@zereight/mcp-gitlab 2.1.28 → 2.1.30

package/build/oauth-proxy.js

@@ -67,6 +67,12 @@ const REQUIRED_GITLAB_SCOPES_RO = ["read_api"];
 const PENDING_AUTH_MAX_SIZE = 1000;
 const PENDING_AUTH_TTL_MS = 10 * 60 * 1000; // 10 minutes
 const CLIENT_CACHE_MAX_SIZE = 1000;
+function singleQueryParam(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function invalidQueryParam(value) {
+    return value != null && typeof value !== "string";
+}
 class BoundedLRUMap {
     _map = new Map();
     _maxSize;
@@ -503,11 +509,19 @@ class GitLabOAuthServerProvider {
             res.status(404).send("Callback proxy mode is not enabled");
             return;
         }
-        const code = req.query.code;
-        const state = req.query.state;
-        const error = req.query.error;
+        if (invalidQueryParam(req.query.code) ||
+            invalidQueryParam(req.query.state) ||
+            invalidQueryParam(req.query.error) ||
+            invalidQueryParam(req.query.error_description)) {
+            res.status(400).send("Invalid query parameter");
+            return;
+        }
+        const code = singleQueryParam(req.query.code);
+        const state = singleQueryParam(req.query.state);
+        const error = singleQueryParam(req.query.error);
+        const errorDescription = singleQueryParam(req.query.error_description) ?? "(no description)";
         if (error) {
-            logger.error(`GitLab OAuth error: ${error} — ${req.query.error_description ?? "(no description)"}`);
+            logger.error(`GitLab OAuth error: ${error} — ${errorDescription}`);
             res.status(400).send("Authorization failed");
             return;
         }

package/build/schemas.js

@@ -527,7 +527,7 @@ export const GetPipelineJobOutputSchema = z.object({
     limit: z
         .number()
         .optional()
-        .describe("Maximum number of lines to return from the end of the log (default: 1000)"),
+        .describe("Maximum number of lines to return from the end of the log (default/max: 1000)"),
     offset: z
         .number()
         .optional()
@@ -1704,7 +1704,17 @@ export const GetBranchDiffsSchema = ProjectParamsSchema.extend({
         .optional()
         .describe('Array of regex patterns to exclude files from the diff results. Each pattern is a JavaScript-compatible regular expression that matches file paths to ignore. Examples: ["^vendor/", "^test/mocks/", "\\.spec\\.ts$", "package-lock\\.json"]'),
 });
-export const GetMergeRequestSchema = ProjectParamsSchema.extend({
+const flexibleBooleanOptional = z.preprocess(val => {
+    if (typeof val !== "string")
+        return val;
+    const normalized = val.trim().toLowerCase();
+    if (normalized === "true")
+        return true;
+    if (normalized === "false")
+        return false;
+    return val;
+}, z.boolean().optional());
+const MergeRequestParamsSchema = ProjectParamsSchema.extend({
     project_id: z
         .preprocess(value => (value === undefined || value === null ? value : String(value)), z
         .string({
@@ -1717,7 +1727,10 @@ export const GetMergeRequestSchema = ProjectParamsSchema.extend({
     merge_request_iid: z.coerce.string().optional().describe("The IID of a merge request"),
     source_branch: z.string().optional().describe("Source branch name"),
 });
-export const UpdateMergeRequestSchema = GetMergeRequestSchema.extend({
+export const GetMergeRequestSchema = MergeRequestParamsSchema.extend({
+    include_summaries: flexibleBooleanOptional.describe("If true, include deployment_summary, commit_addition_summary and approval_summary (extra API calls, larger response). Default false to reduce token usage."),
+});
+export const UpdateMergeRequestSchema = MergeRequestParamsSchema.extend({
     title: z.string().optional().describe("The title of the merge request"),
     description: z.string().optional().describe("The description of the merge request"),
     target_branch: z.string().optional().describe("The target branch"),
@@ -1859,14 +1872,14 @@ export const ListMergeRequestPipelinesSchema = ProjectParamsSchema.extend({
         .transform(value => value.trim()))
         .describe("The internal ID of the merge request"),
 }).merge(PaginationOptionsSchema);
-export const GetMergeRequestDiffsSchema = GetMergeRequestSchema.extend({
+export const GetMergeRequestDiffsSchema = MergeRequestParamsSchema.extend({
     view: z.enum(["inline", "parallel"]).optional().describe("Diff view type"),
     excluded_file_patterns: z
         .array(z.string())
         .optional()
         .describe('Array of regex patterns to exclude files from the diff results. Each pattern is a JavaScript-compatible regular expression that matches file paths to ignore. Examples: ["^vendor/", "^test/mocks/", "\\.spec\\.ts$", "package-lock\\.json"]'),
 });
-export const ListMergeRequestDiffsSchema = GetMergeRequestSchema.extend({
+export const ListMergeRequestDiffsSchema = MergeRequestParamsSchema.extend({
     page: z.coerce.number().optional().describe("Page number for pagination (default: 1)"),
     per_page: z.coerce
         .number()
@@ -1877,13 +1890,13 @@ export const ListMergeRequestDiffsSchema = GetMergeRequestSchema.extend({
         .optional()
         .describe("Present diffs in the unified diff format. Default is false. Introduced in GitLab 16.5."),
 });
-export const ListMergeRequestChangedFilesSchema = GetMergeRequestSchema.extend({
+export const ListMergeRequestChangedFilesSchema = MergeRequestParamsSchema.extend({
     excluded_file_patterns: z
         .array(z.string())
         .optional()
         .describe('Array of regex patterns to exclude files. Examples: ["^vendor/", "\\.pb\\.go$"]'),
 });
-export const GetMergeRequestFileDiffSchema = GetMergeRequestSchema.extend({
+export const GetMergeRequestFileDiffSchema = MergeRequestParamsSchema.extend({
     file_paths: z
         .array(z.string())
         .describe("List of file paths to retrieve diffs for (e.g. ['src/api/users.ts', 'src/repo/user.go']). " +
@@ -2063,6 +2076,7 @@ export const ListMergeRequestsSchema = z
 export const GetIssueSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     issue_iid: z.coerce.string().describe("The internal ID of the project issue"),
+    full_response: flexibleBooleanOptional.describe("If true, return the complete issue object including the full milestone description. Default returns a slim milestone (id, iid, title, state, web_url) to reduce token usage."),
 });
 export const UpdateIssueSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
@@ -2086,6 +2100,7 @@ export const UpdateIssueSchema = z.object({
     issue_type: z
         .preprocess(val => (typeof val === "string" ? val.toLowerCase() : val), z.enum(["issue", "incident", "test_case", "task"]).optional())
         .describe("The type of issue. One of issue, incident, test_case or task."),
+    full_response: flexibleBooleanOptional.describe("If true, return the complete updated issue object. Default returns a slim confirmation (iid, title, state, web_url, updated_at) to reduce token usage."),
 });
 export const DeleteIssueSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
@@ -2321,11 +2336,19 @@ export const ListWikiPagesSchema = z
     .object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     with_content: z.coerce.boolean().optional().describe("Include content of the wiki pages"),
+    render_html: z.coerce
+        .boolean()
+        .optional()
+        .describe("Return rendered HTML content and include front_matter (e.g., the custom title)"),
 })
     .merge(PaginationOptionsSchema);
 export const GetWikiPageSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     slug: z.string().describe("Slug of the wiki page (will be URL-encoded internally)"),
+    render_html: z.coerce
+        .boolean()
+        .optional()
+        .describe("Return rendered HTML content and include front_matter (e.g., the custom title)"),
 });
 export const CreateWikiPageSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
@@ -2336,7 +2359,10 @@ export const CreateWikiPageSchema = z.object({
 export const UpdateWikiPageSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     slug: z.string().describe("Slug of the wiki page (will be URL-encoded internally)"),
-    title: z.string().optional().describe("New title of the wiki page"),
+    title: z
+        .string()
+        .optional()
+        .describe("New title of the wiki page. WARNING: setting this renames the page and changes its slug/URL (for nested pages it can also move the page to a different path), which breaks existing links. To change only the displayed title while keeping the URL, omit this parameter and instead set a `title:` field in the content's YAML front matter."),
     content: z.string().optional().describe("New content of the wiki page"),
     format: z.string().optional().describe("Content format, e.g., markdown, rdoc"),
 });
@@ -2350,6 +2376,7 @@ export const GitLabWikiPageSchema = z.object({
     slug: z.string(),
     format: z.string(),
     content: z.string().optional(),
+    front_matter: z.record(z.unknown()).optional(),
     created_at: z.string().optional(),
     updated_at: z.string().optional(),
 });
@@ -2358,11 +2385,19 @@ export const ListGroupWikiPagesSchema = z
     .object({
     group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
     with_content: z.coerce.boolean().optional().describe("Include content of the wiki pages"),
+    render_html: z.coerce
+        .boolean()
+        .optional()
+        .describe("Return rendered HTML content and include front_matter (e.g., the custom title)"),
 })
     .merge(PaginationOptionsSchema);
 export const GetGroupWikiPageSchema = z.object({
     group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
     slug: z.string().describe("Slug of the wiki page (will be URL-encoded internally)"),
+    render_html: z.coerce
+        .boolean()
+        .optional()
+        .describe("Return rendered HTML content and include front_matter (e.g., the custom title)"),
 });
 export const CreateGroupWikiPageSchema = z.object({
     group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
@@ -2373,7 +2408,10 @@ export const CreateGroupWikiPageSchema = z.object({
 export const UpdateGroupWikiPageSchema = z.object({
     group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
     slug: z.string().describe("Slug of the wiki page (will be URL-encoded internally)"),
-    title: z.string().optional().describe("New title of the wiki page"),
+    title: z
+        .string()
+        .optional()
+        .describe("New title of the wiki page. WARNING: setting this renames the page and changes its slug/URL (for nested pages it can also move the page to a different path), which breaks existing links. To change only the displayed title while keeping the URL, omit this parameter and instead set a `title:` field in the content's YAML front matter."),
     content: z.string().optional().describe("New content of the wiki page"),
     format: z.string().optional().describe("Content format, e.g., markdown, rdoc"),
 });

package/build/scripts/check-skill-sync.js

@@ -0,0 +1,137 @@
+#!/usr/bin/env tsx
+/**
+ * Verify skills/gitlab-mcp/ stays in sync with tools/registry.ts.
+ *
+ * Run with: npm run check:skill-sync
+ */
+import { readFileSync, readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { TOOLSET_DEFINITIONS, allTools, destructiveTools, DEFAULT_TOOLSET_IDS, } from "../tools/registry.js";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = join(__dirname, "..");
+const SKILL_PATH = join(REPO_ROOT, "skills", "gitlab-mcp", "SKILL.md");
+const REF_DIR = join(REPO_ROOT, "skills", "gitlab-mcp", "reference");
+// Response field names in reference docs — not MCP tools.
+const REFERENCE_FIELD_ALLOWLIST = new Set([
+    "allow_multiple",
+    "deleted_file",
+    "excluded_file_patterns",
+    "group_id",
+    "new_file",
+    "new_path",
+    "old_path",
+    "project_id",
+    "renamed_file",
+]);
+function fail(message) {
+    console.error(`::error::${message}`);
+    process.exit(1);
+}
+function parseToolsetTable(skill) {
+    const rows = new Map();
+    const rowRe = /^\| ([a-z_]+) \((\d+) tools?\) \| (yes|no) \|/gm;
+    let match;
+    while ((match = rowRe.exec(skill)) !== null) {
+        rows.set(match[1], {
+            count: Number(match[2]),
+            isDefault: match[3] === "yes",
+        });
+    }
+    return rows;
+}
+function parseIntroCounts(skill) {
+    const match = skill.match(/providing (\d+) tools: (\d+) tools across (\d+) toolsets/);
+    if (!match) {
+        fail("skills/gitlab-mcp/SKILL.md intro line is missing or malformed");
+    }
+    return {
+        totalTools: Number(match[1]),
+        uniqueInToolsets: Number(match[2]),
+        toolsetCount: Number(match[3]),
+    };
+}
+function parseDestructiveTools(skill) {
+    const section = skill.match(/## Destructive Tools[^\n]*\n\n(`[^`]+`(?:, `[^`]+`)*)$/m);
+    if (!section) {
+        fail("skills/gitlab-mcp/SKILL.md destructive tools section is missing or malformed");
+    }
+    return new Set([...section[1].matchAll(/`([a-z_]+)`/g)].map((m) => m[1]));
+}
+function collectReferenceToolNames() {
+    const toolNames = new Set();
+    for (const file of readdirSync(REF_DIR).filter((name) => name.endsWith(".md"))) {
+        const text = readFileSync(join(REF_DIR, file), "utf8");
+        for (const match of text.matchAll(/`([a-z][a-z0-9_]*)`/g)) {
+            const name = match[1];
+            if (!REFERENCE_FIELD_ALLOWLIST.has(name)) {
+                toolNames.add(name);
+            }
+        }
+    }
+    return toolNames;
+}
+const skill = readFileSync(SKILL_PATH, "utf8");
+const errors = [];
+const registryCounts = Object.fromEntries(TOOLSET_DEFINITIONS.map((definition) => [definition.id, definition.tools.size]));
+const skillRows = parseToolsetTable(skill);
+if (skillRows.size !== TOOLSET_DEFINITIONS.length) {
+    errors.push(`toolset table has ${skillRows.size} rows; registry has ${TOOLSET_DEFINITIONS.length}`);
+}
+for (const definition of TOOLSET_DEFINITIONS) {
+    const row = skillRows.get(definition.id);
+    if (!row) {
+        errors.push(`missing toolset row for ${definition.id}`);
+        continue;
+    }
+    const actualCount = registryCounts[definition.id];
+    if (row.count !== actualCount) {
+        errors.push(`${definition.id}: skill says ${row.count}, registry has ${actualCount}`);
+    }
+    const expectedDefault = DEFAULT_TOOLSET_IDS.has(definition.id);
+    if (row.isDefault !== expectedDefault) {
+        errors.push(`${definition.id}: skill default=${row.isDefault}, registry default=${expectedDefault}`);
+    }
+}
+for (const id of skillRows.keys()) {
+    if (!registryCounts[id]) {
+        errors.push(`unknown toolset in skill table: ${id}`);
+    }
+}
+const uniqueInToolsets = new Set(TOOLSET_DEFINITIONS.flatMap((definition) => [...definition.tools]))
+    .size;
+const intro = parseIntroCounts(skill);
+if (intro.totalTools !== allTools.length) {
+    errors.push(`intro total tools: skill says ${intro.totalTools}, registry has ${allTools.length}`);
+}
+if (intro.uniqueInToolsets !== uniqueInToolsets) {
+    errors.push(`intro unique toolset tools: skill says ${intro.uniqueInToolsets}, registry has ${uniqueInToolsets}`);
+}
+if (intro.toolsetCount !== TOOLSET_DEFINITIONS.length) {
+    errors.push(`intro toolset count: skill says ${intro.toolsetCount}, registry has ${TOOLSET_DEFINITIONS.length}`);
+}
+const skillDestructive = parseDestructiveTools(skill);
+for (const tool of skillDestructive) {
+    if (!destructiveTools.has(tool)) {
+        errors.push(`destructive list includes non-destructive tool: ${tool}`);
+    }
+}
+for (const tool of destructiveTools) {
+    if (!skillDestructive.has(tool)) {
+        errors.push(`destructive list missing registry tool: ${tool}`);
+    }
+}
+const registryToolNames = new Set(allTools.map((tool) => tool.name));
+for (const tool of collectReferenceToolNames()) {
+    if (!registryToolNames.has(tool)) {
+        errors.push(`reference mentions unknown tool: ${tool}`);
+    }
+}
+if (errors.length > 0) {
+    console.error("skills/gitlab-mcp/ is out of sync with tools/registry.ts:");
+    for (const error of errors) {
+        console.error(`- ${error}`);
+    }
+    process.exit(1);
+}
+console.log("skills/gitlab-mcp/ is in sync with tools/registry.ts");

package/build/scripts/generate-tool-docs.js

@@ -273,8 +273,13 @@ function buildIndexPage(groupedToolsList) {
         "",
         ...buildToggleSection(groupedToolsList),
         "",
-        "Read-only mode (`GITLAB_READ_ONLY_MODE=true`) hides every write tool",
-        "regardless of toggles. See [Environment Variables](../configuration/environment-variables.md)",
+        "Permission modes control which tools are exposed:",
+        "",
+        "- `GITLAB_PERMISSION_MODE=readonly` — hides every write tool regardless of toggles.",
+        "- `GITLAB_PERMISSION_MODE=modify` — allows create/update but blocks all `delete_*` tools.",
+        "- `GITLAB_READ_ONLY_MODE=true` (deprecated) — same as `readonly`; prefer `GITLAB_PERMISSION_MODE=readonly`.",
+        "",
+        "See [Environment Variables](../configuration/environment-variables.md)",
         "and [CLI Arguments](../getting-started/cli-arguments.md) for the full list.",
         "",
         "## Legend",

package/build/server/metrics.js

@@ -0,0 +1,84 @@
+export function escapePrometheusLabel(value) {
+    return String(value).replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/"/g, '\\"');
+}
+export function formatPrometheusMetrics(snapshot) {
+    const configLabels = Object.entries({
+        max_sessions: snapshot.config.maxSessions,
+        max_requests_per_minute: snapshot.config.maxRequestsPerMinute,
+        session_timeout_seconds: snapshot.config.sessionTimeoutSeconds,
+        remote_auth_enabled: snapshot.config.remoteAuthEnabled,
+        mcp_oauth_enabled: snapshot.config.mcpOAuthEnabled,
+        stateless_mode_enabled: snapshot.config.statelessModeEnabled,
+        stateless_rotation_key: snapshot.config.statelessRotationKey,
+    })
+        .map(([key, value]) => `${key}="${escapePrometheusLabel(value)}"`)
+        .join(",");
+    return [
+        "# HELP gitlab_mcp_requests_processed_total Total MCP requests processed",
+        "# TYPE gitlab_mcp_requests_processed_total counter",
+        `gitlab_mcp_requests_processed_total ${snapshot.requestsProcessed}`,
+        "",
+        "# HELP gitlab_mcp_requests_rejected_total Requests rejected, by reason",
+        "# TYPE gitlab_mcp_requests_rejected_total counter",
+        `gitlab_mcp_requests_rejected_total{reason="rate_limit"} ${snapshot.rejectedByRateLimit}`,
+        `gitlab_mcp_requests_rejected_total{reason="capacity"} ${snapshot.rejectedByCapacity}`,
+        "",
+        "# HELP gitlab_mcp_auth_failures_total Authentication failures",
+        "# TYPE gitlab_mcp_auth_failures_total counter",
+        `gitlab_mcp_auth_failures_total ${snapshot.authFailures}`,
+        "",
+        "# HELP gitlab_mcp_sessions_total Total sessions created",
+        "# TYPE gitlab_mcp_sessions_total counter",
+        `gitlab_mcp_sessions_total ${snapshot.totalSessions}`,
+        "",
+        "# HELP gitlab_mcp_sessions_expired_total Sessions expired due to inactivity",
+        "# TYPE gitlab_mcp_sessions_expired_total counter",
+        `gitlab_mcp_sessions_expired_total ${snapshot.expiredSessions}`,
+        "",
+        "# HELP gitlab_mcp_active_sessions Currently active sessions",
+        "# TYPE gitlab_mcp_active_sessions gauge",
+        `gitlab_mcp_active_sessions ${snapshot.activeSessions}`,
+        "",
+        "# HELP gitlab_mcp_authenticated_sessions Currently authenticated sessions",
+        "# TYPE gitlab_mcp_authenticated_sessions gauge",
+        `gitlab_mcp_authenticated_sessions ${snapshot.authenticatedSessions}`,
+        "",
+        "# HELP gitlab_mcp_client_pool_size Current GitLab client pool size",
+        "# TYPE gitlab_mcp_client_pool_size gauge",
+        `gitlab_mcp_client_pool_size ${snapshot.gitlabClientPool.size}`,
+        "",
+        "# HELP gitlab_mcp_client_pool_max_size Maximum GitLab client pool size",
+        "# TYPE gitlab_mcp_client_pool_max_size gauge",
+        `gitlab_mcp_client_pool_max_size ${snapshot.gitlabClientPool.maxSize}`,
+        "",
+        "# HELP gitlab_mcp_uptime_seconds Process uptime in seconds",
+        "# TYPE gitlab_mcp_uptime_seconds gauge",
+        `gitlab_mcp_uptime_seconds ${snapshot.uptime}`,
+        "",
+        "# HELP gitlab_mcp_memory_usage_bytes Node.js memory usage by type",
+        "# TYPE gitlab_mcp_memory_usage_bytes gauge",
+        ...Object.entries(snapshot.memoryUsage).map(([key, value]) => `gitlab_mcp_memory_usage_bytes{type="${escapePrometheusLabel(key)}"} ${value}`),
+        "",
+        "# HELP gitlab_mcp_stateless_requests_total Stateless MCP requests processed",
+        "# TYPE gitlab_mcp_stateless_requests_total counter",
+        `gitlab_mcp_stateless_requests_total ${snapshot.statelessRequests}`,
+        "",
+        "# HELP gitlab_mcp_stateless_auth_total Stateless auth successes, by source",
+        "# TYPE gitlab_mcp_stateless_auth_total counter",
+        `gitlab_mcp_stateless_auth_total{source="header"} ${snapshot.statelessAuthFromHeader}`,
+        `gitlab_mcp_stateless_auth_total{source="sealed_session_id"} ${snapshot.statelessAuthFromSealedSid}`,
+        "",
+        "# HELP gitlab_mcp_stateless_auth_failures_total Stateless auth failures",
+        "# TYPE gitlab_mcp_stateless_auth_failures_total counter",
+        `gitlab_mcp_stateless_auth_failures_total ${snapshot.statelessAuthFailures}`,
+        "",
+        "# HELP gitlab_mcp_stateless_session_id_rotations_total Stateless session id rotations",
+        "# TYPE gitlab_mcp_stateless_session_id_rotations_total counter",
+        `gitlab_mcp_stateless_session_id_rotations_total ${snapshot.statelessSidRotated}`,
+        "",
+        "# HELP gitlab_mcp_config_info Static configuration (value is always 1)",
+        "# TYPE gitlab_mcp_config_info gauge",
+        `gitlab_mcp_config_info{${configLabels}} 1`,
+        "",
+    ].join("\n");
+}

package/build/server/transport-mode.js

@@ -0,0 +1,25 @@
+import { SSE, STREAMABLE_HTTP } from "../config.js";
+/**
+ * Available transport modes for MCP server.
+ */
+export var TransportMode;
+(function (TransportMode) {
+    TransportMode["STDIO"] = "stdio";
+    TransportMode["SSE"] = "sse";
+    TransportMode["STREAMABLE_HTTP"] = "streamable-http";
+})(TransportMode || (TransportMode = {}));
+/**
+ * Determine the transport mode based on environment variables and availability.
+ *
+ * Transport mode priority (highest to lowest):
+ * 1. STREAMABLE_HTTP
+ * 2. SSE
+ * 3. STDIO
+ */
+export function determineTransportMode() {
+    if (STREAMABLE_HTTP)
+        return TransportMode.STREAMABLE_HTTP;
+    if (SSE)
+        return TransportMode.SSE;
+    return TransportMode.STDIO;
+}

package/build/test/callback-proxy-tests.js

@@ -95,7 +95,7 @@ describe("Callback Proxy Mode", () => {
     // Track the last code+verifier GitLab received so we can verify the proxy PKCE
     let lastTokenRequest = {};
     before(async () => {
-        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_ACCESS_TOKEN],

package/build/test/client-pool-test.js

@@ -22,7 +22,7 @@ describe('Client Pool Limits', () => {
     let mockGitLabUrl;
     before(async () => {
         // Start mock GitLab server
-        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN]

package/build/test/dynamic-api-url-allowlist.test.js

@@ -30,10 +30,10 @@ describe("Dynamic API URL allowlist", () => {
     let secondaryHit = false;
     let getAttackerHits = () => 0;
     before(async () => {
-        const primaryPort = await findMockServerPort(9100);
+        const primaryPort = await findMockServerPort();
         primaryGitLab = new MockGitLabServer({ port: primaryPort, validTokens: [MOCK_TOKEN] });
         await primaryGitLab.start();
-        const secondaryPort = await findMockServerPort(9200);
+        const secondaryPort = await findMockServerPort();
         secondaryGitLab = new MockGitLabServer({ port: secondaryPort, validTokens: [MOCK_TOKEN] });
         secondaryGitLab.addMockHandler("get", "/projects/1/issues", (_req, res) => {
             secondaryHit = true;

package/build/test/dynamic-api-url-test.js

@@ -25,7 +25,7 @@ describe('Dynamic API URL - Multiple GitLab Instances', () => {
     let servers = [];
     before(async () => {
         // Start first mock GitLab server
-        const mockPort1 = await findMockServerPort(MOCK_GITLAB_PORT_BASE_1);
+        const mockPort1 = await findMockServerPort();
         mockGitLab1 = new MockGitLabServer({
             port: mockPort1,
             validTokens: [MOCK_TOKEN_1]
@@ -33,7 +33,7 @@ describe('Dynamic API URL - Multiple GitLab Instances', () => {
         await mockGitLab1.start();
         mockGitLabUrl1 = mockGitLab1.getUrl();
         // Start second mock GitLab server
-        const mockPort2 = await findMockServerPort(MOCK_GITLAB_PORT_BASE_2);
+        const mockPort2 = await findMockServerPort();
         mockGitLab2 = new MockGitLabServer({
             port: mockPort2,
             validTokens: [MOCK_TOKEN_2]
@@ -203,14 +203,14 @@ describe('Dynamic API URL - Connection Pool', () => {
     let servers = [];
     before(async () => {
         // Start mock GitLab servers
-        const mockPort1 = await findMockServerPort(MOCK_GITLAB_PORT_BASE_1 + 50);
+        const mockPort1 = await findMockServerPort();
         mockGitLab1 = new MockGitLabServer({
             port: mockPort1,
             validTokens: [MOCK_TOKEN_1]
         });
         await mockGitLab1.start();
         mockGitLabUrl1 = mockGitLab1.getUrl();
-        const mockPort2 = await findMockServerPort(MOCK_GITLAB_PORT_BASE_2 + 50);
+        const mockPort2 = await findMockServerPort();
         mockGitLab2 = new MockGitLabServer({
             port: mockPort2,
             validTokens: [MOCK_TOKEN_2]

package/build/test/dynamic-routing-tests.js

@@ -29,7 +29,7 @@ describe('Dynamic Routing and Authentication Scenarios', () => {
             // to avoid launchServer overwriting GITLAB_PERSONAL_ACCESS_TOKEN with a different value
             process.env.GITLAB_TOKEN_TEST = MOCK_TOKEN_DEFAULT;
             process.env.TEST_PROJECT_ID = '1';
-            const mockPort = await findMockServerPort(9021);
+            const mockPort = await findMockServerPort();
             mockServer = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN_DEFAULT] });
             await mockServer.start();
             const mcpPort = await findAvailablePort(3021);
@@ -82,7 +82,7 @@ describe('Dynamic Routing and Authentication Scenarios', () => {
         let mcpUrl;
         let mockServer;
         before(async () => {
-            const mockPort = await findMockServerPort(9022);
+            const mockPort = await findMockServerPort();
             mockServer = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN_HEADER] });
             await mockServer.start();
             const mcpPort = await findAvailablePort(3022);
@@ -146,10 +146,10 @@ describe('Dynamic Routing and Authentication Scenarios', () => {
         let defaultMockServer;
         let headerMockServer;
         before(async () => {
-            const defaultPort = await findMockServerPort(9024);
+            const defaultPort = await findMockServerPort();
             defaultMockServer = new MockGitLabServer({ port: defaultPort, validTokens: [MOCK_TOKEN_DEFAULT, MOCK_TOKEN_HEADER] });
             await defaultMockServer.start();
-            const headerPort = await findMockServerPort(9025);
+            const headerPort = await findMockServerPort();
             headerMockServer = new MockGitLabServer({ port: headerPort, validTokens: [MOCK_TOKEN_DEFAULT, MOCK_TOKEN_HEADER] });
             await headerMockServer.start();
             const mcpPort = await findAvailablePort(3024);

package/build/test/mcp-oauth-tests.js

@@ -83,7 +83,7 @@ describe("MCP OAuth — Discovery Endpoints", () => {
     let mockGitLab;
     let servers = [];
     before(async () => {
-        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_OAUTH_TOKEN],
@@ -138,7 +138,7 @@ describe("MCP OAuth — Discovery Endpoints", () => {
         console.log("  ✓ Protected resource metadata returned");
     });
     test("path-prefixed MCP_SERVER_URL serves path-aware discovery metadata", async () => {
-        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE + 25);
+        const mockPort = await findMockServerPort();
         const prefixedMockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_OAUTH_TOKEN],
@@ -196,7 +196,7 @@ describe("MCP OAuth — /mcp Auth Enforcement", () => {
     let mockGitLab;
     let servers = [];
     before(async () => {
-        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE + 50);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_OAUTH_TOKEN],
@@ -492,7 +492,7 @@ describe("MCP OAuth — Header Auth Fallback", () => {
     let mockGitLab;
     let servers = [];
     before(async () => {
-        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE + 150);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             // Include both OAuth token and raw tokens so GitLab API calls succeed
@@ -566,6 +566,19 @@ describe("MCP OAuth — Header Auth Fallback", () => {
         assert.notStrictEqual(res.status, 403, "Should not return 403 with valid JOB-TOKEN");
         console.log(`  ✓ JOB-TOKEN header accepted (status: ${res.status})`);
     });
+    test("POST /mcp with invalid Private-Token is rejected before session creation", async () => {
+        const res = await fetch(mcpUrl, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json, text/event-stream",
+                "Private-Token": "glpat-invalid-token-0000",
+            },
+            body: initBody,
+        });
+        assert.strictEqual(res.status, 401);
+        assert.strictEqual(res.headers.get("mcp-session-id"), null);
+    });
     test("POST /mcp with valid OAuth Bearer token still works normally", async () => {
         const res = await fetch(mcpUrl, {
             method: "POST",

package/build/test/multi-server-test.js

@@ -45,7 +45,7 @@ describe("Single Client Mode (ENABLE_DYNAMIC_API_URL=false)", () => {
     let mcpUrl;
     let mockServer1;
     before(async () => {
-        const mockPort = await findMockServerPort(9001);
+        const mockPort = await findMockServerPort();
         mockServer1 = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN] });
         mockServer1.addMockHandler('get', '/projects/1', (req, res) => { res.json(project1); });
         await mockServer1.start();
@@ -105,8 +105,8 @@ describe("Dynamic Client Mode (ENABLE_DYNAMIC_API_URL=true)", () => {
     let mockServer1;
     let mockServer2;
     before(async () => {
-        const port1 = await findMockServerPort(9011);
-        const port2 = await findMockServerPort(9012);
+        const port1 = await findMockServerPort();
+        const port2 = await findMockServerPort();
         mockServer1 = new MockGitLabServer({ port: port1, validTokens: [MOCK_TOKEN] });
         mockServer2 = new MockGitLabServer({ port: port2, validTokens: [MOCK_TOKEN] });
         mockServer1.addMockHandler('get', '/projects/1', (req, res) => { res.json(project1); });

package/build/test/no-proxy-integration-test.js

@@ -22,7 +22,7 @@ describe('NO_PROXY Integration Tests', () => {
     let mockGitLabHost;
     before(async () => {
         // Start mock GitLab server
-        const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN]