npm - @zereight/mcp-gitlab - Versions diffs - 2.1.27 → 2.1.29 - Mend

@zereight/mcp-gitlab 2.1.27 → 2.1.29

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (12) hide show

package/README.ko.md +40 -32
package/README.md +47 -38
package/README.zh-CN.md +36 -28
package/build/index.js +79 -58
package/build/oauth-proxy.js +18 -4
package/build/schemas.js +17 -0
package/build/test/path-segment-encoding.test.js +27 -0
package/build/test/stateless/callback-proxy.test.js +8 -0
package/build/test/utils/redact-sensitive.test.js +32 -0
package/build/utils/redact-sensitive.js +21 -0
package/build/utils/schema.js +42 -11
package/package.json +5 -4

package/README.ko.md CHANGED Viewed

@@ -20,7 +20,7 @@ PAT, OAuth, 읽기 전용 모드, 동적 API URL, 원격 인증을 지원하며
 - 클라이언트 친화적 설정: Claude Code, Codex, Antigravity, OpenCode, Copilot, Cline, Roo Code, Cursor, Kilo Code, Amp Code 예시 제공
 - 셀프 호스팅 대응: 커스텀 GitLab 인스턴스, 프록시 설정, 동적 API URL 라우팅 지원
-빠른 시작: 아래에서 Personal Access Token 또는 OAuth2 설정 중 하나를 선택하고 MCP 클라이언트 설정에서 `@zereight/mcp-gitlab`을 사용하세요.
+빠른 시작: 아래에서 Personal Access Token 또는 OAuth2 설정 중 하나를 선택하고 `@zereight/mcp-gitlab`을 설치한 뒤 MCP 클라이언트 설정에서 `zereight-mcp-gitlab`을 사용하세요.
 ### 클라이언트 설정 가이드
@@ -63,6 +63,16 @@ PAT, OAuth, 읽기 전용 모드, 동적 API URL, 원격 인증을 지원하며
 가장 단순한 로컬 설정은 Personal Access Token으로 시작하세요. 브라우저 기반 로컬 인증은 OAuth2를 사용하세요. 원격 또는 멀티 유저 배포는 아래 MCP OAuth 및 원격 인증 섹션을 참고하세요.
+서버를 한 번 전역 설치하세요.
+```shell
+npm install -g @zereight/mcp-gitlab
+```
+예시는 기존 `mcp-gitlab`보다 충돌 가능성이 낮은 `zereight-mcp-gitlab` 별칭을 사용합니다. MCP 클라이언트가 찾지 못하면 `which zereight-mcp-gitlab`의 절대 경로를 사용하세요.
+전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.29`처럼 버전을 고정하세요.
 #### CLI 인자 사용하기(환경 변수 문제가 있는 클라이언트용)
 일부 MCP 클라이언트(예: GitHub Copilot CLI)는 환경 변수 처리에 문제가 있을 수 있습니다. 이 경우 CLI 인자를 사용하세요.
@@ -71,13 +81,8 @@ PAT, OAuth, 읽기 전용 모드, 동적 API URL, 원격 인증을 지원하며
 {
   "mcpServers": {
     "gitlab": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "@zereight/mcp-gitlab",
-        "--token=YOUR_GITLAB_TOKEN",
-        "--api-url=https://gitlab.com/api/v4"
-      ],
+      "command": "zereight-mcp-gitlab",
+      "args": ["--token=YOUR_GITLAB_TOKEN", "--api-url=https://gitlab.com/api/v4"],
       "tools": ["*"]
     }
   }
@@ -89,12 +94,19 @@ PAT, OAuth, 읽기 전용 모드, 동적 API URL, 원격 인증을 지원하며
 - `--token` - GitLab Personal Access Token (`GITLAB_PERSONAL_ACCESS_TOKEN` 대체)
 - `--api-url` - GitLab API URL (`GITLAB_API_URL` 대체)
 - `--read-only=true` - 읽기 전용 모드 활성화 (`GITLAB_READ_ONLY_MODE` 대체)
-- `--use-wiki=true` - 위키 API 활성화 (`USE_GITLAB_WIKI` 대체)
-- `--use-milestone=true` - 마일스톤 API 활성화 (`USE_MILESTONE` 대체)
-- `--use-pipeline=true` - 파이프라인 API 활성화 (`USE_PIPELINE` 대체)
+- `--use-wiki=true` - 위키 API 활성화 (`USE_GITLAB_WIKI` 대체, 레거시 — `GITLAB_TOOLSETS=wiki` 권장)
+- `--use-milestone=true` - 마일스톤 API 활성화 (`USE_MILESTONE` 대체, 레거시 — `GITLAB_TOOLSETS=milestones` 권장)
+- `--use-pipeline=true` - 파이프라인 API 활성화 (`USE_PIPELINE` 대체, 레거시 — `GITLAB_TOOLSETS=pipelines` 권장)
 CLI 인자는 환경 변수보다 우선합니다.
+> **세밀한 도구 필터링:** 전체 on/off 방식인 `GITLAB_READ_ONLY_MODE` 외에도,
+> `GITLAB_TOOLSETS=<group,…>`로 도구 그룹을 활성화하고, `GITLAB_TOOLS=<tool,…>`로 개별 도구만
+> 허용하며(예: 읽기 도구 + 특정 쓰기 도구 몇 개), `GITLAB_DENIED_TOOLS_REGEX`로 패턴 차단할 수
+> 있습니다. 레거시 `USE_GITLAB_WIKI` / `USE_MILESTONE` / `USE_PIPELINE` 플래그는 하위 호환용으로만
+> 유지됩니다. [Tools Reference](./docs/tools/index.md#feature-toggles)와
+> [Environment Variables](./docs/configuration/environment-variables.md)를 참고하세요.
 #### SSE
 ```shell
@@ -103,9 +115,7 @@ docker run -i --rm \
   -e GITLAB_PERSONAL_ACCESS_TOKEN=your_gitlab_token \
   -e GITLAB_API_URL="https://gitlab.com/api/v4" \
   -e GITLAB_READ_ONLY_MODE=true \
-  -e USE_GITLAB_WIKI=true \
-  -e USE_MILESTONE=true \
-  -e USE_PIPELINE=true \
+  -e GITLAB_TOOLSETS=wiki,milestones,pipelines \
   -e SSE=true \
   -p 3333:3002 \
   zereight050/gitlab-mcp
@@ -130,9 +140,7 @@ docker run -i --rm \
   -e GITLAB_PERSONAL_ACCESS_TOKEN=your_gitlab_token \
   -e GITLAB_API_URL="https://gitlab.com/api/v4" \
   -e GITLAB_READ_ONLY_MODE=true \
-  -e USE_GITLAB_WIKI=true \
-  -e USE_MILESTONE=true \
-  -e USE_PIPELINE=true \
+  -e GITLAB_TOOLSETS=wiki,milestones,pipelines \
   -e STREAMABLE_HTTP=true \
   -p 3333:3002 \
   zereight050/gitlab-mcp
@@ -178,15 +186,15 @@ MCP 서버가 직접 로컬 브라우저 callback을 받을 때만 `GITLAB_OAUTH
 2. `api` 또는 `read_api` scope가 있는 사전 등록 GitLab OAuth 애플리케이션
    — `Admin area` → `Applications`에서 Redirect URI를 `{MCP_SERVER_URL}/callback`으로 설정하세요.
-| 환경 변수                     | 필수 | 설명                                                       |
-| ----------------------------- | ---- | ---------------------------------------------------------- |
-| `GITLAB_MCP_OAUTH`            | 예   | 활성화하려면 `true`                                        |
-| `GITLAB_API_URL`              | 예   | GitLab API base URL                                        |
-| `GITLAB_OAUTH_APP_ID`         | 예   | GitLab OAuth Application ID                                |
-| `MCP_SERVER_URL`              | 예   | 이 MCP 서버의 공개 HTTPS URL                               |
-| `STREAMABLE_HTTP`             | 예   | 반드시 `true`                                              |
-| `GITLAB_OAUTH_CALLBACK_PROXY` | 선택 | MCP 서버의 고정 `/callback` URL을 사용하려면 `true`        |
-| `GITLAB_OAUTH_SCOPES`         | 선택 | 쉼표로 구분된 scope 목록(기본값: `api,read_api,read_user`) |
+| 환경 변수                     | 필수 | 설명                                                                                                                            |
+| ----------------------------- | ---- | ------------------------------------------------------------------------------------------------------------------------------- |
+| `GITLAB_MCP_OAUTH`            | 예   | 활성화하려면 `true`                                                                                                             |
+| `GITLAB_API_URL`              | 예   | GitLab API base URL                                                                                                             |
+| `GITLAB_OAUTH_APP_ID`         | 예   | GitLab OAuth Application ID                                                                                                     |
+| `MCP_SERVER_URL`              | 예   | 이 MCP 서버의 공개 HTTPS URL                                                                                                    |
+| `STREAMABLE_HTTP`             | 예   | 반드시 `true`                                                                                                                   |
+| `GITLAB_OAUTH_CALLBACK_PROXY` | 선택 | MCP 서버의 고정 `/callback` URL을 사용하려면 `true`                                                                             |
+| `GITLAB_OAUTH_SCOPES`         | 선택 | 쉼표로 구분된 scope 목록(기본값: `api,read_api,read_user`)                                                                      |
 | `GITLAB_OAUTH_ALLOWED_GROUPS` | 선택 | 쉼표로 구분된 GitLab 그룹 전체 경로 — 해당 그룹 및 하위 그룹 멤버만 토큰을 발급받을 수 있음 (기존 `GITLAB_ALLOWED_GROUPS` 대체) |
 > **`Unregistered redirect_uri` 문제 해결**
@@ -233,12 +241,12 @@ MCP 클라이언트 설정:
 **헤더 우선순위**: `Private-Token` > `JOB-TOKEN` > `Authorization: Bearer`
-| 환경 변수                | 필수 | 설명                                |
-| ------------------------ | ---- | ----------------------------------- |
-| `REMOTE_AUTHORIZATION`   | 예   | 활성화하려면 `true`                 |
-| `STREAMABLE_HTTP`        | 예   | 반드시 `true`                       |
-| `ENABLE_DYNAMIC_API_URL` | 선택 | 요청별 `X-GitLab-API-URL` 헤더 허용 |
-| `GITLAB_ALLOWED_HOSTS` | 선택 | 허용할 호스트의 쉼표 구분 목록; `GITLAB_API_URL` 호스트는 항상 허용 |
+| 환경 변수                | 필수 | 설명                                                                |
+| ------------------------ | ---- | ------------------------------------------------------------------- |
+| `REMOTE_AUTHORIZATION`   | 예   | 활성화하려면 `true`                                                 |
+| `STREAMABLE_HTTP`        | 예   | 반드시 `true`                                                       |
+| `ENABLE_DYNAMIC_API_URL` | 선택 | 요청별 `X-GitLab-API-URL` 헤더 허용                                 |
+| `GITLAB_ALLOWED_HOSTS`   | 선택 | 허용할 호스트의 쉼표 구분 목록; `GITLAB_API_URL` 호스트는 항상 허용 |
 **예시 요청 헤더:**

package/README.md CHANGED Viewed

@@ -22,7 +22,7 @@ Supports PAT, OAuth, read-only mode, dynamic API URLs, and remote authorization
 - Client-friendly setup — examples for Claude Code, Codex, Antigravity, OpenCode, Copilot, Cline, Roo Code, Cursor, Kilo Code, and Amp Code
 - Self-hosted ready — works with custom GitLab instances, proxy settings, and dynamic API URL routing
-Quick start: choose either Personal Access Token or OAuth2 setup below and use `@zereight/mcp-gitlab` in your MCP client configuration.
+Quick start: choose either Personal Access Token or OAuth2 setup below, install `@zereight/mcp-gitlab`, and use `zereight-mcp-gitlab` in your MCP client configuration.
 ### Client Setup Guides
@@ -67,6 +67,16 @@ The server supports four authentication methods:
 For the simplest local setup, start with a Personal Access Token. For browser-based local auth, use OAuth2. For remote or multi-user deployments, continue to the MCP OAuth and Remote Authorization sections later in this README.
+Install the server globally once:
+```shell
+npm install -g @zereight/mcp-gitlab
+```
+The examples use `zereight-mcp-gitlab`, a less collision-prone alias for the legacy `mcp-gitlab` binary. If your MCP client cannot find it, use the absolute path from `which zereight-mcp-gitlab`.
+No global install? Pin `npx` to a known version, for example `npx -y @zereight/mcp-gitlab@2.1.29`.
 #### Using CLI Arguments (for clients with env var issues)
 Some MCP clients (like GitHub Copilot CLI) have issues with environment variables. Use CLI arguments instead:
@@ -75,13 +85,8 @@ Some MCP clients (like GitHub Copilot CLI) have issues with environment variable
 {
   "mcpServers": {
     "gitlab": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "@zereight/mcp-gitlab",
-        "--token=YOUR_GITLAB_TOKEN",
-        "--api-url=https://gitlab.com/api/v4"
-      ],
+      "command": "zereight-mcp-gitlab",
+      "args": ["--token=YOUR_GITLAB_TOKEN", "--api-url=https://gitlab.com/api/v4"],
       "tools": ["*"]
     }
   }
@@ -93,12 +98,20 @@ Some MCP clients (like GitHub Copilot CLI) have issues with environment variable
 - `--token` - GitLab Personal Access Token (replaces `GITLAB_PERSONAL_ACCESS_TOKEN`)
 - `--api-url` - GitLab API URL (replaces `GITLAB_API_URL`)
 - `--read-only=true` - Enable read-only mode (replaces `GITLAB_READ_ONLY_MODE`)
-- `--use-wiki=true` - Enable wiki API (replaces `USE_GITLAB_WIKI`)
-- `--use-milestone=true` - Enable milestone API (replaces `USE_MILESTONE`)
-- `--use-pipeline=true` - Enable pipeline API (replaces `USE_PIPELINE`)
+- `--use-wiki=true` - Enable wiki API (replaces `USE_GITLAB_WIKI`, legacy — prefer `GITLAB_TOOLSETS=wiki`)
+- `--use-milestone=true` - Enable milestone API (replaces `USE_MILESTONE`, legacy — prefer `GITLAB_TOOLSETS=milestones`)
+- `--use-pipeline=true` - Enable pipeline API (replaces `USE_PIPELINE`, legacy — prefer `GITLAB_TOOLSETS=pipelines`)
 CLI arguments take precedence over environment variables.
+> **Fine-grained tool filtering:** beyond the all-or-nothing `GITLAB_READ_ONLY_MODE`, you can
+> enable toolset groups with `GITLAB_TOOLSETS=<group,…>`, allow-list individual tools with
+> `GITLAB_TOOLS=<tool,…>` (e.g. read-only groups plus a few specific write tools), and
+> deny-list by pattern with `GITLAB_DENIED_TOOLS_REGEX`. The legacy `USE_GITLAB_WIKI` /
+> `USE_MILESTONE` / `USE_PIPELINE` flags are kept for backward compatibility only.
+> See [Tools Reference](./docs/tools/index.md#feature-toggles) and
+> [Environment Variables](./docs/configuration/environment-variables.md).
 - sse
 ```shell
@@ -107,9 +120,7 @@ docker run -i --rm \
   -e GITLAB_PERSONAL_ACCESS_TOKEN=your_gitlab_token \
   -e GITLAB_API_URL="https://gitlab.com/api/v4" \
   -e GITLAB_READ_ONLY_MODE=true \
-  -e USE_GITLAB_WIKI=true \
-  -e USE_MILESTONE=true \
-  -e USE_PIPELINE=true \
+  -e GITLAB_TOOLSETS=wiki,milestones,pipelines \
   -e SSE=true \
   -e SSE_AUTH_TOKEN=your_mcp_sse_token \
   -p 3333:3002 \
@@ -138,9 +149,7 @@ docker run -i --rm \
   -e REMOTE_AUTHORIZATION=true \
   -e GITLAB_API_URL="https://gitlab.com/api/v4" \
   -e GITLAB_READ_ONLY_MODE=true \
-  -e USE_GITLAB_WIKI=true \
-  -e USE_MILESTONE=true \
-  -e USE_PIPELINE=true \
+  -e GITLAB_TOOLSETS=wiki,milestones,pipelines \
   -e STREAMABLE_HTTP=true \
   -p 3333:3002 \
   zereight050/gitlab-mcp
@@ -186,10 +195,10 @@ Remote MCP OAuth is different. In `GITLAB_MCP_OAUTH=true` mode, the MCP client
 provides its own callback URL during `/authorize`. `GITLAB_OAUTH_REDIRECT_URI`
 does not replace that client-provided URL.
-| Mode | Enable with | Callback variable | GitLab redirect URI |
-| --- | --- | --- | --- |
-| Local OAuth | `GITLAB_USE_OAUTH=true` | `GITLAB_OAUTH_REDIRECT_URI` | `http://127.0.0.1:8888/callback` or your local callback |
-| Remote MCP OAuth | `GITLAB_MCP_OAUTH=true` | `GITLAB_OAUTH_CALLBACK_PROXY=true` | `{MCP_SERVER_URL}/callback` |
+| Mode             | Enable with             | Callback variable                  | GitLab redirect URI                                     |
+| ---------------- | ----------------------- | ---------------------------------- | ------------------------------------------------------- |
+| Local OAuth      | `GITLAB_USE_OAUTH=true` | `GITLAB_OAUTH_REDIRECT_URI`        | `http://127.0.0.1:8888/callback` or your local callback |
+| Remote MCP OAuth | `GITLAB_MCP_OAUTH=true` | `GITLAB_OAUTH_CALLBACK_PROXY=true` | `{MCP_SERVER_URL}/callback`                             |
 Use `GITLAB_OAUTH_REDIRECT_URI` only when the MCP server itself owns the local
 browser callback. Use `GITLAB_OAUTH_CALLBACK_PROXY=true` when a remote MCP client
@@ -205,15 +214,15 @@ exchanging credentials with GitLab on behalf of the client.
 2. A pre-registered GitLab OAuth application with `api` (or `read_api`) scopes
    — Go to `Admin area` → `Applications`, set Redirect URI to `{MCP_SERVER_URL}/callback`
-| Environment Variable  | Required | Description                                                |
-| --------------------- | -------- | ---------------------------------------------------------- |
-| `GITLAB_MCP_OAUTH`    | ✅       | Set to `true` to enable                                    |
-| `GITLAB_API_URL`      | ✅       | GitLab API base URL                                        |
-| `GITLAB_OAUTH_APP_ID` | ✅       | GitLab OAuth Application ID                                |
-| `MCP_SERVER_URL`      | ✅       | Public HTTPS URL of this MCP server                        |
-| `STREAMABLE_HTTP`     | ✅       | Must be `true`                                             |
-| `GITLAB_OAUTH_CALLBACK_PROXY` | optional | Set to `true` to use the MCP server's fixed `/callback` URL |
-| `GITLAB_OAUTH_SCOPES` | optional | Comma-separated scopes (default: `api,read_api,read_user`) |
+| Environment Variable          | Required | Description                                                                                                                             |
+| ----------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------- |
+| `GITLAB_MCP_OAUTH`            | ✅       | Set to `true` to enable                                                                                                                 |
+| `GITLAB_API_URL`              | ✅       | GitLab API base URL                                                                                                                     |
+| `GITLAB_OAUTH_APP_ID`         | ✅       | GitLab OAuth Application ID                                                                                                             |
+| `MCP_SERVER_URL`              | ✅       | Public HTTPS URL of this MCP server                                                                                                     |
+| `STREAMABLE_HTTP`             | ✅       | Must be `true`                                                                                                                          |
+| `GITLAB_OAUTH_CALLBACK_PROXY` | optional | Set to `true` to use the MCP server's fixed `/callback` URL                                                                             |
+| `GITLAB_OAUTH_SCOPES`         | optional | Comma-separated scopes (default: `api,read_api,read_user`)                                                                              |
 | `GITLAB_OAUTH_ALLOWED_GROUPS` | optional | Comma-separated group full paths — only members (and subgroup members) may obtain a token (replaces deprecated `GITLAB_ALLOWED_GROUPS`) |
 When `STREAMABLE_HTTP=true`, server-side `GITLAB_PERSONAL_ACCESS_TOKEN` or `GITLAB_JOB_TOKEN` require `REMOTE_AUTHORIZATION=true` or `GITLAB_MCP_OAUTH=true`.
@@ -266,14 +275,14 @@ the token to GitLab on behalf of the caller.
 **Header priority**: `Private-Token` > `JOB-TOKEN` > `Authorization: Bearer`
-| Environment Variable     | Required | Description                                                |
-| ------------------------ | -------- | ---------------------------------------------------------- |
-| `REMOTE_AUTHORIZATION`   | ✅       | Set to `true` to enable                                    |
-| `STREAMABLE_HTTP`        | ✅       | Must be `true`                                             |
-| `ENABLE_DYNAMIC_API_URL` | optional | Allow per-request GitLab URL via `X-GitLab-API-URL` header |
-| `GITLAB_ALLOWED_HOSTS` | optional | Comma-separated allowed `X-GitLab-API-URL` hosts; `GITLAB_API_URL` hosts are always allowed |
-| `GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY` | optional | Allow unauthenticated `initialize`, `notifications/initialized`, and `tools/list` only (tool calls still require auth) |
-| `MCP_TRUST_PROXY`        | optional | Trust `Forwarded` / `X-Forwarded-*` headers behind a reverse proxy (download URLs, Express `req.ip`, OAuth rate limits) |
+| Environment Variable                          | Required | Description                                                                                                             |
+| --------------------------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------- |
+| `REMOTE_AUTHORIZATION`                        | ✅       | Set to `true` to enable                                                                                                 |
+| `STREAMABLE_HTTP`                             | ✅       | Must be `true`                                                                                                          |
+| `ENABLE_DYNAMIC_API_URL`                      | optional | Allow per-request GitLab URL via `X-GitLab-API-URL` header                                                              |
+| `GITLAB_ALLOWED_HOSTS`                        | optional | Comma-separated allowed `X-GitLab-API-URL` hosts; `GITLAB_API_URL` hosts are always allowed                             |
+| `GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY` | optional | Allow unauthenticated `initialize`, `notifications/initialized`, and `tools/list` only (tool calls still require auth)  |
+| `MCP_TRUST_PROXY`                             | optional | Trust `Forwarded` / `X-Forwarded-*` headers behind a reverse proxy (download URLs, Express `req.ip`, OAuth rate limits) |
 `GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY=true` is intended for MCP gateways
 or admin UIs that need to inspect tool metadata before a user provides a GitLab

package/README.zh-CN.md CHANGED Viewed

@@ -20,7 +20,7 @@
 - 客户端设置友好：提供 Claude Code、Codex、Antigravity、OpenCode、Copilot、Cline、Roo Code、Cursor、Kilo Code 和 Amp Code 示例
 - 适合自托管：支持自定义 GitLab 实例、代理设置和动态 API URL 路由
-快速开始：在下面选择 Personal Access Token 或 OAuth2 设置，并在 MCP 客户端配置中使用 `@zereight/mcp-gitlab`。
+快速开始：在下面选择 Personal Access Token 或 OAuth2 设置，安装 `@zereight/mcp-gitlab`，并在 MCP 客户端配置中使用 `zereight-mcp-gitlab`。
 ### 客户端设置指南
@@ -63,6 +63,16 @@
 最简单的本地设置可以从 Personal Access Token 开始。基于浏览器的本地认证使用 OAuth2。远程或多用户部署请继续查看下面的 MCP OAuth 和远程授权部分。
+先全局安装一次服务器：
+```shell
+npm install -g @zereight/mcp-gitlab
+```
+示例使用 `zereight-mcp-gitlab`，这是比旧的 `mcp-gitlab` 更不容易冲突的别名。如果 MCP 客户端找不到它，请使用 `which zereight-mcp-gitlab` 输出的绝对路径。
+如果不想全局安装，请固定 `npx` 版本，例如 `npx -y @zereight/mcp-gitlab@2.1.29`。
 #### 使用 CLI 参数（适用于环境变量有问题的客户端）
 部分 MCP 客户端（例如 GitHub Copilot CLI）可能难以处理环境变量。可以改用 CLI 参数。
@@ -71,13 +81,8 @@
 {
   "mcpServers": {
     "gitlab": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "@zereight/mcp-gitlab",
-        "--token=YOUR_GITLAB_TOKEN",
-        "--api-url=https://gitlab.com/api/v4"
-      ],
+      "command": "zereight-mcp-gitlab",
+      "args": ["--token=YOUR_GITLAB_TOKEN", "--api-url=https://gitlab.com/api/v4"],
       "tools": ["*"]
     }
   }
@@ -89,12 +94,19 @@
 - `--token` - GitLab Personal Access Token（替代 `GITLAB_PERSONAL_ACCESS_TOKEN`）
 - `--api-url` - GitLab API URL（替代 `GITLAB_API_URL`）
 - `--read-only=true` - 启用只读模式（替代 `GITLAB_READ_ONLY_MODE`）
-- `--use-wiki=true` - 启用 Wiki API（替代 `USE_GITLAB_WIKI`）
-- `--use-milestone=true` - 启用里程碑 API（替代 `USE_MILESTONE`）
-- `--use-pipeline=true` - 启用流水线 API（替代 `USE_PIPELINE`）
+- `--use-wiki=true` - 启用 Wiki API（替代 `USE_GITLAB_WIKI`，旧版 — 推荐 `GITLAB_TOOLSETS=wiki`）
+- `--use-milestone=true` - 启用里程碑 API（替代 `USE_MILESTONE`，旧版 — 推荐 `GITLAB_TOOLSETS=milestones`）
+- `--use-pipeline=true` - 启用流水线 API（替代 `USE_PIPELINE`，旧版 — 推荐 `GITLAB_TOOLSETS=pipelines`）
 CLI 参数优先于环境变量。
+> **细粒度工具过滤：**除了全开/全关的 `GITLAB_READ_ONLY_MODE`，还可以用
+> `GITLAB_TOOLSETS=<group,…>` 启用工具分组，用 `GITLAB_TOOLS=<tool,…>` 白名单启用单个工具
+> （例如：只读分组 + 少数几个写工具），用 `GITLAB_DENIED_TOOLS_REGEX` 按正则屏蔽工具。
+> 旧版 `USE_GITLAB_WIKI` / `USE_MILESTONE` / `USE_PIPELINE` 标志仅为向后兼容保留。
+> 参见 [Tools Reference](./docs/tools/index.md#feature-toggles) 和
+> [Environment Variables](./docs/configuration/environment-variables.md)。
 #### SSE
 ```shell
@@ -103,9 +115,7 @@ docker run -i --rm \
   -e GITLAB_PERSONAL_ACCESS_TOKEN=your_gitlab_token \
   -e GITLAB_API_URL="https://gitlab.com/api/v4" \
   -e GITLAB_READ_ONLY_MODE=true \
-  -e USE_GITLAB_WIKI=true \
-  -e USE_MILESTONE=true \
-  -e USE_PIPELINE=true \
+  -e GITLAB_TOOLSETS=wiki,milestones,pipelines \
   -e SSE=true \
   -p 3333:3002 \
   zereight050/gitlab-mcp
@@ -130,9 +140,7 @@ docker run -i --rm \
   -e GITLAB_PERSONAL_ACCESS_TOKEN=your_gitlab_token \
   -e GITLAB_API_URL="https://gitlab.com/api/v4" \
   -e GITLAB_READ_ONLY_MODE=true \
-  -e USE_GITLAB_WIKI=true \
-  -e USE_MILESTONE=true \
-  -e USE_PIPELINE=true \
+  -e GITLAB_TOOLSETS=wiki,milestones,pipelines \
   -e STREAMABLE_HTTP=true \
   -p 3333:3002 \
   zereight050/gitlab-mcp
@@ -178,16 +186,16 @@ OpenCode、MCPJam、Claude.ai 等远程 MCP 客户端可能会在授权时发送
 2. 预先注册的 GitLab OAuth 应用，包含 `api` 或 `read_api` scopes
    — 前往 `Admin area` → `Applications`，将 Redirect URI 设置为 `{MCP_SERVER_URL}/callback`
-| 环境变量                      | 必需 | 说明                                                  |
-| ----------------------------- | ---- | ----------------------------------------------------- |
-| `GITLAB_MCP_OAUTH`            | 是   | 设置为 `true` 以启用                                  |
-| `GITLAB_API_URL`              | 是   | GitLab API base URL                                   |
-| `GITLAB_OAUTH_APP_ID`         | 是   | GitLab OAuth Application ID                           |
-| `MCP_SERVER_URL`              | 是   | 此 MCP 服务器的公开 HTTPS URL                         |
-| `STREAMABLE_HTTP`             | 是   | 必须为 `true`                                         |
-| `GITLAB_OAUTH_CALLBACK_PROXY` | 可选 | 设置为 `true` 时使用 MCP 服务器固定的 `/callback` URL |
-| `GITLAB_OAUTH_SCOPES`         | 可选 | 逗号分隔的 scope（默认：`api,read_api,read_user`）    |
-| `GITLAB_OAUTH_ALLOWED_GROUPS` | 可选 | 逗号分隔的 GitLab 群组完整路径 — 仅该群组及其子群组的成员可获取令牌（替代已废弃的 `GITLAB_ALLOWED_GROUPS`）|
+| 环境变量                      | 必需 | 说明                                                                                                        |
+| ----------------------------- | ---- | ----------------------------------------------------------------------------------------------------------- |
+| `GITLAB_MCP_OAUTH`            | 是   | 设置为 `true` 以启用                                                                                        |
+| `GITLAB_API_URL`              | 是   | GitLab API base URL                                                                                         |
+| `GITLAB_OAUTH_APP_ID`         | 是   | GitLab OAuth Application ID                                                                                 |
+| `MCP_SERVER_URL`              | 是   | 此 MCP 服务器的公开 HTTPS URL                                                                               |
+| `STREAMABLE_HTTP`             | 是   | 必须为 `true`                                                                                               |
+| `GITLAB_OAUTH_CALLBACK_PROXY` | 可选 | 设置为 `true` 时使用 MCP 服务器固定的 `/callback` URL                                                       |
+| `GITLAB_OAUTH_SCOPES`         | 可选 | 逗号分隔的 scope（默认：`api,read_api,read_user`）                                                          |
+| `GITLAB_OAUTH_ALLOWED_GROUPS` | 可选 | 逗号分隔的 GitLab 群组完整路径 — 仅该群组及其子群组的成员可获取令牌（替代已废弃的 `GITLAB_ALLOWED_GROUPS`） |
 > **排查 `Unregistered redirect_uri`**
 >
@@ -238,7 +246,7 @@ MCP 客户端配置：
 | `REMOTE_AUTHORIZATION`   | 是   | 设置为 `true` 以启用                                    |
 | `STREAMABLE_HTTP`        | 是   | 必须为 `true`                                           |
 | `ENABLE_DYNAMIC_API_URL` | 可选 | 允许按请求通过 `X-GitLab-API-URL` 请求头指定 GitLab URL |
-| `GITLAB_ALLOWED_HOSTS` | 可选 | 逗号分隔的允许主机；`GITLAB_API_URL` 中的主机始终允许 |
+| `GITLAB_ALLOWED_HOSTS`   | 可选 | 逗号分隔的允许主机；`GITLAB_API_URL` 中的主机始终允许   |
 **示例请求头：**

package/build/index.js CHANGED Viewed

@@ -134,6 +134,7 @@ import { normalizeGitLabApiUrl } from "./utils/url.js";
 import { estimateMergeCommitCount, filterDiffsByPatterns, summarizeWebhookEvents, } from "./utils/helpers.js";
 import { graphqlQueryContainsWriteOperation } from "./utils/graphql-query.js";
 import { resolveNestedWikiUpdateTitle } from "./utils/wiki-title.js";
+import { redactSensitiveGitLabFields } from "./utils/redact-sensitive.js";
 import { cleanMutuallyExclusiveIdUsernameOptions, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS, sanitizeToolArguments, } from "./utils/tool-args.js";
 import { parseSearchReplaceBlocks, applySearchReplace, applyUnifiedDiff, } from "./utils/patch-helper.js";
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
@@ -1028,7 +1029,13 @@ function parseAllowedGitLabApiUrls(value) {
         .filter((entry) => Boolean(entry));
 }
 function encodeGitLabPathSegment(value) {
-    return encodeURIComponent(decodeURIComponent(value));
+    const segment = String(value);
+    try {
+        return encodeURIComponent(decodeURIComponent(segment));
+    }
+    catch {
+        return encodeURIComponent(segment);
+    }
 }
 function encodeGitLabPath(value) {
     return value.split("/").map(encodeGitLabPathSegment).join("/");
@@ -1418,7 +1425,7 @@ async function listMergeRequests(projectId, options = {}) {
  */
 async function getIssue(projectId, issueIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -1437,7 +1444,7 @@ async function getIssue(projectId, issueIid) {
  */
 async function updateIssue(projectId, issueIid, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
     // Convert labels array to comma-separated string if present
     const body = { ...options };
     if (body.labels && Array.isArray(body.labels)) {
@@ -1462,7 +1469,7 @@ async function updateIssue(projectId, issueIid, options) {
  */
 async function deleteIssue(projectId, issueIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -2806,7 +2813,7 @@ async function updateWorkItem(projectId, iid, options) {
  */
 async function listIssueLinks(projectId, issueIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}/links`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -2825,7 +2832,7 @@ async function listIssueLinks(projectId, issueIid) {
  */
 async function getIssueLink(projectId, issueIid, issueLinkId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}/links/${issueLinkId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links/${encodeGitLabPathSegment(issueLinkId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -2847,7 +2854,7 @@ async function getIssueLink(projectId, issueIid, issueLinkId) {
 async function createIssueLink(projectId, issueIid, targetProjectId, targetIssueIid, linkType = "relates_to") {
     projectId = decodeURIComponent(projectId); // Decode project ID
     targetProjectId = decodeURIComponent(targetProjectId); // Decode target project ID as well
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}/links`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -2872,7 +2879,7 @@ async function createIssueLink(projectId, issueIid, targetProjectId, targetIssue
  */
 async function deleteIssueLink(projectId, issueIid, issueLinkId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}/links/${issueLinkId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links/${encodeGitLabPathSegment(issueLinkId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -2995,7 +3002,7 @@ async function listIssueDiscussions(projectId, issueIid, options = {}) {
 }
 async function deleteMergeRequestDiscussionNote(projectId, mergeRequestIid, discussionId, noteId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/discussions/${discussionId}/notes/${noteId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -3019,7 +3026,7 @@ async function deleteMergeRequestDiscussionNote(projectId, mergeRequestIid, disc
  */
 async function updateMergeRequestDiscussionNote(projectId, mergeRequestIid, discussionId, noteId, body, resolved) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/discussions/${discussionId}/notes/${noteId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
     // Only one of body or resolved can be sent according to GitLab API
     const payload = {};
     if (body !== undefined) {
@@ -3065,7 +3072,7 @@ async function updateMergeRequestDiscussionNote(projectId, mergeRequestIid, disc
  */
 async function updateIssueNote(projectId, issueIid, discussionId, noteId, body, resolved) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}/discussions/${discussionId}/notes/${noteId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
     // Only one of body or resolved can be sent according to GitLab API
     const payload = {};
     if (body !== undefined) {
@@ -3094,8 +3101,8 @@ async function updateIssueNote(projectId, issueIid, discussionId, noteId, body,
  */
 async function createIssueNote(projectId, issueIid, discussionId, body, createdAt) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const basePath = `${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}`;
-    const url = new URL(discussionId ? `${basePath}/discussions/${discussionId}/notes` : `${basePath}/notes`);
+    const basePath = `${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`;
+    const url = new URL(discussionId ? `${basePath}/discussions/${encodeGitLabPathSegment(discussionId)}/notes` : `${basePath}/notes`);
     const payload = { body };
     if (createdAt) {
         payload.created_at = createdAt;
@@ -3122,7 +3129,7 @@ async function createIssueNote(projectId, issueIid, discussionId, body, createdA
  */
 async function createMergeRequestDiscussionNote(projectId, mergeRequestIid, discussionId, body, createdAt) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/discussions/${discussionId}/notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes`);
     const payload = { body };
     if (createdAt) {
         payload.created_at = createdAt;
@@ -3138,7 +3145,7 @@ async function createMergeRequestDiscussionNote(projectId, mergeRequestIid, disc
 }
 async function createMergeRequestNote(projectId, mergeRequestIid, body) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes`);
     const payload = {
         id: projectId,
         merge_request_iid: mergeRequestIid,
@@ -3155,7 +3162,7 @@ async function createMergeRequestNote(projectId, mergeRequestIid, body) {
 }
 async function deleteMergeRequestNote(projectId, mergeRequestIid, noteId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/notes/${noteId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -3203,7 +3210,7 @@ async function deleteRestAwardEmoji(path) {
 }
 async function getMergeRequestNote(projectId, mergeRequestIid, noteId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/notes/${noteId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -3214,7 +3221,7 @@ async function getMergeRequestNote(projectId, mergeRequestIid, noteId) {
 }
 async function getMergeRequestNotes(projectId, mergeRequestIid, sort, order_by, per_page, page) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes`);
     if (sort) {
         url.searchParams.append("sort", sort);
     }
@@ -3237,7 +3244,7 @@ async function getMergeRequestNotes(projectId, mergeRequestIid, sort, order_by,
 }
 async function updateMergeRequestNote(projectId, mergeRequestIid, noteId, body) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/notes/${noteId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
     const payload = {
         id: projectId,
         merge_request_iid: mergeRequestIid,
@@ -3415,8 +3422,7 @@ async function searchBlobs(params) {
         basePath = `${getEffectiveApiUrl()}/projects/${projectId}/search`;
     }
     else if (params.group_id) {
-        const groupId = encodeURIComponent(decodeURIComponent(params.group_id));
-        basePath = `${getEffectiveApiUrl()}/groups/${groupId}/search`;
+        basePath = `${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(params.group_id)}/search`;
     }
     else {
         basePath = `${getEffectiveApiUrl()}/search`;
@@ -3490,7 +3496,7 @@ async function getMergeRequest(projectId, mergeRequestIid, branchName) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     let url;
     if (mergeRequestIid) {
-        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}`);
+        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}`);
         url.searchParams.append("include_diverged_commits_count", "true");
     }
     else if (branchName) {
@@ -3512,7 +3518,7 @@ async function getMergeRequest(projectId, mergeRequestIid, branchName) {
     return GitLabMergeRequestSchema.parse(data);
 }
 async function getMergeRequestSourceCommitCount(projectId, mergeRequestIid) {
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/commits`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/commits`);
     url.searchParams.append("per_page", "100");
     let totalCount = 0;
     let page = 1;
@@ -3540,7 +3546,7 @@ async function getMergeRequestSourceCommitCount(projectId, mergeRequestIid) {
 }
 async function listMergeRequestPipelines(projectId, mergeRequestIid, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/pipelines`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/pipelines`);
     Object.entries(options).forEach(([key, value]) => {
         if (value !== undefined) {
             url.searchParams.append(key, value.toString());
@@ -3741,7 +3747,7 @@ async function getMergeRequestDiffs(projectId, mergeRequestIid, branchName, view
         const mergeRequest = await getMergeRequest(projectId, undefined, branchName);
         mergeRequestIid = mergeRequest.iid;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/changes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/changes`);
     if (view) {
         url.searchParams.append("view", view);
     }
@@ -3771,7 +3777,7 @@ async function listMergeRequestDiffs(projectId, mergeRequestIid, branchName, pag
         const mergeRequest = await getMergeRequest(projectId, undefined, branchName);
         mergeRequestIid = mergeRequest.iid;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/diffs`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/diffs`);
     if (page) {
         url.searchParams.append("page", page.toString());
     }
@@ -3807,7 +3813,7 @@ async function listMergeRequestChangedFiles(projectId, mergeRequestIid, branchNa
         const mergeRequest = await getMergeRequest(projectId, undefined, branchName);
         mergeRequestIid = mergeRequest.iid;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/changes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/changes`);
     const response = await fetch(url.toString(), { ...getFetchConfig() });
     await handleGitLabError(response);
     const data = (await response.json());
@@ -3848,7 +3854,7 @@ async function getMergeRequestFileDiff(projectId, filePaths, mergeRequestIid, br
     let page = 1;
     const perPage = 20;
     while (remaining.size > 0) {
-        const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/diffs`);
+        const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/diffs`);
         url.searchParams.append("page", page.toString());
         url.searchParams.append("per_page", perPage.toString());
         if (unidiff) {
@@ -3926,7 +3932,7 @@ async function updateMergeRequest(projectId, options, mergeRequestIid, branchNam
         const mergeRequest = await getMergeRequest(projectId, undefined, branchName);
         mergeRequestIid = mergeRequest.iid;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -3946,7 +3952,7 @@ async function updateMergeRequest(projectId, options, mergeRequestIid, branchNam
  */
 async function mergeMergeRequest(projectId, options, mergeRequestIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/merge`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/merge`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -3966,7 +3972,7 @@ async function mergeMergeRequest(projectId, options, mergeRequestIid) {
  */
 async function approveMergeRequest(projectId, mergeRequestIid, sha, approvalPassword) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/approve`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approve`);
     const body = {};
     if (sha) {
         body.sha = sha;
@@ -3991,7 +3997,7 @@ async function approveMergeRequest(projectId, mergeRequestIid, sha, approvalPass
  */
 async function unapproveMergeRequest(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/unapprove`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/unapprove`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -4009,7 +4015,7 @@ async function unapproveMergeRequest(projectId, mergeRequestIid) {
  */
 async function getMergeRequestApprovalState(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const approvalStateUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/approval_state`);
+    const approvalStateUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approval_state`);
     const approvalStateResponse = await fetch(approvalStateUrl.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -4037,7 +4043,7 @@ async function getMergeRequestApprovalState(projectId, mergeRequestIid) {
  */
 async function getMergeRequestConflicts(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/conflicts`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/conflicts`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -4046,7 +4052,7 @@ async function getMergeRequestConflicts(projectId, mergeRequestIid) {
     return (await response.json());
 }
 async function getMergeRequestApprovalsFallback(projectId, mergeRequestIid) {
-    const approvalsUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/approvals`);
+    const approvalsUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approvals`);
     const approvalsResponse = await fetch(approvalsUrl.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -4136,7 +4142,7 @@ async function getDraftNote(project_id, merge_request_iid, draft_note_id) {
 }
 async function listDraftNotes(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/draft_notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -4160,7 +4166,7 @@ async function listDraftNotes(projectId, mergeRequestIid) {
  */
 async function createDraftNote(projectId, mergeRequestIid, body, inReplyToDiscussionId, position, resolveDiscussion) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/draft_notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes`);
     const requestBody = { note: body };
     if (inReplyToDiscussionId) {
         requestBody.in_reply_to_discussion_id = inReplyToDiscussionId;
@@ -4195,7 +4201,7 @@ async function createDraftNote(projectId, mergeRequestIid, body, inReplyToDiscus
  */
 async function updateDraftNote(projectId, mergeRequestIid, draftNoteId, body, position, resolveDiscussion) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/draft_notes/${draftNoteId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}`);
     const requestBody = {};
     if (body !== undefined) {
         requestBody.note = body;
@@ -4227,7 +4233,7 @@ async function updateDraftNote(projectId, mergeRequestIid, draftNoteId, body, po
  */
 async function deleteDraftNote(projectId, mergeRequestIid, draftNoteId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/draft_notes/${draftNoteId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -4246,7 +4252,7 @@ async function deleteDraftNote(projectId, mergeRequestIid, draftNoteId) {
  */
 async function publishDraftNote(projectId, mergeRequestIid, draftNoteId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/draft_notes/${draftNoteId}/publish`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}/publish`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -4298,7 +4304,7 @@ async function publishDraftNote(projectId, mergeRequestIid, draftNoteId) {
  */
 async function bulkPublishDraftNotes(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/draft_notes/bulk_publish`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/bulk_publish`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST", // Changed from PUT to POST
@@ -4327,7 +4333,7 @@ async function bulkPublishDraftNotes(projectId, mergeRequestIid) {
 }
 async function resolveMergeRequestThread(projectId, mergeRequestIid, discussionId, resolved) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/discussions/${discussionId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}`);
     if (resolved !== undefined) {
         url.searchParams.append("resolved", resolved ? "true" : "false");
     }
@@ -4359,7 +4365,7 @@ async function resolveMergeRequestThread(projectId, mergeRequestIid, discussionI
  */
 async function createMergeRequestThread(projectId, mergeRequestIid, body, position, createdAt) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/discussions`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions`);
     const payload = { body };
     if (position) {
         payload.position = position;
@@ -4386,7 +4392,7 @@ async function createMergeRequestThread(projectId, mergeRequestIid, body, positi
  */
 async function listMergeRequestVersions(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/versions`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/versions`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -4405,7 +4411,7 @@ async function listMergeRequestVersions(projectId, mergeRequestIid) {
  */
 async function getMergeRequestVersion(projectId, mergeRequestIid, versionId, unidiff) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/versions/${versionId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/versions/${encodeGitLabPathSegment(versionId)}`);
     if (unidiff !== undefined) {
         url.searchParams.append("unidiff", String(unidiff));
     }
@@ -4696,6 +4702,8 @@ async function listWikiPages(projectId, options = {}) {
         url.searchParams.append("per_page", options.per_page.toString());
     if (options.with_content)
         url.searchParams.append("with_content", options.with_content.toString());
+    if (options.render_html)
+        url.searchParams.append("render_html", options.render_html.toString());
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -4706,9 +4714,12 @@ async function listWikiPages(projectId, options = {}) {
 /**
  * Get a specific wiki page
  */
-async function getWikiPage(projectId, slug) {
+async function getWikiPage(projectId, slug, renderHtml) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/wikis/${encodeURIComponent(slug)}`, { ...getFetchConfig() });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/wikis/${encodeURIComponent(slug)}`);
+    if (renderHtml)
+        url.searchParams.append("render_html", renderHtml.toString());
+    const response = await fetch(url.toString(), { ...getFetchConfig() });
     await handleGitLabError(response);
     const data = await response.json();
     return GitLabWikiPageSchema.parse(data);
@@ -4781,6 +4792,8 @@ async function listGroupWikiPages(groupId, options = {}) {
         url.searchParams.append("per_page", options.per_page.toString());
     if (options.with_content)
         url.searchParams.append("with_content", options.with_content.toString());
+    if (options.render_html)
+        url.searchParams.append("render_html", options.render_html.toString());
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -4791,9 +4804,12 @@ async function listGroupWikiPages(groupId, options = {}) {
 /**
  * Get a specific group wiki page
  */
-async function getGroupWikiPage(groupId, slug) {
+async function getGroupWikiPage(groupId, slug, renderHtml) {
     groupId = decodeURIComponent(groupId); // Decode group ID
-    const response = await fetch(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/wikis/${encodeURIComponent(slug)}`, { ...getFetchConfig() });
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/wikis/${encodeURIComponent(slug)}`);
+    if (renderHtml)
+        url.searchParams.append("render_html", renderHtml.toString());
+    const response = await fetch(url.toString(), { ...getFetchConfig() });
     await handleGitLabError(response);
     const data = await response.json();
     return GitLabWikiPageSchema.parse(data);
@@ -7168,9 +7184,10 @@ async function handleToolCall(params) {
                 });
                 await handleGitLabError(response);
                 const data = await response.json();
-                // Return raw data without parsing through our schema to avoid type mismatches in tests
+                // Return raw data without parsing through our schema to avoid type mismatches in tests,
+                // but strip credential fields (e.g. runners_token) so they never reach the AI context.
                 return {
-                    content: [{ type: "text", text: JSON.stringify(data) }],
+                    content: [{ type: "text", text: JSON.stringify(redactSensitiveGitLabFields(data)) }],
                 };
             }
             case "list_projects": {
@@ -7192,7 +7209,9 @@ async function handleToolCall(params) {
                 await handleGitLabError(response);
                 const data = await response.json();
                 return {
-                    content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+                    content: [
+                        { type: "text", text: JSON.stringify(redactSensitiveGitLabFields(data), null, 2) },
+                    ],
                 };
             }
             case "list_project_members": {
@@ -7647,19 +7666,20 @@ async function handleToolCall(params) {
                 };
             }
             case "list_wiki_pages": {
-                const { project_id, page, per_page, with_content } = ListWikiPagesSchema.parse(params.arguments);
+                const { project_id, page, per_page, with_content, render_html } = ListWikiPagesSchema.parse(params.arguments);
                 const wikiPages = await listWikiPages(project_id, {
                     page,
                     per_page,
                     with_content,
+                    render_html,
                 });
                 return {
                     content: [{ type: "text", text: JSON.stringify(wikiPages) }],
                 };
             }
             case "get_wiki_page": {
-                const { project_id, slug } = GetWikiPageSchema.parse(params.arguments);
-                const wikiPage = await getWikiPage(project_id, slug);
+                const { project_id, slug, render_html } = GetWikiPageSchema.parse(params.arguments);
+                const wikiPage = await getWikiPage(project_id, slug, render_html);
                 return {
                     content: [{ type: "text", text: JSON.stringify(wikiPage) }],
                 };
@@ -7694,19 +7714,20 @@ async function handleToolCall(params) {
                 };
             }
             case "list_group_wiki_pages": {
-                const { group_id, page, per_page, with_content } = ListGroupWikiPagesSchema.parse(params.arguments);
+                const { group_id, page, per_page, with_content, render_html } = ListGroupWikiPagesSchema.parse(params.arguments);
                 const wikiPages = await listGroupWikiPages(group_id, {
                     page,
                     per_page,
                     with_content,
+                    render_html,
                 });
                 return {
                     content: [{ type: "text", text: JSON.stringify(wikiPages) }],
                 };
             }
             case "get_group_wiki_page": {
-                const { group_id, slug } = GetGroupWikiPageSchema.parse(params.arguments);
-                const wikiPage = await getGroupWikiPage(group_id, slug);
+                const { group_id, slug, render_html } = GetGroupWikiPageSchema.parse(params.arguments);
+                const wikiPage = await getGroupWikiPage(group_id, slug, render_html);
                 return {
                     content: [{ type: "text", text: JSON.stringify(wikiPage) }],
                 };

package/build/oauth-proxy.js CHANGED Viewed

@@ -67,6 +67,12 @@ const REQUIRED_GITLAB_SCOPES_RO = ["read_api"];
 const PENDING_AUTH_MAX_SIZE = 1000;
 const PENDING_AUTH_TTL_MS = 10 * 60 * 1000; // 10 minutes
 const CLIENT_CACHE_MAX_SIZE = 1000;
+function singleQueryParam(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function invalidQueryParam(value) {
+    return value != null && typeof value !== "string";
+}
 class BoundedLRUMap {
     _map = new Map();
     _maxSize;
@@ -503,11 +509,19 @@ class GitLabOAuthServerProvider {
             res.status(404).send("Callback proxy mode is not enabled");
             return;
         }
-        const code = req.query.code;
-        const state = req.query.state;
-        const error = req.query.error;
+        if (invalidQueryParam(req.query.code) ||
+            invalidQueryParam(req.query.state) ||
+            invalidQueryParam(req.query.error) ||
+            invalidQueryParam(req.query.error_description)) {
+            res.status(400).send("Invalid query parameter");
+            return;
+        }
+        const code = singleQueryParam(req.query.code);
+        const state = singleQueryParam(req.query.state);
+        const error = singleQueryParam(req.query.error);
+        const errorDescription = singleQueryParam(req.query.error_description) ?? "(no description)";
         if (error) {
-            logger.error(`GitLab OAuth error: ${error} — ${req.query.error_description ?? "(no description)"}`);
+            logger.error(`GitLab OAuth error: ${error} — ${errorDescription}`);
             res.status(400).send("Authorization failed");
             return;
         }

package/build/schemas.js CHANGED Viewed

@@ -2321,11 +2321,19 @@ export const ListWikiPagesSchema = z
     .object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     with_content: z.coerce.boolean().optional().describe("Include content of the wiki pages"),
+    render_html: z.coerce
+        .boolean()
+        .optional()
+        .describe("Return rendered HTML content and include front_matter (e.g., the custom title)"),
 })
     .merge(PaginationOptionsSchema);
 export const GetWikiPageSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     slug: z.string().describe("Slug of the wiki page (will be URL-encoded internally)"),
+    render_html: z.coerce
+        .boolean()
+        .optional()
+        .describe("Return rendered HTML content and include front_matter (e.g., the custom title)"),
 });
 export const CreateWikiPageSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
@@ -2350,6 +2358,7 @@ export const GitLabWikiPageSchema = z.object({
     slug: z.string(),
     format: z.string(),
     content: z.string().optional(),
+    front_matter: z.record(z.unknown()).optional(),
     created_at: z.string().optional(),
     updated_at: z.string().optional(),
 });
@@ -2358,11 +2367,19 @@ export const ListGroupWikiPagesSchema = z
     .object({
     group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
     with_content: z.coerce.boolean().optional().describe("Include content of the wiki pages"),
+    render_html: z.coerce
+        .boolean()
+        .optional()
+        .describe("Return rendered HTML content and include front_matter (e.g., the custom title)"),
 })
     .merge(PaginationOptionsSchema);
 export const GetGroupWikiPageSchema = z.object({
     group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
     slug: z.string().describe("Slug of the wiki page (will be URL-encoded internally)"),
+    render_html: z.coerce
+        .boolean()
+        .optional()
+        .describe("Return rendered HTML content and include front_matter (e.g., the custom title)"),
 });
 export const CreateGroupWikiPageSchema = z.object({
     group_id: z.coerce.string().describe("Group ID or URL-encoded path"),

package/build/test/path-segment-encoding.test.js ADDED Viewed

@@ -0,0 +1,27 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { test } from "node:test";
+const source = readFileSync(new URL("../index.ts", import.meta.url), "utf8");
+const rawPathSegmentPatterns = [
+    "/issues/${issueIid}",
+    "/merge_requests/${mergeRequestIid}",
+    "/discussions/${discussionId}",
+    "/notes/${noteId}",
+    "/links/${issueLinkId}",
+    "/draft_notes/${draftNoteId}",
+    "/versions/${versionId}",
+    "/groups/${groupId}",
+];
+test("GitLab URL path IDs are encoded before interpolation", () => {
+    for (const pattern of rawPathSegmentPatterns) {
+        assert.equal(source.includes(pattern), false, `${pattern} must use encodeGitLabPathSegment`);
+    }
+});
+test("encoding keeps path traversal payloads inside one URL segment", () => {
+    const payload = "1/../../../../admin/ci/variables";
+    const url = new URL(`https://gitlab.com/api/v4/projects/42/issues/${encodeURIComponent(payload)}/notes`);
+    assert.equal(url.pathname, "/api/v4/projects/42/issues/1%2F..%2F..%2F..%2F..%2Fadmin%2Fci%2Fvariables/notes");
+});
+test("malformed percent-encoded segments can still be encoded", () => {
+    assert.equal(encodeURIComponent("bad%zz/path"), "bad%25zz%2Fpath");
+});

package/build/test/stateless/callback-proxy.test.js CHANGED Viewed

@@ -256,6 +256,14 @@ describe("callback-proxy cross-pod flow (stateless)", () => {
         const tokens = await podC.exchangeAuthorizationCode(podCClient, proxyCode, clientCodeVerifier, CLIENT_REDIRECT);
         assert.equal(tokens.access_token, "gl-access-123");
     });
+    test("callback rejects repeated query parameters", async () => {
+        const pod = makeProvider(loadMaterial(secret()));
+        const cbRes = makeFakeRes();
+        await pod.handleCallback(fakeReq({ code: "gitlab-code", state: ["one", "two"] }), cbRes);
+        assert.equal(cbRes.statusCode, 400);
+        assert.equal(cbRes.body, "Invalid query parameter");
+        assert.equal(stub.calls.length, 0);
+    });
     test("exchangeAuthorizationCode rejects wrong PKCE verifier", async () => {
         const s = secret();
         const pod = makeProvider(loadMaterial(s));

package/build/test/utils/redact-sensitive.test.js ADDED Viewed

@@ -0,0 +1,32 @@
+import assert from "node:assert/strict";
+import { describe, test } from "node:test";
+import { redactSensitiveGitLabFields } from "../../utils/redact-sensitive.js";
+describe("When redactSensitiveGitLabFields runs", () => {
+    describe("with a project response containing credentials", () => {
+        test("should remove runners_token and import_url while keeping other fields", () => {
+            const data = {
+                id: 42,
+                name: "demo",
+                runners_token: "GR1348941secret",
+                import_url: "https://user:pass@example.com/repo.git",
+            };
+            const result = redactSensitiveGitLabFields(data);
+            assert.equal("runners_token" in result, false);
+            assert.equal("import_url" in result, false);
+            assert.equal(result.id, 42);
+            assert.equal(result.name, "demo");
+        });
+    });
+    describe("with a response that has no sensitive fields", () => {
+        test("should return the object unchanged", () => {
+            const data = { id: 1, name: "safe" };
+            assert.deepEqual(redactSensitiveGitLabFields(data), { id: 1, name: "safe" });
+        });
+    });
+    describe("with a non-object value", () => {
+        test("should return the value as-is", () => {
+            assert.equal(redactSensitiveGitLabFields(null), null);
+            assert.equal(redactSensitiveGitLabFields("raw"), "raw");
+        });
+    });
+});

package/build/utils/redact-sensitive.js ADDED Viewed

@@ -0,0 +1,21 @@
+/**
+ * Fields GitLab returns that are live credentials or carry embedded secrets.
+ * MCP tool results become part of the AI conversation context, so these must
+ * never be forwarded to the model.
+ */
+const SENSITIVE_GITLAB_FIELDS = ["runners_token", "import_url"];
+/**
+ * Strip known sensitive fields from a GitLab API response object before it is
+ * returned as an MCP tool result. Mutates and returns the same object.
+ *
+ * Used for raw passthrough responses (get_project / update_project) that do not
+ * go through a Zod schema, since Zod would otherwise strip unknown keys for us.
+ */
+export function redactSensitiveGitLabFields(data) {
+    if (data && typeof data === "object") {
+        for (const key of SENSITIVE_GITLAB_FIELDS) {
+            delete data[key];
+        }
+    }
+    return data;
+}

package/build/utils/schema.js CHANGED Viewed

@@ -87,17 +87,48 @@ export const toJSONSchema = (schema) => {
         return obj;
     }
     const fixedSchema = fixNullableOptional(jsonSchema, true);
-    if (!fixedSchema.properties && Array.isArray(fixedSchema.anyOf)) {
-        const variants = fixedSchema.anyOf.filter((item) => item?.type === "object" && item.properties);
-        if (variants.length === fixedSchema.anyOf.length) {
-            fixedSchema.type = "object";
-            fixedSchema.properties = variants.reduce((properties, item) => {
-                Object.entries(item.properties).forEach(([key, value]) => {
-                    if (!properties[key])
-                        properties[key] = value;
-                });
-                return properties;
-            }, {});
+    // Flatten top-level anyOf/oneOf into a single object schema for Anthropic API compatibility.
+    // The Anthropic API rejects tool input_schema with top-level oneOf/allOf/anyOf.
+    for (const combiner of ["anyOf", "oneOf", "allOf"]) {
+        if (Array.isArray(fixedSchema[combiner])) {
+            const variants = fixedSchema[combiner].filter((item) => item?.type === "object" && item.properties);
+            if (variants.length > 0 && variants.length === fixedSchema[combiner].length) {
+                fixedSchema.type = "object";
+                fixedSchema.properties = fixedSchema.properties || {};
+                for (const variant of variants) {
+                    for (const [key, value] of Object.entries(variant.properties)) {
+                        if (!fixedSchema.properties[key]) {
+                            fixedSchema.properties[key] = value;
+                        }
+                    }
+                }
+                // Compute required fields based on combiner semantics:
+                // - allOf: union (all schemas apply, so all requirements apply)
+                // - anyOf/oneOf: intersection (only shared requirements are universal)
+                const requiredSets = variants.map((v) => new Set(Array.isArray(v.required) ? v.required : []));
+                let mergedRequired;
+                if (combiner === "allOf") {
+                    // Union: any field required in any variant is required
+                    const all = new Set();
+                    for (const s of requiredSets) {
+                        for (const field of s)
+                            all.add(field);
+                    }
+                    mergedRequired = [...all];
+                }
+                else {
+                    // Intersection: only fields required in ALL variants
+                    mergedRequired = [...requiredSets[0]].filter(field => requiredSets.every((s) => s.has(field)));
+                }
+                if (mergedRequired.length > 0) {
+                    const existing = new Set(Array.isArray(fixedSchema.required) ? fixedSchema.required : []);
+                    for (const field of mergedRequired) {
+                        existing.add(field);
+                    }
+                    fixedSchema.required = [...existing];
+                }
+                delete fixedSchema[combiner];
+            }
         }
     }
     return fixedSchema;

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.27",
+  "version": "2.1.29",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
@@ -26,7 +26,8 @@
   "author": "zereight",
   "type": "module",
   "bin": {
-    "mcp-gitlab": "build/index.js"
+    "mcp-gitlab": "build/index.js",
+    "zereight-mcp-gitlab": "build/index.js"
   },
   "files": [
     "build"
@@ -51,7 +52,7 @@
     "changelog": "auto-changelog -p",
     "test": "npm run test:all",
     "test:all": "npm run build && npm run test:mock && npm run test:live",
-    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/dynamic-api-url-allowlist.test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/test-oauth-proxy-rate-limit.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && node --import tsx/esm --test test/sse-auth-guard.test.ts && node --import tsx/esm --test test/streamable-http-concurrent-session.test.ts && node --import tsx/esm --test test/streamable-http-unauthenticated-discovery.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-issues.ts && node --import tsx/esm --test test/test-create-repository.ts && node --import tsx/esm --test test/test-update-project.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-remote-downloads.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-protected-branches.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-ci-catalog.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/proxy-client-ip.test.ts && node --import tsx/esm --test test/utils/forwarded-public-base-url.test.ts && node --import tsx/esm --test test/utils/graphql-query.test.ts && node --import tsx/esm --test test/utils/wiki-title.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts && node --import tsx/esm --test test/test-ci-variables.ts && node --import tsx/esm --test test/test-dependency-proxy.ts",
+    "test:mock": "node --import tsx/esm --test test/path-segment-encoding.test.ts && node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/dynamic-api-url-allowlist.test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/test-oauth-proxy-rate-limit.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && node --import tsx/esm --test test/sse-auth-guard.test.ts && node --import tsx/esm --test test/streamable-http-concurrent-session.test.ts && node --import tsx/esm --test test/streamable-http-unauthenticated-discovery.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-issues.ts && node --import tsx/esm --test test/test-create-repository.ts && node --import tsx/esm --test test/test-update-project.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-remote-downloads.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-protected-branches.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-ci-catalog.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/proxy-client-ip.test.ts && node --import tsx/esm --test test/utils/forwarded-public-base-url.test.ts && node --import tsx/esm --test test/utils/graphql-query.test.ts && node --import tsx/esm --test test/utils/wiki-title.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/utils/redact-sensitive.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts && node --import tsx/esm --test test/test-ci-variables.ts && node --import tsx/esm --test test/test-dependency-proxy.ts",
     "test:stateless": "npm run build && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts",
     "test:mcp-oauth": "npm run build && node --import tsx/esm --test test/mcp-oauth-tests.ts",
     "test:live": "node test/validate-api.js",
@@ -70,7 +71,7 @@
     "format:check": "prettier --check \"**/*.{js,ts,json,md}\""
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.24.2",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "@types/node-fetch": "^2.6.12",
     "diff": "^9.0.0",
     "express": "^5.1.0",