@zereight/mcp-gitlab 2.1.25 → 2.1.27

package/build/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { getConfig, ENABLE_DYNAMIC_API_URL, GITLAB_AUTH_COOKIE_PATH, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_READ_ONLY_MODE, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, MCP_TRUST_PROXY, USE_GITLAB_WIKI, USE_MILESTONE, USE_OAUTH, USE_PIPELINE, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_OAUTH_ALLOWED_GROUPS_RAW, GITLAB_ALLOWED_GROUPS_RAW, GITLAB_OAUTH_ALLOWED_GROUPS, } from "./config.js";
+import { getConfig, ENABLE_DYNAMIC_API_URL, GITLAB_AUTH_COOKIE_PATH, GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_READ_ONLY_MODE, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, MCP_TRUST_PROXY, USE_GITLAB_WIKI, USE_MILESTONE, USE_OAUTH, USE_PIPELINE, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_OAUTH_ALLOWED_GROUPS_RAW, GITLAB_ALLOWED_GROUPS_RAW, GITLAB_OAUTH_ALLOWED_GROUPS, } from "./config.js";
 /** True when the server is running in remote/network mode (SSE or StreamableHTTP transport). */
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
 /**
@@ -59,62 +59,6 @@ function decryptDownloadToken(tokenStr) {
         return null;
     }
 }
-function getLastHeaderValue(value) {
-    const raw = Array.isArray(value) ? value[value.length - 1] : value;
-    if (!raw)
-        return undefined;
-    const parts = raw.split(",").map(part => part.trim()).filter(Boolean);
-    return parts.length > 0 ? parts[parts.length - 1] : undefined;
-}
-function unquoteHeaderValue(value) {
-    if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
-        return value.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
-    }
-    return value;
-}
-function getForwardedPublicBaseUrl(req) {
-    if (!MCP_TRUST_PROXY)
-        return undefined;
-    const forwarded = getLastHeaderValue(req.headers.forwarded);
-    const forwardedValues = {};
-    if (forwarded) {
-        for (const part of forwarded.split(";")) {
-            const separator = part.indexOf("=");
-            if (separator <= 0)
-                continue;
-            const key = part.slice(0, separator).trim().toLowerCase();
-            const value = unquoteHeaderValue(part.slice(separator + 1).trim());
-            if (key && value)
-                forwardedValues[key] = value;
-        }
-    }
-    const proto = (forwardedValues.proto || getLastHeaderValue(req.headers["x-forwarded-proto"]))?.toLowerCase();
-    const host = forwardedValues.host || getLastHeaderValue(req.headers["x-forwarded-host"]);
-    if (!proto || !host || !/^https?$/.test(proto))
-        return undefined;
-    if (/[\s/\\]/.test(host))
-        return undefined;
-    const prefix = getLastHeaderValue(req.headers["x-forwarded-prefix"]);
-    const safePrefix = prefix &&
-        prefix.startsWith("/") &&
-        !prefix.startsWith("//") &&
-        !prefix.includes("://") &&
-        !/[\s\\]/.test(prefix)
-        ? prefix.replace(/\/+$/, "")
-        : undefined;
-    try {
-        const baseUrl = new URL(`${proto}://${host}`);
-        if (baseUrl.username || baseUrl.password || baseUrl.pathname !== "/" || baseUrl.search || baseUrl.hash) {
-            return undefined;
-        }
-        if (safePrefix)
-            baseUrl.pathname = safePrefix;
-        return baseUrl.toString().replace(/\/$/, "");
-    }
-    catch {
-        return undefined;
-    }
-}
 /**
  * Build a URL pointing to the download proxy endpoint.
  * Embeds an encrypted auth token (and API URL for dynamic routing)
@@ -185,8 +129,9 @@ import { createGitLabOAuthProvider } from "./oauth-proxy.js";
 import { mcpAuthRouter } from "@modelcontextprotocol/sdk/server/auth/router.js";
 import { ipKeyGenerator } from "express-rate-limit";
 import { normalizeProxyClientIpForRateLimit } from "./utils/proxy-client-ip.js";
+import { getForwardedPublicBaseUrl } from "./utils/forwarded-public-base-url.js";
 import { normalizeGitLabApiUrl } from "./utils/url.js";
-import { estimateMergeCommitCount, filterDiffsByPatterns, summarizeWebhookEvents } from "./utils/helpers.js";
+import { estimateMergeCommitCount, filterDiffsByPatterns, summarizeWebhookEvents, } from "./utils/helpers.js";
 import { graphqlQueryContainsWriteOperation } from "./utils/graphql-query.js";
 import { resolveNestedWikiUpdateTitle } from "./utils/wiki-title.js";
 import { cleanMutuallyExclusiveIdUsernameOptions, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS, sanitizeToolArguments, } from "./utils/tool-args.js";
@@ -201,7 +146,7 @@ GitLabDiscussionNoteSchema, // Added
 GitLabDiscussionSchema, 
 // Draft Notes Schemas
 GitLabDraftNoteSchema, GitLabForkSchema, GitLabBranchSchema, GitLabProtectedBranchSchema, GitLabGroupSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestPipelineSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListBranchesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, GitLabCiVariableSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GitLabDependencyProxySchema, GitLabDependencyProxyBlobSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
-GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, GitLabTagSchema, GitLabTagSignatureSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, ListWebhookEventsSchema, GetWebhookEventSchema, HealthCheckSchema, } from "./schemas.js";
+GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, GitLabTagSchema, GitLabTagSignatureSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, ListWebhookEventsSchema, GetWebhookEventSchema, HealthCheckSchema, } from "./schemas.js";
 import { randomUUID, createCipheriv, createDecipheriv, randomBytes, createHash } from "node:crypto";
 import { pino } from "pino";
 const logger = pino({
@@ -325,7 +270,9 @@ function createServer() {
             const modified = { ...tool };
             // Safety net: remove $schema if present (toJSONSchema strips it for zod schemas,
             // but manually-defined schemas like discover_tools may still have it)
-            if (modified.inputSchema && typeof modified.inputSchema === "object" && modified.inputSchema !== null) {
+            if (modified.inputSchema &&
+                typeof modified.inputSchema === "object" &&
+                modified.inputSchema !== null) {
                 if ("$schema" in modified.inputSchema) {
                     modified.inputSchema = { ...modified.inputSchema };
                     delete modified.inputSchema.$schema;
@@ -371,7 +318,12 @@ function createServer() {
         };
         const logError = (error) => {
             const durationMs = Date.now() - start;
-            logger.error({ tool: toolName, event: "tool_call_error", durationMs, error: error instanceof Error ? error.message : String(error) }, `tool_call_error: ${toolName} (${durationMs}ms)`);
+            logger.error({
+                tool: toolName,
+                event: "tool_call_error",
+                durationMs,
+                error: error instanceof Error ? error.message : String(error),
+            }, `tool_call_error: ${toolName} (${durationMs}ms)`);
             throw error;
         };
         try {
@@ -390,16 +342,18 @@ function createServer() {
                     return logCompletion({
                         content: [{
                                 type: "text",
-                                text: JSON.stringify({ categories, hint: "Call discover_tools with a category name to activate it" }, null, 2),
+                                text: JSON.stringify({ categories, hint: "Call discover_tools with a category name to activate it" }),
                             }],
                     });
                 }
                 if (!ALL_TOOLSET_IDS.has(category)) {
                     return logCompletion({
-                        content: [{
+                        content: [
+                            {
                                 type: "text",
                                 text: `Unknown category "${category}". Available: ${[...ALL_TOOLSET_IDS].join(", ")}`,
-                            }],
+                            },
+                        ],
                         isError: true,
                     });
                 }
@@ -414,10 +368,12 @@ function createServer() {
                 const alreadyActive = [...toolsetDef.tools].every(t => currentToolNames.has(t));
                 if (alreadyActive) {
                     return logCompletion({
-                        content: [{
+                        content: [
+                            {
                                 type: "text",
                                 text: `Category "${category}" is already active (${toolsetDef.tools.size} tools).`,
-                            }],
+                            },
+                        ],
                     });
                 }
                 // Add tools from this toolset, respecting all filtering policies
@@ -437,10 +393,12 @@ function createServer() {
                 }
                 if (newTools.length === 0) {
                     return logCompletion({
-                        content: [{
+                        content: [
+                            {
                                 type: "text",
                                 text: `Category "${category}" has no additional tools to activate (all already active or filtered).`,
-                            }],
+                            },
+                        ],
                     });
                 }
                 filteredTools.push(...newTools);
@@ -460,7 +418,7 @@ function createServer() {
                                 activated: category,
                                 addedTools: addedNames,
                                 totalTools: filteredTools.length,
-                            }, null, 2),
+                            }),
                         }],
                 });
             }
@@ -470,10 +428,12 @@ function createServer() {
                 if (!confirmed) {
                     logger.info({ tool: toolName, event: "tool_call_approval_required" }, `Approval required: ${toolName}`);
                     return logCompletion({
-                        content: [{
+                        content: [
+                            {
                                 type: "text",
                                 text: `Tool "${toolName}" requires confirmation. This tool is marked as requiring approval before execution. Re-call with _confirmed: true to proceed.`,
-                            }],
+                            },
+                        ],
                     });
                 }
                 // Strip _confirmed from args before forwarding to handler
@@ -507,6 +467,14 @@ function createServer() {
 /**
  * Validate configuration at startup
  */
+function isLoopbackBindHost(host) {
+    const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
+    const isIpv4Loopback = /^127(?:\.\d{1,3}){3}$/.test(normalized);
+    return (normalized === "localhost" ||
+        isIpv4Loopback ||
+        normalized === "::1" ||
+        normalized === "0:0:0:0:0:0:0:1");
+}
 function validateConfiguration() {
     const errors = [];
     // Validate SESSION_TIMEOUT_SECONDS
@@ -557,6 +525,12 @@ function validateConfiguration() {
             }
         }
     }
+    const allowedHosts = getConfig("allowed-hosts", "GITLAB_ALLOWED_HOSTS")?.split(",") || [];
+    for (const host of allowedHosts) {
+        if (host.trim() && !toAllowedGitLabApiUrl(host)) {
+            errors.push(`GITLAB_ALLOWED_HOSTS contains an invalid host or URL: ${host.trim()}`);
+        }
+    }
     // Validate auth configuration
     const remoteAuth = getConfig("remote-auth", "REMOTE_AUTHORIZATION") === "true";
     const useOAuth = getConfig("use-oauth", "GITLAB_USE_OAUTH") === "true";
@@ -566,12 +540,19 @@ function validateConfiguration() {
     const mcpOAuth = getConfig("mcp-oauth", "GITLAB_MCP_OAUTH") === "true";
     const mcpServerUrl = getConfig("mcp-server-url", "MCP_SERVER_URL");
     const streamableHttp = getConfig("streamable-http", "STREAMABLE_HTTP") === "true";
+    const sse = getConfig("sse", "SSE") === "true";
+    const bindHost = getConfig("host", "HOST") || "127.0.0.1";
+    const sseAuthToken = getConfig("sse-auth-token", "SSE_AUTH_TOKEN");
+    const allowUnauthenticatedRemoteSse = getConfig("sse-dangerously-allow-unauthenticated-remote", "SSE_DANGEROUSLY_ALLOW_UNAUTHENTICATED_REMOTE") === "true";
     if (!remoteAuth && !useOAuth && !hasToken && !hasJobToken && !hasCookie && !mcpOAuth) {
         errors.push("Either --token, --job-token, --cookie-path, --use-oauth=true, --remote-auth=true, or --mcp-oauth=true must be set (or use environment variables)");
     }
     if (streamableHttp && (hasToken || hasJobToken) && !remoteAuth && !mcpOAuth) {
         errors.push("STREAMABLE_HTTP=true/--streamable-http with GITLAB_PERSONAL_ACCESS_TOKEN/--token or GITLAB_JOB_TOKEN/--job-token requires REMOTE_AUTHORIZATION=true/--remote-auth=true or GITLAB_MCP_OAUTH=true/--mcp-oauth=true");
     }
+    if (sse && !isLoopbackBindHost(bindHost) && !sseAuthToken && !allowUnauthenticatedRemoteSse) {
+        errors.push("SSE=true on a non-loopback HOST requires SSE_AUTH_TOKEN (or explicitly set SSE_DANGEROUSLY_ALLOW_UNAUTHENTICATED_REMOTE=true)");
+    }
     if (mcpOAuth) {
         if (!mcpServerUrl) {
             errors.push("MCP_SERVER_URL is required when GITLAB_MCP_OAUTH=true (e.g. https://mcp.example.com)");
@@ -636,13 +617,24 @@ function redactSessionIdForLog(sid) {
 function isInitializationRequestBody(body) {
     if (!body)
         return false;
-    const isInitObj = (m) => typeof m === "object" &&
-        m !== null &&
-        m.method === "initialize";
+    const isInitObj = (m) => typeof m === "object" && m !== null && m.method === "initialize";
     if (Array.isArray(body))
         return body.some(isInitObj);
     return isInitObj(body);
 }
+function isUnauthenticatedDiscoveryRequestBody(body) {
+    if (!body)
+        return false;
+    const isDiscoveryMethod = (m) => {
+        if (typeof m !== "object" || m === null)
+            return false;
+        const method = m.method;
+        return (method === "initialize" || method === "notifications/initialized" || method === "tools/list");
+    };
+    if (Array.isArray(body))
+        return body.every(isDiscoveryMethod);
+    return isDiscoveryMethod(body);
+}
 /**
  * Normalize an `Mcp-Session-Id` header value.
  *
@@ -699,9 +691,7 @@ catch (err) {
  * a 401 from the OAuth bearer middleware.
  */
 export function hasStatelessSessionId(req) {
-    return Boolean(OAUTH_STATELESS_MODE &&
-        STATELESS_MATERIAL &&
-        readMcpSessionIdHeader(req));
+    return Boolean(OAUTH_STATELESS_MODE && STATELESS_MATERIAL && readMcpSessionIdHeader(req));
 }
 /**
  * Ensure the OAuth token is valid before making an API call.
@@ -845,7 +835,9 @@ function defaultAuthRetryConfig() {
     return {
         isOAuthEnabled: () => USE_OAUTH && oauthClient != null,
         refreshToken: (force) => oauthClient.getAccessToken(force),
-        onTokenRefreshed: (token) => { OAUTH_ACCESS_TOKEN = token; },
+        onTokenRefreshed: (token) => {
+            OAUTH_ACCESS_TOKEN = token;
+        },
         buildAuthHeaders,
         logger,
     };
@@ -1015,11 +1007,57 @@ if (GITLAB_TOOLSETS_RAW && (USE_PIPELINE || USE_MILESTONE || USE_GITLAB_WIKI)) {
         "Legacy flags add tools additively on top of the toolset selection and may produce unexpected results.");
 }
 const MERGE_REQUEST_DEPLOYMENT_SUMMARY_LIMIT = 10;
+function toAllowedGitLabApiUrl(value) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        return null;
+    try {
+        const url = new URL(trimmed.includes("://") ? trimmed : `https://${trimmed}`);
+        if (url.protocol !== "http:" && url.protocol !== "https:")
+            return null;
+        return { host: url.host, apiUrl: normalizeGitLabApiUrl(url.toString()) };
+    }
+    catch {
+        return null;
+    }
+}
+function parseAllowedGitLabApiUrls(value) {
+    return value
+        .split(",")
+        .map(toAllowedGitLabApiUrl)
+        .filter((entry) => Boolean(entry));
+}
+function encodeGitLabPathSegment(value) {
+    return encodeURIComponent(decodeURIComponent(value));
+}
+function encodeGitLabPath(value) {
+    return value.split("/").map(encodeGitLabPathSegment).join("/");
+}
+function resolveTrustedGitLabApiUrl(value) {
+    const parsed = new URL(normalizeGitLabApiUrl(value));
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new Error("GitLab API URL must use HTTP or HTTPS");
+    }
+    const allowedApiUrl = GITLAB_ALLOWED_API_URLS_BY_HOST.get(parsed.host);
+    if (!allowedApiUrl) {
+        throw new Error(`GitLab API URL host is not allowed: ${parsed.host}`);
+    }
+    return allowedApiUrl;
+}
 // Use the normalizeGitLabApiUrl function to handle various URL formats
 const GITLAB_API_URLS = (getConfig("api-url", "GITLAB_API_URL") || "https://gitlab.com")
     .split(",")
     .map(normalizeGitLabApiUrl);
 const GITLAB_API_URL = GITLAB_API_URLS[0];
+const GITLAB_ALLOWED_API_URLS_BY_HOST = new Map();
+for (const { host, apiUrl } of [
+    ...GITLAB_API_URLS.map(toAllowedGitLabApiUrl).filter((entry) => Boolean(entry)),
+    ...parseAllowedGitLabApiUrls(getConfig("allowed-hosts", "GITLAB_ALLOWED_HOSTS") || ""),
+]) {
+    if (!GITLAB_ALLOWED_API_URLS_BY_HOST.has(host)) {
+        GITLAB_ALLOWED_API_URLS_BY_HOST.set(host, apiUrl);
+    }
+}
 const GITLAB_PROJECT_ID = process.env.GITLAB_PROJECT_ID;
 const GITLAB_ALLOWED_PROJECT_IDS = process.env.GITLAB_ALLOWED_PROJECT_IDS?.split(",")
     .map(id => id.trim())
@@ -1058,7 +1096,12 @@ if (GITLAB_MCP_OAUTH) {
     }
     logger.info("MCP OAuth enabled: GitLab OAuth proxy active (Private-Token/JOB-TOKEN headers bypass OAuth)");
 }
-if (!REMOTE_AUTHORIZATION && !GITLAB_MCP_OAUTH && !USE_OAUTH && !GITLAB_PERSONAL_ACCESS_TOKEN && !GITLAB_JOB_TOKEN && !GITLAB_AUTH_COOKIE_PATH) {
+if (!REMOTE_AUTHORIZATION &&
+    !GITLAB_MCP_OAUTH &&
+    !USE_OAUTH &&
+    !GITLAB_PERSONAL_ACCESS_TOKEN &&
+    !GITLAB_JOB_TOKEN &&
+    !GITLAB_AUTH_COOKIE_PATH) {
     // Standard mode: token must be in environment (unless using OAuth)
     logger.error("GITLAB_PERSONAL_ACCESS_TOKEN environment variable is not set");
     logger.info("Either set GITLAB_PERSONAL_ACCESS_TOKEN or enable OAuth with GITLAB_USE_OAUTH=true");
@@ -1483,18 +1526,28 @@ async function resolveNamesToIds(projectPath, labelNames, usernames) {
     if (!labelNames?.length && !usernames?.length) {
         return { labelIds: [], userIds: [] };
     }
-    const data = await executeGraphQL(`query($path: ID!, $usernames: [String!]!) {
-      project(fullPath: $path) { labels(includeAncestorGroups: true, first: 250) { nodes { id title } } }
+    labelNames ??= [];
+    usernames ??= [];
+    const labelVars = Object.fromEntries(labelNames.map((name, i) => [`l${i}`, name]));
+    // One alias per label — exact title match via the `title` argument, includes ancestor
+    // group labels, single round trip with no pagination needed.
+    const varDefs = labelNames.map((_, i) => `$l${i}: String!`).join(", ");
+    const aliases = labelNames.map((_, i) => `l${i}: labels(title: $l${i}, includeAncestorGroups: true, first: 1) { nodes { id } }`).join(" ");
+    const { project, users } = await executeGraphQL(`query($path: ID!, $usernames: [String!]!${varDefs ? `, ${varDefs}` : ""}) {
+      project(fullPath: $path) { ${aliases || "__typename"} }
       users(usernames: $usernames) { nodes { id username } }
-    }`, { path: projectPath, usernames: usernames || [] });
-    const labelIds = (labelNames || []).map(name => {
-        const label = data.project.labels.nodes.find(l => l.title === name);
-        if (!label)
+    }`, { path: projectPath, usernames, ...labelVars });
+    if (!project) {
+        throw new Error(`Project '${projectPath}' not found or inaccessible`);
+    }
+    const labelIds = labelNames.map((name, i) => {
+        const nodes = project[`l${i}`]?.nodes;
+        if (!nodes?.length)
             throw new Error(`Label '${name}' not found in project`);
-        return label.id;
+        return nodes[0].id;
     });
-    const userIds = (usernames || []).map(name => {
-        const user = data.users.nodes.find(u => u.username === name);
+    const userIds = usernames.map(name => {
+        const user = users.nodes.find(u => u.username === name);
         if (!user)
             throw new Error(`User '${name}' not found`);
         return user.id;
@@ -1534,7 +1587,7 @@ async function resolveWorkItemTypeGID(projectPath, typeName) {
         }
       }
     }`, { path: projectPath });
-    const typeNode = data.namespace?.workItemTypes?.nodes?.find((n) => n.name === targetName);
+    const typeNode = data.namespace?.workItemTypes?.nodes?.find(n => n.name === targetName);
     if (!typeNode) {
         throw new Error(`Work item type '${targetName}' not found in project ${projectPath}`);
     }
@@ -2140,7 +2193,11 @@ async function getWorkItem(projectId, iid) {
     if (wi.closedAt)
         result.closedAt = wi.closedAt;
     if (statusWidget?.status)
-        result.status = { name: statusWidget.status.name, id: statusWidget.status.id, category: statusWidget.status.category };
+        result.status = {
+            name: statusWidget.status.name,
+            id: statusWidget.status.id,
+            category: statusWidget.status.category,
+        };
     const labels = (labelsWidget?.labels?.nodes || []).map((l) => l.title);
     if (labels.length > 0)
         result.labels = labels;
@@ -2178,10 +2235,23 @@ async function getWorkItem(projectId, iid) {
     if (colorWidget?.color)
         result.color = colorWidget.color;
     if (hierarchyWidget?.parent)
-        result.parent = { iid: hierarchyWidget.parent.iid, title: hierarchyWidget.parent.title, type: hierarchyWidget.parent.workItemType?.name, project: hierarchyWidget.parent.namespace?.fullPath, webUrl: hierarchyWidget.parent.webUrl };
+        result.parent = {
+            iid: hierarchyWidget.parent.iid,
+            title: hierarchyWidget.parent.title,
+            type: hierarchyWidget.parent.workItemType?.name,
+            project: hierarchyWidget.parent.namespace?.fullPath,
+            webUrl: hierarchyWidget.parent.webUrl,
+        };
     const children = hierarchyWidget?.children?.nodes || [];
     if (children.length > 0)
-        result.children = children.map((c) => ({ iid: c.iid, title: c.title, state: c.state, type: c.workItemType?.name, project: c.namespace?.fullPath, webUrl: c.webUrl }));
+        result.children = children.map((c) => ({
+            iid: c.iid,
+            title: c.title,
+            state: c.state,
+            type: c.workItemType?.name,
+            project: c.namespace?.fullPath,
+            webUrl: c.webUrl,
+        }));
     if (linkedItemsWidget?.blocked)
         result.blocked = true;
     if (linkedItemsWidget?.blockedByCount > 0)
@@ -2253,7 +2323,7 @@ async function listWorkItems(projectId, options) {
         first: options.first || 20,
     };
     if (options.types && options.types.length > 0) {
-        variables.types = options.types.map((t) => typeMap[t] || t.replace(/ /g, "_").toUpperCase());
+        variables.types = options.types.map(t => typeMap[t] || t.replace(/ /g, "_").toUpperCase());
     }
     if (options.state) {
         variables.state = options.state === "opened" ? "opened" : "closed";
@@ -2721,7 +2791,9 @@ async function updateWorkItem(projectId, iid, options) {
         linked_items_added: options.linked_items_to_add?.length || 0,
         linked_items_removed: options.linked_items_to_remove?.length || 0,
         ...(options.severity !== undefined && { severity: options.severity }),
-        ...(options.escalation_status !== undefined && { escalation_status: options.escalation_status }),
+        ...(options.escalation_status !== undefined && {
+            escalation_status: options.escalation_status,
+        }),
     };
 }
 /**
@@ -3023,9 +3095,7 @@ async function updateIssueNote(projectId, issueIid, discussionId, noteId, body,
 async function createIssueNote(projectId, issueIid, discussionId, body, createdAt) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     const basePath = `${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}`;
-    const url = new URL(discussionId
-        ? `${basePath}/discussions/${discussionId}/notes`
-        : `${basePath}/notes`);
+    const url = new URL(discussionId ? `${basePath}/discussions/${discussionId}/notes` : `${basePath}/notes`);
     const payload = { body };
     if (createdAt) {
         payload.created_at = createdAt;
@@ -3392,6 +3462,7 @@ async function createRepository(options) {
         method: "POST",
         body: JSON.stringify({
             name: options.name,
+            ...(options.namespace_id !== undefined ? { namespace_id: options.namespace_id } : {}),
             description: options.description,
             visibility: options.visibility,
             initialize_with_readme: options.initialize_with_readme,
@@ -5718,7 +5789,7 @@ async function getCurrentUser() {
     if ((response.status === 401 || response.status === 403) && usesJobTokenHeader()) {
         const jobResponse = await fetch(`${getEffectiveApiUrl()}/job`, getFetchConfig());
         if (jobResponse.ok) {
-            const jobData = await jobResponse.json();
+            const jobData = (await jobResponse.json());
             if (jobData.user) {
                 return GitLabUserSchema.parse(jobData.user);
             }
@@ -5742,7 +5813,8 @@ async function myIssues(options = {}) {
         effectiveProjectId = getEffectiveProjectId(options.project_id || "");
     }
     catch (err) {
-        if (err instanceof Error && err.message.includes("No project ID provided and GITLAB_PROJECT_ID is not set")) {
+        if (err instanceof Error &&
+            err.message.includes("No project ID provided and GITLAB_PROJECT_ID is not set")) {
             effectiveProjectId = "";
         }
         else {
@@ -5956,7 +6028,11 @@ async function updateGroupVariable(groupId, key, options) {
     if (filter?.environment_scope) {
         url.searchParams.append("filter[environment_scope]", filter.environment_scope);
     }
-    const response = await fetch(url.toString(), { ...getFetchConfig(), method: "PUT", body: JSON.stringify(body) });
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+        method: "PUT",
+        body: JSON.stringify(body),
+    });
     await handleGitLabError(response);
     const data = await response.json();
     return GitLabCiVariableSchema.parse(data);
@@ -6004,7 +6080,9 @@ async function getDependencyProxySettings(groupPath) {
     });
 }
 async function updateDependencyProxySettings(groupPath, options) {
-    if (options.enabled === undefined && options.identity === undefined && options.secret === undefined) {
+    if (options.enabled === undefined &&
+        options.identity === undefined &&
+        options.secret === undefined) {
         throw new Error("At least one of enabled, identity, or secret must be provided");
     }
     const fullPath = await resolveGroupFullPath(groupPath);
@@ -6038,7 +6116,11 @@ async function listDependencyProxyBlobs(groupPath, options = {}) {
     if (!conn)
         throw new Error(`Group not found or dependency proxy not enabled: ${fullPath}`);
     return {
-        blobs: conn.nodes.map(n => GitLabDependencyProxyBlobSchema.parse({ file_name: n.fileName, size: n.size, created_at: n.createdAt })),
+        blobs: conn.nodes.map(n => GitLabDependencyProxyBlobSchema.parse({
+            file_name: n.fileName,
+            size: n.size,
+            created_at: n.createdAt,
+        })),
         pageInfo: conn.pageInfo,
     };
 }
@@ -6098,7 +6180,7 @@ async function markdownUpload(projectId, filePath, content, filename) {
     const response = await fetch(url.toString(), {
         ...defaultFetchConfig,
         method: "POST",
-        body: form
+        body: form,
     });
     if (!response.ok) {
         await handleGitLabError(response);
@@ -6419,6 +6501,34 @@ async function getTagSignature(projectId, tagName) {
     const data = await response.json();
     return GitLabTagSignatureSchema.parse(data);
 }
+async function executeGitLabGraphQL(query, variables = {}) {
+    const apiUrl = new URL(getEffectiveApiUrl());
+    const restPath = apiUrl.pathname || "";
+    const idx = restPath.lastIndexOf("/api/v4");
+    const prefix = idx >= 0 ? restPath.slice(0, idx) : "";
+    const graphqlUrl = process.env.GITLAB_GRAPHQL_URL || `${apiUrl.origin}${prefix}/api/graphql`;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 45000);
+    try {
+        const response = await fetch(graphqlUrl, {
+            ...getFetchConfig(),
+            method: "POST",
+            headers: {
+                ...BASE_HEADERS,
+                ...buildAuthHeaders(),
+            },
+            body: JSON.stringify({ query, variables }),
+            signal: controller.signal,
+        });
+        if (!response.ok) {
+            await handleGitLabError(response);
+        }
+        return await response.json();
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
 // Request handlers are now registered inside createServer() factory function
 // to ensure each transport connection gets its own Server instance (GHSA-345p-7cg4-v4c7).
 async function handleToolCall(params) {
@@ -6482,7 +6592,7 @@ async function handleToolCall(params) {
                     }
                     const json = await response.json();
                     return {
-                        content: [{ type: "text", text: JSON.stringify(json, null, 2) }],
+                        content: [{ type: "text", text: JSON.stringify(json) }],
                     };
                 }
                 catch (err) {
@@ -6491,7 +6601,7 @@ async function handleToolCall(params) {
                         content: [
                             {
                                 type: "text",
-                                text: JSON.stringify({ error: `GraphQL request failed: ${message}` }, null, 2),
+                                text: JSON.stringify({ error: `GraphQL request failed: ${message}` }),
                             },
                         ],
                     };
@@ -6506,7 +6616,7 @@ async function handleToolCall(params) {
                 try {
                     const forkedProject = await forkProject(forkArgs.project_id, forkArgs.namespace);
                     return {
-                        content: [{ type: "text", text: JSON.stringify(forkedProject, null, 2) }],
+                        content: [{ type: "text", text: JSON.stringify(forkedProject) }],
                     };
                 }
                 catch (forkError) {
@@ -6519,7 +6629,7 @@ async function handleToolCall(params) {
                         content: [
                             {
                                 type: "text",
-                                text: JSON.stringify({ error: forkErrorMessage }, null, 2),
+                                text: JSON.stringify({ error: forkErrorMessage }),
                             },
                         ],
                     };
@@ -6536,7 +6646,7 @@ async function handleToolCall(params) {
                     ref,
                 });
                 return {
-                    content: [{ type: "text", text: JSON.stringify(branch, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(branch) }],
                 };
             }
             case "get_branch_diffs": {
@@ -6544,14 +6654,14 @@ async function handleToolCall(params) {
                 const diffResp = await getBranchDiffs(args.project_id, args.from, args.to, args.straight);
                 diffResp.diffs = filterDiffsByPatterns(diffResp.diffs, args.excluded_file_patterns);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(diffResp, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(diffResp) }],
                 };
             }
             case "search_repositories": {
                 const args = SearchRepositoriesSchema.parse(params.arguments);
                 const results = await searchProjects(args.search, args.page, args.per_page);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(results, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(results) }],
                 };
             }
             case "search_code": {
@@ -6565,7 +6675,7 @@ async function handleToolCall(params) {
                     per_page: args.per_page,
                 });
                 return {
-                    content: [{ type: "text", text: JSON.stringify(results, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(results) }],
                 };
             }
             case "search_project_code": {
@@ -6581,7 +6691,7 @@ async function handleToolCall(params) {
                     per_page: args.per_page,
                 });
                 return {
-                    content: [{ type: "text", text: JSON.stringify(results, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(results) }],
                 };
             }
             case "search_group_code": {
@@ -6596,7 +6706,7 @@ async function handleToolCall(params) {
                     per_page: args.per_page,
                 });
                 return {
-                    content: [{ type: "text", text: JSON.stringify(results, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(results) }],
                 };
             }
             case "create_repository": {
@@ -6604,7 +6714,7 @@ async function handleToolCall(params) {
                 const args = CreateRepositorySchema.parse(params.arguments);
                 const repository = await createRepository(args);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(repository, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(repository) }],
                 };
             }
             case "create_group": {
@@ -6631,28 +6741,28 @@ async function handleToolCall(params) {
                 const data = await response.json();
                 const group = GitLabGroupSchema.parse(data);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(group, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(group) }],
                 };
             }
             case "get_file_contents": {
                 const args = GetFileContentsSchema.parse(params.arguments);
                 const contents = await getFileContents(args.project_id, args.file_path, args.ref);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(contents, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(contents) }],
                 };
             }
             case "create_or_update_file": {
                 const args = CreateOrUpdateFileSchema.parse(params.arguments);
                 const result = await createOrUpdateFile(args.project_id, args.file_path, args.content, args.commit_message, args.branch, args.previous_path, args.last_commit_id, args.commit_id);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "push_files": {
                 const args = PushFilesSchema.parse(params.arguments);
                 const result = await createCommit(args.project_id, args.commit_message, args.branch, args.files.map(f => ({ path: f.file_path, content: f.content })));
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "create_issue": {
@@ -6660,7 +6770,7 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const issue = await createIssue(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(issue, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(issue) }],
                 };
             }
             case "create_merge_request": {
@@ -6668,7 +6778,7 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const mergeRequest = await createMergeRequest(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(mergeRequest, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(mergeRequest) }],
                 };
             }
             case "delete_merge_request_discussion_note": {
@@ -6685,21 +6795,21 @@ async function handleToolCall(params) {
                 args.resolved // Now one of body or resolved must be provided, not both
                 );
                 return {
-                    content: [{ type: "text", text: JSON.stringify(note, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(note) }],
                 };
             }
             case "create_merge_request_discussion_note": {
                 const args = CreateMergeRequestDiscussionNoteSchema.parse(params.arguments);
                 const note = await createMergeRequestDiscussionNote(args.project_id, args.merge_request_iid, args.discussion_id, args.body, args.created_at);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(note, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(note) }],
                 };
             }
             case "create_merge_request_note": {
                 const args = CreateMergeRequestNoteSchema.parse(params.arguments);
                 const note = await createMergeRequestNote(args.project_id, args.merge_request_iid, args.body);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(note, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(note) }],
                 };
             }
             case "delete_merge_request_note": {
@@ -6713,121 +6823,141 @@ async function handleToolCall(params) {
                 const args = GetMergeRequestNoteSchema.parse(params.arguments);
                 const note = await getMergeRequestNote(args.project_id, args.merge_request_iid, args.note_id);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(note, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(note) }],
                 };
             }
             case "get_merge_request_notes": {
                 const args = GetMergeRequestNotesSchema.parse(params.arguments);
                 const notes = await getMergeRequestNotes(args.project_id, args.merge_request_iid, args.sort, args.order_by, args.per_page, args.page);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(notes, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(notes) }],
                 };
             }
             case "update_merge_request_note": {
                 const args = UpdateMergeRequestNoteSchema.parse(params.arguments);
                 const note = await updateMergeRequestNote(args.project_id, args.merge_request_iid, args.note_id, args.body);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(note, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(note) }],
                 };
             }
             case "list_merge_request_emoji_reactions": {
                 const args = ListMergeRequestEmojiReactionsSchema.parse(params.arguments);
                 const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid);
                 const result = await listRestAwardEmoji(path);
-                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
             }
             case "list_merge_request_note_emoji_reactions": {
                 const args = ListMergeRequestNoteEmojiReactionsSchema.parse(params.arguments);
                 const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid, { noteId: args.note_id, discussionId: args.discussion_id });
                 const result = await listRestAwardEmoji(path);
-                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
             }
             case "create_merge_request_emoji_reaction": {
                 const args = CreateMergeRequestEmojiReactionSchema.parse(params.arguments);
                 const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid);
                 const result = await createRestAwardEmoji(path, args.name);
-                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
             }
             case "delete_merge_request_emoji_reaction": {
                 const args = DeleteMergeRequestEmojiReactionSchema.parse(params.arguments);
                 const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid, { awardId: args.award_id });
                 await deleteRestAwardEmoji(path);
-                return { content: [{ type: "text", text: "Merge request emoji reaction deleted successfully" }] };
+                return {
+                    content: [{ type: "text", text: "Merge request emoji reaction deleted successfully" }],
+                };
             }
             case "create_merge_request_note_emoji_reaction": {
                 const args = CreateMergeRequestNoteEmojiReactionSchema.parse(params.arguments);
                 const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid, { noteId: args.note_id, discussionId: args.discussion_id });
                 const result = await createRestAwardEmoji(path, args.name);
-                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
             }
             case "delete_merge_request_note_emoji_reaction": {
                 const args = DeleteMergeRequestNoteEmojiReactionSchema.parse(params.arguments);
                 const path = buildAwardEmojiPath("merge_requests", args.project_id, args.merge_request_iid, { noteId: args.note_id, discussionId: args.discussion_id, awardId: args.award_id });
                 await deleteRestAwardEmoji(path);
-                return { content: [{ type: "text", text: "Merge request note emoji reaction deleted successfully" }] };
+                return {
+                    content: [
+                        { type: "text", text: "Merge request note emoji reaction deleted successfully" },
+                    ],
+                };
             }
             case "update_issue_note": {
                 const args = UpdateIssueNoteSchema.parse(params.arguments);
                 const note = await updateIssueNote(args.project_id, args.issue_iid, args.discussion_id, args.note_id, args.body, args.resolved);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(note, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(note) }],
                 };
             }
             case "create_issue_note": {
                 const args = CreateIssueNoteSchema.parse(params.arguments);
                 const note = await createIssueNote(args.project_id, args.issue_iid, args.discussion_id, args.body, args.created_at);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(note, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(note) }],
                 };
             }
             case "list_issue_emoji_reactions": {
                 const args = ListIssueEmojiReactionsSchema.parse(params.arguments);
                 const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid);
                 const result = await listRestAwardEmoji(path);
-                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
             }
             case "list_issue_note_emoji_reactions": {
                 const args = ListIssueNoteEmojiReactionsSchema.parse(params.arguments);
-                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid, { noteId: args.note_id, discussionId: args.discussion_id });
+                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid, {
+                    noteId: args.note_id,
+                    discussionId: args.discussion_id,
+                });
                 const result = await listRestAwardEmoji(path);
-                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
             }
             case "create_issue_emoji_reaction": {
                 const args = CreateIssueEmojiReactionSchema.parse(params.arguments);
                 const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid);
                 const result = await createRestAwardEmoji(path, args.name);
-                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
             }
             case "delete_issue_emoji_reaction": {
                 const args = DeleteIssueEmojiReactionSchema.parse(params.arguments);
-                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid, { awardId: args.award_id });
+                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid, {
+                    awardId: args.award_id,
+                });
                 await deleteRestAwardEmoji(path);
                 return { content: [{ type: "text", text: "Issue emoji reaction deleted successfully" }] };
             }
             case "create_issue_note_emoji_reaction": {
                 const args = CreateIssueNoteEmojiReactionSchema.parse(params.arguments);
-                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid, { noteId: args.note_id, discussionId: args.discussion_id });
+                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid, {
+                    noteId: args.note_id,
+                    discussionId: args.discussion_id,
+                });
                 const result = await createRestAwardEmoji(path, args.name);
-                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
             }
             case "delete_issue_note_emoji_reaction": {
                 const args = DeleteIssueNoteEmojiReactionSchema.parse(params.arguments);
-                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid, { noteId: args.note_id, discussionId: args.discussion_id, awardId: args.award_id });
+                const path = buildAwardEmojiPath("issues", args.project_id, args.issue_iid, {
+                    noteId: args.note_id,
+                    discussionId: args.discussion_id,
+                    awardId: args.award_id,
+                });
                 await deleteRestAwardEmoji(path);
-                return { content: [{ type: "text", text: "Issue note emoji reaction deleted successfully" }] };
+                return {
+                    content: [{ type: "text", text: "Issue note emoji reaction deleted successfully" }],
+                };
             }
             case "list_todos": {
                 const args = ListTodosSchema.parse(params.arguments);
                 const todos = await listTodos(args);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(todos, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(todos) }],
                 };
             }
             case "mark_todo_done": {
                 const args = MarkTodoDoneSchema.parse(params.arguments);
                 const todo = await markTodoDone(args.id);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(todo, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(todo) }],
                 };
             }
             case "mark_all_todos_done": {
@@ -6861,7 +6991,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(mergeRequestWithDeploymentSummary, null, 2),
+                            text: JSON.stringify(mergeRequestWithDeploymentSummary),
                         },
                     ],
                 };
@@ -6871,14 +7001,14 @@ async function handleToolCall(params) {
                 const diffs = await getMergeRequestDiffs(args.project_id, args.merge_request_iid, args.source_branch, args.view);
                 const filteredDiffs = filterDiffsByPatterns(diffs, args.excluded_file_patterns);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(filteredDiffs, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(filteredDiffs) }],
                 };
             }
             case "list_merge_request_changed_files": {
                 const args = ListMergeRequestChangedFilesSchema.parse(params.arguments);
                 const files = await listMergeRequestChangedFiles(args.project_id, args.merge_request_iid, args.source_branch, args.excluded_file_patterns);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(files, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(files) }],
                 };
             }
             case "list_merge_request_pipelines": {
@@ -6886,35 +7016,35 @@ async function handleToolCall(params) {
                 const { project_id, merge_request_iid, ...options } = args;
                 const pipelines = await listMergeRequestPipelines(project_id, merge_request_iid, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(pipelines, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(pipelines) }],
                 };
             }
             case "list_merge_request_diffs": {
                 const args = ListMergeRequestDiffsSchema.parse(params.arguments);
                 const changes = await listMergeRequestDiffs(args.project_id, args.merge_request_iid, args.source_branch, args.page, args.per_page, args.unidiff);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(changes, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(changes) }],
                 };
             }
             case "get_merge_request_file_diff": {
                 const args = GetMergeRequestFileDiffSchema.parse(params.arguments);
                 const fileDiff = await getMergeRequestFileDiff(args.project_id, args.file_paths, args.merge_request_iid, args.source_branch, args.unidiff);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(fileDiff, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(fileDiff) }],
                 };
             }
             case "list_merge_request_versions": {
                 const args = ListMergeRequestVersionsSchema.parse(params.arguments);
                 const versions = await listMergeRequestVersions(args.project_id, args.merge_request_iid);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(versions, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(versions) }],
                 };
             }
             case "get_merge_request_version": {
                 const args = GetMergeRequestVersionSchema.parse(params.arguments);
                 const version = await getMergeRequestVersion(args.project_id, args.merge_request_iid, args.version_id, args.unidiff);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(version, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(version) }],
                 };
             }
             case "update_merge_request": {
@@ -6922,7 +7052,7 @@ async function handleToolCall(params) {
                 const { project_id, merge_request_iid, source_branch, ...options } = args;
                 const mergeRequest = await updateMergeRequest(project_id, options, merge_request_iid, source_branch);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(mergeRequest, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(mergeRequest) }],
                 };
             }
             case "merge_merge_request": {
@@ -6930,35 +7060,35 @@ async function handleToolCall(params) {
                 const { project_id, merge_request_iid, ...options } = args;
                 const mergeRequest = await mergeMergeRequest(project_id, options, merge_request_iid);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(mergeRequest, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(mergeRequest) }],
                 };
             }
             case "approve_merge_request": {
                 const args = ApproveMergeRequestSchema.parse(params.arguments);
                 const approvalState = await approveMergeRequest(args.project_id, args.merge_request_iid, args.sha, args.approval_password);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(approvalState, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(approvalState) }],
                 };
             }
             case "unapprove_merge_request": {
                 const args = UnapproveMergeRequestSchema.parse(params.arguments);
                 const approvalState = await unapproveMergeRequest(args.project_id, args.merge_request_iid);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(approvalState, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(approvalState) }],
                 };
             }
             case "get_merge_request_approval_state": {
                 const args = GetMergeRequestApprovalStateSchema.parse(params.arguments);
                 const approvalState = await getMergeRequestApprovalState(args.project_id, args.merge_request_iid);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(approvalState, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(approvalState) }],
                 };
             }
             case "get_merge_request_conflicts": {
                 const args = GetMergeRequestConflictsSchema.parse(params.arguments);
                 const conflicts = await getMergeRequestConflicts(args.project_id, args.merge_request_iid);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(conflicts, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(conflicts) }],
                 };
             }
             case "mr_discussions": {
@@ -6966,7 +7096,7 @@ async function handleToolCall(params) {
                 const { project_id, merge_request_iid, ...options } = args;
                 const discussions = await listMergeRequestDiscussions(project_id, merge_request_iid, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(discussions, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(discussions) }],
                 };
             }
             case "list_namespaces": {
@@ -6991,7 +7121,7 @@ async function handleToolCall(params) {
                 const data = await response.json();
                 const namespaces = z.array(GitLabNamespaceSchema).parse(data);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(namespaces, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(namespaces) }],
                 };
             }
             case "get_namespace": {
@@ -7004,7 +7134,7 @@ async function handleToolCall(params) {
                 const data = await response.json();
                 const namespace = GitLabNamespaceSchema.parse(data);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(namespace, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(namespace) }],
                 };
             }
             case "verify_namespace": {
@@ -7019,7 +7149,7 @@ async function handleToolCall(params) {
                 const data = await response.json();
                 const namespaceExists = GitLabNamespaceExistsResponseSchema.parse(data);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(namespaceExists, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(namespaceExists) }],
                 };
             }
             case "get_project": {
@@ -7040,14 +7170,29 @@ async function handleToolCall(params) {
                 const data = await response.json();
                 // Return raw data without parsing through our schema to avoid type mismatches in tests
                 return {
-                    content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(data) }],
                 };
             }
             case "list_projects": {
                 const args = ListProjectsSchema.parse(params.arguments);
                 const projects = await listProjects(args);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(projects, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(projects) }],
+                };
+            }
+            case "update_project": {
+                const { project_id, ...updates } = UpdateProjectSchema.parse(params.arguments);
+                const effectiveProjectId = getEffectiveProjectId(project_id);
+                const body = Object.fromEntries(Object.entries(updates).filter(([, value]) => value !== undefined));
+                const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`, {
+                    ...getFetchConfig(),
+                    method: "PUT",
+                    body: JSON.stringify(body),
+                });
+                await handleGitLabError(response);
+                const data = await response.json();
+                return {
+                    content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
                 };
             }
             case "list_project_members": {
@@ -7055,14 +7200,14 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const members = await listProjectMembers(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(members, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(members) }],
                 };
             }
             case "get_users": {
                 const args = GetUsersSchema.parse(params.arguments);
                 const usersMap = await getUsers(args.usernames);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(usersMap, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(usersMap) }],
                 };
             }
             case "get_user": {
@@ -7075,7 +7220,7 @@ async function handleToolCall(params) {
                 const data = await response.json();
                 const user = GitLabUserFullSchema.parse(data);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(user, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(user) }],
                 };
             }
             case "whoami": {
@@ -7088,7 +7233,7 @@ async function handleToolCall(params) {
                 const data = await response.json();
                 const user = GitLabCurrentUserSchema.parse(data);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(user, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(user) }],
                 };
             }
             case "create_note": {
@@ -7096,7 +7241,7 @@ async function handleToolCall(params) {
                 const { project_id, noteable_type, noteable_iid, body } = args;
                 const note = await createNote(project_id, noteable_type, noteable_iid, body);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(note, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(note) }],
                 };
             }
             case "get_draft_note": {
@@ -7104,7 +7249,7 @@ async function handleToolCall(params) {
                 const { project_id, merge_request_iid, draft_note_id } = args;
                 const draftNote = await getDraftNote(project_id, merge_request_iid, draft_note_id);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(draftNote, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(draftNote) }],
                 };
             }
             case "list_draft_notes": {
@@ -7112,15 +7257,15 @@ async function handleToolCall(params) {
                 const { project_id, merge_request_iid } = args;
                 const draftNotes = await listDraftNotes(project_id, merge_request_iid);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(draftNotes, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(draftNotes) }],
                 };
             }
             case "create_draft_note": {
                 const args = CreateDraftNoteSchema.parse(params.arguments);
-                const { project_id, merge_request_iid, body, in_reply_to_discussion_id, position, resolve_discussion } = args;
+                const { project_id, merge_request_iid, body, in_reply_to_discussion_id, position, resolve_discussion, } = args;
                 const draftNote = await createDraftNote(project_id, merge_request_iid, body, in_reply_to_discussion_id, position, resolve_discussion);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(draftNote, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(draftNote) }],
                 };
             }
             case "update_draft_note": {
@@ -7128,7 +7273,7 @@ async function handleToolCall(params) {
                 const { project_id, merge_request_iid, draft_note_id, body, position, resolve_discussion } = args;
                 const draftNote = await updateDraftNote(project_id, merge_request_iid, draft_note_id, body, position, resolve_discussion);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(draftNote, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(draftNote) }],
                 };
             }
             case "delete_draft_note": {
@@ -7144,7 +7289,7 @@ async function handleToolCall(params) {
                 const { project_id, merge_request_iid, draft_note_id } = args;
                 const publishedNote = await publishDraftNote(project_id, merge_request_iid, draft_note_id);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(publishedNote, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(publishedNote) }],
                 };
             }
             case "bulk_publish_draft_notes": {
@@ -7152,7 +7297,7 @@ async function handleToolCall(params) {
                 const { project_id, merge_request_iid } = args;
                 const publishedNotes = await bulkPublishDraftNotes(project_id, merge_request_iid);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(publishedNotes, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(publishedNotes) }],
                 };
             }
             case "create_merge_request_thread": {
@@ -7160,7 +7305,7 @@ async function handleToolCall(params) {
                 const { project_id, merge_request_iid, body, position, created_at } = args;
                 const thread = await createMergeRequestThread(project_id, merge_request_iid, body, position, created_at);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(thread, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(thread) }],
                 };
             }
             case "resolve_merge_request_thread": {
@@ -7177,21 +7322,21 @@ async function handleToolCall(params) {
                 const cleanedOptions = cleanMutuallyExclusiveIdUsernameOptions(options);
                 const issues = await listIssues(project_id, cleanedOptions);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(issues, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(issues) }],
                 };
             }
             case "my_issues": {
                 const args = MyIssuesSchema.parse(params.arguments);
                 const issues = await myIssues(args);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(issues, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(issues) }],
                 };
             }
             case "get_issue": {
                 const args = GetIssueSchema.parse(params.arguments);
                 const issue = await getIssue(args.project_id, args.issue_iid);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(issue, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(issue) }],
                 };
             }
             case "update_issue": {
@@ -7199,7 +7344,7 @@ async function handleToolCall(params) {
                 const { project_id, issue_iid, ...options } = args;
                 const issue = await updateIssue(project_id, issue_iid, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(issue, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(issue) }],
                 };
             }
             case "update_issue_description_patch": {
@@ -7293,7 +7438,7 @@ async function handleToolCall(params) {
                 const args = ListIssueLinksSchema.parse(params.arguments);
                 const links = await listIssueLinks(args.project_id, args.issue_iid);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(links, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(links) }],
                 };
             }
             case "list_issue_discussions": {
@@ -7301,21 +7446,21 @@ async function handleToolCall(params) {
                 const { project_id, issue_iid, ...options } = args;
                 const discussions = await listIssueDiscussions(project_id, issue_iid, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(discussions, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(discussions) }],
                 };
             }
             case "get_issue_link": {
                 const args = GetIssueLinkSchema.parse(params.arguments);
                 const link = await getIssueLink(args.project_id, args.issue_iid, args.issue_link_id);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(link, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(link) }],
                 };
             }
             case "create_issue_link": {
                 const args = CreateIssueLinkSchema.parse(params.arguments);
                 const link = await createIssueLink(args.project_id, args.issue_iid, args.target_project_id, args.target_issue_iid, args.link_type);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(link, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(link) }],
                 };
             }
             case "delete_issue_link": {
@@ -7337,7 +7482,7 @@ async function handleToolCall(params) {
                 const args = GetWorkItemSchema.parse(params.arguments);
                 const result = await getWorkItem(args.project_id, args.iid);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "list_work_items": {
@@ -7345,7 +7490,7 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const result = await listWorkItems(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "create_work_item": {
@@ -7353,7 +7498,7 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const result = await createWorkItem(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "update_work_item": {
@@ -7361,117 +7506,117 @@ async function handleToolCall(params) {
                 const { project_id, iid, ...options } = args;
                 const result = await updateWorkItem(project_id, iid, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "convert_work_item_type": {
                 const args = ConvertWorkItemTypeSchema.parse(params.arguments);
                 const result = await convertIssueType(args.project_id, args.iid, args.new_type);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "list_work_item_statuses": {
                 const args = ListWorkItemStatusesSchema.parse(params.arguments);
                 const result = await listIssueStatuses(args.project_id, args.work_item_type);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "list_custom_field_definitions": {
                 const args = ListCustomFieldDefinitionsSchema.parse(params.arguments);
                 const result = await listCustomFieldDefinitions(args.project_id, args.work_item_type);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "move_work_item": {
                 const args = MoveWorkItemSchema.parse(params.arguments);
                 const result = await moveWorkItem(args.project_id, args.iid, args.target_project_id);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "list_work_item_notes": {
                 const args = ListWorkItemNotesSchema.parse(params.arguments);
                 const result = await listWorkItemNotes(args.project_id, args.iid, args);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "create_work_item_note": {
                 const args = CreateWorkItemNoteSchema.parse(params.arguments);
                 const result = await createWorkItemNote(args.project_id, args.iid, args.body, args);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "list_work_item_emoji_reactions": {
                 const args = ListWorkItemEmojiReactionsSchema.parse(params.arguments);
                 const { workItemGID } = await resolveWorkItemGID(args.project_id, args.iid);
                 const result = await listGraphQLAwardEmoji(workItemGID);
-                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
             }
             case "list_work_item_note_emoji_reactions": {
                 const args = ListWorkItemNoteEmojiReactionsSchema.parse(params.arguments);
                 const result = await listGraphQLAwardEmoji(args.note_id);
-                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
             }
             case "create_work_item_emoji_reaction": {
                 const args = CreateWorkItemEmojiReactionSchema.parse(params.arguments);
                 const { workItemGID } = await resolveWorkItemGID(args.project_id, args.iid);
                 const result = await addGraphQLAwardEmoji(workItemGID, args.name);
-                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
             }
             case "delete_work_item_emoji_reaction": {
                 const args = DeleteWorkItemEmojiReactionSchema.parse(params.arguments);
                 const { workItemGID } = await resolveWorkItemGID(args.project_id, args.iid);
                 const result = await removeGraphQLAwardEmoji(workItemGID, args.name);
-                return { content: [{ type: "text", text: JSON.stringify(result ?? { status: "success", message: "Work item emoji reaction removed" }, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(result ?? { status: "success", message: "Work item emoji reaction removed" }) }] };
             }
             case "create_work_item_note_emoji_reaction": {
                 const args = CreateWorkItemNoteEmojiReactionSchema.parse(params.arguments);
                 const result = await addGraphQLAwardEmoji(args.note_id, args.name);
-                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
             }
             case "delete_work_item_note_emoji_reaction": {
                 const args = DeleteWorkItemNoteEmojiReactionSchema.parse(params.arguments);
                 const result = await removeGraphQLAwardEmoji(args.note_id, args.name);
-                return { content: [{ type: "text", text: JSON.stringify(result ?? { status: "success", message: "Work item note emoji reaction removed" }, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(result ?? { status: "success", message: "Work item note emoji reaction removed" }) }] };
             }
             case "get_timeline_events": {
                 const args = GetTimelineEventsSchema.parse(params.arguments);
                 const result = await getTimelineEvents(args.project_id, args.incident_iid);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "create_timeline_event": {
                 const args = CreateTimelineEventSchema.parse(params.arguments);
                 const result = await createTimelineEvent(args.project_id, args.incident_iid, args.note, args.occurred_at, args.tag_names);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "list_labels": {
                 const args = ListLabelsSchema.parse(params.arguments);
                 const labels = await listLabels(args.project_id, args);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(labels, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(labels) }],
                 };
             }
             case "get_label": {
                 const args = GetLabelSchema.parse(params.arguments);
                 const label = await getLabel(args.project_id, args.label_id, args.include_ancestor_groups);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(label, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(label) }],
                 };
             }
             case "create_label": {
                 const args = CreateLabelSchema.parse(params.arguments);
                 const label = await createLabel(args.project_id, args);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(label, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(label) }],
                 };
             }
             case "update_label": {
@@ -7479,7 +7624,7 @@ async function handleToolCall(params) {
                 const { project_id, label_id, ...options } = args;
                 const label = await updateLabel(project_id, label_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(label, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(label) }],
                 };
             }
             case "delete_label": {
@@ -7498,7 +7643,7 @@ async function handleToolCall(params) {
                 const args = ListGroupProjectsSchema.parse(params.arguments);
                 const projects = await listGroupProjects(args);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(projects, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(projects) }],
                 };
             }
             case "list_wiki_pages": {
@@ -7509,28 +7654,28 @@ async function handleToolCall(params) {
                     with_content,
                 });
                 return {
-                    content: [{ type: "text", text: JSON.stringify(wikiPages, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(wikiPages) }],
                 };
             }
             case "get_wiki_page": {
                 const { project_id, slug } = GetWikiPageSchema.parse(params.arguments);
                 const wikiPage = await getWikiPage(project_id, slug);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(wikiPage, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(wikiPage) }],
                 };
             }
             case "create_wiki_page": {
                 const { project_id, title, content, format } = CreateWikiPageSchema.parse(params.arguments);
                 const wikiPage = await createWikiPage(project_id, title, content, format);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(wikiPage, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(wikiPage) }],
                 };
             }
             case "update_wiki_page": {
                 const { project_id, slug, title, content, format } = UpdateWikiPageSchema.parse(params.arguments);
                 const wikiPage = await updateWikiPage(project_id, slug, title, content, format);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(wikiPage, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(wikiPage) }],
                 };
             }
             case "delete_wiki_page": {
@@ -7556,28 +7701,28 @@ async function handleToolCall(params) {
                     with_content,
                 });
                 return {
-                    content: [{ type: "text", text: JSON.stringify(wikiPages, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(wikiPages) }],
                 };
             }
             case "get_group_wiki_page": {
                 const { group_id, slug } = GetGroupWikiPageSchema.parse(params.arguments);
                 const wikiPage = await getGroupWikiPage(group_id, slug);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(wikiPage, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(wikiPage) }],
                 };
             }
             case "create_group_wiki_page": {
                 const { group_id, title, content, format } = CreateGroupWikiPageSchema.parse(params.arguments);
                 const wikiPage = await createGroupWikiPage(group_id, title, content, format);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(wikiPage, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(wikiPage) }],
                 };
             }
             case "update_group_wiki_page": {
                 const { group_id, slug, title, content, format } = UpdateGroupWikiPageSchema.parse(params.arguments);
                 const wikiPage = await updateGroupWikiPage(group_id, slug, title, content, format);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(wikiPage, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(wikiPage) }],
                 };
             }
             case "delete_group_wiki_page": {
@@ -7608,7 +7753,7 @@ async function handleToolCall(params) {
                     }
                     : items;
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "list_pipelines": {
@@ -7616,7 +7761,7 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const pipelines = await listPipelines(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(pipelines, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(pipelines) }],
                 };
             }
             case "get_pipeline": {
@@ -7626,7 +7771,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(pipeline, null, 2),
+                            text: JSON.stringify(pipeline),
                         },
                     ],
                 };
@@ -7636,14 +7781,14 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const deployments = await listDeployments(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(deployments, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(deployments) }],
                 };
             }
             case "get_deployment": {
                 const { project_id, deployment_id } = GetDeploymentSchema.parse(params.arguments);
                 const deployment = await getDeployment(project_id, deployment_id);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(deployment, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(deployment) }],
                 };
             }
             case "list_environments": {
@@ -7651,14 +7796,14 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const environments = await listEnvironments(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(environments, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(environments) }],
                 };
             }
             case "get_environment": {
                 const { project_id, environment_id } = GetEnvironmentSchema.parse(params.arguments);
                 const environment = await getEnvironment(project_id, environment_id);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(environment, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(environment) }],
                 };
             }
             case "list_pipeline_jobs": {
@@ -7668,7 +7813,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(jobs, null, 2),
+                            text: JSON.stringify(jobs),
                         },
                     ],
                 };
@@ -7680,7 +7825,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(triggerJobs, null, 2),
+                            text: JSON.stringify(triggerJobs),
                         },
                     ],
                 };
@@ -7692,7 +7837,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(jobDetails, null, 2),
+                            text: JSON.stringify(jobDetails),
                         },
                     ],
                 };
@@ -7714,7 +7859,7 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const result = await validateCiLint(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "validate_project_ci_lint": {
@@ -7722,8 +7867,130 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const result = await validateProjectCiLint(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
-                };
+                    content: [{ type: "text", text: JSON.stringify(result) }],
+                };
+            }
+            case "list_ci_catalog_resources": {
+                const args = ListCiCatalogResourcesSchema.parse(params.arguments);
+                const result = await executeGitLabGraphQL(`query ListCiCatalogResources(
+            $search: String,
+            $first: Int,
+            $after: String,
+            $groupIds: [GroupID!],
+            $scope: CiCatalogResourceScope,
+            $sort: CiCatalogResourceSort,
+            $topics: [String!],
+            $verificationLevel: CiCatalogResourceVerificationLevel
+          ) {
+            ciCatalogResources(
+              search: $search,
+              first: $first,
+              after: $after,
+              groupIds: $groupIds,
+              scope: $scope,
+              sort: $sort,
+              topics: $topics,
+              verificationLevel: $verificationLevel
+            ) {
+              nodes {
+                id
+                name
+                description
+                fullPath
+                icon
+                starCount
+                topics
+                verificationLevel
+                visibilityLevel
+                webPath
+                latestReleasedAt
+                last30DayUsageCount
+              }
+              pageInfo { hasNextPage endCursor }
+            }
+          }`, {
+                    search: args.search,
+                    first: args.first ?? 20,
+                    after: args.after,
+                    groupIds: args.group_ids,
+                    scope: args.scope,
+                    sort: args.sort,
+                    topics: args.topics,
+                    verificationLevel: args.verification_level,
+                });
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+            }
+            case "get_ci_catalog_resource": {
+                const args = GetCiCatalogResourceSchema.parse(params.arguments);
+                const result = await executeGitLabGraphQL(`query GetCiCatalogResource(
+            $id: CiCatalogResourceID,
+            $fullPath: ID,
+            $versionLimit: Int!,
+            $componentLimit: Int!,
+            $includeReadme: Boolean!
+          ) {
+            ciCatalogResource(id: $id, fullPath: $fullPath) {
+              id
+              name
+              description
+              fullPath
+              icon
+              starCount
+              topics
+              verificationLevel
+              visibilityLevel
+              webPath
+              latestReleasedAt
+              last30DayUsageCount
+              versions(first: $versionLimit) {
+                nodes {
+                  id
+                  name
+                  path
+                  createdAt
+                  releasedAt
+                  readme @include(if: $includeReadme)
+                  semver { major minor patch }
+                  components(first: $componentLimit) {
+                    nodes {
+                      id
+                      name
+                      description
+                      includePath
+                      last30DayUsageCount
+                      inputs {
+                        name
+                        description
+                        type
+                        required
+                        default
+                        options
+                        regex
+                      }
+                    }
+                    pageInfo { hasNextPage endCursor }
+                  }
+                }
+                pageInfo { hasNextPage endCursor }
+              }
+            }
+          }`, {
+                    id: args.id,
+                    fullPath: args.full_path,
+                    versionLimit: args.version_limit ?? 5,
+                    componentLimit: args.component_limit ?? 20,
+                    includeReadme: args.include_readme ?? false,
+                });
+                if (args.component_name) {
+                    const resource = result?.data?.ciCatalogResource;
+                    for (const version of resource?.versions?.nodes ?? []) {
+                        const components = version?.components?.nodes;
+                        if (Array.isArray(components)) {
+                            version.components.nodes = components.filter(component => component?.name === args.component_name);
+                        }
+                    }
+                }
+                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
             }
             case "create_pipeline": {
                 const { project_id, ref, variables, inputs } = CreatePipelineSchema.parse(params.arguments);
@@ -7804,7 +8071,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(artifacts, null, 2),
+                            text: JSON.stringify(artifacts),
                         },
                     ],
                 };
@@ -7817,7 +8084,7 @@ async function handleToolCall(params) {
                     }
                     const downloadUrl = buildDownloadUrl("job-artifacts", { project_id, job_id });
                     return {
-                        content: [{ type: "text", text: JSON.stringify({ download_url: downloadUrl, filename: `artifacts_job_${job_id}.zip` }, null, 2) }],
+                        content: [{ type: "text", text: JSON.stringify({ download_url: downloadUrl, filename: `artifacts_job_${job_id}.zip` }) }],
                     };
                 }
                 const filePath = await downloadJobArtifacts(project_id, job_id, local_path);
@@ -7825,7 +8092,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify({ success: true, file_path: filePath }, null, 2),
+                            text: JSON.stringify({ success: true, file_path: filePath }),
                         },
                     ],
                 };
@@ -7847,7 +8114,7 @@ async function handleToolCall(params) {
                 const cleanedOptions = cleanMutuallyExclusiveIdUsernameOptions(options, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS);
                 const mergeRequests = await listMergeRequests(project_id, cleanedOptions);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(mergeRequests, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(mergeRequests) }],
                 };
             }
             case "list_milestones": {
@@ -7857,7 +8124,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(milestones, null, 2),
+                            text: JSON.stringify(milestones),
                         },
                     ],
                 };
@@ -7869,7 +8136,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(milestone, null, 2),
+                            text: JSON.stringify(milestone),
                         },
                     ],
                 };
@@ -7881,7 +8148,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(milestone, null, 2),
+                            text: JSON.stringify(milestone),
                         },
                     ],
                 };
@@ -7893,7 +8160,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(milestone, null, 2),
+                            text: JSON.stringify(milestone),
                         },
                     ],
                 };
@@ -7920,7 +8187,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(issues, null, 2),
+                            text: JSON.stringify(issues),
                         },
                     ],
                 };
@@ -7932,7 +8199,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(mergeRequests, null, 2),
+                            text: JSON.stringify(mergeRequests),
                         },
                     ],
                 };
@@ -7944,7 +8211,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(milestone, null, 2),
+                            text: JSON.stringify(milestone),
                         },
                     ],
                 };
@@ -7956,7 +8223,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(events, null, 2),
+                            text: JSON.stringify(events),
                         },
                     ],
                 };
@@ -7965,21 +8232,21 @@ async function handleToolCall(params) {
                 const args = ListCommitsSchema.parse(params.arguments);
                 const commits = await listCommits(args.project_id, args);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(commits, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(commits) }],
                 };
             }
             case "get_commit": {
                 const args = GetCommitSchema.parse(params.arguments);
                 const commit = await getCommit(args.project_id, args.sha, args.stats);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(commit, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(commit) }],
                 };
             }
             case "get_commit_diff": {
                 const args = GetCommitDiffSchema.parse(params.arguments);
                 const diff = await getCommitDiff(args.project_id, args.sha, args.full_diff);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(diff, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(diff) }],
                 };
             }
             case "get_file_blame": {
@@ -7987,7 +8254,7 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const blame = await getFileBlame(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(blame, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(blame) }],
                 };
             }
             case "list_commit_statuses": {
@@ -7995,7 +8262,7 @@ async function handleToolCall(params) {
                 const { project_id, sha, ...options } = args;
                 const statuses = await listCommitStatuses(project_id, sha, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(statuses, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(statuses) }],
                 };
             }
             case "create_commit_status": {
@@ -8003,14 +8270,14 @@ async function handleToolCall(params) {
                 const { project_id, sha, ...options } = args;
                 const status = await createCommitStatus(project_id, sha, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(status, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(status) }],
                 };
             }
             case "list_group_iterations": {
                 const args = ListGroupIterationsSchema.parse(params.arguments);
                 const iterations = await listGroupIterations(args.group_id, args);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(iterations, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(iterations) }],
                 };
             }
             // --- CI/CD Variables ---
@@ -8018,24 +8285,24 @@ async function handleToolCall(params) {
                 const args = ListProjectVariablesSchema.parse(params.arguments);
                 const { project_id, ...options } = args;
                 const variables = await listProjectVariables(project_id, options);
-                return { content: [{ type: "text", text: JSON.stringify(variables, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(variables) }] };
             }
             case "get_project_variable": {
                 const args = GetProjectVariableSchema.parse(params.arguments);
                 const variable = await getProjectVariable(args.project_id, args.key, args.filter);
-                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(variable) }] };
             }
             case "create_project_variable": {
                 const args = CreateProjectVariableSchema.parse(params.arguments);
                 const { project_id, ...options } = args;
                 const variable = await createProjectVariable(project_id, options);
-                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(variable) }] };
             }
             case "update_project_variable": {
                 const args = UpdateProjectVariableSchema.parse(params.arguments);
                 const { project_id, key, ...options } = args;
                 const variable = await updateProjectVariable(project_id, key, options);
-                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(variable) }] };
             }
             case "delete_project_variable": {
                 const args = DeleteProjectVariableSchema.parse(params.arguments);
@@ -8054,27 +8321,27 @@ async function handleToolCall(params) {
                 const args = ListGroupVariablesSchema.parse(params.arguments);
                 const { group_id, ...options } = args;
                 const variables = await listGroupVariables(group_id, options);
-                return { content: [{ type: "text", text: JSON.stringify(variables, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(variables) }] };
             }
             case "get_group_variable": {
                 rejectIfProjectScopedDeployment("get_group_variable");
                 const args = GetGroupVariableSchema.parse(params.arguments);
                 const variable = await getGroupVariable(args.group_id, args.key, args.filter);
-                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(variable) }] };
             }
             case "create_group_variable": {
                 rejectIfProjectScopedDeployment("create_group_variable");
                 const args = CreateGroupVariableSchema.parse(params.arguments);
                 const { group_id, ...options } = args;
                 const variable = await createGroupVariable(group_id, options);
-                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(variable) }] };
             }
             case "update_group_variable": {
                 rejectIfProjectScopedDeployment("update_group_variable");
                 const args = UpdateGroupVariableSchema.parse(params.arguments);
                 const { group_id, key, ...options } = args;
                 const variable = await updateGroupVariable(group_id, key, options);
-                return { content: [{ type: "text", text: JSON.stringify(variable, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(variable) }] };
             }
             case "delete_group_variable": {
                 rejectIfProjectScopedDeployment("delete_group_variable");
@@ -8094,7 +8361,7 @@ async function handleToolCall(params) {
                 const args = GetDependencyProxySettingsSchema.parse(params.arguments);
                 const settings = await getDependencyProxySettings(args.group_id);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(settings, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(settings) }],
                 };
             }
             case "update_dependency_proxy_settings": {
@@ -8103,7 +8370,7 @@ async function handleToolCall(params) {
                 const { group_id, ...options } = args;
                 const settings = await updateDependencyProxySettings(group_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(settings, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(settings) }],
                 };
             }
             case "list_dependency_proxy_blobs": {
@@ -8112,7 +8379,7 @@ async function handleToolCall(params) {
                 const { group_id, ...options } = args;
                 const result = await listDependencyProxyBlobs(group_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "purge_dependency_proxy_cache": {
@@ -8133,13 +8400,13 @@ async function handleToolCall(params) {
                     const args = MarkdownUploadRemoteSchema.parse(params.arguments);
                     const upload = await markdownUpload(args.project_id, undefined, args.content, args.filename);
                     return {
-                        content: [{ type: "text", text: JSON.stringify(upload, null, 2) }],
+                        content: [{ type: "text", text: JSON.stringify(upload) }],
                     };
                 }
                 const args = MarkdownUploadSchema.parse(params.arguments);
                 const upload = await markdownUpload(args.project_id, args.file_path);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(upload, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(upload) }],
                 };
             }
             case "download_attachment": {
@@ -8151,10 +8418,12 @@ async function handleToolCall(params) {
                 const mimeType = getImageMimeType(args.filename);
                 if (IS_REMOTE && !mimeType) {
                     const downloadUrl = buildDownloadUrl("attachment", {
-                        project_id: args.project_id, secret: args.secret, filename: args.filename,
+                        project_id: args.project_id,
+                        secret: args.secret,
+                        filename: args.filename,
                     });
                     return {
-                        content: [{ type: "text", text: JSON.stringify({ download_url: downloadUrl, filename: args.filename }, null, 2) }],
+                        content: [{ type: "text", text: JSON.stringify({ download_url: downloadUrl, filename: args.filename }) }],
                     };
                 }
                 const result = await downloadAttachment(args.project_id, args.secret, args.filename, args.local_path);
@@ -8166,7 +8435,7 @@ async function handleToolCall(params) {
                             { type: "image", data: base64, mimeType: result.mimeType },
                             {
                                 type: "text",
-                                text: JSON.stringify({ filename: result.filename, mimeType: result.mimeType }, null, 2),
+                                text: JSON.stringify({ filename: result.filename, mimeType: result.mimeType }),
                             },
                         ],
                     };
@@ -8175,7 +8444,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify({ success: true, file_path: result.savedPath }, null, 2),
+                            text: JSON.stringify({ success: true, file_path: result.savedPath }),
                         },
                     ],
                 };
@@ -8184,7 +8453,7 @@ async function handleToolCall(params) {
                 const args = ListEventsSchema.parse(params.arguments);
                 const events = await listEvents(args);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(events, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(events) }],
                 };
             }
             case "get_project_events": {
@@ -8192,7 +8461,7 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const events = await getProjectEvents(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(events, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(events) }],
                 };
             }
             case "list_releases": {
@@ -8200,14 +8469,14 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const releases = await listReleases(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(releases, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(releases) }],
                 };
             }
             case "get_release": {
                 const args = GetReleaseSchema.parse(params.arguments);
                 const release = await getRelease(args.project_id, args.tag_name, args.include_html_description);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(release, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(release) }],
                 };
             }
             case "create_release": {
@@ -8215,7 +8484,7 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const release = await createRelease(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(release, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(release) }],
                 };
             }
             case "update_release": {
@@ -8223,7 +8492,7 @@ async function handleToolCall(params) {
                 const { project_id, tag_name, ...options } = args;
                 const release = await updateRelease(project_id, tag_name, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(release, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(release) }],
                 };
             }
             case "delete_release": {
@@ -8254,10 +8523,12 @@ async function handleToolCall(params) {
                 const args = DownloadReleaseAssetSchema.parse(params.arguments);
                 if (IS_REMOTE) {
                     const downloadUrl = buildDownloadUrl("release-asset", {
-                        project_id: args.project_id, tag_name: args.tag_name, direct_asset_path: args.direct_asset_path,
+                        project_id: args.project_id,
+                        tag_name: args.tag_name,
+                        direct_asset_path: args.direct_asset_path,
                     });
                     return {
-                        content: [{ type: "text", text: JSON.stringify({ download_url: downloadUrl, filename: args.direct_asset_path.split("/").pop() || args.direct_asset_path }, null, 2) }],
+                        content: [{ type: "text", text: JSON.stringify({ download_url: downloadUrl, filename: args.direct_asset_path.split("/").pop() || args.direct_asset_path }) }],
                     };
                 }
                 const assetContent = await downloadReleaseAsset(args.project_id, args.tag_name, args.direct_asset_path);
@@ -8270,14 +8541,14 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const tags = await listTags(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(tags, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(tags) }],
                 };
             }
             case "get_tag": {
                 const args = GetTagSchema.parse(params.arguments);
                 const tag = await getTag(args.project_id, args.tag_name);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(tag, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(tag) }],
                 };
             }
             case "create_tag": {
@@ -8285,7 +8556,7 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const tag = await createTag(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(tag, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(tag) }],
                 };
             }
             case "delete_tag": {
@@ -8304,30 +8575,28 @@ async function handleToolCall(params) {
                 const args = GetTagSignatureSchema.parse(params.arguments);
                 const signature = await getTagSignature(args.project_id, args.tag_name);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(signature, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(signature) }],
                 };
             }
             case "list_webhooks": {
                 const args = ListWebhooksSchema.parse(params.arguments);
                 const webhooks = await listWebhooks(args);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(webhooks, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(webhooks) }],
                 };
             }
             case "list_webhook_events": {
                 const args = ListWebhookEventsSchema.parse(params.arguments);
                 const events = await listWebhookEvents(args);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(events, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(events) }],
                 };
             }
             case "get_webhook_event": {
                 const args = GetWebhookEventSchema.parse(params.arguments);
                 const event = await getWebhookEvent(args);
                 if (!event) {
-                    const searchScope = args.page
-                        ? `on page ${args.page}`
-                        : "in the 500 most recent events";
+                    const searchScope = args.page ? `on page ${args.page}` : "in the 500 most recent events";
                     return {
                         content: [
                             {
@@ -8338,7 +8607,7 @@ async function handleToolCall(params) {
                     };
                 }
                 return {
-                    content: [{ type: "text", text: JSON.stringify(event, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(event) }],
                 };
             }
             case "health_check": {
@@ -8346,13 +8615,24 @@ async function handleToolCall(params) {
                 const url = new URL(`${getEffectiveApiUrl()}/user`);
                 const response = await fetch(url.toString(), getFetchConfig());
                 let authenticated = response.ok;
-                if (!authenticated && (response.status === 401 || response.status === 403) && (GITLAB_JOB_TOKEN || usesJobTokenHeader())) {
+                if (!authenticated &&
+                    (response.status === 401 || response.status === 403) &&
+                    (GITLAB_JOB_TOKEN || usesJobTokenHeader())) {
                     const jobUrl = new URL(`${getEffectiveApiUrl()}/job`);
                     const jobResponse = await fetch(jobUrl.toString(), getFetchConfig());
                     authenticated = jobResponse.ok;
                 }
                 return {
-                    content: [{ type: "text", text: JSON.stringify({ status: authenticated ? "ok" : "error", authenticated, gitlab_url: getEffectiveApiUrl() }) }],
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                status: authenticated ? "ok" : "error",
+                                authenticated,
+                                gitlab_url: getEffectiveApiUrl(),
+                            }),
+                        },
+                    ],
                 };
             }
             case "get_branch": {
@@ -8366,7 +8646,7 @@ async function handleToolCall(params) {
                 const data = await response.json();
                 const branch = GitLabBranchSchema.parse(data);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(branch, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(branch) }],
                 };
             }
             case "list_branches": {
@@ -8389,7 +8669,7 @@ async function handleToolCall(params) {
                 const data = await response.json();
                 const branches = z.array(GitLabBranchSchema).parse(data);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(branches, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(branches) }],
                 };
             }
             case "delete_branch": {
@@ -8402,7 +8682,7 @@ async function handleToolCall(params) {
                 });
                 await handleGitLabError(response);
                 return {
-                    content: [{ type: "text", text: JSON.stringify({ status: "deleted", branch: args.branch_name }, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify({ status: "deleted", branch: args.branch_name }) }],
                 };
             }
             case "list_protected_branches": {
@@ -8422,7 +8702,7 @@ async function handleToolCall(params) {
                 await handleGitLabError(response);
                 const data = z.array(GitLabProtectedBranchSchema).parse(await response.json());
                 return {
-                    content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(data) }],
                 };
             }
             case "get_protected_branch": {
@@ -8436,7 +8716,7 @@ async function handleToolCall(params) {
                 await handleGitLabError(response);
                 const data = GitLabProtectedBranchSchema.parse(await response.json());
                 return {
-                    content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(data) }],
                 };
             }
             case "protect_branch": {
@@ -8463,7 +8743,7 @@ async function handleToolCall(params) {
                 await handleGitLabError(response);
                 const data = GitLabProtectedBranchSchema.parse(await response.json());
                 return {
-                    content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(data) }],
                 };
             }
             case "unprotect_branch": {
@@ -8477,7 +8757,7 @@ async function handleToolCall(params) {
                 });
                 await handleGitLabError(response);
                 return {
-                    content: [{ type: "text", text: JSON.stringify({ status: "unprotected", branch: args.branch_name }, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify({ status: "unprotected", branch: args.branch_name }) }],
                 };
             }
             case "update_default_branch": {
@@ -8493,7 +8773,7 @@ async function handleToolCall(params) {
                 await handleGitLabError(response);
                 const data = await response.json();
                 return {
-                    content: [{ type: "text", text: JSON.stringify({ status: "updated", default_branch: args.default_branch, project: data }, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify({ status: "updated", default_branch: args.default_branch, project: data }) }],
                 };
             }
             default:
@@ -8631,18 +8911,15 @@ function registerDownloadProxy(app, maxRequestsPerMinute = Number.parseInt(proce
             return;
         }
         // API URL: prefer token-embedded URL, then X-GitLab-API-URL header, then default
-        let apiUrl = tokenApiUrl || GITLAB_API_URL;
-        if (!tokenApiUrl) {
-            const dynamicApiUrl = req.headers["x-gitlab-api-url"]?.trim();
-            if (ENABLE_DYNAMIC_API_URL && dynamicApiUrl) {
-                try {
-                    new URL(dynamicApiUrl);
-                    apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);
-                }
-                catch {
-                    res.status(400).json({ error: "Invalid X-GitLab-API-URL" });
-                    return;
-                }
+        let apiUrl = GITLAB_API_URL;
+        const requestedApiUrl = tokenApiUrl || req.headers["x-gitlab-api-url"]?.trim();
+        if (ENABLE_DYNAMIC_API_URL && requestedApiUrl) {
+            try {
+                apiUrl = resolveTrustedGitLabApiUrl(requestedApiUrl);
+            }
+            catch {
+                res.status(400).json({ error: "Invalid X-GitLab-API-URL" });
+                return;
             }
         }
         const { type } = req.params;
@@ -8656,7 +8933,7 @@ function registerDownloadProxy(app, maxRequestsPerMinute = Number.parseInt(proce
                         return;
                     }
                     const effectiveProjectId = getEffectiveProjectId(decodeURIComponent(project_id));
-                    gitlabUrl = `${apiUrl}/projects/${encodeURIComponent(effectiveProjectId)}/jobs/${job_id}/artifacts`;
+                    gitlabUrl = `${apiUrl}/projects/${encodeURIComponent(effectiveProjectId)}/jobs/${encodeGitLabPathSegment(job_id)}/artifacts`;
                     break;
                 }
                 case "attachment": {
@@ -8666,17 +8943,19 @@ function registerDownloadProxy(app, maxRequestsPerMinute = Number.parseInt(proce
                         return;
                     }
                     const effectiveProjectId = getEffectiveProjectId(decodeURIComponent(project_id));
-                    gitlabUrl = `${apiUrl}/projects/${encodeURIComponent(effectiveProjectId)}/uploads/${secret}/${filename}`;
+                    gitlabUrl = `${apiUrl}/projects/${encodeURIComponent(effectiveProjectId)}/uploads/${encodeGitLabPathSegment(secret)}/${encodeGitLabPath(filename)}`;
                     break;
                 }
                 case "release-asset": {
                     const { project_id, tag_name, direct_asset_path } = req.query;
                     if (!project_id || !tag_name || !direct_asset_path) {
-                        res.status(400).json({ error: "project_id, tag_name, and direct_asset_path are required" });
+                        res
+                            .status(400)
+                            .json({ error: "project_id, tag_name, and direct_asset_path are required" });
                         return;
                     }
                     const effectiveProjectId = getEffectiveProjectId(decodeURIComponent(project_id));
-                    gitlabUrl = `${apiUrl}/projects/${encodeURIComponent(effectiveProjectId)}/releases/${encodeURIComponent(tag_name)}/downloads/${direct_asset_path}`;
+                    gitlabUrl = `${apiUrl}/projects/${encodeURIComponent(effectiveProjectId)}/releases/${encodeURIComponent(tag_name)}/downloads/${encodeGitLabPath(direct_asset_path)}`;
                     break;
                 }
                 default:
@@ -8728,12 +9007,21 @@ function registerDownloadProxy(app, maxRequestsPerMinute = Number.parseInt(proce
  */
 async function startSSEServer() {
     const app = express();
+    const sseAuthToken = getConfig("sse-auth-token", "SSE_AUTH_TOKEN");
     if (MCP_TRUST_PROXY) {
         app.set("trust proxy", 1);
     }
+    const requireSseAuth = (req, res, next) => {
+        if (!sseAuthToken)
+            return next();
+        const match = /^Bearer\s+(\S+)$/i.exec(req.headers.authorization || "");
+        if (match?.[1] === sseAuthToken)
+            return next();
+        res.status(401).json({ error: "SSE authentication required" });
+    };
     const transports = {};
     let shuttingDown = false;
-    app.get("/sse", async (_, res) => {
+    app.get("/sse", requireSseAuth, async (_, res) => {
         const serverInstance = createServer();
         const transport = new SSEServerTransport("/messages", res);
         transports[transport.sessionId] = transport;
@@ -8742,7 +9030,7 @@ async function startSSEServer() {
         });
         await serverInstance.connect(transport);
     });
-    app.post("/messages", async (req, res) => {
+    app.post("/messages", requireSseAuth, async (req, res) => {
         const sessionId = req.query.sessionId;
         const transport = transports[sessionId];
         if (transport) {
@@ -8866,12 +9154,11 @@ async function startStreamableHTTPServer() {
         // Only process dynamic URL if the feature is enabled
         if (ENABLE_DYNAMIC_API_URL && dynamicApiUrl) {
             try {
-                new URL(dynamicApiUrl); // Ensure it's a valid URL format
-                apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);
+                apiUrl = resolveTrustedGitLabApiUrl(dynamicApiUrl);
             }
             catch {
                 logger.warn(`Invalid X-GitLab-API-URL provided: ${dynamicApiUrl}. Auth will fail.`);
-                return null; // Reject if URL is malformed
+                return null; // Reject if URL is malformed or not allowed
             }
         }
         // Extract token — priority: Private-Token > JOB-TOKEN > Authorization Bearer
@@ -9079,7 +9366,7 @@ async function startStreamableHTTPServer() {
             token: effective.token,
             lastUsed: Date.now(),
             apiUrl: effective.apiUrl,
-            publicBaseUrl: getForwardedPublicBaseUrl(req),
+            publicBaseUrl: getForwardedPublicBaseUrl(req, MCP_TRUST_PROXY),
         };
         // Step 4: create a fresh transport per request.
         const transport = isInit
@@ -9273,16 +9560,14 @@ async function startStreamableHTTPServer() {
     // Streamable HTTP endpoint - handles both session creation and message handling
     app.post("/mcp", mcpBearerAuth, async (req, res) => {
         const sessionId = readMcpSessionIdHeader(req);
-        const publicBaseUrl = getForwardedPublicBaseUrl(req);
+        const publicBaseUrl = getForwardedPublicBaseUrl(req, MCP_TRUST_PROXY);
         // Track request
         metrics.requestsProcessed++;
         // Stateless-mode branch: bypass authBySession / streamableTransports
         // entirely and derive the session auth from either the current request
         // headers (init) or a sealed Mcp-Session-Id (subsequent requests).
         // Rate limiting is disabled here because there is no shared counter.
-        if (OAUTH_STATELESS_MODE &&
-            STATELESS_MATERIAL &&
-            (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH)) {
+        if (OAUTH_STATELESS_MODE && STATELESS_MATERIAL && (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH)) {
             await handleStatelessMcpRequest(req, res, STATELESS_MATERIAL, OAUTH_STATELESS_SESSION_TTL_SECONDS);
             return;
         }
@@ -9307,9 +9592,11 @@ async function startStreamableHTTPServer() {
         // Handle remote authorization: extract and store auth headers per session
         if (REMOTE_AUTHORIZATION) {
             const authData = parseAuthHeaders(req);
+            const allowUnauthenticatedDiscovery = GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY &&
+                isUnauthenticatedDiscoveryRequestBody(req.body);
             if (sessionId && !authBySession[sessionId]) {
-                // New session: require auth headers
-                if (!authData) {
+                // New session: require auth headers unless public discovery was explicitly enabled.
+                if (!authData && !allowUnauthenticatedDiscovery) {
                     metrics.authFailures++;
                     res.status(401).json({
                         error: "Missing Private-Token, JOB-TOKEN, or Authorization header",
@@ -9317,10 +9604,16 @@ async function startStreamableHTTPServer() {
                     });
                     return;
                 }
-                // Store auth for this session
-                authBySession[sessionId] = withPublicBaseUrl(authData, publicBaseUrl);
-                logger.info(`Session ${sessionId}: stored ${authData.header} header`);
-                setAuthTimeout(sessionId);
+                // Store auth only when provided. Public discovery intentionally leaves the session unauthenticated.
+                if (authData) {
+                    authBySession[sessionId] = withPublicBaseUrl(authData, publicBaseUrl);
+                    logger.info(`Session ${sessionId}: stored ${authData.header} header`);
+                    setAuthTimeout(sessionId);
+                }
+                else if (allowUnauthenticatedDiscovery) {
+                    // Schedule cleanup for unauthenticated discovery sessions to prevent slot exhaustion
+                    setAuthTimeout(sessionId);
+                }
             }
             else if (sessionId && authData) {
                 // Existing session: allow auth rotation/update
@@ -9493,25 +9786,112 @@ async function startStreamableHTTPServer() {
             message: "GET /mcp is not supported when STREAMABLE_HTTP is enabled. Use POST to communicate with the MCP server.",
         });
     });
+    const getMetricsSnapshot = () => ({
+        ...metrics,
+        activeSessions: Object.keys(streamableTransports).length,
+        authenticatedSessions: Object.keys(authBySession).length,
+        gitlabClientPool: clientPool.getStats(),
+        uptime: process.uptime(),
+        memoryUsage: process.memoryUsage(),
+        config: {
+            maxSessions: MAX_SESSIONS,
+            maxRequestsPerMinute: MAX_REQUESTS_PER_MINUTE,
+            sessionTimeoutSeconds: SESSION_TIMEOUT_SECONDS,
+            remoteAuthEnabled: REMOTE_AUTHORIZATION,
+            mcpOAuthEnabled: GITLAB_MCP_OAUTH,
+            statelessModeEnabled: OAUTH_STATELESS_MODE && STATELESS_MATERIAL !== null,
+            statelessRotationKey: OAUTH_STATELESS_MODE && STATELESS_MATERIAL?.previous != null,
+        },
+    });
+    const escapePrometheusLabel = (value) => String(value).replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/"/g, '\\"');
+    const formatPrometheusMetrics = () => {
+        const snapshot = getMetricsSnapshot();
+        const configLabels = Object.entries({
+            max_sessions: snapshot.config.maxSessions,
+            max_requests_per_minute: snapshot.config.maxRequestsPerMinute,
+            session_timeout_seconds: snapshot.config.sessionTimeoutSeconds,
+            remote_auth_enabled: snapshot.config.remoteAuthEnabled,
+            mcp_oauth_enabled: snapshot.config.mcpOAuthEnabled,
+            stateless_mode_enabled: snapshot.config.statelessModeEnabled,
+            stateless_rotation_key: snapshot.config.statelessRotationKey,
+        })
+            .map(([key, value]) => `${key}="${escapePrometheusLabel(value)}"`)
+            .join(",");
+        return [
+            "# HELP gitlab_mcp_requests_processed_total Total MCP requests processed",
+            "# TYPE gitlab_mcp_requests_processed_total counter",
+            `gitlab_mcp_requests_processed_total ${snapshot.requestsProcessed}`,
+            "",
+            "# HELP gitlab_mcp_requests_rejected_total Requests rejected, by reason",
+            "# TYPE gitlab_mcp_requests_rejected_total counter",
+            `gitlab_mcp_requests_rejected_total{reason="rate_limit"} ${snapshot.rejectedByRateLimit}`,
+            `gitlab_mcp_requests_rejected_total{reason="capacity"} ${snapshot.rejectedByCapacity}`,
+            "",
+            "# HELP gitlab_mcp_auth_failures_total Authentication failures",
+            "# TYPE gitlab_mcp_auth_failures_total counter",
+            `gitlab_mcp_auth_failures_total ${snapshot.authFailures}`,
+            "",
+            "# HELP gitlab_mcp_sessions_total Total sessions created",
+            "# TYPE gitlab_mcp_sessions_total counter",
+            `gitlab_mcp_sessions_total ${snapshot.totalSessions}`,
+            "",
+            "# HELP gitlab_mcp_sessions_expired_total Sessions expired due to inactivity",
+            "# TYPE gitlab_mcp_sessions_expired_total counter",
+            `gitlab_mcp_sessions_expired_total ${snapshot.expiredSessions}`,
+            "",
+            "# HELP gitlab_mcp_active_sessions Currently active sessions",
+            "# TYPE gitlab_mcp_active_sessions gauge",
+            `gitlab_mcp_active_sessions ${snapshot.activeSessions}`,
+            "",
+            "# HELP gitlab_mcp_authenticated_sessions Currently authenticated sessions",
+            "# TYPE gitlab_mcp_authenticated_sessions gauge",
+            `gitlab_mcp_authenticated_sessions ${snapshot.authenticatedSessions}`,
+            "",
+            "# HELP gitlab_mcp_client_pool_size Current GitLab client pool size",
+            "# TYPE gitlab_mcp_client_pool_size gauge",
+            `gitlab_mcp_client_pool_size ${snapshot.gitlabClientPool.size}`,
+            "",
+            "# HELP gitlab_mcp_client_pool_max_size Maximum GitLab client pool size",
+            "# TYPE gitlab_mcp_client_pool_max_size gauge",
+            `gitlab_mcp_client_pool_max_size ${snapshot.gitlabClientPool.maxSize}`,
+            "",
+            "# HELP gitlab_mcp_uptime_seconds Process uptime in seconds",
+            "# TYPE gitlab_mcp_uptime_seconds gauge",
+            `gitlab_mcp_uptime_seconds ${snapshot.uptime}`,
+            "",
+            "# HELP gitlab_mcp_memory_usage_bytes Node.js memory usage by type",
+            "# TYPE gitlab_mcp_memory_usage_bytes gauge",
+            ...Object.entries(snapshot.memoryUsage).map(([key, value]) => `gitlab_mcp_memory_usage_bytes{type="${escapePrometheusLabel(key)}"} ${value}`),
+            "",
+            "# HELP gitlab_mcp_stateless_requests_total Stateless MCP requests processed",
+            "# TYPE gitlab_mcp_stateless_requests_total counter",
+            `gitlab_mcp_stateless_requests_total ${snapshot.statelessRequests}`,
+            "",
+            "# HELP gitlab_mcp_stateless_auth_total Stateless auth successes, by source",
+            "# TYPE gitlab_mcp_stateless_auth_total counter",
+            `gitlab_mcp_stateless_auth_total{source="header"} ${snapshot.statelessAuthFromHeader}`,
+            `gitlab_mcp_stateless_auth_total{source="sealed_session_id"} ${snapshot.statelessAuthFromSealedSid}`,
+            "",
+            "# HELP gitlab_mcp_stateless_auth_failures_total Stateless auth failures",
+            "# TYPE gitlab_mcp_stateless_auth_failures_total counter",
+            `gitlab_mcp_stateless_auth_failures_total ${snapshot.statelessAuthFailures}`,
+            "",
+            "# HELP gitlab_mcp_stateless_session_id_rotations_total Stateless session id rotations",
+            "# TYPE gitlab_mcp_stateless_session_id_rotations_total counter",
+            `gitlab_mcp_stateless_session_id_rotations_total ${snapshot.statelessSidRotated}`,
+            "",
+            "# HELP gitlab_mcp_config_info Static configuration (value is always 1)",
+            "# TYPE gitlab_mcp_config_info gauge",
+            `gitlab_mcp_config_info{${configLabels}} 1`,
+            "",
+        ].join("\n");
+    };
     // Metrics endpoint
     app.get("/metrics", (_req, res) => {
-        res.json({
-            ...metrics,
-            activeSessions: Object.keys(streamableTransports).length,
-            authenticatedSessions: Object.keys(authBySession).length,
-            gitlabClientPool: clientPool.getStats(),
-            uptime: process.uptime(),
-            memoryUsage: process.memoryUsage(),
-            config: {
-                maxSessions: MAX_SESSIONS,
-                maxRequestsPerMinute: MAX_REQUESTS_PER_MINUTE,
-                sessionTimeoutSeconds: SESSION_TIMEOUT_SECONDS,
-                remoteAuthEnabled: REMOTE_AUTHORIZATION,
-                mcpOAuthEnabled: GITLAB_MCP_OAUTH,
-                statelessModeEnabled: OAUTH_STATELESS_MODE && STATELESS_MATERIAL !== null,
-                statelessRotationKey: OAUTH_STATELESS_MODE && STATELESS_MATERIAL?.previous != null,
-            },
-        });
+        res.type("text/plain; version=0.0.4").send(formatPrometheusMetrics());
+    });
+    app.get("/metrics.json", (_req, res) => {
+        res.json(getMetricsSnapshot());
     });
     // Health check endpoint
     app.get("/health", (_req, res) => {