@zereight/mcp-gitlab 2.1.29 → 2.1.38

package/build/tools/registry.js

@@ -1,7 +1,7 @@
 import { zodToJsonSchema } from "zod-to-json-schema";
 import { toJSONSchema } from "../utils/schema.js";
 import { USE_GITLAB_WIKI, USE_MILESTONE, USE_PIPELINE, SSE, STREAMABLE_HTTP, } from "../config.js";
-import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UnprotectBranchSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadAttachmentRemoteSchema, DownloadJobArtifactsSchema, DownloadJobArtifactsRemoteSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, HealthCheckSchema, GetBranchSchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GetDeploymentSchema, GetDraftNoteSchema, GetEnvironmentSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, GetPipelineSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetTimelineEventsSchema, GetUsersSchema, GetUserSchema, WhoAmISchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListBranchesSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListPipelinesSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, } from "../schemas.js";
+import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateGroupMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UnprotectBranchSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupMilestoneSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadAttachmentRemoteSchema, DownloadJobArtifactsSchema, DownloadJobArtifactsRemoteSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, EditGroupMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, HealthCheckSchema, GetBranchSchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GetDeploymentSchema, GetDraftNoteSchema, GetEnvironmentSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetGroupMilestoneSchema, GetGroupMilestoneIssuesSchema, GetGroupMilestoneMergeRequestsSchema, GetGroupMilestoneBurndownEventsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, PipelineJobControlSchema, GetPipelineSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetTimelineEventsSchema, GetUsersSchema, GetUserSchema, WhoAmISchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListBranchesSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupMilestonesSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListPipelinesSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, } from "../schemas.js";
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
 // Define all available tools
 export const allTools = [
@@ -132,7 +132,7 @@ export const allTools = [
     },
     {
         name: "get_merge_request",
-        description: "Get details of a merge request (mergeRequestIid or branchName required)",
+        description: "Get details of a merge request (mergeRequestIid or branchName required). Set include_summaries=true for deployment/commit/approval summaries",
         inputSchema: toJSONSchema(GetMergeRequestSchema),
     },
     {
@@ -354,12 +354,12 @@ export const allTools = [
     },
     {
         name: "get_issue",
-        description: "Get details of a specific issue",
+        description: "Get details of a specific issue. Returns a slim milestone by default; set full_response=true for the complete milestone object",
         inputSchema: toJSONSchema(GetIssueSchema),
     },
     {
         name: "update_issue",
-        description: "Update an issue",
+        description: "Update an issue. Returns a slim confirmation by default; set full_response=true for the complete updated issue object",
         inputSchema: toJSONSchema(UpdateIssueSchema),
     },
     {
@@ -577,7 +577,7 @@ export const allTools = [
     {
         name: "get_pipeline_job",
         description: "Get details of a GitLab pipeline job number",
-        inputSchema: toJSONSchema(GetPipelineJobOutputSchema),
+        inputSchema: toJSONSchema(PipelineJobControlSchema),
     },
     {
         name: "get_pipeline_job_output",
@@ -703,6 +703,46 @@ export const allTools = [
         description: "Get burndown events for a specific milestone",
         inputSchema: toJSONSchema(GetMilestoneBurndownEventsSchema),
     },
+    {
+        name: "list_group_milestones",
+        description: "List group milestones with filtering options",
+        inputSchema: toJSONSchema(ListGroupMilestonesSchema),
+    },
+    {
+        name: "get_group_milestone",
+        description: "Get details of a specific group milestone",
+        inputSchema: toJSONSchema(GetGroupMilestoneSchema),
+    },
+    {
+        name: "create_group_milestone",
+        description: "Create a new group milestone",
+        inputSchema: toJSONSchema(CreateGroupMilestoneSchema),
+    },
+    {
+        name: "edit_group_milestone",
+        description: "Edit an existing group milestone",
+        inputSchema: toJSONSchema(EditGroupMilestoneSchema),
+    },
+    {
+        name: "delete_group_milestone",
+        description: "Delete a group milestone",
+        inputSchema: toJSONSchema(DeleteGroupMilestoneSchema),
+    },
+    {
+        name: "get_group_milestone_issue",
+        description: "Get issues associated with a specific group milestone",
+        inputSchema: toJSONSchema(GetGroupMilestoneIssuesSchema),
+    },
+    {
+        name: "get_group_milestone_merge_requests",
+        description: "Get merge requests associated with a specific group milestone",
+        inputSchema: toJSONSchema(GetGroupMilestoneMergeRequestsSchema),
+    },
+    {
+        name: "get_group_milestone_burndown_events",
+        description: "Get burndown events for a specific group milestone",
+        inputSchema: toJSONSchema(GetGroupMilestoneBurndownEventsSchema),
+    },
     {
         name: "get_users",
         description: "Get GitLab user details by usernames",
@@ -1126,6 +1166,11 @@ export const readOnlyTools = new Set([
     "get_milestone_issue",
     "get_milestone_merge_requests",
     "get_milestone_burndown_events",
+    "list_group_milestones",
+    "get_group_milestone",
+    "get_group_milestone_issue",
+    "get_group_milestone_merge_requests",
+    "get_group_milestone_burndown_events",
     "list_wiki_pages",
     "get_wiki_page",
     "list_group_wiki_pages",
@@ -1181,6 +1226,7 @@ export const destructiveTools = new Set([
     "delete_wiki_page",
     "delete_group_wiki_page",
     "delete_milestone",
+    "delete_group_milestone",
     "delete_release",
     "delete_tag",
     "delete_merge_request_note",
@@ -1202,6 +1248,32 @@ export const destructiveTools = new Set([
     "delete_group_variable",
     "purge_dependency_proxy_cache",
 ]);
+// Tools that permanently delete resources — blocked in "modify" permission mode.
+// Narrower than destructiveTools: merge/protect/push are modifications, not deletions.
+export const deleteTools = new Set([
+    "delete_branch",
+    "delete_draft_note",
+    "delete_group_variable",
+    "delete_group_wiki_page",
+    "delete_group_milestone",
+    "delete_issue",
+    "delete_issue_emoji_reaction",
+    "delete_issue_link",
+    "delete_issue_note_emoji_reaction",
+    "delete_label",
+    "delete_merge_request_discussion_note",
+    "delete_merge_request_emoji_reaction",
+    "delete_merge_request_note",
+    "delete_merge_request_note_emoji_reaction",
+    "delete_milestone",
+    "delete_project_variable",
+    "delete_release",
+    "delete_tag",
+    "delete_wiki_page",
+    "delete_work_item_emoji_reaction",
+    "delete_work_item_note_emoji_reaction",
+    "purge_dependency_proxy_cache",
+]);
 // Define which tools are related to wiki and can be toggled by USE_GITLAB_WIKI
 export const wikiToolNames = new Set([
     "list_wiki_pages",
@@ -1227,6 +1299,14 @@ export const milestoneToolNames = new Set([
     "get_milestone_merge_requests",
     "promote_milestone",
     "get_milestone_burndown_events",
+    "list_group_milestones",
+    "get_group_milestone",
+    "create_group_milestone",
+    "edit_group_milestone",
+    "delete_group_milestone",
+    "get_group_milestone_issue",
+    "get_group_milestone_merge_requests",
+    "get_group_milestone_burndown_events",
 ]);
 // Define which tools are related to pipelines and can be toggled by USE_PIPELINE
 export const pipelineToolNames = new Set([
@@ -1446,6 +1526,14 @@ export const TOOLSET_DEFINITIONS = [
             "get_milestone_merge_requests",
             "promote_milestone",
             "get_milestone_burndown_events",
+            "list_group_milestones",
+            "get_group_milestone",
+            "create_group_milestone",
+            "edit_group_milestone",
+            "delete_group_milestone",
+            "get_group_milestone_issue",
+            "get_group_milestone_merge_requests",
+            "get_group_milestone_burndown_events",
         ]),
     },
     {

package/build/utils/download-token.js

@@ -0,0 +1,71 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+/**
+ * Encryption key for download tokens. When DOWNLOAD_TOKEN_SECRET is set
+ * (recommended for HA deployments behind a load balancer) the key is
+ * derived from that value so all replicas share the same key. Otherwise
+ * a random key is generated per process (tokens are not portable across
+ * restarts or replicas).
+ */
+const DOWNLOAD_TOKEN_KEY = (() => {
+    const secret = process.env.DOWNLOAD_TOKEN_SECRET;
+    if (secret) {
+        return createHash("sha256").update(secret).digest();
+    }
+    return randomBytes(32);
+})();
+/** Download token TTL in seconds (default 5 minutes). */
+const DEFAULT_DOWNLOAD_TOKEN_TTL = 300;
+const parsedDownloadTokenTtl = Number.parseInt(process.env.DOWNLOAD_TOKEN_TTL || "", 10);
+const DOWNLOAD_TOKEN_TTL = Number.isFinite(parsedDownloadTokenTtl) && parsedDownloadTokenTtl > 0
+    ? parsedDownloadTokenTtl
+    : DEFAULT_DOWNLOAD_TOKEN_TTL;
+/**
+ * Create a self-contained encrypted download token for a specific GitLab resource.
+ */
+export function createDownloadToken(header, token, apiUrl, resource) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", DOWNLOAD_TOKEN_KEY, iv);
+    const payload = JSON.stringify({
+        h: header,
+        t: token,
+        e: Math.floor(Date.now() / 1000) + DOWNLOAD_TOKEN_TTL,
+        ...(apiUrl ? { u: apiUrl } : {}),
+        ...(resource ? { r: resource.type, p: resource.params } : {}),
+    });
+    const encrypted = Buffer.concat([cipher.update(payload, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, tag, encrypted]).toString("base64url");
+}
+/**
+ * Decrypt and validate a download token, returning null when it is invalid or expired.
+ */
+export function decryptDownloadToken(tokenStr) {
+    try {
+        const buf = Buffer.from(tokenStr, "base64url");
+        if (buf.length < 29)
+            return null;
+        const iv = buf.subarray(0, 12);
+        const tag = buf.subarray(12, 28);
+        const encrypted = buf.subarray(28);
+        const decipher = createDecipheriv("aes-256-gcm", DOWNLOAD_TOKEN_KEY, iv);
+        decipher.setAuthTag(tag);
+        const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+        const payload = JSON.parse(decrypted.toString("utf8"));
+        if (payload.e && Math.floor(Date.now() / 1000) > payload.e) {
+            return null;
+        }
+        if (typeof payload.h !== "string" || payload.h.length === 0)
+            return null;
+        if (typeof payload.t !== "string" || payload.t.length === 0)
+            return null;
+        return {
+            header: payload.h,
+            token: payload.t,
+            ...(payload.u ? { apiUrl: payload.u } : {}),
+            ...(payload.r ? { resourceType: payload.r, resourceParams: payload.p } : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}

package/build/utils/forwarded-public-base-url.js

@@ -1,3 +1,25 @@
+export function getForwardedRequestHost(req, trustProxy) {
+    if (!trustProxy)
+        return undefined;
+    const forwarded = getLastHeaderValue(req.headers.forwarded);
+    if (forwarded) {
+        for (const part of forwarded.split(";")) {
+            const separator = part.indexOf("=");
+            if (separator <= 0)
+                continue;
+            const key = part.slice(0, separator).trim().toLowerCase();
+            const value = unquoteHeaderValue(part.slice(separator + 1).trim());
+            if (key === "host" && value && !/[\s/\\]/.test(value)) {
+                return value;
+            }
+        }
+    }
+    const host = getLastHeaderValue(req.headers["x-forwarded-host"]);
+    if (host && !/[\s/\\]/.test(host)) {
+        return host;
+    }
+    return undefined;
+}
 function getLastHeaderValue(value) {
     const raw = Array.isArray(value) ? value[value.length - 1] : value;
     if (!raw)

package/build/utils/graphql-query.js

@@ -10,6 +10,21 @@ function stripGraphQLCommentsAndStrings(source) {
             result += " ";
             continue;
         }
+        if (source.slice(i, i + 3) === '"""') {
+            i += 3;
+            while (i < source.length && source.slice(i, i + 3) !== '"""') {
+                if (source[i] === "\\" && source.slice(i, i + 4) === '\\"""') {
+                    i += 4;
+                    continue;
+                }
+                i++;
+            }
+            if (i < source.length) {
+                i += 3;
+            }
+            result += " ";
+            continue;
+        }
         if (ch === '"' || ch === "'") {
             const quote = ch;
             i++;
@@ -27,17 +42,6 @@ function stripGraphQLCommentsAndStrings(source) {
             result += " ";
             continue;
         }
-        if (source.slice(i, i + 3) === '"""') {
-            i += 3;
-            while (i < source.length && source.slice(i, i + 3) !== '"""') {
-                i++;
-            }
-            if (i < source.length) {
-                i += 3;
-            }
-            result += " ";
-            continue;
-        }
         result += ch;
         i++;
     }
@@ -48,5 +52,98 @@ export function graphqlQueryContainsWriteOperation(query) {
     if (!normalized) {
         return false;
     }
-    return /(?:^|[};]\s*)(mutation|subscription)\b/.test(normalized);
+    const operationTypePattern = /\s*(?:,\s*)?(query|mutation|subscription)\b/y;
+    let depth = 0;
+    let expectingOperationType = true;
+    for (let i = 0; i < normalized.length; i++) {
+        const ch = normalized[i];
+        if (ch === "{") {
+            depth++;
+            expectingOperationType = false;
+            continue;
+        }
+        if (ch === "}") {
+            depth = Math.max(0, depth - 1);
+            if (depth === 0) {
+                expectingOperationType = true;
+            }
+            continue;
+        }
+        if (depth === 0 && (ch === ";" || ch === ",")) {
+            expectingOperationType = true;
+            continue;
+        }
+        if (depth === 0 && expectingOperationType) {
+            operationTypePattern.lastIndex = i;
+            const operationMatch = operationTypePattern.exec(normalized);
+            if (operationMatch) {
+                const operationType = operationMatch[1];
+                expectingOperationType = false;
+                if (operationType === "mutation" || operationType === "subscription") {
+                    return true;
+                }
+                i = operationTypePattern.lastIndex - 1;
+            }
+        }
+    }
+    return false;
+}
+const DELETE_FIELD_PATTERN = /delete|destroy|remove|prune|purge/i;
+// Collects top-level selection field names (and aliases) of every mutation operation.
+// Content inside parentheses (arguments) is skipped so argument names like
+// removeSourceBranch do not count as delete fields. Returns null when a top-level
+// fragment spread is present, since the spread could hide a delete field.
+function extractTopLevelMutationFields(normalized) {
+    const fields = [];
+    const mutationRegex = /(?:^|[};]\s*)mutation\b[^({]*(?:\([^)]*\))?\s*\{/g;
+    let match;
+    while ((match = mutationRegex.exec(normalized)) !== null) {
+        let i = mutationRegex.lastIndex;
+        let braceDepth = 1;
+        let parenDepth = 0;
+        let current = "";
+        while (i < normalized.length && braceDepth > 0) {
+            const ch = normalized[i];
+            if (ch === "(")
+                parenDepth++;
+            else if (ch === ")")
+                parenDepth = Math.max(0, parenDepth - 1);
+            else if (ch === "{")
+                braceDepth++;
+            else if (ch === "}")
+                braceDepth--;
+            if (braceDepth === 1 && parenDepth === 0) {
+                if (normalized.startsWith("...", i)) {
+                    return null;
+                }
+                if (/[A-Za-z0-9_]/.test(ch)) {
+                    current += ch;
+                    i++;
+                    continue;
+                }
+            }
+            if (current) {
+                fields.push(current);
+                current = "";
+            }
+            i++;
+        }
+        if (current) {
+            fields.push(current);
+        }
+    }
+    return fields;
+}
+export function graphqlQueryContainsDeleteOperation(query) {
+    const normalized = stripGraphQLCommentsAndStrings(query).trim();
+    if (!normalized || !/(?:^|[};]\s*)mutation\b/.test(normalized)) {
+        return false;
+    }
+    const fields = extractTopLevelMutationFields(normalized);
+    if (fields === null || fields.length === 0) {
+        // Fragment spread at mutation top level, or a mutation whose selection set
+        // could not be located (exotic syntax): be conservative and treat as delete
+        return true;
+    }
+    return fields.some(field => DELETE_FIELD_PATTERN.test(field));
 }

package/build/utils/version-check.js

@@ -0,0 +1,40 @@
+const NPM_REGISTRY_LATEST_URL = "https://registry.npmjs.org/@zereight/mcp-gitlab/latest";
+const RELEASE_VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
+export function isNewerVersion(candidate, current) {
+    const parse = (version) => version.split(".").map(part => Number.parseInt(part, 10));
+    const a = parse(candidate);
+    const b = parse(current);
+    for (let i = 0; i < 3; i++) {
+        if (!Number.isFinite(a[i]) || !Number.isFinite(b[i]))
+            return false;
+        if (a[i] !== b[i])
+            return a[i] > b[i];
+    }
+    return false;
+}
+export async function fetchLatestVersion(fetchFn = fetch, timeoutMs = 3000) {
+    try {
+        const response = await fetchFn(NPM_REGISTRY_LATEST_URL, {
+            signal: AbortSignal.timeout(timeoutMs),
+            headers: { accept: "application/json" },
+        });
+        if (!response.ok)
+            return null;
+        const data = (await response.json());
+        return typeof data.version === "string" ? data.version : null;
+    }
+    catch {
+        // Fail silent: the update check must never break or delay server startup
+        // (offline machines, air-gapped networks, registry outages).
+        return null;
+    }
+}
+/** Returns the latest published version when it is newer than `currentVersion`, otherwise null. */
+export async function checkForNewVersion(currentVersion, fetchFn = fetch) {
+    if (!RELEASE_VERSION_PATTERN.test(currentVersion))
+        return null;
+    const latest = await fetchLatestVersion(fetchFn);
+    if (!latest || !RELEASE_VERSION_PATTERN.test(latest))
+        return null;
+    return isNewerVersion(latest, currentVersion) ? latest : null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.29",
+  "version": "2.1.38",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
@@ -52,18 +52,19 @@
     "changelog": "auto-changelog -p",
     "test": "npm run test:all",
     "test:all": "npm run build && npm run test:mock && npm run test:live",
-    "test:mock": "node --import tsx/esm --test test/path-segment-encoding.test.ts && node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/dynamic-api-url-allowlist.test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/test-oauth-proxy-rate-limit.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && node --import tsx/esm --test test/sse-auth-guard.test.ts && node --import tsx/esm --test test/streamable-http-concurrent-session.test.ts && node --import tsx/esm --test test/streamable-http-unauthenticated-discovery.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-issues.ts && node --import tsx/esm --test test/test-create-repository.ts && node --import tsx/esm --test test/test-update-project.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-remote-downloads.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-protected-branches.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-ci-catalog.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/proxy-client-ip.test.ts && node --import tsx/esm --test test/utils/forwarded-public-base-url.test.ts && node --import tsx/esm --test test/utils/graphql-query.test.ts && node --import tsx/esm --test test/utils/wiki-title.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/utils/redact-sensitive.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts && node --import tsx/esm --test test/test-ci-variables.ts && node --import tsx/esm --test test/test-dependency-proxy.ts",
-    "test:stateless": "npm run build && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts",
+    "test:mock": "bash scripts/run-mock-tests.sh",
+    "test:stateless": "npm run build && node --import tsx/esm --test --experimental-test-isolation=none test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts",
     "test:mcp-oauth": "npm run build && node --import tsx/esm --test test/mcp-oauth-tests.ts",
     "test:live": "node test/validate-api.js",
     "test:consumer-smoke": "bash scripts/consumer-install-smoke.sh",
-    "test:remote-auth": "npm run build && node --import tsx/esm --test test/remote-auth-simple-test.ts",
+    "test:remote-auth": "npm run build && node --import tsx/esm --test --experimental-test-isolation=none test/remote-auth-simple-test.ts",
     "test:schema": "tsx test/schema-tests.ts && tsx test/test-json-schema.ts",
     "test:oauth": "tsx test/oauth-tests.ts",
     "test:list-merge-requests": "npm run build && tsx test/test-list-merge-requests.ts",
     "test:approvals": "npm run build && tsx test/test-merge-request-approvals.ts",
     "lint": "eslint . --ext .ts",
     "check:runtime-deps": "node scripts/check-runtime-deps.mjs",
+    "check:skill-sync": "tsx scripts/check-skill-sync.ts",
     "lint:fix": "eslint . --ext .ts --fix",
     "release": "bash scripts/release.sh",
     "release:mcp-registry": "bash scripts/publish_mcp_registry.sh",