@zereight/mcp-gitlab 2.1.28 → 2.1.29

package/README.ko.md

@@ -71,7 +71,7 @@ npm install -g @zereight/mcp-gitlab
 
 예시는 기존 `mcp-gitlab`보다 충돌 가능성이 낮은 `zereight-mcp-gitlab` 별칭을 사용합니다. MCP 클라이언트가 찾지 못하면 `which zereight-mcp-gitlab`의 절대 경로를 사용하세요.
 
-전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.27`처럼 버전을 고정하세요.
+전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.29`처럼 버전을 고정하세요.
 
 #### CLI 인자 사용하기(환경 변수 문제가 있는 클라이언트용)
 
@@ -94,12 +94,19 @@ npm install -g @zereight/mcp-gitlab
 - `--token` - GitLab Personal Access Token (`GITLAB_PERSONAL_ACCESS_TOKEN` 대체)
 - `--api-url` - GitLab API URL (`GITLAB_API_URL` 대체)
 - `--read-only=true` - 읽기 전용 모드 활성화 (`GITLAB_READ_ONLY_MODE` 대체)
-- `--use-wiki=true` - 위키 API 활성화 (`USE_GITLAB_WIKI` 대체)
-- `--use-milestone=true` - 마일스톤 API 활성화 (`USE_MILESTONE` 대체)
-- `--use-pipeline=true` - 파이프라인 API 활성화 (`USE_PIPELINE` 대체)
+- `--use-wiki=true` - 위키 API 활성화 (`USE_GITLAB_WIKI` 대체, 레거시 — `GITLAB_TOOLSETS=wiki` 권장)
+- `--use-milestone=true` - 마일스톤 API 활성화 (`USE_MILESTONE` 대체, 레거시 — `GITLAB_TOOLSETS=milestones` 권장)
+- `--use-pipeline=true` - 파이프라인 API 활성화 (`USE_PIPELINE` 대체, 레거시 — `GITLAB_TOOLSETS=pipelines` 권장)
 
 CLI 인자는 환경 변수보다 우선합니다.
 
+> **세밀한 도구 필터링:** 전체 on/off 방식인 `GITLAB_READ_ONLY_MODE` 외에도,
+> `GITLAB_TOOLSETS=<group,…>`로 도구 그룹을 활성화하고, `GITLAB_TOOLS=<tool,…>`로 개별 도구만
+> 허용하며(예: 읽기 도구 + 특정 쓰기 도구 몇 개), `GITLAB_DENIED_TOOLS_REGEX`로 패턴 차단할 수
+> 있습니다. 레거시 `USE_GITLAB_WIKI` / `USE_MILESTONE` / `USE_PIPELINE` 플래그는 하위 호환용으로만
+> 유지됩니다. [Tools Reference](./docs/tools/index.md#feature-toggles)와
+> [Environment Variables](./docs/configuration/environment-variables.md)를 참고하세요.
+
 #### SSE
 
 ```shell
@@ -108,9 +115,7 @@ docker run -i --rm \
   -e GITLAB_PERSONAL_ACCESS_TOKEN=your_gitlab_token \
   -e GITLAB_API_URL="https://gitlab.com/api/v4" \
   -e GITLAB_READ_ONLY_MODE=true \
-  -e USE_GITLAB_WIKI=true \
-  -e USE_MILESTONE=true \
-  -e USE_PIPELINE=true \
+  -e GITLAB_TOOLSETS=wiki,milestones,pipelines \
   -e SSE=true \
   -p 3333:3002 \
   zereight050/gitlab-mcp
@@ -135,9 +140,7 @@ docker run -i --rm \
   -e GITLAB_PERSONAL_ACCESS_TOKEN=your_gitlab_token \
   -e GITLAB_API_URL="https://gitlab.com/api/v4" \
   -e GITLAB_READ_ONLY_MODE=true \
-  -e USE_GITLAB_WIKI=true \
-  -e USE_MILESTONE=true \
-  -e USE_PIPELINE=true \
+  -e GITLAB_TOOLSETS=wiki,milestones,pipelines \
   -e STREAMABLE_HTTP=true \
   -p 3333:3002 \
   zereight050/gitlab-mcp

package/README.md

@@ -75,7 +75,7 @@ npm install -g @zereight/mcp-gitlab
 
 The examples use `zereight-mcp-gitlab`, a less collision-prone alias for the legacy `mcp-gitlab` binary. If your MCP client cannot find it, use the absolute path from `which zereight-mcp-gitlab`.
 
-No global install? Pin `npx` to a known version, for example `npx -y @zereight/mcp-gitlab@2.1.27`.
+No global install? Pin `npx` to a known version, for example `npx -y @zereight/mcp-gitlab@2.1.29`.
 
 #### Using CLI Arguments (for clients with env var issues)
 
@@ -98,12 +98,20 @@ Some MCP clients (like GitHub Copilot CLI) have issues with environment variable
 - `--token` - GitLab Personal Access Token (replaces `GITLAB_PERSONAL_ACCESS_TOKEN`)
 - `--api-url` - GitLab API URL (replaces `GITLAB_API_URL`)
 - `--read-only=true` - Enable read-only mode (replaces `GITLAB_READ_ONLY_MODE`)
-- `--use-wiki=true` - Enable wiki API (replaces `USE_GITLAB_WIKI`)
-- `--use-milestone=true` - Enable milestone API (replaces `USE_MILESTONE`)
-- `--use-pipeline=true` - Enable pipeline API (replaces `USE_PIPELINE`)
+- `--use-wiki=true` - Enable wiki API (replaces `USE_GITLAB_WIKI`, legacy — prefer `GITLAB_TOOLSETS=wiki`)
+- `--use-milestone=true` - Enable milestone API (replaces `USE_MILESTONE`, legacy — prefer `GITLAB_TOOLSETS=milestones`)
+- `--use-pipeline=true` - Enable pipeline API (replaces `USE_PIPELINE`, legacy — prefer `GITLAB_TOOLSETS=pipelines`)
 
 CLI arguments take precedence over environment variables.
 
+> **Fine-grained tool filtering:** beyond the all-or-nothing `GITLAB_READ_ONLY_MODE`, you can
+> enable toolset groups with `GITLAB_TOOLSETS=<group,…>`, allow-list individual tools with
+> `GITLAB_TOOLS=<tool,…>` (e.g. read-only groups plus a few specific write tools), and
+> deny-list by pattern with `GITLAB_DENIED_TOOLS_REGEX`. The legacy `USE_GITLAB_WIKI` /
+> `USE_MILESTONE` / `USE_PIPELINE` flags are kept for backward compatibility only.
+> See [Tools Reference](./docs/tools/index.md#feature-toggles) and
+> [Environment Variables](./docs/configuration/environment-variables.md).
+
 - sse
 
 ```shell
@@ -112,9 +120,7 @@ docker run -i --rm \
   -e GITLAB_PERSONAL_ACCESS_TOKEN=your_gitlab_token \
   -e GITLAB_API_URL="https://gitlab.com/api/v4" \
   -e GITLAB_READ_ONLY_MODE=true \
-  -e USE_GITLAB_WIKI=true \
-  -e USE_MILESTONE=true \
-  -e USE_PIPELINE=true \
+  -e GITLAB_TOOLSETS=wiki,milestones,pipelines \
   -e SSE=true \
   -e SSE_AUTH_TOKEN=your_mcp_sse_token \
   -p 3333:3002 \
@@ -143,9 +149,7 @@ docker run -i --rm \
   -e REMOTE_AUTHORIZATION=true \
   -e GITLAB_API_URL="https://gitlab.com/api/v4" \
   -e GITLAB_READ_ONLY_MODE=true \
-  -e USE_GITLAB_WIKI=true \
-  -e USE_MILESTONE=true \
-  -e USE_PIPELINE=true \
+  -e GITLAB_TOOLSETS=wiki,milestones,pipelines \
   -e STREAMABLE_HTTP=true \
   -p 3333:3002 \
   zereight050/gitlab-mcp

package/README.zh-CN.md

@@ -71,7 +71,7 @@ npm install -g @zereight/mcp-gitlab
 
 示例使用 `zereight-mcp-gitlab`，这是比旧的 `mcp-gitlab` 更不容易冲突的别名。如果 MCP 客户端找不到它，请使用 `which zereight-mcp-gitlab` 输出的绝对路径。
 
-如果不想全局安装，请固定 `npx` 版本，例如 `npx -y @zereight/mcp-gitlab@2.1.27`。
+如果不想全局安装，请固定 `npx` 版本，例如 `npx -y @zereight/mcp-gitlab@2.1.29`。
 
 #### 使用 CLI 参数（适用于环境变量有问题的客户端）
 
@@ -94,12 +94,19 @@ npm install -g @zereight/mcp-gitlab
 - `--token` - GitLab Personal Access Token（替代 `GITLAB_PERSONAL_ACCESS_TOKEN`）
 - `--api-url` - GitLab API URL（替代 `GITLAB_API_URL`）
 - `--read-only=true` - 启用只读模式（替代 `GITLAB_READ_ONLY_MODE`）
-- `--use-wiki=true` - 启用 Wiki API（替代 `USE_GITLAB_WIKI`）
-- `--use-milestone=true` - 启用里程碑 API（替代 `USE_MILESTONE`）
-- `--use-pipeline=true` - 启用流水线 API（替代 `USE_PIPELINE`）
+- `--use-wiki=true` - 启用 Wiki API（替代 `USE_GITLAB_WIKI`，旧版 — 推荐 `GITLAB_TOOLSETS=wiki`）
+- `--use-milestone=true` - 启用里程碑 API（替代 `USE_MILESTONE`，旧版 — 推荐 `GITLAB_TOOLSETS=milestones`）
+- `--use-pipeline=true` - 启用流水线 API（替代 `USE_PIPELINE`，旧版 — 推荐 `GITLAB_TOOLSETS=pipelines`）
 
 CLI 参数优先于环境变量。
 
+> **细粒度工具过滤：**除了全开/全关的 `GITLAB_READ_ONLY_MODE`，还可以用
+> `GITLAB_TOOLSETS=<group,…>` 启用工具分组，用 `GITLAB_TOOLS=<tool,…>` 白名单启用单个工具
+> （例如：只读分组 + 少数几个写工具），用 `GITLAB_DENIED_TOOLS_REGEX` 按正则屏蔽工具。
+> 旧版 `USE_GITLAB_WIKI` / `USE_MILESTONE` / `USE_PIPELINE` 标志仅为向后兼容保留。
+> 参见 [Tools Reference](./docs/tools/index.md#feature-toggles) 和
+> [Environment Variables](./docs/configuration/environment-variables.md)。
+
 #### SSE
 
 ```shell
@@ -108,9 +115,7 @@ docker run -i --rm \
   -e GITLAB_PERSONAL_ACCESS_TOKEN=your_gitlab_token \
   -e GITLAB_API_URL="https://gitlab.com/api/v4" \
   -e GITLAB_READ_ONLY_MODE=true \
-  -e USE_GITLAB_WIKI=true \
-  -e USE_MILESTONE=true \
-  -e USE_PIPELINE=true \
+  -e GITLAB_TOOLSETS=wiki,milestones,pipelines \
   -e SSE=true \
   -p 3333:3002 \
   zereight050/gitlab-mcp
@@ -135,9 +140,7 @@ docker run -i --rm \
   -e GITLAB_PERSONAL_ACCESS_TOKEN=your_gitlab_token \
   -e GITLAB_API_URL="https://gitlab.com/api/v4" \
   -e GITLAB_READ_ONLY_MODE=true \
-  -e USE_GITLAB_WIKI=true \
-  -e USE_MILESTONE=true \
-  -e USE_PIPELINE=true \
+  -e GITLAB_TOOLSETS=wiki,milestones,pipelines \
   -e STREAMABLE_HTTP=true \
   -p 3333:3002 \
   zereight050/gitlab-mcp

package/build/index.js

@@ -134,6 +134,7 @@ import { normalizeGitLabApiUrl } from "./utils/url.js";
 import { estimateMergeCommitCount, filterDiffsByPatterns, summarizeWebhookEvents, } from "./utils/helpers.js";
 import { graphqlQueryContainsWriteOperation } from "./utils/graphql-query.js";
 import { resolveNestedWikiUpdateTitle } from "./utils/wiki-title.js";
+import { redactSensitiveGitLabFields } from "./utils/redact-sensitive.js";
 import { cleanMutuallyExclusiveIdUsernameOptions, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS, sanitizeToolArguments, } from "./utils/tool-args.js";
 import { parseSearchReplaceBlocks, applySearchReplace, applyUnifiedDiff, } from "./utils/patch-helper.js";
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
@@ -1028,7 +1029,13 @@ function parseAllowedGitLabApiUrls(value) {
         .filter((entry) => Boolean(entry));
 }
 function encodeGitLabPathSegment(value) {
-    return encodeURIComponent(decodeURIComponent(value));
+    const segment = String(value);
+    try {
+        return encodeURIComponent(decodeURIComponent(segment));
+    }
+    catch {
+        return encodeURIComponent(segment);
+    }
 }
 function encodeGitLabPath(value) {
     return value.split("/").map(encodeGitLabPathSegment).join("/");
@@ -1418,7 +1425,7 @@ async function listMergeRequests(projectId, options = {}) {
  */
 async function getIssue(projectId, issueIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -1437,7 +1444,7 @@ async function getIssue(projectId, issueIid) {
  */
 async function updateIssue(projectId, issueIid, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
     // Convert labels array to comma-separated string if present
     const body = { ...options };
     if (body.labels && Array.isArray(body.labels)) {
@@ -1462,7 +1469,7 @@ async function updateIssue(projectId, issueIid, options) {
  */
 async function deleteIssue(projectId, issueIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -2806,7 +2813,7 @@ async function updateWorkItem(projectId, iid, options) {
  */
 async function listIssueLinks(projectId, issueIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}/links`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -2825,7 +2832,7 @@ async function listIssueLinks(projectId, issueIid) {
  */
 async function getIssueLink(projectId, issueIid, issueLinkId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}/links/${issueLinkId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links/${encodeGitLabPathSegment(issueLinkId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -2847,7 +2854,7 @@ async function getIssueLink(projectId, issueIid, issueLinkId) {
 async function createIssueLink(projectId, issueIid, targetProjectId, targetIssueIid, linkType = "relates_to") {
     projectId = decodeURIComponent(projectId); // Decode project ID
     targetProjectId = decodeURIComponent(targetProjectId); // Decode target project ID as well
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}/links`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -2872,7 +2879,7 @@ async function createIssueLink(projectId, issueIid, targetProjectId, targetIssue
  */
 async function deleteIssueLink(projectId, issueIid, issueLinkId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}/links/${issueLinkId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links/${encodeGitLabPathSegment(issueLinkId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -2995,7 +3002,7 @@ async function listIssueDiscussions(projectId, issueIid, options = {}) {
 }
 async function deleteMergeRequestDiscussionNote(projectId, mergeRequestIid, discussionId, noteId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/discussions/${discussionId}/notes/${noteId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -3019,7 +3026,7 @@ async function deleteMergeRequestDiscussionNote(projectId, mergeRequestIid, disc
  */
 async function updateMergeRequestDiscussionNote(projectId, mergeRequestIid, discussionId, noteId, body, resolved) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/discussions/${discussionId}/notes/${noteId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
     // Only one of body or resolved can be sent according to GitLab API
     const payload = {};
     if (body !== undefined) {
@@ -3065,7 +3072,7 @@ async function updateMergeRequestDiscussionNote(projectId, mergeRequestIid, disc
  */
 async function updateIssueNote(projectId, issueIid, discussionId, noteId, body, resolved) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}/discussions/${discussionId}/notes/${noteId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
     // Only one of body or resolved can be sent according to GitLab API
     const payload = {};
     if (body !== undefined) {
@@ -3094,8 +3101,8 @@ async function updateIssueNote(projectId, issueIid, discussionId, noteId, body,
  */
 async function createIssueNote(projectId, issueIid, discussionId, body, createdAt) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const basePath = `${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${issueIid}`;
-    const url = new URL(discussionId ? `${basePath}/discussions/${discussionId}/notes` : `${basePath}/notes`);
+    const basePath = `${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`;
+    const url = new URL(discussionId ? `${basePath}/discussions/${encodeGitLabPathSegment(discussionId)}/notes` : `${basePath}/notes`);
     const payload = { body };
     if (createdAt) {
         payload.created_at = createdAt;
@@ -3122,7 +3129,7 @@ async function createIssueNote(projectId, issueIid, discussionId, body, createdA
  */
 async function createMergeRequestDiscussionNote(projectId, mergeRequestIid, discussionId, body, createdAt) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/discussions/${discussionId}/notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes`);
     const payload = { body };
     if (createdAt) {
         payload.created_at = createdAt;
@@ -3138,7 +3145,7 @@ async function createMergeRequestDiscussionNote(projectId, mergeRequestIid, disc
 }
 async function createMergeRequestNote(projectId, mergeRequestIid, body) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes`);
     const payload = {
         id: projectId,
         merge_request_iid: mergeRequestIid,
@@ -3155,7 +3162,7 @@ async function createMergeRequestNote(projectId, mergeRequestIid, body) {
 }
 async function deleteMergeRequestNote(projectId, mergeRequestIid, noteId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/notes/${noteId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -3203,7 +3210,7 @@ async function deleteRestAwardEmoji(path) {
 }
 async function getMergeRequestNote(projectId, mergeRequestIid, noteId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/notes/${noteId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -3214,7 +3221,7 @@ async function getMergeRequestNote(projectId, mergeRequestIid, noteId) {
 }
 async function getMergeRequestNotes(projectId, mergeRequestIid, sort, order_by, per_page, page) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes`);
     if (sort) {
         url.searchParams.append("sort", sort);
     }
@@ -3237,7 +3244,7 @@ async function getMergeRequestNotes(projectId, mergeRequestIid, sort, order_by,
 }
 async function updateMergeRequestNote(projectId, mergeRequestIid, noteId, body) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/notes/${noteId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
     const payload = {
         id: projectId,
         merge_request_iid: mergeRequestIid,
@@ -3415,8 +3422,7 @@ async function searchBlobs(params) {
         basePath = `${getEffectiveApiUrl()}/projects/${projectId}/search`;
     }
     else if (params.group_id) {
-        const groupId = encodeURIComponent(decodeURIComponent(params.group_id));
-        basePath = `${getEffectiveApiUrl()}/groups/${groupId}/search`;
+        basePath = `${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(params.group_id)}/search`;
     }
     else {
         basePath = `${getEffectiveApiUrl()}/search`;
@@ -3490,7 +3496,7 @@ async function getMergeRequest(projectId, mergeRequestIid, branchName) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     let url;
     if (mergeRequestIid) {
-        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}`);
+        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}`);
         url.searchParams.append("include_diverged_commits_count", "true");
     }
     else if (branchName) {
@@ -3512,7 +3518,7 @@ async function getMergeRequest(projectId, mergeRequestIid, branchName) {
     return GitLabMergeRequestSchema.parse(data);
 }
 async function getMergeRequestSourceCommitCount(projectId, mergeRequestIid) {
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/commits`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/commits`);
     url.searchParams.append("per_page", "100");
     let totalCount = 0;
     let page = 1;
@@ -3540,7 +3546,7 @@ async function getMergeRequestSourceCommitCount(projectId, mergeRequestIid) {
 }
 async function listMergeRequestPipelines(projectId, mergeRequestIid, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/pipelines`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/pipelines`);
     Object.entries(options).forEach(([key, value]) => {
         if (value !== undefined) {
             url.searchParams.append(key, value.toString());
@@ -3741,7 +3747,7 @@ async function getMergeRequestDiffs(projectId, mergeRequestIid, branchName, view
         const mergeRequest = await getMergeRequest(projectId, undefined, branchName);
         mergeRequestIid = mergeRequest.iid;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/changes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/changes`);
     if (view) {
         url.searchParams.append("view", view);
     }
@@ -3771,7 +3777,7 @@ async function listMergeRequestDiffs(projectId, mergeRequestIid, branchName, pag
         const mergeRequest = await getMergeRequest(projectId, undefined, branchName);
         mergeRequestIid = mergeRequest.iid;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/diffs`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/diffs`);
     if (page) {
         url.searchParams.append("page", page.toString());
     }
@@ -3807,7 +3813,7 @@ async function listMergeRequestChangedFiles(projectId, mergeRequestIid, branchNa
         const mergeRequest = await getMergeRequest(projectId, undefined, branchName);
         mergeRequestIid = mergeRequest.iid;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/changes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/changes`);
     const response = await fetch(url.toString(), { ...getFetchConfig() });
     await handleGitLabError(response);
     const data = (await response.json());
@@ -3848,7 +3854,7 @@ async function getMergeRequestFileDiff(projectId, filePaths, mergeRequestIid, br
     let page = 1;
     const perPage = 20;
     while (remaining.size > 0) {
-        const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/diffs`);
+        const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/diffs`);
         url.searchParams.append("page", page.toString());
         url.searchParams.append("per_page", perPage.toString());
         if (unidiff) {
@@ -3926,7 +3932,7 @@ async function updateMergeRequest(projectId, options, mergeRequestIid, branchNam
         const mergeRequest = await getMergeRequest(projectId, undefined, branchName);
         mergeRequestIid = mergeRequest.iid;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -3946,7 +3952,7 @@ async function updateMergeRequest(projectId, options, mergeRequestIid, branchNam
  */
 async function mergeMergeRequest(projectId, options, mergeRequestIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/merge`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/merge`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -3966,7 +3972,7 @@ async function mergeMergeRequest(projectId, options, mergeRequestIid) {
  */
 async function approveMergeRequest(projectId, mergeRequestIid, sha, approvalPassword) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/approve`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approve`);
     const body = {};
     if (sha) {
         body.sha = sha;
@@ -3991,7 +3997,7 @@ async function approveMergeRequest(projectId, mergeRequestIid, sha, approvalPass
  */
 async function unapproveMergeRequest(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/unapprove`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/unapprove`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -4009,7 +4015,7 @@ async function unapproveMergeRequest(projectId, mergeRequestIid) {
  */
 async function getMergeRequestApprovalState(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const approvalStateUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/approval_state`);
+    const approvalStateUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approval_state`);
     const approvalStateResponse = await fetch(approvalStateUrl.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -4037,7 +4043,7 @@ async function getMergeRequestApprovalState(projectId, mergeRequestIid) {
  */
 async function getMergeRequestConflicts(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/conflicts`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/conflicts`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -4046,7 +4052,7 @@ async function getMergeRequestConflicts(projectId, mergeRequestIid) {
     return (await response.json());
 }
 async function getMergeRequestApprovalsFallback(projectId, mergeRequestIid) {
-    const approvalsUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/approvals`);
+    const approvalsUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approvals`);
     const approvalsResponse = await fetch(approvalsUrl.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -4136,7 +4142,7 @@ async function getDraftNote(project_id, merge_request_iid, draft_note_id) {
 }
 async function listDraftNotes(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/draft_notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -4160,7 +4166,7 @@ async function listDraftNotes(projectId, mergeRequestIid) {
  */
 async function createDraftNote(projectId, mergeRequestIid, body, inReplyToDiscussionId, position, resolveDiscussion) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/draft_notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes`);
     const requestBody = { note: body };
     if (inReplyToDiscussionId) {
         requestBody.in_reply_to_discussion_id = inReplyToDiscussionId;
@@ -4195,7 +4201,7 @@ async function createDraftNote(projectId, mergeRequestIid, body, inReplyToDiscus
  */
 async function updateDraftNote(projectId, mergeRequestIid, draftNoteId, body, position, resolveDiscussion) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/draft_notes/${draftNoteId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}`);
     const requestBody = {};
     if (body !== undefined) {
         requestBody.note = body;
@@ -4227,7 +4233,7 @@ async function updateDraftNote(projectId, mergeRequestIid, draftNoteId, body, po
  */
 async function deleteDraftNote(projectId, mergeRequestIid, draftNoteId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/draft_notes/${draftNoteId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -4246,7 +4252,7 @@ async function deleteDraftNote(projectId, mergeRequestIid, draftNoteId) {
  */
 async function publishDraftNote(projectId, mergeRequestIid, draftNoteId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/draft_notes/${draftNoteId}/publish`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}/publish`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -4298,7 +4304,7 @@ async function publishDraftNote(projectId, mergeRequestIid, draftNoteId) {
  */
 async function bulkPublishDraftNotes(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/draft_notes/bulk_publish`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/bulk_publish`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST", // Changed from PUT to POST
@@ -4327,7 +4333,7 @@ async function bulkPublishDraftNotes(projectId, mergeRequestIid) {
 }
 async function resolveMergeRequestThread(projectId, mergeRequestIid, discussionId, resolved) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/discussions/${discussionId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}`);
     if (resolved !== undefined) {
         url.searchParams.append("resolved", resolved ? "true" : "false");
     }
@@ -4359,7 +4365,7 @@ async function resolveMergeRequestThread(projectId, mergeRequestIid, discussionI
  */
 async function createMergeRequestThread(projectId, mergeRequestIid, body, position, createdAt) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/discussions`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions`);
     const payload = { body };
     if (position) {
         payload.position = position;
@@ -4386,7 +4392,7 @@ async function createMergeRequestThread(projectId, mergeRequestIid, body, positi
  */
 async function listMergeRequestVersions(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/versions`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/versions`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -4405,7 +4411,7 @@ async function listMergeRequestVersions(projectId, mergeRequestIid) {
  */
 async function getMergeRequestVersion(projectId, mergeRequestIid, versionId, unidiff) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${mergeRequestIid}/versions/${versionId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/versions/${encodeGitLabPathSegment(versionId)}`);
     if (unidiff !== undefined) {
         url.searchParams.append("unidiff", String(unidiff));
     }
@@ -4696,6 +4702,8 @@ async function listWikiPages(projectId, options = {}) {
         url.searchParams.append("per_page", options.per_page.toString());
     if (options.with_content)
         url.searchParams.append("with_content", options.with_content.toString());
+    if (options.render_html)
+        url.searchParams.append("render_html", options.render_html.toString());
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -4706,9 +4714,12 @@ async function listWikiPages(projectId, options = {}) {
 /**
  * Get a specific wiki page
  */
-async function getWikiPage(projectId, slug) {
+async function getWikiPage(projectId, slug, renderHtml) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/wikis/${encodeURIComponent(slug)}`, { ...getFetchConfig() });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/wikis/${encodeURIComponent(slug)}`);
+    if (renderHtml)
+        url.searchParams.append("render_html", renderHtml.toString());
+    const response = await fetch(url.toString(), { ...getFetchConfig() });
     await handleGitLabError(response);
     const data = await response.json();
     return GitLabWikiPageSchema.parse(data);
@@ -4781,6 +4792,8 @@ async function listGroupWikiPages(groupId, options = {}) {
         url.searchParams.append("per_page", options.per_page.toString());
     if (options.with_content)
         url.searchParams.append("with_content", options.with_content.toString());
+    if (options.render_html)
+        url.searchParams.append("render_html", options.render_html.toString());
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -4791,9 +4804,12 @@ async function listGroupWikiPages(groupId, options = {}) {
 /**
  * Get a specific group wiki page
  */
-async function getGroupWikiPage(groupId, slug) {
+async function getGroupWikiPage(groupId, slug, renderHtml) {
     groupId = decodeURIComponent(groupId); // Decode group ID
-    const response = await fetch(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/wikis/${encodeURIComponent(slug)}`, { ...getFetchConfig() });
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/wikis/${encodeURIComponent(slug)}`);
+    if (renderHtml)
+        url.searchParams.append("render_html", renderHtml.toString());
+    const response = await fetch(url.toString(), { ...getFetchConfig() });
     await handleGitLabError(response);
     const data = await response.json();
     return GitLabWikiPageSchema.parse(data);
@@ -7168,9 +7184,10 @@ async function handleToolCall(params) {
                 });
                 await handleGitLabError(response);
                 const data = await response.json();
-                // Return raw data without parsing through our schema to avoid type mismatches in tests
+                // Return raw data without parsing through our schema to avoid type mismatches in tests,
+                // but strip credential fields (e.g. runners_token) so they never reach the AI context.
                 return {
-                    content: [{ type: "text", text: JSON.stringify(data) }],
+                    content: [{ type: "text", text: JSON.stringify(redactSensitiveGitLabFields(data)) }],
                 };
             }
             case "list_projects": {
@@ -7192,7 +7209,9 @@ async function handleToolCall(params) {
                 await handleGitLabError(response);
                 const data = await response.json();
                 return {
-                    content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+                    content: [
+                        { type: "text", text: JSON.stringify(redactSensitiveGitLabFields(data), null, 2) },
+                    ],
                 };
             }
             case "list_project_members": {
@@ -7647,19 +7666,20 @@ async function handleToolCall(params) {
                 };
             }
             case "list_wiki_pages": {
-                const { project_id, page, per_page, with_content } = ListWikiPagesSchema.parse(params.arguments);
+                const { project_id, page, per_page, with_content, render_html } = ListWikiPagesSchema.parse(params.arguments);
                 const wikiPages = await listWikiPages(project_id, {
                     page,
                     per_page,
                     with_content,
+                    render_html,
                 });
                 return {
                     content: [{ type: "text", text: JSON.stringify(wikiPages) }],
                 };
             }
             case "get_wiki_page": {
-                const { project_id, slug } = GetWikiPageSchema.parse(params.arguments);
-                const wikiPage = await getWikiPage(project_id, slug);
+                const { project_id, slug, render_html } = GetWikiPageSchema.parse(params.arguments);
+                const wikiPage = await getWikiPage(project_id, slug, render_html);
                 return {
                     content: [{ type: "text", text: JSON.stringify(wikiPage) }],
                 };
@@ -7694,19 +7714,20 @@ async function handleToolCall(params) {
                 };
             }
             case "list_group_wiki_pages": {
-                const { group_id, page, per_page, with_content } = ListGroupWikiPagesSchema.parse(params.arguments);
+                const { group_id, page, per_page, with_content, render_html } = ListGroupWikiPagesSchema.parse(params.arguments);
                 const wikiPages = await listGroupWikiPages(group_id, {
                     page,
                     per_page,
                     with_content,
+                    render_html,
                 });
                 return {
                     content: [{ type: "text", text: JSON.stringify(wikiPages) }],
                 };
             }
             case "get_group_wiki_page": {
-                const { group_id, slug } = GetGroupWikiPageSchema.parse(params.arguments);
-                const wikiPage = await getGroupWikiPage(group_id, slug);
+                const { group_id, slug, render_html } = GetGroupWikiPageSchema.parse(params.arguments);
+                const wikiPage = await getGroupWikiPage(group_id, slug, render_html);
                 return {
                     content: [{ type: "text", text: JSON.stringify(wikiPage) }],
                 };

package/build/oauth-proxy.js

@@ -67,6 +67,12 @@ const REQUIRED_GITLAB_SCOPES_RO = ["read_api"];
 const PENDING_AUTH_MAX_SIZE = 1000;
 const PENDING_AUTH_TTL_MS = 10 * 60 * 1000; // 10 minutes
 const CLIENT_CACHE_MAX_SIZE = 1000;
+function singleQueryParam(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function invalidQueryParam(value) {
+    return value != null && typeof value !== "string";
+}
 class BoundedLRUMap {
     _map = new Map();
     _maxSize;
@@ -503,11 +509,19 @@ class GitLabOAuthServerProvider {
             res.status(404).send("Callback proxy mode is not enabled");
             return;
         }
-        const code = req.query.code;
-        const state = req.query.state;
-        const error = req.query.error;
+        if (invalidQueryParam(req.query.code) ||
+            invalidQueryParam(req.query.state) ||
+            invalidQueryParam(req.query.error) ||
+            invalidQueryParam(req.query.error_description)) {
+            res.status(400).send("Invalid query parameter");
+            return;
+        }
+        const code = singleQueryParam(req.query.code);
+        const state = singleQueryParam(req.query.state);
+        const error = singleQueryParam(req.query.error);
+        const errorDescription = singleQueryParam(req.query.error_description) ?? "(no description)";
         if (error) {
-            logger.error(`GitLab OAuth error: ${error} — ${req.query.error_description ?? "(no description)"}`);
+            logger.error(`GitLab OAuth error: ${error} — ${errorDescription}`);
             res.status(400).send("Authorization failed");
             return;
         }

package/build/schemas.js

@@ -2321,11 +2321,19 @@ export const ListWikiPagesSchema = z
     .object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     with_content: z.coerce.boolean().optional().describe("Include content of the wiki pages"),
+    render_html: z.coerce
+        .boolean()
+        .optional()
+        .describe("Return rendered HTML content and include front_matter (e.g., the custom title)"),
 })
     .merge(PaginationOptionsSchema);
 export const GetWikiPageSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     slug: z.string().describe("Slug of the wiki page (will be URL-encoded internally)"),
+    render_html: z.coerce
+        .boolean()
+        .optional()
+        .describe("Return rendered HTML content and include front_matter (e.g., the custom title)"),
 });
 export const CreateWikiPageSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
@@ -2350,6 +2358,7 @@ export const GitLabWikiPageSchema = z.object({
     slug: z.string(),
     format: z.string(),
     content: z.string().optional(),
+    front_matter: z.record(z.unknown()).optional(),
     created_at: z.string().optional(),
     updated_at: z.string().optional(),
 });
@@ -2358,11 +2367,19 @@ export const ListGroupWikiPagesSchema = z
     .object({
     group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
     with_content: z.coerce.boolean().optional().describe("Include content of the wiki pages"),
+    render_html: z.coerce
+        .boolean()
+        .optional()
+        .describe("Return rendered HTML content and include front_matter (e.g., the custom title)"),
 })
     .merge(PaginationOptionsSchema);
 export const GetGroupWikiPageSchema = z.object({
     group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
     slug: z.string().describe("Slug of the wiki page (will be URL-encoded internally)"),
+    render_html: z.coerce
+        .boolean()
+        .optional()
+        .describe("Return rendered HTML content and include front_matter (e.g., the custom title)"),
 });
 export const CreateGroupWikiPageSchema = z.object({
     group_id: z.coerce.string().describe("Group ID or URL-encoded path"),

package/build/test/path-segment-encoding.test.js

@@ -0,0 +1,27 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { test } from "node:test";
+const source = readFileSync(new URL("../index.ts", import.meta.url), "utf8");
+const rawPathSegmentPatterns = [
+    "/issues/${issueIid}",
+    "/merge_requests/${mergeRequestIid}",
+    "/discussions/${discussionId}",
+    "/notes/${noteId}",
+    "/links/${issueLinkId}",
+    "/draft_notes/${draftNoteId}",
+    "/versions/${versionId}",
+    "/groups/${groupId}",
+];
+test("GitLab URL path IDs are encoded before interpolation", () => {
+    for (const pattern of rawPathSegmentPatterns) {
+        assert.equal(source.includes(pattern), false, `${pattern} must use encodeGitLabPathSegment`);
+    }
+});
+test("encoding keeps path traversal payloads inside one URL segment", () => {
+    const payload = "1/../../../../admin/ci/variables";
+    const url = new URL(`https://gitlab.com/api/v4/projects/42/issues/${encodeURIComponent(payload)}/notes`);
+    assert.equal(url.pathname, "/api/v4/projects/42/issues/1%2F..%2F..%2F..%2F..%2Fadmin%2Fci%2Fvariables/notes");
+});
+test("malformed percent-encoded segments can still be encoded", () => {
+    assert.equal(encodeURIComponent("bad%zz/path"), "bad%25zz%2Fpath");
+});

package/build/test/stateless/callback-proxy.test.js

@@ -256,6 +256,14 @@ describe("callback-proxy cross-pod flow (stateless)", () => {
         const tokens = await podC.exchangeAuthorizationCode(podCClient, proxyCode, clientCodeVerifier, CLIENT_REDIRECT);
         assert.equal(tokens.access_token, "gl-access-123");
     });
+    test("callback rejects repeated query parameters", async () => {
+        const pod = makeProvider(loadMaterial(secret()));
+        const cbRes = makeFakeRes();
+        await pod.handleCallback(fakeReq({ code: "gitlab-code", state: ["one", "two"] }), cbRes);
+        assert.equal(cbRes.statusCode, 400);
+        assert.equal(cbRes.body, "Invalid query parameter");
+        assert.equal(stub.calls.length, 0);
+    });
     test("exchangeAuthorizationCode rejects wrong PKCE verifier", async () => {
         const s = secret();
         const pod = makeProvider(loadMaterial(s));

package/build/test/utils/redact-sensitive.test.js

@@ -0,0 +1,32 @@
+import assert from "node:assert/strict";
+import { describe, test } from "node:test";
+import { redactSensitiveGitLabFields } from "../../utils/redact-sensitive.js";
+describe("When redactSensitiveGitLabFields runs", () => {
+    describe("with a project response containing credentials", () => {
+        test("should remove runners_token and import_url while keeping other fields", () => {
+            const data = {
+                id: 42,
+                name: "demo",
+                runners_token: "GR1348941secret",
+                import_url: "https://user:pass@example.com/repo.git",
+            };
+            const result = redactSensitiveGitLabFields(data);
+            assert.equal("runners_token" in result, false);
+            assert.equal("import_url" in result, false);
+            assert.equal(result.id, 42);
+            assert.equal(result.name, "demo");
+        });
+    });
+    describe("with a response that has no sensitive fields", () => {
+        test("should return the object unchanged", () => {
+            const data = { id: 1, name: "safe" };
+            assert.deepEqual(redactSensitiveGitLabFields(data), { id: 1, name: "safe" });
+        });
+    });
+    describe("with a non-object value", () => {
+        test("should return the value as-is", () => {
+            assert.equal(redactSensitiveGitLabFields(null), null);
+            assert.equal(redactSensitiveGitLabFields("raw"), "raw");
+        });
+    });
+});

package/build/utils/redact-sensitive.js

@@ -0,0 +1,21 @@
+/**
+ * Fields GitLab returns that are live credentials or carry embedded secrets.
+ * MCP tool results become part of the AI conversation context, so these must
+ * never be forwarded to the model.
+ */
+const SENSITIVE_GITLAB_FIELDS = ["runners_token", "import_url"];
+/**
+ * Strip known sensitive fields from a GitLab API response object before it is
+ * returned as an MCP tool result. Mutates and returns the same object.
+ *
+ * Used for raw passthrough responses (get_project / update_project) that do not
+ * go through a Zod schema, since Zod would otherwise strip unknown keys for us.
+ */
+export function redactSensitiveGitLabFields(data) {
+    if (data && typeof data === "object") {
+        for (const key of SENSITIVE_GITLAB_FIELDS) {
+            delete data[key];
+        }
+    }
+    return data;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.28",
+  "version": "2.1.29",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
@@ -52,7 +52,7 @@
     "changelog": "auto-changelog -p",
     "test": "npm run test:all",
     "test:all": "npm run build && npm run test:mock && npm run test:live",
-    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/dynamic-api-url-allowlist.test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/test-oauth-proxy-rate-limit.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && node --import tsx/esm --test test/sse-auth-guard.test.ts && node --import tsx/esm --test test/streamable-http-concurrent-session.test.ts && node --import tsx/esm --test test/streamable-http-unauthenticated-discovery.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-issues.ts && node --import tsx/esm --test test/test-create-repository.ts && node --import tsx/esm --test test/test-update-project.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-remote-downloads.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-protected-branches.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-ci-catalog.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/proxy-client-ip.test.ts && node --import tsx/esm --test test/utils/forwarded-public-base-url.test.ts && node --import tsx/esm --test test/utils/graphql-query.test.ts && node --import tsx/esm --test test/utils/wiki-title.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts && node --import tsx/esm --test test/test-ci-variables.ts && node --import tsx/esm --test test/test-dependency-proxy.ts",
+    "test:mock": "node --import tsx/esm --test test/path-segment-encoding.test.ts && node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/dynamic-api-url-allowlist.test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/test-oauth-proxy-rate-limit.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && node --import tsx/esm --test test/sse-auth-guard.test.ts && node --import tsx/esm --test test/streamable-http-concurrent-session.test.ts && node --import tsx/esm --test test/streamable-http-unauthenticated-discovery.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-issues.ts && node --import tsx/esm --test test/test-create-repository.ts && node --import tsx/esm --test test/test-update-project.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-remote-downloads.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-protected-branches.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-ci-catalog.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/proxy-client-ip.test.ts && node --import tsx/esm --test test/utils/forwarded-public-base-url.test.ts && node --import tsx/esm --test test/utils/graphql-query.test.ts && node --import tsx/esm --test test/utils/wiki-title.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/utils/redact-sensitive.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts && node --import tsx/esm --test test/test-ci-variables.ts && node --import tsx/esm --test test/test-dependency-proxy.ts",
     "test:stateless": "npm run build && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts",
     "test:mcp-oauth": "npm run build && node --import tsx/esm --test test/mcp-oauth-tests.ts",
     "test:live": "node test/validate-api.js",