@zereight/mcp-gitlab 2.1.22 → 2.1.24

package/README.ko.md

@@ -2,7 +2,7 @@
 
 [English](./README.md) | [한국어](./README.ko.md) | [简体中文](./README.zh-CN.md)
 
-> **새 기능**: 커넥션 풀링을 포함한 동적 GitLab API URL을 지원합니다. 자세한 내용은 [Dynamic API URL 문서](docs/dynamic-api-url.md)를 참고하세요.
+> **새 기능**: 커넥션 풀링을 포함한 동적 GitLab API URL을 지원합니다. 자세한 내용은 [Dynamic API URL 문서](docs/configuration/dynamic-api-url.md)를 참고하세요.
 
 [![Star History Chart](https://api.star-history.com/svg?repos=zereight/gitlab-mcp&type=Date)](https://www.star-history.com/#zereight/gitlab-mcp&Date)
 
@@ -24,14 +24,14 @@ PAT, OAuth, 읽기 전용 모드, 동적 API URL, 원격 인증을 지원하며
 
 ### 클라이언트 설정 가이드
 
-- [Claude Code 설정 가이드](./docs/claude-code-setup.md)
-- [VS Code 설정 가이드](./docs/vscode-setup.md)
-- [GitHub Copilot 설정 가이드](./docs/copilot-setup.md)
-- [Codex 설정 가이드](./docs/codex-setup.md)
-- [Cursor 설정 가이드](./docs/cursor-setup.md)
-- [JSON 기반 MCP 클라이언트 설정 가이드](./docs/json-mcp-clients-setup.md) - Factory AI Droid, OpenClaw, OpenCode 스타일 클라이언트용
-- [OAuth2 인증 설정 가이드](./docs/oauth-setup.md)
-- [환경 변수 레퍼런스](./docs/environment-variables.md)
+- [Claude Code 설정 가이드](./docs/clients/claude-code.md)
+- [VS Code 설정 가이드](./docs/clients/vscode.md)
+- [GitHub Copilot 설정 가이드](./docs/clients/copilot.md)
+- [Codex 설정 가이드](./docs/clients/codex.md)
+- [Cursor 설정 가이드](./docs/clients/cursor.md)
+- [JSON 기반 MCP 클라이언트 설정 가이드](./docs/clients/json-clients.md) - Factory AI Droid, OpenClaw, OpenCode 스타일 클라이언트용
+- [OAuth2 인증 설정 가이드](./docs/auth/oauth-setup.md)
+- [환경 변수 레퍼런스](./docs/configuration/environment-variables.md)
 
 ## 사용법
 
@@ -53,13 +53,13 @@ PAT, OAuth, 읽기 전용 모드, 동적 API URL, 원격 인증을 지원하며
 
 #### 빠른 설정 경로
 
-- **Claude Code**: [Claude Code 설정 가이드](./docs/claude-code-setup.md)
-- **VS Code**: [VS Code 설정 가이드](./docs/vscode-setup.md)
-- **GitHub Copilot**: [GitHub Copilot 설정 가이드](./docs/copilot-setup.md)
-- **Codex**: [Codex 설정 가이드](./docs/codex-setup.md)
-- **Cursor**: [Cursor 설정 가이드](./docs/cursor-setup.md)
-- **Factory AI Droid / OpenClaw / OpenCode 스타일 클라이언트**: [JSON 기반 MCP 클라이언트 설정 가이드](./docs/json-mcp-clients-setup.md)
-- **OAuth 브라우저 플로우 상세**: [OAuth2 인증 설정 가이드](./docs/oauth-setup.md)
+- **Claude Code**: [Claude Code 설정 가이드](./docs/clients/claude-code.md)
+- **VS Code**: [VS Code 설정 가이드](./docs/clients/vscode.md)
+- **GitHub Copilot**: [GitHub Copilot 설정 가이드](./docs/clients/copilot.md)
+- **Codex**: [Codex 설정 가이드](./docs/clients/codex.md)
+- **Cursor**: [Cursor 설정 가이드](./docs/clients/cursor.md)
+- **Factory AI Droid / OpenClaw / OpenCode 스타일 클라이언트**: [JSON 기반 MCP 클라이언트 설정 가이드](./docs/clients/json-clients.md)
+- **OAuth 브라우저 플로우 상세**: [OAuth2 인증 설정 가이드](./docs/auth/oauth-setup.md)
 
 가장 단순한 로컬 설정은 Personal Access Token으로 시작하세요. 브라우저 기반 로컬 인증은 OAuth2를 사용하세요. 원격 또는 멀티 유저 배포는 아래 MCP OAuth 및 원격 인증 섹션을 참고하세요.
 
@@ -163,10 +163,10 @@ OpenCode, MCPJam, Claude.ai 같은 원격 MCP 클라이언트는 인증 중에
 
 원격 MCP OAuth는 다릅니다. `GITLAB_MCP_OAUTH=true` 모드에서는 MCP 클라이언트가 `/authorize` 요청 중에 자체 callback URL을 제공합니다. `GITLAB_OAUTH_REDIRECT_URI`는 그 클라이언트 제공 URL을 대체하지 않습니다.
 
-| 모드 | 활성화 변수 | Callback 변수 | GitLab Redirect URI |
-| --- | --- | --- | --- |
-| 로컬 OAuth | `GITLAB_USE_OAUTH=true` | `GITLAB_OAUTH_REDIRECT_URI` | `http://127.0.0.1:8888/callback` 또는 로컬 callback |
-| 원격 MCP OAuth | `GITLAB_MCP_OAUTH=true` | `GITLAB_OAUTH_CALLBACK_PROXY=true` | `{MCP_SERVER_URL}/callback` |
+| 모드           | 활성화 변수             | Callback 변수                      | GitLab Redirect URI                                 |
+| -------------- | ----------------------- | ---------------------------------- | --------------------------------------------------- |
+| 로컬 OAuth     | `GITLAB_USE_OAUTH=true` | `GITLAB_OAUTH_REDIRECT_URI`        | `http://127.0.0.1:8888/callback` 또는 로컬 callback |
+| 원격 MCP OAuth | `GITLAB_MCP_OAUTH=true` | `GITLAB_OAUTH_CALLBACK_PROXY=true` | `{MCP_SERVER_URL}/callback`                         |
 
 MCP 서버가 직접 로컬 브라우저 callback을 받을 때만 `GITLAB_OAUTH_REDIRECT_URI`를 사용하세요. 원격 MCP 클라이언트가 callback URL을 소유하는 경우에는 `GITLAB_OAUTH_CALLBACK_PROXY=true`를 사용하세요.
 
@@ -178,15 +178,15 @@ MCP 서버가 직접 로컬 브라우저 callback을 받을 때만 `GITLAB_OAUTH
 2. `api` 또는 `read_api` scope가 있는 사전 등록 GitLab OAuth 애플리케이션
    — `Admin area` → `Applications`에서 Redirect URI를 `{MCP_SERVER_URL}/callback`으로 설정하세요.
 
-| 환경 변수 | 필수 | 설명 |
-| --- | --- | --- |
-| `GITLAB_MCP_OAUTH` | 예 | 활성화하려면 `true` |
-| `GITLAB_API_URL` | 예 | GitLab API base URL |
-| `GITLAB_OAUTH_APP_ID` | 예 | GitLab OAuth Application ID |
-| `MCP_SERVER_URL` | 예 | 이 MCP 서버의 공개 HTTPS URL |
-| `STREAMABLE_HTTP` | 예 | 반드시 `true` |
-| `GITLAB_OAUTH_CALLBACK_PROXY` | 선택 | MCP 서버의 고정 `/callback` URL을 사용하려면 `true` |
-| `GITLAB_OAUTH_SCOPES` | 선택 | 쉼표로 구분된 scope 목록(기본값: `api,read_api,read_user`) |
+| 환경 변수                     | 필수 | 설명                                                       |
+| ----------------------------- | ---- | ---------------------------------------------------------- |
+| `GITLAB_MCP_OAUTH`            | 예   | 활성화하려면 `true`                                        |
+| `GITLAB_API_URL`              | 예   | GitLab API base URL                                        |
+| `GITLAB_OAUTH_APP_ID`         | 예   | GitLab OAuth Application ID                                |
+| `MCP_SERVER_URL`              | 예   | 이 MCP 서버의 공개 HTTPS URL                               |
+| `STREAMABLE_HTTP`             | 예   | 반드시 `true`                                              |
+| `GITLAB_OAUTH_CALLBACK_PROXY` | 선택 | MCP 서버의 고정 `/callback` URL을 사용하려면 `true`        |
+| `GITLAB_OAUTH_SCOPES`         | 선택 | 쉼표로 구분된 scope 목록(기본값: `api,read_api,read_user`) |
 | `GITLAB_OAUTH_ALLOWED_GROUPS` | 선택 | 쉼표로 구분된 GitLab 그룹 전체 경로 — 해당 그룹 및 하위 그룹 멤버만 토큰을 발급받을 수 있음 (기존 `GITLAB_ALLOWED_GROUPS` 대체) |
 
 > **`Unregistered redirect_uri` 문제 해결**
@@ -233,10 +233,10 @@ MCP 클라이언트 설정:
 
 **헤더 우선순위**: `Private-Token` > `JOB-TOKEN` > `Authorization: Bearer`
 
-| 환경 변수 | 필수 | 설명 |
-| --- | --- | --- |
-| `REMOTE_AUTHORIZATION` | 예 | 활성화하려면 `true` |
-| `STREAMABLE_HTTP` | 예 | 반드시 `true` |
+| 환경 변수                | 필수 | 설명                                |
+| ------------------------ | ---- | ----------------------------------- |
+| `REMOTE_AUTHORIZATION`   | 예   | 활성화하려면 `true`                 |
+| `STREAMABLE_HTTP`        | 예   | 반드시 `true`                       |
 | `ENABLE_DYNAMIC_API_URL` | 선택 | 요청별 `X-GitLab-API-URL` 헤더 허용 |
 
 **예시 요청 헤더:**
@@ -257,7 +257,7 @@ Authorization: Bearer glpat-xxxxxxxxxxxxxxxxxxxx
 
 전체 환경 변수 목록은 전용 문서를 참고하세요.
 
-- [환경 변수 레퍼런스](./docs/environment-variables.md)
+- [환경 변수 레퍼런스](./docs/configuration/environment-variables.md)
 
 대부분의 사용자는 아래 시작 조합 중 하나만 필요합니다.
 
@@ -283,7 +283,7 @@ Authorization: Bearer glpat-xxxxxxxxxxxxxxxxxxxx
 - 전송 및 세션 변수
 - 프록시 및 TLS 변수
 
-콜백 프록시 모드 상세는 [GitLab MCP OAuth Callback Proxy](./docs/oauth-callback-proxy.md)를 참고하세요.
+콜백 프록시 모드 상세는 [GitLab MCP OAuth Callback Proxy](./docs/auth/oauth-callback-proxy.md)를 참고하세요.
 
 ### 원격 인증 설정(멀티 유저 지원)
 
@@ -411,15 +411,15 @@ node build/index.js
 
 **환경 변수:**
 
-| 변수 | 필수 | 설명 |
-| --- | --- | --- |
-| `GITLAB_MCP_OAUTH` | 예 | 활성화하려면 `true` |
-| `GITLAB_OAUTH_APP_ID` | 예 | 사전 등록 GitLab OAuth 애플리케이션의 client ID |
-| `MCP_SERVER_URL` | 예 | MCP 서버의 공개 HTTPS URL |
-| `GITLAB_API_URL` | 예 | GitLab 인스턴스 API URL(예: `https://gitlab.com/api/v4`) |
-| `STREAMABLE_HTTP` | 예 | 반드시 `true`(SSE 미지원) |
-| `GITLAB_OAUTH_SCOPES` | 아니오 | 요청할 GitLab scope 목록(쉼표 구분). 기본값은 `api` 또는 `GITLAB_READ_ONLY_MODE=true`일 때 `read_api`입니다. 사전 등록 애플리케이션에 해당 scope가 설정되어 있어야 합니다. |
-| `MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL` | 아니오 | 로컬 HTTP 개발에서만 `true` |
+| 변수                                        | 필수   | 설명                                                                                                                                                                       |
+| ------------------------------------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `GITLAB_MCP_OAUTH`                          | 예     | 활성화하려면 `true`                                                                                                                                                        |
+| `GITLAB_OAUTH_APP_ID`                       | 예     | 사전 등록 GitLab OAuth 애플리케이션의 client ID                                                                                                                            |
+| `MCP_SERVER_URL`                            | 예     | MCP 서버의 공개 HTTPS URL                                                                                                                                                  |
+| `GITLAB_API_URL`                            | 예     | GitLab 인스턴스 API URL(예: `https://gitlab.com/api/v4`)                                                                                                                   |
+| `STREAMABLE_HTTP`                           | 예     | 반드시 `true`(SSE 미지원)                                                                                                                                                  |
+| `GITLAB_OAUTH_SCOPES`                       | 아니오 | 요청할 GitLab scope 목록(쉼표 구분). 기본값은 `api` 또는 `GITLAB_READ_ONLY_MODE=true`일 때 `read_api`입니다. 사전 등록 애플리케이션에 해당 scope가 설정되어 있어야 합니다. |
+| `MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL` | 아니오 | 로컬 HTTP 개발에서만 `true`                                                                                                                                                |
 
 **중요 사항:**
 

package/README.md

@@ -2,7 +2,9 @@
 
 [English](./README.md) | [한국어](./README.ko.md) | [简体中文](./README.zh-CN.md)
 
-> **New Feature**: Dynamic GitLab API URL support with connection pooling! See [Dynamic API URL Documentation](docs/dynamic-api-url.md) for details.
+📖 **[Documentation →](https://zereight.github.io/gitlab-mcp/)** Setup guides, environment variables, and the full tool reference live on the hosted docs site.
+
+> **New Feature**: Dynamic GitLab API URL support with connection pooling! See [Dynamic API URL Documentation](docs/configuration/dynamic-api-url.md) for details.
 
 [![Star History Chart](https://api.star-history.com/svg?repos=zereight/gitlab-mcp&type=Date)](https://www.star-history.com/#zereight/gitlab-mcp&Date)
 
@@ -24,16 +26,16 @@ Quick start: choose either Personal Access Token or OAuth2 setup below and use `
 
 ### Client Setup Guides
 
-- [Claude Code Setup Guide](./docs/claude-code-setup.md)
-- [VS Code Setup Guide](./docs/vscode-setup.md)
-- [GitHub Copilot Setup Guide](./docs/copilot-setup.md)
-- [Codex Setup Guide](./docs/codex-setup.md)
-- [Cursor Setup Guide](./docs/cursor-setup.md)
-- [JSON-Based MCP Clients Setup Guide](./docs/json-mcp-clients-setup.md) - for Factory AI Droid, OpenClaw, and OpenCode style clients
-- [OAuth2 Authentication Setup Guide](./docs/oauth-setup.md)
-- [Environment Variables Reference](./docs/environment-variables.md)
-- [Stateless Mode — Multi-Pod HPA](./docs/stateless-mode.md)
-- [Custom Agents and Multiple PAT Setup](./docs/custom-agent-multiple-pat.md)
+- [Claude Code Setup Guide](./docs/clients/claude-code.md)
+- [VS Code Setup Guide](./docs/clients/vscode.md)
+- [GitHub Copilot Setup Guide](./docs/clients/copilot.md)
+- [Codex Setup Guide](./docs/clients/codex.md)
+- [Cursor Setup Guide](./docs/clients/cursor.md)
+- [JSON-Based MCP Clients Setup Guide](./docs/clients/json-clients.md) - for Factory AI Droid, OpenClaw, and OpenCode style clients
+- [OAuth2 Authentication Setup Guide](./docs/auth/oauth-setup.md)
+- [Environment Variables Reference](./docs/configuration/environment-variables.md)
+- [Stateless Mode — Multi-Pod HPA](./docs/configuration/stateless-mode.md)
+- [Custom Agents and Multiple PAT Setup](./docs/auth/custom-agent-multiple-pat.md)
 
 ## Usage
 
@@ -55,13 +57,13 @@ The server supports four authentication methods:
 
 #### Quick setup paths
 
-- **Claude Code**: see [Claude Code Setup Guide](./docs/claude-code-setup.md)
-- **VS Code**: see [VS Code Setup Guide](./docs/vscode-setup.md)
-- **GitHub Copilot**: see [GitHub Copilot Setup Guide](./docs/copilot-setup.md)
-- **Codex**: see [Codex Setup Guide](./docs/codex-setup.md)
-- **Cursor**: see [Cursor Setup Guide](./docs/cursor-setup.md)
-- **Factory AI Droid / OpenClaw / OpenCode style clients**: see [JSON-Based MCP Clients Setup Guide](./docs/json-mcp-clients-setup.md)
-- **OAuth browser flow details**: see [OAuth2 Authentication Setup Guide](./docs/oauth-setup.md)
+- **Claude Code**: see [Claude Code Setup Guide](./docs/clients/claude-code.md)
+- **VS Code**: see [VS Code Setup Guide](./docs/clients/vscode.md)
+- **GitHub Copilot**: see [GitHub Copilot Setup Guide](./docs/clients/copilot.md)
+- **Codex**: see [Codex Setup Guide](./docs/clients/codex.md)
+- **Cursor**: see [Cursor Setup Guide](./docs/clients/cursor.md)
+- **Factory AI Droid / OpenClaw / OpenCode style clients**: see [JSON-Based MCP Clients Setup Guide](./docs/clients/json-clients.md)
+- **OAuth browser flow details**: see [OAuth2 Authentication Setup Guide](./docs/auth/oauth-setup.md)
 
 For the simplest local setup, start with a Personal Access Token. For browser-based local auth, use OAuth2. For remote or multi-user deployments, continue to the MCP OAuth and Remote Authorization sections later in this README.
 
@@ -265,13 +267,17 @@ the token to GitLab on behalf of the caller.
 | `REMOTE_AUTHORIZATION`   | ✅       | Set to `true` to enable                                    |
 | `STREAMABLE_HTTP`        | ✅       | Must be `true`                                             |
 | `ENABLE_DYNAMIC_API_URL` | optional | Allow per-request GitLab URL via `X-GitLab-API-URL` header |
-| `MCP_TRUST_PROXY`        | optional | Trust `Forwarded` / `X-Forwarded-*` headers for public download URLs when deployed behind a trusted reverse proxy |
+| `MCP_TRUST_PROXY`        | optional | Trust `Forwarded` / `X-Forwarded-*` headers behind a reverse proxy (download URLs, Express `req.ip`, OAuth rate limits) |
 
 When `MCP_SERVER_URL` is not set, remote download URLs fall back to the local
 server address. Set `MCP_TRUST_PROXY=true` only if the server is reachable through a
 trusted reverse proxy and direct client access to the MCP server is blocked.
-This lets the server derive public download URLs from `Forwarded` /
-`X-Forwarded-Proto`, `X-Forwarded-Host`, and `X-Forwarded-Prefix`.
+This enables Express `trust proxy` for Streamable HTTP and SSE, derives public
+download URLs from `Forwarded` / `X-Forwarded-Proto` / `X-Forwarded-Host` /
+`X-Forwarded-Prefix`, and keeps OAuth endpoint rate limiting working when
+proxies send `X-Forwarded-For` with a client port (for example `1.2.3.4:5678`).
+Existing OAuth+proxy deployments must set this explicitly after the flag was
+introduced.
 
 **Example request headers**:
 
@@ -291,14 +297,14 @@ Authorization: Bearer glpat-xxxxxxxxxxxxxxxxxxxx
 
 Use the dedicated reference for the full environment variable list:
 
-- [Environment Variables Reference](./docs/environment-variables.md)
+- [Environment Variables Reference](./docs/configuration/environment-variables.md)
 
 Most users only need one of these starting sets:
 
 - **Local PAT**: `GITLAB_PERSONAL_ACCESS_TOKEN`, `GITLAB_API_URL`
 - **Local OAuth**: `GITLAB_USE_OAUTH=true`, `GITLAB_OAUTH_CLIENT_ID`, `GITLAB_OAUTH_REDIRECT_URI`, `GITLAB_API_URL`
 - **Remote multi-user HTTP**: `STREAMABLE_HTTP=true`, `REMOTE_AUTHORIZATION=true`, `HOST`, `PORT`
-- **Multi-pod HPA (stateless)**: above + `OAUTH_STATELESS_MODE=true`, `OAUTH_STATELESS_SECRET` (same across all pods). See [Stateless Mode](./docs/stateless-mode.md).
+- **Multi-pod HPA (stateless)**: above + `OAUTH_STATELESS_MODE=true`, `OAUTH_STATELESS_SECRET` (same across all pods). See [Stateless Mode](./docs/configuration/stateless-mode.md).
 
 Commonly referenced variables:
 
@@ -321,7 +327,7 @@ The reference document also covers:
 - transport and session variables
 - proxy and TLS variables
 
-For callback proxy mode details, see [GitLab MCP OAuth Callback Proxy](./docs/oauth-callback-proxy.md).
+For callback proxy mode details, see [GitLab MCP OAuth Callback Proxy](./docs/auth/oauth-callback-proxy.md).
 
 ### Remote Authorization Setup (Multi-User Support)
 

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](./README.md) | [한국어](./README.ko.md) | [简体中文](./README.zh-CN.md)
 
-> **新功能**：支持带连接池的动态 GitLab API URL。详情请参阅 [Dynamic API URL 文档](docs/dynamic-api-url.md)。
+> **新功能**：支持带连接池的动态 GitLab API URL。详情请参阅 [Dynamic API URL 文档](docs/configuration/dynamic-api-url.md)。
 
 [![Star History Chart](https://api.star-history.com/svg?repos=zereight/gitlab-mcp&type=Date)](https://www.star-history.com/#zereight/gitlab-mcp&Date)
 
@@ -24,14 +24,14 @@
 
 ### 客户端设置指南
 
-- [Claude Code 设置指南](./docs/claude-code-setup.md)
-- [VS Code 设置指南](./docs/vscode-setup.md)
-- [GitHub Copilot 设置指南](./docs/copilot-setup.md)
-- [Codex 设置指南](./docs/codex-setup.md)
-- [Cursor 设置指南](./docs/cursor-setup.md)
-- [基于 JSON 的 MCP 客户端设置指南](./docs/json-mcp-clients-setup.md) - 适用于 Factory AI Droid、OpenClaw 和 OpenCode 风格客户端
-- [OAuth2 认证设置指南](./docs/oauth-setup.md)
-- [环境变量参考](./docs/environment-variables.md)
+- [Claude Code 设置指南](./docs/clients/claude-code.md)
+- [VS Code 设置指南](./docs/clients/vscode.md)
+- [GitHub Copilot 设置指南](./docs/clients/copilot.md)
+- [Codex 设置指南](./docs/clients/codex.md)
+- [Cursor 设置指南](./docs/clients/cursor.md)
+- [基于 JSON 的 MCP 客户端设置指南](./docs/clients/json-clients.md) - 适用于 Factory AI Droid、OpenClaw 和 OpenCode 风格客户端
+- [OAuth2 认证设置指南](./docs/auth/oauth-setup.md)
+- [环境变量参考](./docs/configuration/environment-variables.md)
 
 ## 使用方法
 
@@ -53,13 +53,13 @@
 
 #### 快速设置路径
 
-- **Claude Code**：[Claude Code 设置指南](./docs/claude-code-setup.md)
-- **VS Code**：[VS Code 设置指南](./docs/vscode-setup.md)
-- **GitHub Copilot**：[GitHub Copilot 设置指南](./docs/copilot-setup.md)
-- **Codex**：[Codex 设置指南](./docs/codex-setup.md)
-- **Cursor**：[Cursor 设置指南](./docs/cursor-setup.md)
-- **Factory AI Droid / OpenClaw / OpenCode 风格客户端**：[基于 JSON 的 MCP 客户端设置指南](./docs/json-mcp-clients-setup.md)
-- **OAuth 浏览器流程详情**：[OAuth2 认证设置指南](./docs/oauth-setup.md)
+- **Claude Code**：[Claude Code 设置指南](./docs/clients/claude-code.md)
+- **VS Code**：[VS Code 设置指南](./docs/clients/vscode.md)
+- **GitHub Copilot**：[GitHub Copilot 设置指南](./docs/clients/copilot.md)
+- **Codex**：[Codex 设置指南](./docs/clients/codex.md)
+- **Cursor**：[Cursor 设置指南](./docs/clients/cursor.md)
+- **Factory AI Droid / OpenClaw / OpenCode 风格客户端**：[基于 JSON 的 MCP 客户端设置指南](./docs/clients/json-clients.md)
+- **OAuth 浏览器流程详情**：[OAuth2 认证设置指南](./docs/auth/oauth-setup.md)
 
 最简单的本地设置可以从 Personal Access Token 开始。基于浏览器的本地认证使用 OAuth2。远程或多用户部署请继续查看下面的 MCP OAuth 和远程授权部分。
 
@@ -163,10 +163,10 @@ OpenCode、MCPJam、Claude.ai 等远程 MCP 客户端可能会在授权时发送
 
 远程 MCP OAuth 不同。在 `GITLAB_MCP_OAUTH=true` 模式下，MCP 客户端会在 `/authorize` 请求中提供自己的 callback URL。`GITLAB_OAUTH_REDIRECT_URI` 不会替换这个客户端提供的 URL。
 
-| 模式 | 启用方式 | Callback 变量 | GitLab Redirect URI |
-| --- | --- | --- | --- |
-| 本地 OAuth | `GITLAB_USE_OAUTH=true` | `GITLAB_OAUTH_REDIRECT_URI` | `http://127.0.0.1:8888/callback` 或你的本地 callback |
-| 远程 MCP OAuth | `GITLAB_MCP_OAUTH=true` | `GITLAB_OAUTH_CALLBACK_PROXY=true` | `{MCP_SERVER_URL}/callback` |
+| 模式           | 启用方式                | Callback 变量                      | GitLab Redirect URI                                  |
+| -------------- | ----------------------- | ---------------------------------- | ---------------------------------------------------- |
+| 本地 OAuth     | `GITLAB_USE_OAUTH=true` | `GITLAB_OAUTH_REDIRECT_URI`        | `http://127.0.0.1:8888/callback` 或你的本地 callback |
+| 远程 MCP OAuth | `GITLAB_MCP_OAUTH=true` | `GITLAB_OAUTH_CALLBACK_PROXY=true` | `{MCP_SERVER_URL}/callback`                          |
 
 只有当 MCP 服务器自己接收本地浏览器 callback 时，才使用 `GITLAB_OAUTH_REDIRECT_URI`。当远程 MCP 客户端拥有 callback URL 时，请使用 `GITLAB_OAUTH_CALLBACK_PROXY=true`。
 
@@ -178,15 +178,15 @@ OpenCode、MCPJam、Claude.ai 等远程 MCP 客户端可能会在授权时发送
 2. 预先注册的 GitLab OAuth 应用，包含 `api` 或 `read_api` scopes
    — 前往 `Admin area` → `Applications`，将 Redirect URI 设置为 `{MCP_SERVER_URL}/callback`
 
-| 环境变量 | 必需 | 说明 |
-| --- | --- | --- |
-| `GITLAB_MCP_OAUTH` | 是 | 设置为 `true` 以启用 |
-| `GITLAB_API_URL` | 是 | GitLab API base URL |
-| `GITLAB_OAUTH_APP_ID` | 是 | GitLab OAuth Application ID |
-| `MCP_SERVER_URL` | 是 | 此 MCP 服务器的公开 HTTPS URL |
-| `STREAMABLE_HTTP` | 是 | 必须为 `true` |
+| 环境变量                      | 必需 | 说明                                                  |
+| ----------------------------- | ---- | ----------------------------------------------------- |
+| `GITLAB_MCP_OAUTH`            | 是   | 设置为 `true` 以启用                                  |
+| `GITLAB_API_URL`              | 是   | GitLab API base URL                                   |
+| `GITLAB_OAUTH_APP_ID`         | 是   | GitLab OAuth Application ID                           |
+| `MCP_SERVER_URL`              | 是   | 此 MCP 服务器的公开 HTTPS URL                         |
+| `STREAMABLE_HTTP`             | 是   | 必须为 `true`                                         |
 | `GITLAB_OAUTH_CALLBACK_PROXY` | 可选 | 设置为 `true` 时使用 MCP 服务器固定的 `/callback` URL |
-| `GITLAB_OAUTH_SCOPES` | 可选 | 逗号分隔的 scope（默认：`api,read_api,read_user`） |
+| `GITLAB_OAUTH_SCOPES`         | 可选 | 逗号分隔的 scope（默认：`api,read_api,read_user`）    |
 | `GITLAB_OAUTH_ALLOWED_GROUPS` | 可选 | 逗号分隔的 GitLab 群组完整路径 — 仅该群组及其子群组的成员可获取令牌（替代已废弃的 `GITLAB_ALLOWED_GROUPS`）|
 
 > **排查 `Unregistered redirect_uri`**
@@ -233,10 +233,10 @@ MCP 客户端配置：
 
 **请求头优先级**：`Private-Token` > `JOB-TOKEN` > `Authorization: Bearer`
 
-| 环境变量 | 必需 | 说明 |
-| --- | --- | --- |
-| `REMOTE_AUTHORIZATION` | 是 | 设置为 `true` 以启用 |
-| `STREAMABLE_HTTP` | 是 | 必须为 `true` |
+| 环境变量                 | 必需 | 说明                                                    |
+| ------------------------ | ---- | ------------------------------------------------------- |
+| `REMOTE_AUTHORIZATION`   | 是   | 设置为 `true` 以启用                                    |
+| `STREAMABLE_HTTP`        | 是   | 必须为 `true`                                           |
 | `ENABLE_DYNAMIC_API_URL` | 可选 | 允许按请求通过 `X-GitLab-API-URL` 请求头指定 GitLab URL |
 
 **示例请求头：**
@@ -257,7 +257,7 @@ Authorization: Bearer glpat-xxxxxxxxxxxxxxxxxxxx
 
 完整环境变量列表请查看专门的参考文档：
 
-- [环境变量参考](./docs/environment-variables.md)
+- [环境变量参考](./docs/configuration/environment-variables.md)
 
 大多数用户只需要以下起始组合之一：
 
@@ -283,7 +283,7 @@ Authorization: Bearer glpat-xxxxxxxxxxxxxxxxxxxx
 - 传输和会话变量
 - 代理和 TLS 变量
 
-回调代理模式详情请参阅 [GitLab MCP OAuth Callback Proxy](./docs/oauth-callback-proxy.md)。
+回调代理模式详情请参阅 [GitLab MCP OAuth Callback Proxy](./docs/auth/oauth-callback-proxy.md)。
 
 ### 远程授权设置（多用户支持）
 
@@ -411,15 +411,15 @@ node build/index.js
 
 **环境变量：**
 
-| 变量 | 必需 | 说明 |
-| --- | --- | --- |
-| `GITLAB_MCP_OAUTH` | 是 | 设置为 `true` 以启用 |
-| `GITLAB_OAUTH_APP_ID` | 是 | 预先注册的 GitLab OAuth 应用 client ID |
-| `MCP_SERVER_URL` | 是 | MCP 服务器的公开 HTTPS URL |
-| `GITLAB_API_URL` | 是 | GitLab 实例 API URL（例如 `https://gitlab.com/api/v4`） |
-| `STREAMABLE_HTTP` | 是 | 必须为 `true`（不支持 SSE） |
-| `GITLAB_OAUTH_SCOPES` | 否 | 要请求的 GitLab scopes，以逗号分隔。默认值为 `api`，当 `GITLAB_READ_ONLY_MODE=true` 时为 `read_api`。预注册应用必须配置至少这些 scopes。 |
-| `MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL` | 否 | 仅用于本地 HTTP 开发 |
+| 变量                                        | 必需 | 说明                                                                                                                                     |
+| ------------------------------------------- | ---- | ---------------------------------------------------------------------------------------------------------------------------------------- |
+| `GITLAB_MCP_OAUTH`                          | 是   | 设置为 `true` 以启用                                                                                                                     |
+| `GITLAB_OAUTH_APP_ID`                       | 是   | 预先注册的 GitLab OAuth 应用 client ID                                                                                                   |
+| `MCP_SERVER_URL`                            | 是   | MCP 服务器的公开 HTTPS URL                                                                                                               |
+| `GITLAB_API_URL`                            | 是   | GitLab 实例 API URL（例如 `https://gitlab.com/api/v4`）                                                                                  |
+| `STREAMABLE_HTTP`                           | 是   | 必须为 `true`（不支持 SSE）                                                                                                              |
+| `GITLAB_OAUTH_SCOPES`                       | 否   | 要请求的 GitLab scopes，以逗号分隔。默认值为 `api`，当 `GITLAB_READ_ONLY_MODE=true` 时为 `read_api`。预注册应用必须配置至少这些 scopes。 |
+| `MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL` | 否   | 仅用于本地 HTTP 开发                                                                                                                     |
 
 **重要说明：**
 

package/build/index.js

@@ -183,6 +183,8 @@ import { z } from "zod";
 import { initializeOAuthClient } from "./oauth.js";
 import { createGitLabOAuthProvider } from "./oauth-proxy.js";
 import { mcpAuthRouter } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { ipKeyGenerator } from "express-rate-limit";
+import { normalizeProxyClientIpForRateLimit } from "./utils/proxy-client-ip.js";
 import { normalizeGitLabApiUrl } from "./utils/url.js";
 import { estimateMergeCommitCount, filterDiffsByPatterns, summarizeWebhookEvents } from "./utils/helpers.js";
 import { graphqlQueryContainsWriteOperation } from "./utils/graphql-query.js";
@@ -718,7 +720,7 @@ async function ensureValidOAuthToken() {
         logger.info("OAuth token refreshed successfully");
     }
     catch (error) {
-        logger.error("Failed to refresh OAuth token:", error);
+        logger.error({ err: error }, "Failed to refresh OAuth token");
         throw error;
     }
 }
@@ -1074,7 +1076,7 @@ async function handleGitLabError(response) {
         const errorBody = await response.text();
         // Check specifically for Rate Limit error
         if (response.status === 403 && errorBody.includes("User API Key Rate limit exceeded")) {
-            logger.error("GitLab API Rate Limit Exceeded:", errorBody);
+            logger.error({ err: errorBody }, "GitLab API Rate Limit Exceeded");
             logger.error("User API Key Rate limit exceeded. Please try again later.");
             throw new Error(`GitLab API Rate Limit Exceeded: ${errorBody}`);
         }
@@ -5498,7 +5500,7 @@ async function getUser(username) {
         return null;
     }
     catch (error) {
-        logger.error(`Error fetching user by username '${username}':`, error);
+        logger.error({ err: error }, `Error fetching user by username '${username}'`);
         return null;
     }
 }
@@ -5517,7 +5519,7 @@ async function getUsers(usernames) {
             users[username] = user;
         }
         catch (error) {
-            logger.error(`Error processing username '${username}':`, error);
+            logger.error({ err: error }, `Error processing username '${username}'`);
             users[username] = null;
         }
     }
@@ -6498,7 +6500,7 @@ async function handleToolCall(params) {
                     };
                 }
                 catch (forkError) {
-                    logger.error("Error forking repository:", forkError);
+                    logger.error({ err: forkError }, "Error forking repository");
                     let forkErrorMessage = "Failed to fork repository";
                     if (forkError instanceof Error) {
                         forkErrorMessage = `${forkErrorMessage}: ${forkError.message}`;
@@ -8702,7 +8704,7 @@ function registerDownloadProxy(app, maxRequestsPerMinute = Number.parseInt(proce
             }
         }
         catch (error) {
-            logger.error("Download proxy error:", error);
+            logger.error({ err: error }, "Download proxy error");
             if (!res.headersSent) {
                 res.status(502).json({ error: "Failed to proxy download from GitLab" });
             }
@@ -8714,6 +8716,9 @@ function registerDownloadProxy(app, maxRequestsPerMinute = Number.parseInt(proce
  */
 async function startSSEServer() {
     const app = express();
+    if (MCP_TRUST_PROXY) {
+        app.set("trust proxy", 1);
+    }
     const transports = {};
     let shuttingDown = false;
     app.get("/sse", async (_, res) => {
@@ -8758,7 +8763,7 @@ async function startSSEServer() {
                 await transport.close();
             }
             catch (error) {
-                logger.error("Error closing SSE transport:", error);
+                logger.error({ err: error }, "Error closing SSE transport");
             }
         }));
         clientPool.closeAll();
@@ -9176,12 +9181,22 @@ async function startStreamableHTTPServer() {
         }
         // Mounts /.well-known/oauth-authorization-server (shadowed above when basePath set),
         //        /.well-known/oauth-protected-resource, /authorize, /token, /register, /revoke
+        // Some proxies include the port in X-Forwarded-For (e.g. "1.2.3.4:5678" or
+        // "[2001:db8::1]:5678"), which makes express-rate-limit throw
+        // ERR_ERL_INVALID_IP_ADDRESS. Strip the port first, then delegate to
+        // ipKeyGenerator for correct IPv6 subnet handling.
+        const rateLimitKeyGenerator = (req) => ipKeyGenerator(normalizeProxyClientIpForRateLimit(req.ip ?? ""));
+        const rateLimitOptions = { keyGenerator: rateLimitKeyGenerator };
         app.use(mcpAuthRouter({
             provider: oauthProvider,
             issuerUrl,
             baseUrl: issuerUrl,
             scopesSupported,
             resourceName: "GitLab MCP Server",
+            authorizationOptions: { rateLimit: rateLimitOptions },
+            tokenOptions: { rateLimit: rateLimitOptions },
+            revocationOptions: { rateLimit: rateLimitOptions },
+            clientRegistrationOptions: { rateLimit: rateLimitOptions },
         }));
         // Expose provider so the /mcp route middleware can reference it
         app._mcpOAuthProvider = oauthProvider;
@@ -9432,7 +9447,7 @@ async function startStreamableHTTPServer() {
                 }
             }
             catch (error) {
-                logger.error("Streamable HTTP error:", error);
+                logger.error({ err: error }, "Streamable HTTP error");
                 res.status(500).json({
                     error: "Internal server error",
                     message: error instanceof Error ? error.message : "Unknown error",
@@ -9516,7 +9531,7 @@ async function startStreamableHTTPServer() {
                 res.status(204).send();
             }
             catch (error) {
-                logger.error(`Error closing session ${sessionId}:`, error);
+                logger.error({ err: error }, `Error closing session ${sessionId}`);
                 res.status(500).json({ error: "Failed to close session" });
             }
         }
@@ -9551,7 +9566,7 @@ async function startStreamableHTTPServer() {
                 }
             }
             catch (error) {
-                logger.error(`Error closing session ${sessionId}:`, error);
+                logger.error({ err: error }, `Error closing session ${sessionId}`);
             }
         });
         await Promise.allSettled(closePromises);
@@ -9572,7 +9587,7 @@ async function startStreamableHTTPServer() {
  * Handle transport-specific initialization logic
  */
 async function initializeServerByTransportMode(mode) {
-    logger.info("Initializing server with transport mode:", mode);
+    logger.info({ mode }, "Initializing server with transport mode");
     switch (mode) {
         case TransportMode.STDIO:
             logger.warn("Starting GitLab MCP Server with stdio transport");
@@ -9612,7 +9627,7 @@ async function runServer() {
                 logger.info("OAuth authentication successful");
             }
             catch (error) {
-                logger.error("OAuth authentication failed:", error);
+                logger.error({ err: error }, "OAuth authentication failed");
                 process.exit(1);
             }
         }
@@ -9633,12 +9648,12 @@ async function runServer() {
         }
     }
     catch (error) {
-        logger.error("Error initializing server:", error);
+        logger.error({ err: error }, "Error initializing server");
         process.exit(1);
     }
 }
 // 下記の２行を追記
 runServer().catch(error => {
-    logger.error("Fatal error in main():", error);
+    logger.fatal({ err: error }, "Fatal error in main()");
     process.exit(1);
 });

package/build/oauth.js

@@ -193,7 +193,7 @@ export class GitLabOAuth {
             logger.info(`Token saved to ${this.tokenStoragePath}`);
         }
         catch (error) {
-            logger.error("Failed to save token:", error);
+            logger.error({ err: error }, "Failed to save token");
             throw error;
         }
     }
@@ -209,7 +209,7 @@ export class GitLabOAuth {
             return JSON.parse(data);
         }
         catch (error) {
-            logger.error("Failed to load token:", error);
+            logger.error({ err: error }, "Failed to load token");
             return null;
         }
     }
@@ -240,7 +240,7 @@ export class GitLabOAuth {
                 return await requestAuthFromExistingServer(callbackPort, requestId);
             }
             catch (error) {
-                logger.error("Failed to connect to existing OAuth server:", error);
+                logger.error({ err: error }, "Failed to connect to existing OAuth server");
                 throw new Error(`Port ${callbackPort} is in use but cannot connect to existing OAuth server. Please close other instances or use a different port.`);
             }
         }
@@ -285,7 +285,7 @@ export class GitLabOAuth {
                         logger.info("Opening browser for new authentication request...");
                         logger.info(`If browser doesn't open, visit: ${authUrl}`);
                         open(authUrl).catch(err => {
-                            logger.error("Failed to open browser:", err);
+                            logger.error({ err }, "Failed to open browser");
                             logger.info(`Please manually open: ${authUrl}`);
                         });
                         // Wait for the auth to complete
@@ -430,7 +430,7 @@ export class GitLabOAuth {
                     }
                 }
                 catch (error) {
-                    logger.error("Error handling request:", error);
+                    logger.error({ err: error }, "Error handling request");
                     res.writeHead(500, { "Content-Type": "text/plain" });
                     res.end("Internal Server Error");
                 }
@@ -441,12 +441,12 @@ export class GitLabOAuth {
                 logger.info("Opening browser for authentication...");
                 logger.info(`If browser doesn't open, visit: ${authUrl}`);
                 open(authUrl).catch(err => {
-                    logger.error("Failed to open browser:", err);
+                    logger.error({ err }, "Failed to open browser");
                     logger.info(`Please manually open: ${authUrl}`);
                 });
             });
             server.on("error", error => {
-                logger.error("OAuth server error:", error);
+                logger.error({ err: error }, "OAuth server error");
                 const pending = pendingAuthRequests.get(initialRequestId);
                 if (pending) {
                     clearTimeout(pending.timeout);
@@ -474,7 +474,7 @@ export class GitLabOAuth {
                     this.saveToken(tokenData);
                 }
                 catch (error) {
-                    logger.error("Token refresh failed. Starting new OAuth flow...", error);
+                    logger.error({ err: error }, "Token refresh failed. Starting new OAuth flow...");
                     tokenData = await this.startOAuthFlow();
                 }
             }
@@ -496,7 +496,7 @@ export class GitLabOAuth {
             }
         }
         catch (error) {
-            logger.error("Failed to clear token:", error);
+            logger.error({ err: error }, "Failed to clear token");
         }
     }
     /**

package/build/schemas.js

@@ -467,7 +467,10 @@ export const RetryPipelineSchema = z.object({
     pipeline_id: z.coerce.string().describe("The ID of the pipeline to retry"),
 });
 // Schema for canceling a pipeline
-export const CancelPipelineSchema = RetryPipelineSchema;
+export const CancelPipelineSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    pipeline_id: z.coerce.string().describe("The ID of the pipeline to cancel"),
+});
 // Schema for the input parameters for pipeline job operations
 export const GetPipelineJobOutputSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
@@ -1668,7 +1671,7 @@ export const MergeMergeRequestSchema = ProjectParamsSchema.extend({
         .boolean()
         .optional()
         .default(false)
-        .describe("If true, the merge request merges when the pipeline succeeds.in GitLab 17.11. Use"),
+        .describe("If true, the merge request merges when the pipeline succeeds. Deprecated in GitLab 17.11. Use `auto_merge` instead."),
     should_remove_source_branch: z.coerce
         .boolean()
         .optional()
@@ -2091,7 +2094,7 @@ export const ListLabelsSchema = z
     with_counts: z
         .coerce.boolean()
         .optional()
-        .describe("Whether or not to include issue and merge request counts"),
+        .describe("Whether to include issue and merge request counts"),
     include_ancestor_groups: z.coerce.boolean().optional().describe("Include ancestor groups"),
     search: z.string().optional().describe("Keyword to filter labels by"),
 })

package/build/scripts/generate-tool-docs.js

@@ -0,0 +1,404 @@
+#!/usr/bin/env tsx
+/**
+ * Generate per-group tool reference pages under docs/tools/ from the
+ * authoritative tool registry (tools/registry.ts).
+ *
+ * Run with: npx tsx scripts/generate-tool-docs.ts
+ * Or via:   make tools-docs
+ */
+import { writeFileSync, mkdirSync, readdirSync, unlinkSync, statSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { allTools, readOnlyTools, TOOLSET_DEFINITIONS } from "../tools/registry.js";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = join(__dirname, "..");
+const OUT_DIR = join(REPO_ROOT, "docs", "tools");
+// Legacy single-group env flags that pre-date GITLAB_TOOLSETS.
+// Only three groups have these for backward compatibility; everything else
+// opt-in is configured via GITLAB_TOOLSETS / GITLAB_TOOLS / discover_tools.
+const LEGACY_TOGGLE_ENV = {
+    pipelines: "USE_PIPELINE",
+    milestones: "USE_MILESTONE",
+    wiki: "USE_GITLAB_WIKI",
+};
+function isDefaultToolset(id) {
+    return TOOLSET_DEFINITIONS.find(d => d.id === id)?.isDefault ?? false;
+}
+function computeToggleNote(id) {
+    if (isDefaultToolset(id))
+        return undefined;
+    // Synthetic group for tools not in any TOOLSET_DEFINITIONS entry.
+    // discover_tools is always exposed; execute_graphql is opt-in via GITLAB_TOOLS.
+    if (id === "meta") {
+        return "Mixed availability. `discover_tools` is always exposed (the server re-adds it after every toolset filter). `execute_graphql` is not part of any toolset — enable it explicitly with `GITLAB_TOOLS=execute_graphql`.";
+    }
+    const legacy = LEGACY_TOGGLE_ENV[id];
+    if (legacy) {
+        return `Opt-in. Enable via \`GITLAB_TOOLSETS=${id}\` (or \`GITLAB_TOOLSETS=all\`), or use the legacy \`${legacy}=true\` flag for backward compatibility.`;
+    }
+    return `Opt-in. Enable via \`GITLAB_TOOLSETS=${id}\` (or \`GITLAB_TOOLSETS=all\`), list individual tools in \`GITLAB_TOOLS=\`, or activate at runtime with the \`discover_tools\` MCP tool.`;
+}
+const GROUP_META = {
+    merge_requests: {
+        title: "Merge Requests",
+        blurb: "MR lifecycle — create, update, merge, approve, plus diff/conflict inspection and the full discussion/note/draft API.",
+    },
+    issues: {
+        title: "Issues",
+        blurb: "Issue CRUD, links, discussions and notes, todos, and emoji reactions.",
+    },
+    repositories: {
+        title: "Projects & Files",
+        blurb: "Project search/creation/fork plus the Files API for reading and writing repository content without shelling out to git.",
+    },
+    branches: {
+        title: "Branches & Commits",
+        blurb: "Branch management, commit listing/inspection, file blame, and CI commit-status manipulation.",
+    },
+    projects: {
+        title: "Projects & Namespaces",
+        blurb: "Project/namespace listing, member queries, group iterations, and server health.",
+    },
+    labels: {
+        title: "Labels",
+        blurb: "Project label CRUD.",
+    },
+    ci: {
+        title: "CI Lint",
+        blurb: "Validate `.gitlab-ci.yml` snippets and project pipeline configs.",
+    },
+    groups: {
+        title: "Groups",
+        blurb: "Create new groups and subgroups.",
+    },
+    pipelines: {
+        title: "Pipelines, Jobs & Deployments",
+        blurb: "Pipeline + job control (trigger, retry, cancel, play manual jobs, fetch logs/artifacts), and the deployments/environments view.",
+    },
+    milestones: {
+        title: "Milestones",
+        blurb: "Project milestone CRUD plus associated issues/MRs and burndown events.",
+    },
+    wiki: {
+        title: "Wiki",
+        blurb: "Project and group wiki page CRUD. Attachment uploads where supported.",
+    },
+    releases: {
+        title: "Releases",
+        blurb: "Release lifecycle, release evidence, and asset download.",
+    },
+    tags: {
+        title: "Tags",
+        blurb: "Tag listing, creation, deletion, and signature inspection.",
+    },
+    users: {
+        title: "Users & Events",
+        blurb: "User lookup, the authenticated user (`whoami`), event streams, and markdown attachment upload/download.",
+    },
+    workitems: {
+        title: "Work Items",
+        blurb: "Modern unified API for issues, tasks, incidents, and other typed work items — including notes, emoji reactions, and incident timeline events.",
+    },
+    webhooks: {
+        title: "Webhooks",
+        blurb: "List webhooks configured on projects or groups, and inspect recent webhook events.",
+    },
+    search: {
+        title: "Search",
+        blurb: "Code search across all visible projects, a specific project, or a specific group.",
+    },
+    variables: {
+        title: "Variables",
+        blurb: "Project and group CI/CD variable CRUD.",
+    },
+    dependency_proxy: {
+        title: "Dependency Proxy",
+        blurb: "Inspect and manage the GitLab dependency proxy cache settings, blob storage, and purge operations.",
+    },
+};
+const GROUP_ORDER = [
+    "projects",
+    "repositories",
+    "branches",
+    "groups",
+    "merge_requests",
+    "issues",
+    "labels",
+    "workitems",
+    "ci",
+    "pipelines",
+    "milestones",
+    "wiki",
+    "releases",
+    "tags",
+    "users",
+    "variables",
+    "webhooks",
+    "search",
+    "dependency_proxy",
+];
+// Authoritative classification — uses the `readOnlyTools` set from
+// tools/registry.ts. That set is what the server itself consults to decide
+// which tools survive `GITLAB_READ_ONLY_MODE=true`, so the badges here
+// match real runtime behavior exactly (no prefix heuristics).
+function classify(name) {
+    return readOnlyTools.has(name) ? "read" : "write";
+}
+function rwBadge(name) {
+    return classify(name) === "read" ? "📖 Read-only" : "✏️ Writes";
+}
+function describeType(prop) {
+    if (prop.enum) {
+        return `enum (\`${prop.enum.map(String).join("` \\| `")}\`)`;
+    }
+    if (prop.anyOf || prop.oneOf) {
+        const variants = (prop.anyOf || prop.oneOf || []).map(describeType).filter(Boolean);
+        return variants.join(" \\| ") || "any";
+    }
+    if (Array.isArray(prop.type)) {
+        return prop.type.join(" \\| ");
+    }
+    if (prop.type === "array") {
+        return `array<${prop.items ? describeType(prop.items) : "any"}>`;
+    }
+    if (prop.format && prop.type) {
+        return `${prop.type} (${prop.format})`;
+    }
+    return prop.type || "any";
+}
+function escapePipe(text) {
+    return text.replace(/\|/g, "\\|").replace(/\n/g, " ");
+}
+function paramTable(schema) {
+    if (!schema || !schema.properties || Object.keys(schema.properties).length === 0) {
+        return "_No parameters._";
+    }
+    const required = new Set(schema.required || []);
+    const rows = ["| Parameter | Type | Required | Description |", "|---|---|:-:|---|"];
+    for (const [name, prop] of Object.entries(schema.properties)) {
+        const type = describeType(prop);
+        const req = required.has(name) ? "✓" : "";
+        const desc = escapePipe(prop.description || "");
+        rows.push(`| \`${name}\` | ${type} | ${req} | ${desc} |`);
+    }
+    return rows.join("\n");
+}
+function toolSection(name, description, schema) {
+    return [
+        `### \`${name}\``,
+        "",
+        `*${rwBadge(name)}*`,
+        "",
+        description,
+        "",
+        "**Parameters**",
+        "",
+        paramTable(schema),
+        "",
+    ].join("\n");
+}
+function buildGroupPage(id, toolNames) {
+    const meta = GROUP_META[id];
+    const lines = [`# ${meta.title}`, "", meta.blurb, ""];
+    const toggle = computeToggleNote(id);
+    if (toggle) {
+        lines.push(`!!! note "Feature toggle"`);
+        lines.push(`    ${toggle}`);
+        lines.push("");
+    }
+    // Quick index
+    lines.push("## Tools in this group");
+    lines.push("");
+    for (const name of toolNames) {
+        lines.push(`- [\`${name}\`](#${name.replace(/_/g, "_")}) — ${rwBadge(name)}`);
+    }
+    lines.push("");
+    lines.push("---");
+    lines.push("");
+    for (const name of toolNames) {
+        const tool = allTools.find(t => t.name === name);
+        if (!tool) {
+            throw new Error(`Tool '${name}' referenced in toolset '${id}' but missing from allTools registry`);
+        }
+        lines.push(toolSection(name, tool.description, tool.inputSchema));
+    }
+    return lines.join("\n");
+}
+function buildToggleSection(groupedToolsList) {
+    const grouped = groupedToolsList.filter(([id]) => GROUP_META[id]);
+    const defaults = grouped.filter(([id]) => isDefaultToolset(id));
+    const optins = grouped.filter(([id]) => !isDefaultToolset(id));
+    const formatList = (items) => items
+        .map(([id]) => {
+        const slug = id.replace(/_/g, "-");
+        const legacy = LEGACY_TOGGLE_ENV[id];
+        const suffix = legacy ? ` (also \`${legacy}=true\`)` : "";
+        return `[${GROUP_META[id].title}](${slug}.md)${suffix}`;
+    })
+        .join(", ");
+    return [
+        "| Status | Groups |",
+        "|---|---|",
+        `| **Default** — always exposed | ${formatList(defaults)} |`,
+        `| **Opt-in** — must be enabled | ${formatList(optins)} |`,
+        "",
+        "**How to enable opt-in groups** (any one is sufficient):",
+        "",
+        "- `GITLAB_TOOLSETS=<group,…>` — comma-separated toolset IDs.",
+        "- `GITLAB_TOOLSETS=all` — enables every group.",
+        "- `GITLAB_TOOLS=<tool,…>` — enables individual tools regardless of group.",
+        "- `USE_PIPELINE=true` / `USE_MILESTONE=true` / `USE_GITLAB_WIKI=true` —" +
+            " legacy single-group flags (Pipelines, Milestones, Wiki only).",
+        "- Call the `discover_tools` MCP tool at runtime to activate categories" +
+            " for the current session.",
+    ];
+}
+function buildIndexPage(groupedToolsList) {
+    const lines = [
+        "# Tools Reference",
+        "",
+        "Complete catalog of every tool the GitLab MCP server exposes.",
+        "",
+        "> **Setup first** — if you haven't connected your Personal Access Token or",
+        "> OAuth credentials yet, follow one of the [client setup guides](../clients/claude-code.md)",
+        "> or read [Getting Started](../getting-started/index.md). Tools listed below",
+        "> will be unavailable until the server is authenticated.",
+        "",
+        "## Feature toggles",
+        "",
+        "Toolsets are split into a **default** set (exposed automatically) and an",
+        "**opt-in** set (must be explicitly enabled). The lists below are derived",
+        "directly from `TOOLSET_DEFINITIONS` in",
+        "[`tools/registry.ts`](https://github.com/zereight/gitlab-mcp/blob/main/tools/registry.ts).",
+        "",
+        ...buildToggleSection(groupedToolsList),
+        "",
+        "Read-only mode (`GITLAB_READ_ONLY_MODE=true`) hides every write tool",
+        "regardless of toggles. See [Environment Variables](../configuration/environment-variables.md)",
+        "and [CLI Arguments](../getting-started/cli-arguments.md) for the full list.",
+        "",
+        "## Legend",
+        "",
+        "| Marker | Meaning |",
+        "|---|---|",
+        "| 📖 | **Read-only** — fetches data, does not modify GitLab state. Safe to invoke freely. |",
+        "| ✏️ | **Writes** — creates, updates, or deletes data on GitLab. Confirm intent before running. |",
+        "",
+        "## Browse by group",
+        "",
+        "Each group has its own page with full parameter tables — click any tool name to jump to its details, or click the group title for the per-group view.",
+        "",
+    ];
+    for (const [id, tools] of groupedToolsList) {
+        const meta = GROUP_META[id];
+        const slug = id.replace(/_/g, "-");
+        lines.push(`### [${meta.title}](${slug}.md)`);
+        lines.push("");
+        lines.push(`${meta.blurb} *(${tools.length} tools)*`);
+        lines.push("");
+        const toggle = computeToggleNote(id);
+        if (toggle) {
+            lines.push(`> ${toggle}`);
+            lines.push("");
+        }
+        lines.push("| Tool | What it does | R/W |");
+        lines.push("|---|---|:-:|");
+        for (const name of tools) {
+            const tool = allTools.find(t => t.name === name);
+            if (!tool)
+                continue;
+            const desc = escapePipe(tool.description);
+            const marker = classify(name) === "read" ? "📖" : "✏️";
+            lines.push(`| [\`${name}\`](${slug}.md#${name}) | ${desc} | ${marker} |`);
+        }
+        lines.push("");
+    }
+    lines.push("---");
+    lines.push("");
+    lines.push("## Argument schemas");
+    lines.push("");
+    lines.push("Each group page includes a parameter table per tool, generated from");
+    lines.push("the authoritative Zod schemas in");
+    lines.push("[`schemas.ts`](https://github.com/zereight/gitlab-mcp/blob/main/schemas.ts).");
+    lines.push("For runtime schema inspection from a connected MCP client, call the");
+    lines.push("`discover_tools` tool.");
+    return lines.join("\n");
+}
+// --- Main -----------------------------------------------------------------
+function main() {
+    mkdirSync(OUT_DIR, { recursive: true });
+    // Clean previously generated per-group files (keep index.md until last)
+    for (const file of readdirSync(OUT_DIR)) {
+        const full = join(OUT_DIR, file);
+        if (statSync(full).isFile() && file.endsWith(".md")) {
+            unlinkSync(full);
+        }
+    }
+    const grouped = [];
+    const allCategorizedNames = new Set();
+    for (const id of GROUP_ORDER) {
+        const def = TOOLSET_DEFINITIONS.find(d => d.id === id);
+        if (!def) {
+            throw new Error(`Toolset '${id}' listed in GROUP_ORDER but missing from TOOLSET_DEFINITIONS — keep them in sync`);
+        }
+        // Preserve insertion order from TOOLSET_DEFINITIONS
+        const tools = [...def.tools];
+        for (const t of tools)
+            allCategorizedNames.add(t);
+        grouped.push([id, tools]);
+        const page = buildGroupPage(id, tools);
+        const slug = id.replace(/_/g, "-");
+        writeFileSync(join(OUT_DIR, `${slug}.md`), page);
+        console.log(`generated docs/tools/${slug}.md — ${tools.length} tools`);
+    }
+    // Tools NOT in any toolset (e.g., execute_graphql, discover_tools)
+    const uncategorized = allTools.map(t => t.name).filter(n => !allCategorizedNames.has(n));
+    if (uncategorized.length > 0) {
+        const metaToggle = computeToggleNote("meta");
+        const lines = [
+            `# Meta & GraphQL`,
+            "",
+            "Tools the MCP exposes that aren't tied to a specific GitLab feature group — server diagnostics and the GraphQL escape hatch.",
+            "",
+        ];
+        if (metaToggle) {
+            lines.push(`!!! note "Feature toggle"`);
+            lines.push(`    ${metaToggle}`);
+            lines.push("");
+        }
+        lines.push("## Tools in this group");
+        lines.push("");
+        for (const name of uncategorized) {
+            lines.push(`- [\`${name}\`](#${name}) — ${rwBadge(name)}`);
+        }
+        lines.push("");
+        lines.push("---");
+        lines.push("");
+        for (const name of uncategorized) {
+            const tool = allTools.find(t => t.name === name);
+            if (!tool) {
+                throw new Error(`Uncategorized tool '${name}' missing from allTools registry`);
+            }
+            lines.push(toolSection(name, tool.description, tool.inputSchema));
+        }
+        writeFileSync(join(OUT_DIR, "meta.md"), lines.join("\n"));
+        console.log(`generated docs/tools/meta.md — ${uncategorized.length} tools`);
+        grouped.push(["meta", uncategorized]);
+        GROUP_META["meta"] = {
+            title: "Meta & GraphQL",
+            blurb: "Server diagnostics, tool discovery, and the GraphQL escape hatch.",
+        };
+    }
+    writeFileSync(join(OUT_DIR, "index.md"), buildIndexPage(grouped));
+    console.log(`generated docs/tools/index.md`);
+    // Emit nav fragment so you can paste it into mkdocs.yml if needed
+    console.log("\n--- mkdocs.yml nav fragment ---");
+    console.log("  - Tools:");
+    console.log("      - Overview: tools/index.md");
+    for (const [id] of grouped) {
+        const meta = GROUP_META[id];
+        const slug = id.replace(/_/g, "-");
+        console.log(`      - ${meta.title}: tools/${slug}.md`);
+    }
+}
+main();

package/build/test/test-oauth-proxy-rate-limit.js

@@ -0,0 +1,133 @@
+/**
+ * Regression tests for OAuth endpoint rate limiting behind trusted proxies.
+ */
+import { describe, test, after, before } from "node:test";
+import assert from "node:assert";
+import { launchServer, findAvailablePort, cleanupServers, TransportMode, HOST, } from "./utils/server-launcher.js";
+import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
+const MOCK_GITLAB_PORT_BASE = 9210;
+const MCP_SERVER_PORT_BASE = 3210;
+const MOCK_CLIENT_ID = "mock-app-uid-from-dcr";
+function addOAuthEndpoints(mockGitLab, baseUrl) {
+    mockGitLab.addRootHandler("post", "/oauth/register", (req, res) => {
+        res.status(201).json({
+            client_id: MOCK_CLIENT_ID,
+            client_name: req.body?.client_name ?? "test",
+            redirect_uris: req.body?.redirect_uris ?? [],
+            token_endpoint_auth_method: "none",
+            require_pkce: true,
+        });
+    });
+    mockGitLab.addRootHandler("get", "/.well-known/oauth-authorization-server", (_req, res) => {
+        res.json({
+            issuer: baseUrl,
+            authorization_endpoint: `${baseUrl}/oauth/authorize`,
+            token_endpoint: `${baseUrl}/oauth/token`,
+            registration_endpoint: `${baseUrl}/oauth/register`,
+            revocation_endpoint: `${baseUrl}/oauth/revoke`,
+            scopes_supported: ["api", "read_api", "read_user"],
+            response_types_supported: ["code"],
+            grant_types_supported: ["authorization_code", "refresh_token"],
+            code_challenge_methods_supported: ["S256"],
+        });
+    });
+}
+describe("When MCP OAuth runs behind a trusted proxy", () => {
+    describe("with X-Forwarded-For containing client ports", () => {
+        let mcpBaseUrl;
+        let mockGitLab;
+        let servers = [];
+        before(async () => {
+            const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE);
+            mockGitLab = new MockGitLabServer({ port: mockPort, validTokens: [] });
+            await mockGitLab.start();
+            const mockGitLabUrl = mockGitLab.getUrl();
+            addOAuthEndpoints(mockGitLab, mockGitLabUrl);
+            const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE);
+            mcpBaseUrl = `http://${HOST}:${mcpPort}`;
+            const server = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port: mcpPort,
+                timeout: 5000,
+                env: {
+                    STREAMABLE_HTTP: "true",
+                    GITLAB_MCP_OAUTH: "true",
+                    MCP_TRUST_PROXY: "true",
+                    GITLAB_OAUTH_APP_ID: "test-oauth-app-id",
+                    GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+                    MCP_SERVER_URL: mcpBaseUrl,
+                    MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL: "true",
+                },
+            });
+            servers.push(server);
+        });
+        after(async () => {
+            cleanupServers(servers);
+            if (mockGitLab) {
+                await mockGitLab.stop();
+            }
+        });
+        test("should not return 500 from /register", async () => {
+            const res = await fetch(`${mcpBaseUrl}/register`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    "X-Forwarded-For": "160.79.106.36:38914",
+                },
+                body: JSON.stringify({
+                    redirect_uris: ["https://client.example/callback"],
+                    client_name: "proxy-rate-limit-test",
+                }),
+            });
+            assert.notEqual(res.status, 500, "rate-limit key generation should not crash /register");
+            assert.strictEqual(res.status, 201, "DCR should succeed behind forwarded IPv4:port");
+        });
+        test("should not return 500 from /authorize", async () => {
+            const params = new URLSearchParams({
+                response_type: "code",
+                client_id: MOCK_CLIENT_ID,
+                redirect_uri: "https://client.example/callback",
+                code_challenge: "challenge",
+                code_challenge_method: "S256",
+                state: "proxy-rate-limit-state",
+                scope: "api",
+            });
+            const res = await fetch(`${mcpBaseUrl}/authorize?${params}`, {
+                redirect: "manual",
+                headers: {
+                    "X-Forwarded-For": "[2001:db8::1]:5678",
+                },
+            });
+            assert.notEqual(res.status, 500, "rate-limit key generation should not crash /authorize");
+        });
+        test("should not return 500 from /token", async () => {
+            const res = await fetch(`${mcpBaseUrl}/token`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    "X-Forwarded-For": "160.79.106.36:38914",
+                },
+                body: new URLSearchParams({
+                    grant_type: "authorization_code",
+                    client_id: MOCK_CLIENT_ID,
+                    code: "invalid-code",
+                    redirect_uri: "https://client.example/callback",
+                }),
+            });
+            assert.notEqual(res.status, 500, "rate-limit key generation should not crash /token");
+        });
+        test("should not return 500 from /revoke", async () => {
+            const res = await fetch(`${mcpBaseUrl}/revoke`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    "X-Forwarded-For": "[2001:db8::1]",
+                },
+                body: new URLSearchParams({
+                    token: "invalid-token",
+                }),
+            });
+            assert.notEqual(res.status, 500, "rate-limit key generation should not crash /revoke");
+        });
+    });
+});

package/build/test/utils/proxy-client-ip.test.js

@@ -0,0 +1,28 @@
+import assert from "node:assert/strict";
+import { describe, test } from "node:test";
+import { ipKeyGenerator } from "express-rate-limit";
+import { normalizeProxyClientIpForRateLimit } from "../../utils/proxy-client-ip.js";
+function rateLimitKeyFromForwardedIp(ip) {
+    return ipKeyGenerator(normalizeProxyClientIpForRateLimit(ip));
+}
+describe("When normalizeProxyClientIpForRateLimit runs", () => {
+    describe("with proxy-forwarded client addresses", () => {
+        test("should strip IPv4 ports before ipKeyGenerator accepts the address", () => {
+            const key = rateLimitKeyFromForwardedIp("160.79.106.36:38914");
+            assert.equal(key, "160.79.106.36");
+        });
+        test("should strip bracketed IPv6 ports before ipKeyGenerator accepts the address", () => {
+            const key = rateLimitKeyFromForwardedIp("[2001:db8::1]:5678");
+            assert.equal(key, "2001:db8::/56");
+        });
+        test("should strip brackets from bracketed IPv6 addresses without ports", () => {
+            const key = rateLimitKeyFromForwardedIp("[2001:db8::1]");
+            assert.equal(key, "2001:db8::/56");
+        });
+        test("should leave plain IPv4 and IPv6 addresses unchanged", () => {
+            assert.equal(rateLimitKeyFromForwardedIp("1.2.3.4"), "1.2.3.4");
+            assert.equal(rateLimitKeyFromForwardedIp("2001:db8::1"), "2001:db8::/56");
+            assert.equal(rateLimitKeyFromForwardedIp("::1"), "::/56");
+        });
+    });
+});

package/build/utils/proxy-client-ip.js

@@ -0,0 +1,11 @@
+/**
+ * Normalize Express req.ip values from reverse proxies before rate limiting.
+ *
+ * Some proxies append the client port to X-Forwarded-For (e.g. "1.2.3.4:5678"
+ * or "[2001:db8::1]:5678"). express-rate-limit rejects those unless stripped.
+ */
+export function normalizeProxyClientIpForRateLimit(ip) {
+    return ip
+        .replace(/^(\d+\.\d+\.\d+\.\d+):\d+$/, "$1")
+        .replace(/^\[([^\]]+)\](?::\d+)?$/, "$1");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.22",
+  "version": "2.1.24",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
@@ -51,7 +51,7 @@
     "changelog": "auto-changelog -p",
     "test": "npm run test:all",
     "test:all": "npm run build && npm run test:mock && npm run test:live",
-    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-issues.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-remote-downloads.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-protected-branches.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/graphql-query.test.ts && node --import tsx/esm --test test/utils/wiki-title.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts && node --import tsx/esm --test test/test-ci-variables.ts && node --import tsx/esm --test test/test-dependency-proxy.ts",
+    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/test-oauth-proxy-rate-limit.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-issues.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-remote-downloads.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-protected-branches.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/proxy-client-ip.test.ts && node --import tsx/esm --test test/utils/graphql-query.test.ts && node --import tsx/esm --test test/utils/wiki-title.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts && node --import tsx/esm --test test/test-ci-variables.ts && node --import tsx/esm --test test/test-dependency-proxy.ts",
     "test:stateless": "npm run build && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts",
     "test:mcp-oauth": "npm run build && node --import tsx/esm --test test/mcp-oauth-tests.ts",
     "test:live": "node test/validate-api.js",
@@ -72,6 +72,7 @@
     "@types/node-fetch": "^2.6.12",
     "diff": "^9.0.0",
     "express": "^5.1.0",
+    "express-rate-limit": "^8.5.2",
     "fetch-cookie": "^3.1.0",
     "form-data": "^4.0.0",
     "http-proxy-agent": "^7.0.2",