (_req, res) => {
+            res.status(202).send();
+        });
+        await mockServer.start();
+        baseEnv = {
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+            GITLAB_API_URL: `http://localhost:${mockPort}/api/v4`,
+            GITLAB_TOOLSETS: "dependency_proxy",
+        };
+    });
+    after(async () => {
+        await mockServer.stop();
+    });
+    test("get_dependency_proxy_settings returns enabled status and blob info", async () => {
+        const result = await callTool("get_dependency_proxy_settings", { group_id: TEST_GROUP_PATH }, baseEnv);
+        assert.strictEqual(result.enabled, true);
+        assert.strictEqual(result.blob_count, 3);
+        assert.strictEqual(result.total_size, "15728640");
+        assert.ok(result.ttl_policy?.enabled);
+    });
+    test("list_dependency_proxy_blobs returns blobs with string sizes", async () => {
+        const result = await callTool("list_dependency_proxy_blobs", { group_id: TEST_GROUP_PATH }, baseEnv);
+        assert.ok(Array.isArray(result.blobs));
+        assert.strictEqual(result.blobs.length, 2);
+        assert.strictEqual(typeof result.blobs[0].size, "string");
+        assert.strictEqual(result.blobs[0].file_name, "sha256:abc123");
+    });
+    test("purge_dependency_proxy_cache returns scheduled status", async () => {
+        const result = await callTool("purge_dependency_proxy_cache", { group_id: TEST_GROUP_PATH }, baseEnv);
+        assert.strictEqual(result.status, "success");
+        assert.ok(result.message.includes("scheduled"));
+    });
+    test("update_dependency_proxy_settings enables the proxy and returns settings", async () => {
+        const result = await callTool("update_dependency_proxy_settings", { group_id: TEST_GROUP_PATH, enabled: true }, baseEnv);
+        assert.strictEqual(result.enabled, true);
+    });
+    test("update_dependency_proxy_settings rejects empty options", async () => {
+        await assert.rejects(() => callTool("update_dependency_proxy_settings", { group_id: TEST_GROUP_PATH }, baseEnv), /At least one of enabled, identity, or secret must be provided/);
+    });
+    test("dependency_proxy tools are absent when toolset is not activated", async () => {
+        return new Promise((resolve, reject) => {
+            const proc = spawn("node", ["build/index.js"], {
+                stdio: ["pipe", "pipe", "pipe"],
+                env: {
+                    ...process.env,
+                    GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+                    GITLAB_API_URL: `http://localhost:${mockPort}/api/v4`,
+                    // No GITLAB_TOOLSETS — default toolsets only
+                },
+            });
+            let output = "";
+            proc.stdout?.on("data", (d) => (output += d));
+            proc.on("close", () => {
+                try {
+                    const line = output.split("\n").find(l => l.startsWith("{"));
+                    if (!line)
+                        return reject(new Error("No JSON output found"));
+                    const response = JSON.parse(line);
+                    const tools = response.result?.tools ?? [];
+                    const names = tools.map(t => t.name);
+                    assert.ok(!names.includes("get_dependency_proxy_settings"), "tool should not be in default toolset");
+                    assert.ok(!names.includes("purge_dependency_proxy_cache"), "tool should not be in default toolset");
+                    resolve();
+                }
+                catch (e) {
+                    reject(e);
+                }
+            });
+            proc.stdin?.end(JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list", params: {} }) + "\n");
+        });
+    });
+    test("write tools are absent from tools/list in read-only mode", async () => {
+        return new Promise((resolve, reject) => {
+            const proc = spawn("node", ["build/index.js"], {
+                stdio: ["pipe", "pipe", "pipe"],
+                env: { ...process.env, ...baseEnv, GITLAB_READ_ONLY_MODE: "true" },
+            });
+            let output = "";
+            proc.stdout?.on("data", (d) => (output += d));
+            proc.on("close", () => {
+                try {
+                    const line = output.split("\n").find(l => l.startsWith("{"));
+                    if (!line)
+                        return reject(new Error("No JSON output found"));
+                    const response = JSON.parse(line);
+                    const names = (response.result?.tools ?? []).map((t) => t.name);
+                    assert.ok(!names.includes("purge_dependency_proxy_cache"), "purge should be absent in read-only mode");
+                    assert.ok(!names.includes("update_dependency_proxy_settings"), "update should be absent in read-only mode");
+                    assert.ok(names.includes("get_dependency_proxy_settings"), "get should be present in read-only mode");
+                    assert.ok(names.includes("list_dependency_proxy_blobs"), "list should be present in read-only mode");
+                    resolve();
+                }
+                catch (e) {
+                    reject(e);
+                }
+            });
+            proc.stdin?.end(JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list", params: {} }) + "\n");
+        });
+    });
+});

package/build/test/test-geteffectiveprojectid.js

@@ -271,6 +271,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                     REMOTE_AUTHORIZATION: 'true',
                     GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
                     GITLAB_PROJECT_ID: DEFAULT_PROJECT_ID,
+                    GITLAB_TOOLSETS: 'variables',
                 }
             });
             servers.push(server);
@@ -317,6 +318,26 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                 assert.ok(error.message.includes('create_group is not allowed'), 'Should mention create_group');
             }
         });
+        test('should reject list_group_variables when GITLAB_PROJECT_ID is set', async () => {
+            try {
+                await client.callTool('list_group_variables', { group_id: 'my-group' });
+                assert.fail('Should have rejected list_group_variables');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('list_group_variables is not allowed'), 'Should mention list_group_variables');
+            }
+        });
+        test('should reject get_group_variable when GITLAB_PROJECT_ID is set', async () => {
+            try {
+                await client.callTool('get_group_variable', { group_id: 'my-group', key: 'SHARED_SECRET' });
+                assert.fail('Should have rejected get_group_variable');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('get_group_variable is not allowed'), 'Should mention get_group_variable');
+            }
+        });
         test('should allow get_project (non-mutator) when GITLAB_PROJECT_ID is set', async () => {
             const result = await client.callTool('get_project', { project_id: '' });
             assert.ok(result.content, 'Should have content');
@@ -348,6 +369,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                     REMOTE_AUTHORIZATION: 'true',
                     GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
                     GITLAB_ALLOWED_PROJECT_IDS: DEFAULT_PROJECT_ID,
+                    GITLAB_TOOLSETS: 'variables',
                 }
             });
             servers.push(server);
@@ -394,6 +416,26 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                 assert.ok(error.message.includes('create_group is not allowed'), 'Should mention create_group');
             }
         });
+        test('should reject list_group_variables with GITLAB_ALLOWED_PROJECT_IDS', async () => {
+            try {
+                await client.callTool('list_group_variables', { group_id: 'my-group' });
+                assert.fail('Should have rejected list_group_variables');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('list_group_variables is not allowed'), 'Should mention list_group_variables');
+            }
+        });
+        test('should reject get_group_variable with GITLAB_ALLOWED_PROJECT_IDS', async () => {
+            try {
+                await client.callTool('get_group_variable', { group_id: 'my-group', key: 'SHARED_SECRET' });
+                assert.fail('Should have rejected get_group_variable');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('get_group_variable is not allowed'), 'Should mention get_group_variable');
+            }
+        });
         test('should allow get_project (non-mutator) with GITLAB_ALLOWED_PROJECT_IDS', async () => {
             const result = await client.callTool('get_project', { project_id: '' });
             assert.ok(result.content, 'Should have content');
@@ -466,4 +508,64 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
             assert.ok(result.content, 'Should have content');
         });
     });
+    describe('GITLAB_PROJECT_ID guards dependency proxy tools', () => {
+        let mcpUrl;
+        let mockGitLab;
+        let servers = [];
+        let client;
+        before(async () => {
+            const mockPort = await findMockServerPort(9500);
+            mockGitLab = new MockGitLabServer({
+                port: mockPort,
+                validTokens: [MOCK_TOKEN],
+            });
+            await mockGitLab.start();
+            const mockGitLabUrl = mockGitLab.getUrl();
+            const mcpPort = await findAvailablePort(3500);
+            const server = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port: mcpPort,
+                timeout: 5000,
+                env: {
+                    REMOTE_AUTHORIZATION: 'true',
+                    GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+                    GITLAB_PROJECT_ID: DEFAULT_PROJECT_ID,
+                    GITLAB_TOOLSETS: 'dependency_proxy',
+                },
+            });
+            servers.push(server);
+            mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
+            client = new CustomHeaderClient({
+                authorization: `Bearer ${MOCK_TOKEN}`,
+            });
+            await client.connect(mcpUrl);
+        });
+        after(async () => {
+            if (client)
+                await client.disconnect();
+            cleanupServers(servers);
+            if (mockGitLab)
+                await mockGitLab.stop();
+        });
+        test('should reject get_dependency_proxy_settings when GITLAB_PROJECT_ID is set', async () => {
+            try {
+                await client.callTool('get_dependency_proxy_settings', { group_id: 'my-group' });
+                assert.fail('Should have rejected get_dependency_proxy_settings');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('get_dependency_proxy_settings is not allowed'), 'Should mention get_dependency_proxy_settings');
+            }
+        });
+        test('should reject purge_dependency_proxy_cache when GITLAB_PROJECT_ID is set', async () => {
+            try {
+                await client.callTool('purge_dependency_proxy_cache', { group_id: 'my-group' });
+                assert.fail('Should have rejected purge_dependency_proxy_cache');
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('purge_dependency_proxy_cache is not allowed'), 'Should mention purge_dependency_proxy_cache');
+            }
+        });
+    });
 }); // end wrapper describe

package/build/test/test-toolset-filtering.js

@@ -33,6 +33,8 @@ const TOOLSET_TOOL_COUNTS = {
     workitems: 18,
     webhooks: 3,
     groups: 1,
+    variables: 10,
+    dependency_proxy: 4,
 };
 const LEGACY_PIPELINE_TOOL_COUNT = TOOLSET_TOOL_COUNTS.pipelines + TOOLSET_TOOL_COUNTS.ci;
 const DEFAULT_TOOLSETS = [
@@ -55,6 +57,8 @@ const NON_DEFAULT_TOOLSETS = [
     "workitems",
     "webhooks",
     "search",
+    "variables",
+    "dependency_proxy",
 ];
 // discover_tools meta-tool is always force-injected (Step 5.5)
 const DISCOVER_TOOLS_COUNT = 1;
@@ -78,6 +82,8 @@ const TOOLSET_SAMPLE_TOOLS = {
     search: ["search_code", "search_project_code", "search_group_code"],
     webhooks: ["list_webhooks", "list_webhook_events", "get_webhook_event"],
     groups: ["create_group"],
+    variables: ["list_project_variables", "create_project_variable", "delete_project_variable", "list_group_variables", "create_group_variable", "delete_group_variable"],
+    dependency_proxy: ["get_dependency_proxy_settings", "list_dependency_proxy_blobs", "purge_dependency_proxy_cache"],
 };
 // --- Helpers ---
 async function launchMcpServer(mockGitLabUrl, mcpPort, extraEnv = {}) {