@zereight/mcp-gitlab 2.1.18 → 2.1.19

package/README.ko.md

@@ -187,6 +187,7 @@ MCP 서버가 직접 로컬 브라우저 callback을 받을 때만 `GITLAB_OAUTH
 | `STREAMABLE_HTTP` | 예 | 반드시 `true` |
 | `GITLAB_OAUTH_CALLBACK_PROXY` | 선택 | MCP 서버의 고정 `/callback` URL을 사용하려면 `true` |
 | `GITLAB_OAUTH_SCOPES` | 선택 | 쉼표로 구분된 scope 목록(기본값: `api,read_api,read_user`) |
+| `GITLAB_ALLOWED_GROUPS` | 선택 | 쉼표로 구분된 GitLab 그룹 전체 경로 — 해당 그룹 및 하위 그룹 멤버만 토큰을 발급받을 수 있음 |
 
 > **`Unregistered redirect_uri` 문제 해결**
 >

package/README.md

@@ -208,6 +208,7 @@ exchanging credentials with GitLab on behalf of the client.
 | `STREAMABLE_HTTP`     | ✅       | Must be `true`                                             |
 | `GITLAB_OAUTH_CALLBACK_PROXY` | optional | Set to `true` to use the MCP server's fixed `/callback` URL |
 | `GITLAB_OAUTH_SCOPES` | optional | Comma-separated scopes (default: `api,read_api,read_user`) |
+| `GITLAB_ALLOWED_GROUPS` | optional | Comma-separated group full paths — only members (and subgroup members) may obtain a token |
 
 When `STREAMABLE_HTTP=true`, server-side `GITLAB_PERSONAL_ACCESS_TOKEN` or `GITLAB_JOB_TOKEN` require `REMOTE_AUTHORIZATION=true` or `GITLAB_MCP_OAUTH=true`.
 

package/README.zh-CN.md

@@ -187,6 +187,7 @@ OpenCode、MCPJam、Claude.ai 等远程 MCP 客户端可能会在授权时发送
 | `STREAMABLE_HTTP` | 是 | 必须为 `true` |
 | `GITLAB_OAUTH_CALLBACK_PROXY` | 可选 | 设置为 `true` 时使用 MCP 服务器固定的 `/callback` URL |
 | `GITLAB_OAUTH_SCOPES` | 可选 | 逗号分隔的 scope（默认：`api,read_api,read_user`） |
+| `GITLAB_ALLOWED_GROUPS` | 可选 | 逗号分隔的 GitLab 群组完整路径 — 仅该群组及其子群组的成员可获取令牌 |
 
 > **排查 `Unregistered redirect_uri`**
 >

package/build/config.js

@@ -57,6 +57,13 @@ export const GITLAB_OAUTH_SCOPES = GITLAB_OAUTH_SCOPES_RAW
     ? GITLAB_OAUTH_SCOPES_RAW.split(",").map((s) => s.trim()).filter(Boolean)
     : undefined;
 export const GITLAB_OAUTH_CALLBACK_PROXY = getConfig("oauth-callback-proxy", "GITLAB_OAUTH_CALLBACK_PROXY") === "true";
+export const GITLAB_ALLOWED_GROUPS = (() => {
+    const raw = getConfig("allowed-groups", "GITLAB_ALLOWED_GROUPS");
+    if (!raw)
+        return undefined;
+    const groups = raw.split(",").map((g) => g.trim()).filter(Boolean);
+    return groups.length > 0 ? groups : undefined;
+})();
 export const ENABLE_DYNAMIC_API_URL = getConfig("enable-dynamic-api-url", "ENABLE_DYNAMIC_API_URL") === "true";
 // ---------------------------------------------------------------------------
 // Stateless mode (multi-pod safe OAuth / session encoding)

package/build/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { getConfig, ENABLE_DYNAMIC_API_URL, GITLAB_AUTH_COOKIE_PATH, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_READ_ONLY_MODE, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, USE_GITLAB_WIKI, USE_MILESTONE, USE_OAUTH, USE_PIPELINE, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, } from "./config.js";
+import { getConfig, ENABLE_DYNAMIC_API_URL, GITLAB_AUTH_COOKIE_PATH, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_READ_ONLY_MODE, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, USE_GITLAB_WIKI, USE_MILESTONE, USE_OAUTH, USE_PIPELINE, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_ALLOWED_GROUPS, } from "./config.js";
 /** True when the server is running in remote/network mode (SSE or StreamableHTTP transport). */
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
 /**
@@ -134,12 +134,12 @@ import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middlew
 import { GitLabClientPool } from "./gitlab-client-pool.js";
 import { allTools, readOnlyTools, destructiveTools, parseEnabledToolsets, parseIndividualTools, buildFeatureFlagOverrides, isToolInEnabledToolset, TOOLSET_DEFINITIONS, ALL_TOOLSET_IDS, } from "./tools/registry.js";
 import { BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, // Added
-CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateMergeRequestNoteEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateRepositorySchema, CreateGroupSchema, CreateWikiPageSchema, CreateGroupWikiPageSchema, DeleteBranchSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteProjectMilestoneSchema, DeleteWikiPageSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, EditProjectMilestoneSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetBranchSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GitLabBlameEntrySchema, GetDraftNoteSchema, GetFileContentsSchema, GetIssueLinkSchema, GetIssueSchema, GetLabelSchema, GetMergeRequestDiffsSchema, GetMergeRequestSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetDeploymentSchema, GetEnvironmentSchema, GetNamespaceSchema, GitLabCiLintResultSchema, GetPipelineJobOutputSchema, GetPipelineSchema, GetProjectMilestoneSchema, GetProjectSchema, GetRepositoryTreeSchema, GetUsersSchema, GetUserSchema, GitLabUserFullSchema, WhoAmISchema, GitLabCurrentUserSchema, GetWikiPageSchema, GitLabCommitSchema, GitLabCommitStatusSchema, GitLabCompareResultSchema, GitLabContentSchema, GitLabCreateUpdateFileResponseSchema, GitLabDiffSchema, 
+CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateMergeRequestNoteEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateRepositorySchema, CreateGroupSchema, CreateWikiPageSchema, CreateGroupWikiPageSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UnprotectBranchSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteProjectMilestoneSchema, DeleteWikiPageSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, EditProjectMilestoneSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetBranchSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GitLabBlameEntrySchema, GetDraftNoteSchema, GetFileContentsSchema, GetIssueLinkSchema, GetIssueSchema, GetLabelSchema, GetMergeRequestDiffsSchema, GetMergeRequestSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetDeploymentSchema, GetEnvironmentSchema, GetNamespaceSchema, GitLabCiLintResultSchema, GetPipelineJobOutputSchema, GetPipelineSchema, GetProjectMilestoneSchema, GetProjectSchema, GetRepositoryTreeSchema, GetUsersSchema, GetUserSchema, GitLabUserFullSchema, WhoAmISchema, GitLabCurrentUserSchema, GetWikiPageSchema, GitLabCommitSchema, GitLabCommitStatusSchema, GitLabCompareResultSchema, GitLabContentSchema, GitLabCreateUpdateFileResponseSchema, GitLabDiffSchema, 
 // Discussion Schemas
 GitLabDiscussionNoteSchema, // Added
 GitLabDiscussionSchema, 
 // Draft Notes Schemas
-GitLabDraftNoteSchema, GitLabForkSchema, GitLabBranchSchema, GitLabGroupSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestPipelineSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListBranchesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, GitLabCiVariableSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GitLabDependencyProxySchema, GitLabDependencyProxyBlobSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
+GitLabDraftNoteSchema, GitLabForkSchema, GitLabBranchSchema, GitLabProtectedBranchSchema, GitLabGroupSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestPipelineSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListBranchesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, GitLabCiVariableSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GitLabDependencyProxySchema, GitLabDependencyProxyBlobSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
 GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, GitLabTagSchema, GitLabTagSignatureSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, ListWebhookEventsSchema, GetWebhookEventSchema, HealthCheckSchema, } from "./schemas.js";
 import { randomUUID, createCipheriv, createDecipheriv, randomBytes, createHash } from "node:crypto";
 import { pino } from "pino";
@@ -8315,6 +8315,97 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify({ status: "deleted", branch: args.branch_name }, null, 2) }],
                 };
             }
+            case "list_protected_branches": {
+                const args = ListProtectedBranchesSchema.parse(params.arguments);
+                const projectId = decodeURIComponent(args.project_id);
+                const effectiveProjectId = getEffectiveProjectId(projectId);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/protected_branches`);
+                if (args.search)
+                    url.searchParams.append("search", args.search);
+                if (args.page)
+                    url.searchParams.append("page", String(args.page));
+                if (args.per_page)
+                    url.searchParams.append("per_page", String(args.per_page));
+                const response = await fetch(url.toString(), {
+                    ...getFetchConfig(),
+                });
+                await handleGitLabError(response);
+                const data = z.array(GitLabProtectedBranchSchema).parse(await response.json());
+                return {
+                    content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+                };
+            }
+            case "get_protected_branch": {
+                const args = GetProtectedBranchSchema.parse(params.arguments);
+                const projectId = decodeURIComponent(args.project_id);
+                const effectiveProjectId = getEffectiveProjectId(projectId);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/protected_branches/${encodeURIComponent(args.branch_name)}`);
+                const response = await fetch(url.toString(), {
+                    ...getFetchConfig(),
+                });
+                await handleGitLabError(response);
+                const data = GitLabProtectedBranchSchema.parse(await response.json());
+                return {
+                    content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+                };
+            }
+            case "protect_branch": {
+                const args = ProtectBranchSchema.parse(params.arguments);
+                const projectId = decodeURIComponent(args.project_id);
+                const effectiveProjectId = getEffectiveProjectId(projectId);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/protected_branches`);
+                const body = { name: args.branch_name };
+                if (args.push_access_level !== undefined)
+                    body.push_access_level = args.push_access_level;
+                if (args.merge_access_level !== undefined)
+                    body.merge_access_level = args.merge_access_level;
+                if (args.unprotect_access_level !== undefined)
+                    body.unprotect_access_level = args.unprotect_access_level;
+                if (args.allow_force_push !== undefined)
+                    body.allow_force_push = args.allow_force_push;
+                if (args.code_owner_approval_required !== undefined)
+                    body.code_owner_approval_required = args.code_owner_approval_required;
+                const response = await fetch(url.toString(), {
+                    ...getFetchConfig(),
+                    method: "POST",
+                    body: JSON.stringify(body),
+                });
+                await handleGitLabError(response);
+                const data = GitLabProtectedBranchSchema.parse(await response.json());
+                return {
+                    content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+                };
+            }
+            case "unprotect_branch": {
+                const args = UnprotectBranchSchema.parse(params.arguments);
+                const projectId = decodeURIComponent(args.project_id);
+                const effectiveProjectId = getEffectiveProjectId(projectId);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/protected_branches/${encodeURIComponent(args.branch_name)}`);
+                const response = await fetch(url.toString(), {
+                    ...getFetchConfig(),
+                    method: "DELETE",
+                });
+                await handleGitLabError(response);
+                return {
+                    content: [{ type: "text", text: JSON.stringify({ status: "unprotected", branch: args.branch_name }, null, 2) }],
+                };
+            }
+            case "update_default_branch": {
+                const args = UpdateDefaultBranchSchema.parse(params.arguments);
+                const projectId = decodeURIComponent(args.project_id);
+                const effectiveProjectId = getEffectiveProjectId(projectId);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`);
+                const response = await fetch(url.toString(), {
+                    ...getFetchConfig(),
+                    method: "PUT",
+                    body: JSON.stringify({ default_branch: args.default_branch }),
+                });
+                await handleGitLabError(response);
+                const data = await response.json();
+                return {
+                    content: [{ type: "text", text: JSON.stringify({ status: "updated", default_branch: args.default_branch, project: data }, null, 2) }],
+                };
+            }
             default:
                 throw new Error(`Unknown tool: ${params.name}`);
         }
@@ -8719,9 +8810,9 @@ async function startStreamableHTTPServer() {
         return null;
     };
     /**
-     * Set or reset timeout for session auth
+     * Set or reset timeout for session auth.
      * After SESSION_TIMEOUT_SECONDS of inactivity, the auth token is removed
-     * but the transport session remains active
+     * and the Streamable HTTP transport is closed so the session slot is released.
      */
     const setAuthTimeout = (sessionId) => {
         // Clear existing timeout if any
@@ -8733,6 +8824,13 @@ async function startStreamableHTTPServer() {
                 delete authBySession[sessionId];
                 delete authTimeouts[sessionId];
                 metrics.expiredSessions++;
+                // Close the transport to free the slot; without this, stale sessions accumulate and exhaust MAX_SESSIONS.
+                const transport = streamableTransports[sessionId];
+                if (transport) {
+                    transport.close().catch(err => {
+                        logger.error(`Error closing transport for expired session ${sessionId}:`, err);
+                    });
+                }
             }
         }, SESSION_TIMEOUT_SECONDS * 1000);
     };
@@ -8957,7 +9055,7 @@ async function startStreamableHTTPServer() {
                 storedTtlSeconds: OAUTH_STATELESS_STORED_TTL_SECONDS,
             }
             : null;
-        const oauthProvider = createGitLabOAuthProvider(gitlabBaseUrl, GITLAB_OAUTH_APP_ID, "GitLab MCP Server", GITLAB_READ_ONLY_MODE, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, callbackUrl, statelessOptions);
+        const oauthProvider = createGitLabOAuthProvider(gitlabBaseUrl, GITLAB_OAUTH_APP_ID, "GitLab MCP Server", GITLAB_READ_ONLY_MODE, GITLAB_OAUTH_SCOPES, GITLAB_ALLOWED_GROUPS, GITLAB_OAUTH_CALLBACK_PROXY, callbackUrl, statelessOptions);
         const scopesSupported = GITLAB_OAUTH_SCOPES ?? ["api", "read_api", "read_user"];
         // When server URL has a path (e.g. behind Kong), the SDK's well-known metadata
         // advertises root-level endpoints. Override to use path-prefixed endpoints.

package/build/oauth-proxy.js

@@ -127,7 +127,11 @@ class GitLabOAuthServerProvider {
     // serialised into opaque OAuth values and the in-memory caches above are
     // bypassed. Enabled independently of callback-proxy mode.
     _stateless;
-    constructor(gitlabBaseUrl, gitlabAppId, resourceName, readOnly, customScopes, callbackProxyEnabled = false, callbackUrl = "", stateless = null) {
+    // Group allowlist (optional). When set, tokens are rejected unless the
+    // authenticated user is a direct or inherited member of at least one group.
+    // Checked once at token issuance (exchangeAuthorizationCode), not per request.
+    _allowedGroups;
+    constructor(gitlabBaseUrl, gitlabAppId, resourceName, readOnly, customScopes, allowedGroups, callbackProxyEnabled = false, callbackUrl = "", stateless = null) {
         this._gitlabBaseUrl = gitlabBaseUrl;
         this._gitlabAppId = gitlabAppId;
         this._resourceName = resourceName;
@@ -137,6 +141,7 @@ class GitLabOAuthServerProvider {
                 : readOnly
                     ? REQUIRED_GITLAB_SCOPES_RO
                     : REQUIRED_GITLAB_SCOPES_RW;
+        this._allowedGroups = allowedGroups ?? null;
         this._callbackProxyEnabled = callbackProxyEnabled;
         this._callbackUrl = callbackUrl;
         this._stateless = stateless;
@@ -313,6 +318,7 @@ class GitLabOAuthServerProvider {
     }
     // ---- Token exchange ----------------------------------------------------
     async exchangeAuthorizationCode(client, authorizationCode, codeVerifier, redirectUri, resource) {
+        let tokens;
         if (this._callbackProxyEnabled) {
             // --- Callback proxy mode ---
             // The authorizationCode is a proxy code we generated in handleCallback().
@@ -373,32 +379,74 @@ class GitLabOAuthServerProvider {
                     throw new ServerError("PKCE verification failed");
                 }
             }
-            return entry.tokens;
+            tokens = entry.tokens;
         }
-        // --- Passthrough mode (original behavior) ---
-        const params = new URLSearchParams({
-            grant_type: "authorization_code",
-            client_id: this._gitlabAppId,
-            code: authorizationCode,
-        });
-        if (codeVerifier)
-            params.append("code_verifier", codeVerifier);
-        if (redirectUri)
-            params.append("redirect_uri", redirectUri);
-        if (resource)
-            params.append("resource", resource.href);
-        const response = await fetch(`${this._gitlabBaseUrl}/oauth/token`, {
-            method: "POST",
-            headers: { "Content-Type": "application/x-www-form-urlencoded" },
-            body: params.toString(),
-        });
-        if (!response.ok) {
-            const body = await response.text();
-            logger.error(`Token exchange failed (${response.status}): ${body}`);
-            throw new ServerError(`Token exchange failed: ${response.status}`);
+        else {
+            // --- Passthrough mode (original behavior) ---
+            const params = new URLSearchParams({
+                grant_type: "authorization_code",
+                client_id: this._gitlabAppId,
+                code: authorizationCode,
+            });
+            if (codeVerifier)
+                params.append("code_verifier", codeVerifier);
+            if (redirectUri)
+                params.append("redirect_uri", redirectUri);
+            if (resource)
+                params.append("resource", resource.href);
+            const response = await fetch(`${this._gitlabBaseUrl}/oauth/token`, {
+                method: "POST",
+                headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                body: params.toString(),
+            });
+            if (!response.ok) {
+                const body = await response.text();
+                logger.error(`Token exchange failed (${response.status}): ${body}`);
+                throw new ServerError(`Token exchange failed: ${response.status}`);
+            }
+            const data = await response.json();
+            tokens = OAuthTokensSchema.parse(data);
         }
-        const data = await response.json();
-        return OAuthTokensSchema.parse(data);
+        if (this._allowedGroups) {
+            const isMember = await this._checkGroupMembership(tokens.access_token);
+            if (!isMember) {
+                logger.warn({ allowedGroups: this._allowedGroups }, "Token issuance denied: user is not a member of any allowed group");
+                throw new ServerError("Access denied: user is not a member of an allowed group");
+            }
+        }
+        return tokens;
+    }
+    /**
+     * Returns true if the token owner belongs to at least one group whose
+     * full_path equals or is a sub-path of any configured allowed group.
+     *
+     * Example: allowedGroups=["my-org"] allows members of "my-org",
+     * "my-org/team-a", "my-org/team-a/squad-1", etc.
+     */
+    async _checkGroupMembership(token) {
+        const allowedPaths = this._allowedGroups.map((g) => g.toLowerCase());
+        let page = 1;
+        while (true) {
+            const res = await fetch(`${this._gitlabBaseUrl}/api/v4/groups?min_access_level=10&per_page=100&page=${page}`, {
+                headers: { Authorization: `Bearer ${token}` }
+            });
+            if (!res.ok)
+                break;
+            const groups = (await res.json());
+            if (groups.length === 0)
+                break;
+            const matched = groups.some((g) => {
+                const fp = g.full_path.toLowerCase();
+                return allowedPaths.some((allowed) => fp === allowed || fp.startsWith(`${allowed}/`));
+            });
+            if (matched)
+                return true;
+            const totalPages = Number.parseInt(res.headers.get("x-total-pages") ?? "1", 10);
+            if (page >= totalPages)
+                break;
+            page++;
+        }
+        return false;
     }
     // ---- Refresh token -----------------------------------------------------
     async exchangeRefreshToken(_client, refreshToken, scopes, resource) {
@@ -598,6 +646,6 @@ class GitLabOAuthServerProvider {
  *                        callback-proxy state is encoded into opaque OAuth values
  *                        instead of an in-memory cache, enabling multi-pod deploys.
  */
-export function createGitLabOAuthProvider(gitlabBaseUrl, gitlabAppId, resourceName = "GitLab MCP Server", readOnly = false, customScopes, callbackProxyEnabled = false, callbackUrl = "", stateless = null) {
-    return new GitLabOAuthServerProvider(gitlabBaseUrl, gitlabAppId, resourceName, readOnly, customScopes, callbackProxyEnabled, callbackUrl, stateless);
+export function createGitLabOAuthProvider(gitlabBaseUrl, gitlabAppId, resourceName = "GitLab MCP Server", readOnly = false, customScopes, allowedGroups, callbackProxyEnabled = false, callbackUrl = "", stateless = null) {
+    return new GitLabOAuthServerProvider(gitlabBaseUrl, gitlabAppId, resourceName, readOnly, customScopes, allowedGroups, callbackProxyEnabled, callbackUrl, stateless);
 }

package/build/schemas.js

@@ -1515,6 +1515,79 @@ export const ListBranchesSchema = ProjectParamsSchema.extend({
 export const DeleteBranchSchema = ProjectParamsSchema.extend({
     branch_name: z.string().describe("Name of the branch to delete"),
 });
+// Protected Branches related schemas
+export const ListProtectedBranchesSchema = ProjectParamsSchema.extend({
+    search: z.string().optional().describe("Search term to filter protected branches by name"),
+}).merge(PaginationOptionsSchema);
+export const GetProtectedBranchSchema = ProjectParamsSchema.extend({
+    branch_name: z.string().describe("Name of the protected branch"),
+});
+// String-aware boolean preprocessing: correctly handles "false" → false
+const stringBoolean = z.preprocess((val) => {
+    if (typeof val === "string") {
+        const lower = val.toLowerCase();
+        if (lower === "false" || lower === "0")
+            return false;
+        if (lower === "true" || lower === "1")
+            return true;
+    }
+    return val;
+}, z.boolean().optional());
+const protectedBranchAccessLevel = z.coerce
+    .number()
+    .int()
+    .refine((level) => [0, 30, 40, 60].includes(level), {
+    message: "Access level must be one of 0 (No access), 30 (Developer), 40 (Maintainer), or 60 (Admin)",
+});
+export const ProtectBranchSchema = z.preprocess((input) => {
+    if (typeof input !== "object" || input === null) {
+        return input;
+    }
+    const args = { ...input };
+    if (!args.branch_name && args.name) {
+        args.branch_name = args.name;
+    }
+    return args;
+}, ProjectParamsSchema.extend({
+    branch_name: z.string().describe("Branch name or wildcard pattern to protect"),
+    name: z
+        .string()
+        .optional()
+        .describe("Deprecated alias for branch_name; prefer branch_name for consistency"),
+    push_access_level: protectedBranchAccessLevel
+        .optional()
+        .describe("Access level for pushing (0=No access, 30=Developer, 40=Maintainer, 60=Admin). GitLab default applies when omitted."),
+    merge_access_level: protectedBranchAccessLevel
+        .optional()
+        .describe("Access level for merging (0=No access, 30=Developer, 40=Maintainer, 60=Admin). GitLab default applies when omitted."),
+    unprotect_access_level: protectedBranchAccessLevel
+        .optional()
+        .describe("Access level for unprotecting (0=No access, 30=Developer, 40=Maintainer, 60=Admin). GitLab default applies when omitted."),
+    allow_force_push: stringBoolean.describe("Allow force push to the protected branch. Default: false"),
+    code_owner_approval_required: stringBoolean.describe("Require code owner approval before merging (PREMIUM). Default: false"),
+}));
+export const UnprotectBranchSchema = ProjectParamsSchema.extend({
+    branch_name: z.string().describe("Name of the protected branch to unprotect"),
+});
+// Update default branch schema
+export const UpdateDefaultBranchSchema = ProjectParamsSchema.extend({
+    default_branch: z.string().describe("The new default branch name for the project"),
+});
+export const GitLabProtectedBranchAccessLevelSchema = z.object({
+    access_level: z.number().nullable().optional(),
+    access_level_description: z.string().optional(),
+    user_id: z.number().optional(),
+    group_id: z.number().optional(),
+});
+export const GitLabProtectedBranchSchema = z.object({
+    id: z.number().optional(),
+    name: z.string(),
+    push_access_levels: z.array(GitLabProtectedBranchAccessLevelSchema).optional(),
+    merge_access_levels: z.array(GitLabProtectedBranchAccessLevelSchema).optional(),
+    unprotect_access_levels: z.array(GitLabProtectedBranchAccessLevelSchema).optional(),
+    allow_force_push: z.boolean().optional(),
+    code_owner_approval_required: z.boolean().optional(),
+});
 export const GitLabBranchSchema = z.object({
     name: z.string(),
     commit: z.object({

package/build/test/mcp-oauth-tests.js

@@ -79,7 +79,6 @@ function addOAuthEndpoints(mockGitLab, validToken, clientId, baseUrl) {
 // Test suite: Discovery endpoints
 // ---------------------------------------------------------------------------
 describe("MCP OAuth — Discovery Endpoints", () => {
-    let mcpUrl;
     let mcpBaseUrl;
     let mockGitLab;
     let servers = [];
@@ -94,7 +93,6 @@ describe("MCP OAuth — Discovery Endpoints", () => {
         addOAuthEndpoints(mockGitLab, MOCK_OAUTH_TOKEN, MOCK_CLIENT_ID, mockGitLabUrl);
         const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE);
         mcpBaseUrl = `http://${HOST}:${mcpPort}`;
-        mcpUrl = `${mcpBaseUrl}/mcp`;
         const server = await launchServer({
             mode: TransportMode.STREAMABLE_HTTP,
             port: mcpPort,
@@ -285,13 +283,6 @@ describe("MCP OAuth — /mcp Auth Enforcement", () => {
 describe("MCP OAuth — BoundedClientCache", () => {
     // Access the internal class via a minimal provider (it's not exported directly)
     // by driving it through the public clientsStore API.
-    function makeClient(id, redirectUri = "https://example.com/cb") {
-        return {
-            client_id: id,
-            redirect_uris: [redirectUri],
-            token_endpoint_auth_method: "none",
-        };
-    }
     async function buildCachingProvider() {
         // Spin up a DCR stub that returns a stable client_id from the request body.
         // The stub reads client_id from the incoming body (set by the SDK's register
@@ -380,7 +371,7 @@ describe("MCP OAuth — createGitLabOAuthProvider", () => {
     test("verifyAccessToken throws on non-OK response", async () => {
         // Spin up a tiny local server that always returns 401
         const { createServer } = await import("node:http");
-        const stub = createServer((req, res) => {
+        const stub = createServer((_req, res) => {
             res.writeHead(401);
             res.end(JSON.stringify({ error: "invalid_token" }));
         });
@@ -599,3 +590,195 @@ describe("MCP OAuth — Header Auth Fallback", () => {
         console.log("  ✓ No auth still returns 401");
     });
 });
+// ---------------------------------------------------------------------------
+// Test suite: Group Allowlist (unit tests — exchangeAuthorizationCode)
+// ---------------------------------------------------------------------------
+describe("MCP OAuth — Group Allowlist", () => {
+    let stubServer;
+    let stubUrl;
+    // Mutable state lets each test control the stub's response without
+    // spinning up a new server.
+    let groupsForPage = () => [];
+    let totalPages = 1;
+    before(async () => {
+        const { createServer } = await import("node:http");
+        stubServer = createServer((req, res) => {
+            const url = new URL(req.url, "http://127.0.0.1");
+            res.setHeader("Content-Type", "application/json");
+            // Token exchange — passthrough mode calls POST /oauth/token
+            if (req.method === "POST" && url.pathname === "/oauth/token") {
+                res.writeHead(200).end(JSON.stringify({
+                    access_token: MOCK_OAUTH_TOKEN,
+                    token_type: "bearer",
+                    expires_in: 7200,
+                    refresh_token: "mock-refresh",
+                    scope: "api",
+                }));
+                return;
+            }
+            if (req.method === "GET" && url.pathname === "/api/v4/groups") {
+                const page = Number.parseInt(url.searchParams.get("page") ?? "1", 10);
+                res
+                    .writeHead(200, { "x-total-pages": String(totalPages) })
+                    .end(JSON.stringify(groupsForPage(page)));
+                return;
+            }
+            res.writeHead(404).end("{}");
+        });
+        await new Promise(resolve => stubServer.listen(0, "127.0.0.1", resolve));
+        const addr = stubServer.address();
+        stubUrl = `http://127.0.0.1:${addr.port}`;
+    });
+    after(() => {
+        stubServer.close();
+    });
+    async function makeProvider(allowedGroups = undefined, callbackProxyEnabled = false) {
+        const { createGitLabOAuthProvider } = await import("../oauth-proxy.js");
+        return createGitLabOAuthProvider(stubUrl, "test-app-id", "GitLab MCP Server", false, undefined, // customScopes
+        allowedGroups, callbackProxyEnabled, callbackProxyEnabled ? "https://mcp.example.test/callback" : "" // callbackUrl
+        );
+    }
+    function exchange(provider) {
+        return provider.exchangeAuthorizationCode({}, "mock-auth-code");
+    }
+    test("no allowedGroups — groups API not called, tokens returned", async () => {
+        const provider = await makeProvider(undefined);
+        groupsForPage = () => []; // wrong groups — proves endpoint isn't called
+        totalPages = 1;
+        const tokens = await exchange(provider);
+        assert.strictEqual(tokens.access_token, MOCK_OAUTH_TOKEN);
+        console.log("  ✓ No allowedGroups: token issued without group check");
+    });
+    test("user is direct member of the allowed group → token issued", async () => {
+        const provider = await makeProvider(["my-org"]);
+        groupsForPage = () => [{ full_path: "my-org" }];
+        totalPages = 1;
+        const tokens = await exchange(provider);
+        assert.strictEqual(tokens.access_token, MOCK_OAUTH_TOKEN);
+        console.log("  ✓ Direct group member: token issued");
+    });
+    test("user in first-level subgroup of allowed group → token issued", async () => {
+        const provider = await makeProvider(["my-org"]);
+        groupsForPage = () => [{ full_path: "my-org/team-a" }];
+        totalPages = 1;
+        const tokens = await exchange(provider);
+        assert.strictEqual(tokens.access_token, MOCK_OAUTH_TOKEN);
+        console.log("  ✓ First-level subgroup member: token issued");
+    });
+    test("user in nested subgroup → token issued", async () => {
+        const provider = await makeProvider(["my-org"]);
+        groupsForPage = () => [{ full_path: "my-org/team-a/squad-1" }];
+        totalPages = 1;
+        const tokens = await exchange(provider);
+        assert.strictEqual(tokens.access_token, MOCK_OAUTH_TOKEN);
+        console.log("  ✓ Nested subgroup member: token issued");
+    });
+    test("user not in any matching group → token issuance denied", async () => {
+        const provider = await makeProvider(["my-org"]);
+        groupsForPage = () => [{ full_path: "other-org" }];
+        totalPages = 1;
+        await assert.rejects(() => exchange(provider), (err) => {
+            assert.ok(err.message.includes("Access denied"), `Unexpected message: ${err.message}`);
+            return true;
+        });
+        console.log("  ✓ Non-member: token issuance denied");
+    });
+    test("prefix spoofing rejected — my-org2 does not match my-org", async () => {
+        const provider = await makeProvider(["my-org"]);
+        groupsForPage = () => [{ full_path: "my-org2" }];
+        totalPages = 1;
+        await assert.rejects(() => exchange(provider), (err) => {
+            assert.ok(err.message.includes("Access denied"), `Unexpected message: ${err.message}`);
+            return true;
+        });
+        console.log("  ✓ my-org2 correctly rejected (not a sub-path of my-org)");
+    });
+    test("user matches second of multiple allowed groups → token issued", async () => {
+        const provider = await makeProvider(["team-x", "my-org"]);
+        groupsForPage = () => [{ full_path: "my-org/backend" }];
+        totalPages = 1;
+        const tokens = await exchange(provider);
+        assert.strictEqual(tokens.access_token, MOCK_OAUTH_TOKEN);
+        console.log("  ✓ Match on second allowed group: token issued");
+    });
+    test("match found on page 2 of paginated groups response → token issued", async () => {
+        const provider = await makeProvider(["my-org"]);
+        totalPages = 2;
+        groupsForPage = page => page === 1 ? [{ full_path: "other-org" }] : [{ full_path: "my-org/team-b" }];
+        const tokens = await exchange(provider);
+        assert.strictEqual(tokens.access_token, MOCK_OAUTH_TOKEN);
+        console.log("  ✓ Group found on page 2: token issued");
+    });
+    test("user not in group across all pages → token issuance denied", async () => {
+        const provider = await makeProvider(["my-org"]);
+        totalPages = 2;
+        groupsForPage = () => [{ full_path: "other-org" }];
+        await assert.rejects(() => exchange(provider), (err) => {
+            assert.ok(err.message.includes("Access denied"), `Unexpected message: ${err.message}`);
+            return true;
+        });
+        console.log("  ✓ Non-member across all pages: token issuance denied");
+    });
+    test("callback-proxy exchange also enforces allowed groups", async () => {
+        const provider = await makeProvider(["my-org"], true);
+        groupsForPage = () => [{ full_path: "my-org/team-a" }];
+        totalPages = 1;
+        const proxyCode = "proxy-code-for-group-test";
+        const clientId = "test-client";
+        const redirectUri = "https://client.example.test/callback";
+        provider._storedTokens.set(proxyCode, {
+            tokens: {
+                access_token: MOCK_OAUTH_TOKEN,
+                token_type: "bearer",
+                expires_in: 7200,
+                refresh_token: "mock-refresh",
+                scope: "api",
+            },
+            clientId,
+            clientCodeChallenge: "",
+            clientRedirectUri: redirectUri,
+            createdAt: Date.now(),
+        });
+        const tokens = await provider.exchangeAuthorizationCode({
+            client_id: clientId,
+        }, proxyCode, undefined, redirectUri);
+        assert.strictEqual(tokens.access_token, MOCK_OAUTH_TOKEN);
+        console.log("  ✓ Callback-proxy exchange enforces allowedGroups before issuing tokens");
+    });
+    test("callback-proxy exchange denies users outside allowed groups", async () => {
+        const provider = await makeProvider(["my-org"], true);
+        groupsForPage = () => [{ full_path: "other-org/team-a" }];
+        totalPages = 1;
+        const proxyCode = "proxy-code-for-group-deny-test";
+        const clientId = "test-client-deny";
+        const redirectUri = "https://client.example.test/callback";
+        provider._storedTokens.set(proxyCode, {
+            tokens: {
+                access_token: MOCK_OAUTH_TOKEN,
+                token_type: "bearer",
+                expires_in: 7200,
+                refresh_token: "mock-refresh",
+                scope: "api",
+            },
+            clientId,
+            clientCodeChallenge: "",
+            clientRedirectUri: redirectUri,
+            createdAt: Date.now(),
+        });
+        await assert.rejects(() => provider.exchangeAuthorizationCode({
+            client_id: clientId,
+        }, proxyCode, undefined, redirectUri), (err) => {
+            assert.ok(err.message.includes("Access denied"), `Unexpected message: ${err.message}`);
+            return true;
+        });
+        console.log("  ✓ Callback-proxy exchange denies users outside allowedGroups");
+    });
+    test("matching is case-insensitive", async () => {
+        const provider = await makeProvider(["My-Org"]);
+        groupsForPage = () => [{ full_path: "my-org/team-a" }];
+        totalPages = 1;
+        const tokens = await exchange(provider);
+        assert.strictEqual(tokens.access_token, MOCK_OAUTH_TOKEN);
+        console.log("  ✓ Case-insensitive match: token issued");
+    });
+});

package/build/test/remote-auth-simple-test.js

@@ -10,7 +10,6 @@ import { CustomHeaderClient } from './clients/custom-header-client.js';
 // Test constants
 const MOCK_TOKEN = 'glpat-mock-token-12345';
 const MOCK_JOB_TOKEN = 'glcbt-mock-job-token-9876';
-const TEST_PROJECT_ID = '123';
 // Port ranges to avoid collisions
 const MOCK_GITLAB_PORT_BASE = 9000;
 const MOCK_GITLAB_PORT_OFFSET = 500; // Offset for timeout test suite
@@ -22,6 +21,26 @@ const TIMEOUT_BUFFER_MS = 1000; // Extra time beyond timeout to ensure expiratio
 const TIMEOUT_TEST_WAIT_MS = SESSION_TIMEOUT_SECONDS * 1000 + TIMEOUT_BUFFER_MS;
 const KEEPALIVE_INTERVAL_MS = 2000; // Must be less than SESSION_TIMEOUT_SECONDS
 const KEEPALIVE_REQUEST_COUNT = 3; // Number of keepalive requests to test
+async function getMetrics(mcpUrl) {
+    const metricsUrl = mcpUrl.replace(/\/mcp$/, '/metrics');
+    const response = await fetch(metricsUrl);
+    assert.strictEqual(response.status, 200, 'metrics endpoint should be available');
+    return (await response.json());
+}
+async function waitForSessionDecrease(mcpUrl, beforeTimeout, timeoutMs = 3000) {
+    const startedAt = Date.now();
+    let last = await getMetrics(mcpUrl);
+    while (Date.now() - startedAt < timeoutMs) {
+        if (last.activeSessions < beforeTimeout.activeSessions &&
+            last.authenticatedSessions < beforeTimeout.authenticatedSessions) {
+            return;
+        }
+        await new Promise(resolve => setTimeout(resolve, 100));
+        last = await getMetrics(mcpUrl);
+    }
+    assert.ok(last.activeSessions < beforeTimeout.activeSessions, `activeSessions should decrease after timeout (${last.activeSessions} !< ${beforeTimeout.activeSessions})`);
+    assert.ok(last.authenticatedSessions < beforeTimeout.authenticatedSessions, `authenticatedSessions should decrease after timeout (${last.authenticatedSessions} !< ${beforeTimeout.authenticatedSessions})`);
+}
 console.log('🔐 Remote Authorization Test Suite');
 console.log('');
 describe('Remote Authorization - Basic Functionality', () => {
@@ -178,6 +197,7 @@ describe('Remote Authorization - Session Timeout', () => {
     test('session timeout expiration - inactivity expires auth', async () => {
         // Add a small delay to ensure server is ready/clean from previous test
         await new Promise(resolve => setTimeout(resolve, 1000));
+        const baseline = await getMetrics(mcpUrl);
         // Step 1: Connect WITH auth header to establish session
         const clientWithAuth = new CustomHeaderClient({
             'authorization': `Bearer ${MOCK_TOKEN}`
@@ -190,9 +210,14 @@ describe('Remote Authorization - Session Timeout', () => {
         const sessionId = clientWithAuth.getSessionId();
         assert.ok(sessionId, 'Session ID should exist');
         console.log(`  ℹ️  Session ID: ${sessionId}`);
+        const beforeTimeout = await getMetrics(mcpUrl);
+        assert.strictEqual(beforeTimeout.activeSessions, baseline.activeSessions + 1, 'Session should occupy one additional active slot');
+        assert.strictEqual(beforeTimeout.authenticatedSessions, baseline.authenticatedSessions + 1, 'Session should add one authenticated session');
         // Step 2: Wait for timeout WITHOUT making any requests
         console.log(`  ⏳ Waiting ${TIMEOUT_TEST_WAIT_MS / 1000}s for timeout without activity...`);
         await new Promise(resolve => setTimeout(resolve, TIMEOUT_TEST_WAIT_MS));
+        await waitForSessionDecrease(mcpUrl, beforeTimeout);
+        console.log('  ✓ Timeout closed transport and released active session slot');
         // Step 3: Try to make request WITHOUT auth header - should fail with 401
         try {
             const response = await fetch(mcpUrl, {

package/build/test/stateless/callback-proxy.test.js

@@ -34,7 +34,7 @@ function loadMaterial(current, previous) {
     return m;
 }
 function makeProvider(material, { callbackProxy = true } = {}) {
-    return createGitLabOAuthProvider(GITLAB_BASE, "real-gitlab-app-id", "Test Server", false, undefined, callbackProxy, callbackProxy ? CALLBACK_URL : "", material
+    return createGitLabOAuthProvider(GITLAB_BASE, "real-gitlab-app-id", "Test Server", false, undefined, undefined, callbackProxy, callbackProxy ? CALLBACK_URL : "", material
         ? {
             material,
             clientTtlSeconds: 86400,

package/build/test/stateless/client-id.test.js

@@ -31,6 +31,7 @@ function loadMaterial(current, previous) {
 function makeProvider(material, { callbackProxy = false } = {}) {
     return createGitLabOAuthProvider("https://gitlab.example.com", "real-gitlab-app-id", "GitLab MCP Server (test)", false, // readOnly
     undefined, // customScopes
+    undefined, // allowedGroups
     callbackProxy, callbackProxy ? "https://mcp.example.com/callback" : "", material
         ? {
             material,

package/build/test/test-protected-branches.js

@@ -0,0 +1,155 @@
+import { after, before, describe, test } from "node:test";
+import assert from "node:assert";
+import { spawn } from "child_process";
+import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
+const MOCK_TOKEN = "glpat-mock-token-protected-branches";
+const TEST_PROJECT_ID = "123";
+const TEST_BRANCH = "main";
+function buildProtectedBranch(overrides = {}) {
+    return {
+        id: 1,
+        name: TEST_BRANCH,
+        push_access_levels: [
+            { access_level: 30, access_level_description: "Developers + Maintainers" },
+        ],
+        merge_access_levels: [{ access_level: 40, access_level_description: "Maintainers" }],
+        unprotect_access_levels: [{ access_level: 60, access_level_description: "Administrators" }],
+        allow_force_push: false,
+        code_owner_approval_required: false,
+        ...overrides,
+    };
+}
+async function callTool(toolName, args, env) {
+    return new Promise((resolve, reject) => {
+        const proc = spawn("node", ["build/index.js"], {
+            stdio: ["pipe", "pipe", "pipe"],
+            env: {
+                ...process.env,
+                ...env,
+            },
+        });
+        let output = "";
+        let errorOutput = "";
+        proc.stdout?.on("data", (d) => (output += d));
+        proc.stderr?.on("data", (d) => (errorOutput += d));
+        proc.on("close", code => {
+            if (code !== 0) {
+                reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
+                return;
+            }
+            const line = output.split("\n").find(l => l.startsWith("{"));
+            if (!line) {
+                reject(new Error("No JSON output found"));
+                return;
+            }
+            const response = JSON.parse(line);
+            if (response.error) {
+                reject(new Error(response.error.message ?? JSON.stringify(response.error)));
+                return;
+            }
+            const content = response.result?.content?.[0]?.text;
+            if (!content) {
+                resolve(response.result);
+                return;
+            }
+            try {
+                resolve(JSON.parse(content));
+            }
+            catch {
+                resolve(content);
+            }
+        });
+        proc.stdin?.end(JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "tools/call",
+            params: { name: toolName, arguments: args },
+        }) + "\n");
+    });
+}
+describe("protected branch tools", () => {
+    let mockGitLab;
+    let mockGitLabUrl;
+    before(async () => {
+        const mockPort = await findMockServerPort(20500, 50);
+        mockGitLab = new MockGitLabServer({
+            port: mockPort,
+            validTokens: [MOCK_TOKEN],
+        });
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/protected_branches`, (req, res) => {
+            assert.strictEqual(req.query.search, "main");
+            assert.strictEqual(req.query.page, "2");
+            assert.strictEqual(req.query.per_page, "10");
+            res.json([buildProtectedBranch()]);
+        });
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/protected_branches/${TEST_BRANCH}`, (_req, res) => {
+            res.json(buildProtectedBranch());
+        });
+        mockGitLab.addMockHandler("post", `/projects/${TEST_PROJECT_ID}/protected_branches`, (req, res) => {
+            assert.deepStrictEqual(req.body, {
+                name: TEST_BRANCH,
+                push_access_level: 30,
+                merge_access_level: 40,
+                unprotect_access_level: 60,
+                allow_force_push: false,
+                code_owner_approval_required: false,
+            });
+            res.status(201).json(buildProtectedBranch());
+        });
+        mockGitLab.addMockHandler("delete", `/projects/${TEST_PROJECT_ID}/protected_branches/${TEST_BRANCH}`, (_req, res) => {
+            res.status(204).send();
+        });
+        mockGitLab.addMockHandler("put", `/projects/${TEST_PROJECT_ID}`, (req, res) => {
+            assert.deepStrictEqual(req.body, { default_branch: TEST_BRANCH });
+            res.json({ id: Number(TEST_PROJECT_ID), default_branch: TEST_BRANCH });
+        });
+        await mockGitLab.start();
+        mockGitLabUrl = mockGitLab.getUrl();
+    });
+    after(async () => {
+        await mockGitLab.stop();
+    });
+    const env = () => ({
+        GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+        GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        GITLAB_TOOLSETS: "branches",
+    });
+    test("list_protected_branches forwards search and pagination", async () => {
+        const result = await callTool("list_protected_branches", { project_id: TEST_PROJECT_ID, search: "main", page: 2, per_page: 10 }, env());
+        assert.ok(Array.isArray(result));
+        assert.strictEqual(result[0].name, TEST_BRANCH);
+    });
+    test("get_protected_branch parses a single protected branch", async () => {
+        const result = await callTool("get_protected_branch", { project_id: TEST_PROJECT_ID, branch_name: TEST_BRANCH }, env());
+        assert.strictEqual(result.name, TEST_BRANCH);
+        assert.strictEqual(result.allow_force_push, false);
+    });
+    test("protect_branch posts normalized branch name, access levels, and false booleans", async () => {
+        const result = await callTool("protect_branch", {
+            project_id: TEST_PROJECT_ID,
+            branch_name: TEST_BRANCH,
+            push_access_level: "30",
+            merge_access_level: 40,
+            unprotect_access_level: 60,
+            allow_force_push: "false",
+            code_owner_approval_required: "false",
+        }, env());
+        assert.strictEqual(result.name, TEST_BRANCH);
+    });
+    test("protect_branch rejects invalid access levels before calling GitLab", async () => {
+        await assert.rejects(() => callTool("protect_branch", {
+            project_id: TEST_PROJECT_ID,
+            branch_name: TEST_BRANCH,
+            push_access_level: 99,
+        }, env()), /Access level must be one of/);
+    });
+    test("unprotect_branch sends DELETE and returns status", async () => {
+        const result = await callTool("unprotect_branch", { project_id: TEST_PROJECT_ID, branch_name: TEST_BRANCH }, env());
+        assert.deepStrictEqual(result, { status: "unprotected", branch: TEST_BRANCH });
+    });
+    test("update_default_branch sends the expected PUT body", async () => {
+        const result = await callTool("update_default_branch", { project_id: TEST_PROJECT_ID, default_branch: TEST_BRANCH }, env());
+        assert.strictEqual(result.status, "updated");
+        assert.strictEqual(result.default_branch, TEST_BRANCH);
+    });
+});

package/build/test/test-toolset-filtering.js

@@ -19,7 +19,7 @@ const TOOLSET_TOOL_COUNTS = {
     merge_requests: 41,
     issues: 24,
     repositories: 7,
-    branches: 10,
+    branches: 15,
     projects: 9,
     labels: 5,
     ci: 2,

package/build/tools/registry.js

@@ -1,7 +1,7 @@
 import { zodToJsonSchema } from "zod-to-json-schema";
 import { toJSONSchema } from "../utils/schema.js";
 import { USE_GITLAB_WIKI, USE_MILESTONE, USE_PIPELINE, SSE, STREAMABLE_HTTP, } from "../config.js";
-import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteBranchSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadAttachmentRemoteSchema, DownloadJobArtifactsSchema, DownloadJobArtifactsRemoteSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, HealthCheckSchema, GetBranchSchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GetDeploymentSchema, GetDraftNoteSchema, GetEnvironmentSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, GetPipelineSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetTimelineEventsSchema, GetUsersSchema, GetUserSchema, WhoAmISchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListBranchesSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListPipelinesSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, } from "../schemas.js";
+import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UnprotectBranchSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadAttachmentRemoteSchema, DownloadJobArtifactsSchema, DownloadJobArtifactsRemoteSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, HealthCheckSchema, GetBranchSchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GetDeploymentSchema, GetDraftNoteSchema, GetEnvironmentSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, GetPipelineSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetTimelineEventsSchema, GetUsersSchema, GetUserSchema, WhoAmISchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListBranchesSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListPipelinesSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, } from "../schemas.js";
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
 // Define all available tools
 export const allTools = [
@@ -105,6 +105,31 @@ export const allTools = [
         description: "Delete branch from project",
         inputSchema: toJSONSchema(DeleteBranchSchema),
     },
+    {
+        name: "list_protected_branches",
+        description: "List protected branches in a project, supports search filter",
+        inputSchema: toJSONSchema(ListProtectedBranchesSchema),
+    },
+    {
+        name: "get_protected_branch",
+        description: "Get details of a single protected branch (access levels, force push settings)",
+        inputSchema: toJSONSchema(GetProtectedBranchSchema),
+    },
+    {
+        name: "protect_branch",
+        description: "Protect a repository branch (set push/merge/unprotect access levels)",
+        inputSchema: toJSONSchema(ProtectBranchSchema),
+    },
+    {
+        name: "unprotect_branch",
+        description: "Remove protection from a previously protected branch",
+        inputSchema: toJSONSchema(UnprotectBranchSchema),
+    },
+    {
+        name: "update_default_branch",
+        description: "Change the default branch of a project",
+        inputSchema: toJSONSchema(UpdateDefaultBranchSchema),
+    },
     {
         name: "get_merge_request",
         description: "Get details of a merge request (mergeRequestIid or branchName required)",
@@ -1038,6 +1063,8 @@ export const readOnlyTools = new Set([
     "get_branch",
     "list_branches",
     "get_branch_diffs",
+    "list_protected_branches",
+    "get_protected_branch",
     "list_merge_request_pipelines",
     "get_merge_request_note",
     "get_merge_request_notes",
@@ -1149,6 +1176,9 @@ export const destructiveTools = new Set([
     "delete_work_item_emoji_reaction",
     "delete_work_item_note_emoji_reaction",
     "delete_branch",
+    "unprotect_branch",
+    "protect_branch",
+    "update_default_branch",
     "merge_merge_request",
     "push_files",
     "delete_project_variable",
@@ -1306,6 +1336,11 @@ export const TOOLSET_DEFINITIONS = [
             "get_branch",
             "list_branches",
             "delete_branch",
+            "list_protected_branches",
+            "get_protected_branch",
+            "protect_branch",
+            "unprotect_branch",
+            "update_default_branch",
             "list_commits",
             "get_commit",
             "get_commit_diff",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.18",
+  "version": "2.1.19",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
@@ -51,7 +51,7 @@
     "changelog": "auto-changelog -p",
     "test": "npm run test:all",
     "test:all": "npm run build && npm run test:mock && npm run test:live",
-    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts && node --import tsx/esm --test test/test-ci-variables.ts && node --import tsx/esm --test test/test-dependency-proxy.ts",
+    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-protected-branches.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts && node --import tsx/esm --test test/test-ci-variables.ts && node --import tsx/esm --test test/test-dependency-proxy.ts",
     "test:stateless": "npm run build && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts",
     "test:mcp-oauth": "npm run build && node --import tsx/esm --test test/mcp-oauth-tests.ts",
     "test:live": "node test/validate-api.js",