@zereight/mcp-gitlab 2.1.29 → 2.1.38

package/build/test/test-geteffectiveprojectid.js

@@ -26,13 +26,134 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
         let mockGitLab;
         let servers = [];
         let client;
+        let group123Requested = false;
+        let group789Requested = false;
+        let labelLookupRoots = [];
         before(async () => {
             // Start mock GitLab server
-            const mockPort = await findMockServerPort(9100);
+            const mockPort = await findMockServerPort();
             mockGitLab = new MockGitLabServer({
                 port: mockPort,
                 validTokens: [MOCK_TOKEN]
             });
+            mockGitLab.addMockHandler('get', '/groups/123', (_req, res) => {
+                group123Requested = true;
+                res.json({
+                    id: 123,
+                    name: 'Test Group',
+                    path: 'test-group',
+                    full_path: 'test-group',
+                });
+            });
+            mockGitLab.addMockHandler('get', '/projects/789', (_req, res) => {
+                res.status(404).json({ message: '404 Project Not Found' });
+            });
+            mockGitLab.addMockHandler('get', '/groups/789', (_req, res) => {
+                group789Requested = true;
+                res.json({
+                    id: 789,
+                    name: 'Numeric Group',
+                    path: 'numeric-group',
+                    full_path: 'numeric-group',
+                });
+            });
+            mockGitLab.addRootHandler('post', '/api/graphql', (req, res) => {
+                const { query, variables } = req.body;
+                if (query.includes('workItemTypes')) {
+                    res.json({
+                        data: {
+                            namespace: {
+                                workItemTypes: {
+                                    nodes: [{ id: 'gid://gitlab/WorkItems::Type/1', name: 'Issue' }],
+                                },
+                            },
+                        },
+                    });
+                    return;
+                }
+                if (query.includes('workItems(')) {
+                    assert.ok(query.includes('group(fullPath: $path)'), 'Should query the group GraphQL root');
+                    assert.strictEqual(variables.path, 'test-group', 'Should use resolved group full_path');
+                    res.json({
+                        data: {
+                            group: {
+                                workItems: {
+                                    nodes: [
+                                        {
+                                            id: 'gid://gitlab/WorkItem/1',
+                                            iid: '1',
+                                            title: 'Group work item',
+                                            state: 'OPEN',
+                                            webUrl: 'https://gitlab.mock/groups/test-group/-/work_items/1',
+                                            workItemType: { name: 'Issue' },
+                                            widgets: [],
+                                        },
+                                    ],
+                                    pageInfo: { hasNextPage: false, endCursor: null },
+                                },
+                            },
+                        },
+                    });
+                    return;
+                }
+                if (query.includes('labels(title:')) {
+                    assert.ok(query.includes('group(fullPath: $path)'), 'Should resolve labels from Group');
+                    assert.ok(!query.includes('namespace(fullPath: $path)'), 'Should not query labels from Namespace');
+                    labelLookupRoots.push('group');
+                    res.json({
+                        data: {
+                            group: { l0: { nodes: [{ id: 'gid://gitlab/GroupLabel/1' }] } },
+                            users: { nodes: [] },
+                        },
+                    });
+                    return;
+                }
+                if (query.includes('workItem(iid: $iid)')) {
+                    res.json({
+                        data: { namespace: { workItem: { id: 'gid://gitlab/WorkItem/1' } } },
+                    });
+                    return;
+                }
+                if (query.includes('workItemCreate')) {
+                    assert.deepStrictEqual(variables.labelIds, ['gid://gitlab/GroupLabel/1']);
+                    res.json({
+                        data: {
+                            workItemCreate: {
+                                workItem: {
+                                    id: 'gid://gitlab/WorkItem/2',
+                                    iid: '2',
+                                    title: variables.title,
+                                    webUrl: 'https://gitlab.mock/groups/test-group/-/work_items/2',
+                                    workItemType: { name: 'Issue' },
+                                },
+                                errors: [],
+                            },
+                        },
+                    });
+                    return;
+                }
+                if (query.includes('workItemUpdate')) {
+                    assert.deepStrictEqual(variables.addLabelIds, ['gid://gitlab/GroupLabel/1']);
+                    res.json({
+                        data: {
+                            workItemUpdate: {
+                                workItem: {
+                                    id: variables.id,
+                                    iid: '1',
+                                    title: 'Updated group work item',
+                                    state: 'OPEN',
+                                    webUrl: 'https://gitlab.mock/groups/test-group/-/work_items/1',
+                                    workItemType: { name: 'Issue' },
+                                    widgets: [],
+                                },
+                                errors: [],
+                            },
+                        },
+                    });
+                    return;
+                }
+                res.status(500).json({ message: `Unexpected GraphQL query: ${query}` });
+            });
             await mockGitLab.start();
             const mockGitLabUrl = mockGitLab.getUrl();
             // Start MCP server WITHOUT GITLAB_ALLOWED_PROJECT_IDS
@@ -46,7 +167,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                     REMOTE_AUTHORIZATION: 'true',
                     GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
                     GITLAB_PROJECT_ID: DEFAULT_PROJECT_ID,
-                    GITLAB_READ_ONLY_MODE: 'true',
+                    GITLAB_READ_ONLY_MODE: 'false',
                 }
             });
             servers.push(server);
@@ -94,6 +215,82 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
             assert.strictEqual(project.id.toString(), OTHER_PROJECT_ID, 'Should use passed project_id');
             console.log(`  ✓ Used passed project_id ${OTHER_PROJECT_ID} instead of default ${DEFAULT_PROJECT_ID}`);
         });
+        test('should resolve explicit numeric group IDs through the groups endpoint', async () => {
+            group123Requested = false;
+            const result = await client.callTool('list_work_items', {
+                project_id: 'group:123',
+            });
+            assert.ok(group123Requested, 'Should request /groups/123');
+            assert.ok(result.content, 'Should have content');
+            const content = result.content[0];
+            assert.ok('text' in content, 'Content should have text');
+            const parsed = JSON.parse(content.text);
+            assert.strictEqual(parsed.items.length, 1, 'Should return group work items');
+            assert.strictEqual(parsed.items[0].title, 'Group work item');
+            console.log('  ✓ Resolved group:123 via /groups/123 when no project allowlist is set');
+        });
+        test('should resolve labels from the group root when creating group work items', async () => {
+            labelLookupRoots = [];
+            const result = await client.callTool('create_work_item', {
+                project_id: 'group:123',
+                title: 'Created group work item',
+                labels: ['group-label'],
+            });
+            assert.deepStrictEqual(labelLookupRoots, ['group']);
+            assert.ok(result.content, 'Should have content');
+            const content = result.content[0];
+            assert.ok('text' in content, 'Content should have text');
+            assert.strictEqual(JSON.parse(content.text).title, 'Created group work item');
+            console.log('  ✓ Resolved create labels through group(fullPath:)');
+        });
+        test('should resolve labels from the group root when updating group work items', async () => {
+            labelLookupRoots = [];
+            const result = await client.callTool('update_work_item', {
+                project_id: 'group:123',
+                iid: 1,
+                add_labels: ['group-label'],
+            });
+            assert.deepStrictEqual(labelLookupRoots, ['group']);
+            assert.ok(result.content, 'Should have content');
+            const content = result.content[0];
+            assert.ok('text' in content, 'Content should have text');
+            assert.strictEqual(JSON.parse(content.text).title, 'Updated group work item');
+            console.log('  ✓ Resolved update labels through group(fullPath:)');
+        });
+        test('should not fall back from bare numeric project IDs to groups', async () => {
+            group789Requested = false;
+            let didThrow = false;
+            try {
+                await client.callTool('list_work_items', {
+                    project_id: '789',
+                });
+            }
+            catch (error) {
+                didThrow = true;
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('404'), 'Should surface the project 404');
+            }
+            assert.ok(didThrow, 'Should have failed on the project 404');
+            assert.strictEqual(group789Requested, false, 'Should not request /groups/789');
+            console.log('  ✓ Bare numeric ID 789 did not fall back to /groups/789');
+        });
+        test('should not fall back from explicit numeric project IDs to groups', async () => {
+            group789Requested = false;
+            let didThrow = false;
+            try {
+                await client.callTool('list_work_items', {
+                    project_id: 'project:789',
+                });
+            }
+            catch (error) {
+                didThrow = true;
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('404'), 'Should surface the project 404');
+            }
+            assert.ok(didThrow, 'Should have failed on the project 404');
+            assert.strictEqual(group789Requested, false, 'Should not request /groups/789');
+            console.log('  ✓ Explicit project:789 did not fall back to /groups/789');
+        });
     });
     describe('getEffectiveProjectId - With single GITLAB_ALLOWED_PROJECT_IDS', () => {
         let mcpUrl;
@@ -102,7 +299,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
         let client;
         before(async () => {
             // Start mock GitLab server
-            const mockPort = await findMockServerPort(9200);
+            const mockPort = await findMockServerPort();
             mockGitLab = new MockGitLabServer({
                 port: mockPort,
                 validTokens: [MOCK_TOKEN]
@@ -166,6 +363,22 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                 console.log('  ✓ Correctly rejected access to non-allowed project');
             }
         });
+        test('should reject explicit group IDs when GITLAB_ALLOWED_PROJECT_IDS is set', async () => {
+            let didThrow = false;
+            try {
+                await client.callTool('list_work_items', {
+                    project_id: 'group:123',
+                });
+            }
+            catch (error) {
+                didThrow = true;
+                assert.ok(error instanceof Error);
+                assert.ok(error.message.includes('GITLAB_ALLOWED_PROJECT_IDS') &&
+                    error.message.includes('project allowlist does not cover groups'), 'Should explain that project allowlists do not authorize groups');
+                console.log('  ✓ Rejected group:123 when GITLAB_ALLOWED_PROJECT_IDS is set');
+            }
+            assert.ok(didThrow, 'Should have rejected explicit group access');
+        });
     });
     describe('getEffectiveProjectId - With multiple GITLAB_ALLOWED_PROJECT_IDS', () => {
         let mcpUrl;
@@ -174,7 +387,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
         let client;
         before(async () => {
             // Start mock GitLab server
-            const mockPort = await findMockServerPort(9300);
+            const mockPort = await findMockServerPort();
             mockGitLab = new MockGitLabServer({
                 port: mockPort,
                 validTokens: [MOCK_TOKEN]
@@ -255,7 +468,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
         let servers = [];
         let client;
         before(async () => {
-            const mockPort = await findMockServerPort(9400);
+            const mockPort = await findMockServerPort();
             mockGitLab = new MockGitLabServer({
                 port: mockPort,
                 validTokens: [MOCK_TOKEN]
@@ -353,7 +566,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
         let servers = [];
         let client;
         before(async () => {
-            const mockPort = await findMockServerPort(9600);
+            const mockPort = await findMockServerPort();
             mockGitLab = new MockGitLabServer({
                 port: mockPort,
                 validTokens: [MOCK_TOKEN]
@@ -451,7 +664,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
         let servers = [];
         let client;
         before(async () => {
-            const mockPort = await findMockServerPort(9500);
+            const mockPort = await findMockServerPort();
             mockGitLab = new MockGitLabServer({
                 port: mockPort,
                 validTokens: [MOCK_TOKEN]
@@ -514,7 +727,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
         let servers = [];
         let client;
         before(async () => {
-            const mockPort = await findMockServerPort(9500);
+            const mockPort = await findMockServerPort();
             mockGitLab = new MockGitLabServer({
                 port: mockPort,
                 validTokens: [MOCK_TOKEN],

package/build/test/test-issue-description-patch.js

@@ -137,7 +137,7 @@ describe("update_issue_description_patch MCP tool", () => {
         return client;
     }
     before(async () => {
-        const mockPort = await findMockServerPort(MOCK_PORT_BASE);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],

package/build/test/test-job-artifacts.js

@@ -69,7 +69,7 @@ describe('job artifacts tools', () => {
     let mockGitLabUrl;
     let tmpDir;
     before(async () => {
-        const mockPort = await findMockServerPort(9200);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],

package/build/test/test-list-issues.js

@@ -65,7 +65,7 @@ describe("list_issues", () => {
     let mockGitLab;
     let mockGitLabUrl;
     before(async () => {
-        const mockPort = await findMockServerPort(9000);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],

package/build/test/test-list-merge-requests.js

@@ -62,7 +62,7 @@ describe('list_merge_requests', () => {
     let mockGitLab;
     let mockGitLabUrl;
     before(async () => {
-        const mockPort = await findMockServerPort(9000);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN]

package/build/test/test-list-project-members.js

@@ -84,7 +84,7 @@ describe('list_project_members', () => {
     let directEndpointHit = false;
     let inheritedEndpointHit = false;
     before(async () => {
-        const mockPort = await findMockServerPort(9000);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN]

package/build/test/test-merge-request-approval-state-tools.js

@@ -65,7 +65,7 @@ describe("merge request approval state tools", () => {
     let mockGitLab;
     let mockGitLabUrl;
     before(async () => {
-        const mockPort = await findMockServerPort(9400);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],

package/build/test/test-merge-request-pipelines.js

@@ -55,7 +55,7 @@ describe("list_merge_request_pipelines", () => {
     let mockGitLabUrl;
     let lastQuery = {};
     before(async () => {
-        const mockPort = await findMockServerPort(9250);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],

package/build/test/test-mr-diffs-filter.js

@@ -62,7 +62,7 @@ describe('get_merge_request_diffs with excluded_file_patterns', () => {
     let mockGitLab;
     let mockGitLabUrl;
     before(async () => {
-        const mockPort = await findMockServerPort(9100);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN]

package/build/test/test-mr-file-diffs.js

@@ -115,7 +115,7 @@ describe('list_merge_request_changed_files', () => {
     let mockGitLab;
     let mockGitLabUrl;
     before(async () => {
-        const mockPort = await findMockServerPort(9150);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN]
@@ -177,7 +177,7 @@ describe('get_merge_request_file_diff', () => {
     let mockGitLab;
     let mockGitLabUrl;
     before(async () => {
-        const mockPort = await findMockServerPort(9200);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN]

package/build/test/test-oauth-proxy-rate-limit.js

@@ -38,7 +38,7 @@ describe("When MCP OAuth runs behind a trusted proxy", () => {
         let mockGitLab;
         let servers = [];
         before(async () => {
-            const mockPort = await findMockServerPort(MOCK_GITLAB_PORT_BASE);
+            const mockPort = await findMockServerPort();
             mockGitLab = new MockGitLabServer({ port: mockPort, validTokens: [] });
             await mockGitLab.start();
             const mockGitLabUrl = mockGitLab.getUrl();

package/build/test/test-permission-mode.js

@@ -0,0 +1,216 @@
+/**
+ * Permission Mode Test Suite
+ *
+ * Tests GITLAB_PERMISSION_MODE (readonly / modify / full), its interaction with
+ * the legacy GITLAB_READ_ONLY_MODE flag, and enforcement at list_tools,
+ * call_tool, and execute_graphql levels.
+ */
+import { describe, test, after, before } from "node:test";
+import assert from "node:assert";
+import { launchServer, findAvailablePort, cleanupServers, TransportMode, HOST, } from "./utils/server-launcher.js";
+import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
+import { CustomHeaderClient } from "./clients/custom-header-client.js";
+const MOCK_TOKEN = "glpat-permission-mode-test";
+const MOCK_PORT_BASE = 9700;
+const MCP_PORT_BASE = 3700;
+let mockGitLab;
+let mockGitLabUrl;
+let portCounter = 0;
+async function nextMcpPort() {
+    return findAvailablePort(MCP_PORT_BASE + portCounter++ * 10);
+}
+async function launchMcpServer(extraEnv = {}) {
+    const port = await nextMcpPort();
+    return launchServer({
+        mode: TransportMode.STREAMABLE_HTTP,
+        port,
+        timeout: 10000,
+        env: {
+            STREAMABLE_HTTP: "true",
+            REMOTE_AUTHORIZATION: "true",
+            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+            GITLAB_TOOLSETS: "all",
+            ...extraEnv,
+        },
+    });
+}
+function mcpUrl(server) {
+    return `http://${HOST}:${server.port}/mcp`;
+}
+async function connectClient(server) {
+    const client = new CustomHeaderClient({
+        authorization: `Bearer ${MOCK_TOKEN}`,
+    });
+    await client.connect(mcpUrl(server));
+    return client;
+}
+async function getToolNames(server) {
+    const client = await connectClient(server);
+    const result = await client.listTools();
+    await client.disconnect();
+    return result.tools.map((t) => t.name);
+}
+const DELETE_SAMPLE_TOOLS = [
+    "delete_issue",
+    "delete_branch",
+    "delete_label",
+    "delete_wiki_page",
+    "delete_milestone",
+    "delete_group_milestone",
+    "delete_project_variable",
+];
+const MODIFY_SAMPLE_TOOLS = [
+    "create_issue",
+    "update_issue",
+    "create_merge_request",
+    "create_branch",
+    "push_files",
+    "merge_merge_request",
+];
+const READ_SAMPLE_TOOLS = ["list_issues", "get_project", "list_merge_requests"];
+describe("Permission Mode", { concurrency: 1 }, () => {
+    before(async () => {
+        const mockPort = await findMockServerPort();
+        mockGitLab = new MockGitLabServer({
+            port: mockPort,
+            validTokens: [MOCK_TOKEN],
+        });
+        await mockGitLab.start();
+        mockGitLabUrl = mockGitLab.getUrl();
+    });
+    after(async () => {
+        if (mockGitLab)
+            await mockGitLab.stop();
+    });
+    describe("full mode (default)", () => {
+        let server;
+        const servers = [];
+        before(async () => {
+            server = await launchMcpServer();
+            servers.push(server);
+        });
+        after(() => cleanupServers(servers));
+        test("exposes read, modify, and delete tools", async () => {
+            const names = await getToolNames(server);
+            for (const name of [...READ_SAMPLE_TOOLS, ...MODIFY_SAMPLE_TOOLS, ...DELETE_SAMPLE_TOOLS]) {
+                assert.ok(names.includes(name), `full mode: expected "${name}" to be present`);
+            }
+        });
+    });
+    describe("modify mode", () => {
+        let server;
+        const servers = [];
+        before(async () => {
+            server = await launchMcpServer({ GITLAB_PERMISSION_MODE: "modify" });
+            servers.push(server);
+        });
+        after(() => cleanupServers(servers));
+        test("hides delete tools but keeps read and modify tools", async () => {
+            const names = await getToolNames(server);
+            for (const name of DELETE_SAMPLE_TOOLS) {
+                assert.ok(!names.includes(name), `modify mode: expected "${name}" to be absent`);
+            }
+            for (const name of [...READ_SAMPLE_TOOLS, ...MODIFY_SAMPLE_TOOLS]) {
+                assert.ok(names.includes(name), `modify mode: expected "${name}" to be present`);
+            }
+            assert.ok(!names.some(n => n.startsWith("delete_")), "no delete_* tool should be listed");
+        });
+        test("hides purge_dependency_proxy_cache", async () => {
+            const names = await getToolNames(server);
+            assert.ok(!names.includes("purge_dependency_proxy_cache"), "modify mode: purge_dependency_proxy_cache should be absent");
+        });
+        test("rejects direct delete tool calls", async () => {
+            const client = await connectClient(server);
+            try {
+                await assert.rejects(() => client.callTool("delete_issue", { project_id: "1", issue_iid: 1 }), (error) => error.message.includes("not allowed in modify mode"), "delete_issue should be rejected in modify mode");
+                await assert.rejects(() => client.callTool("purge_dependency_proxy_cache", { group_id: "my-group" }), (error) => error.message.includes("not allowed in modify mode"), "purge_dependency_proxy_cache should be rejected in modify mode");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("rejects delete mutations via execute_graphql", async () => {
+            const client = await connectClient(server);
+            try {
+                await assert.rejects(() => client.callTool("execute_graphql", {
+                    query: 'mutation { issueDelete(input: { projectPath: "g/p", iid: "1" }) { errors } }',
+                }), (error) => error.message.includes("delete mutations in modify mode"), "delete mutation should be rejected in modify mode");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("does not apply the modify-mode guard to non-delete mutations", async () => {
+            const client = await connectClient(server);
+            try {
+                // The mock GitLab server has no GraphQL endpoint, so the call may fail
+                // downstream — but it must not fail with the modify-mode guard error.
+                await client.callTool("execute_graphql", {
+                    query: "mutation { issueSetSeverity(input: { severity: HIGH }) { errors } }",
+                });
+            }
+            catch (error) {
+                assert.ok(error instanceof Error);
+                assert.ok(!error.message.includes("modify mode"), `non-delete mutation should pass the guard, got: ${error.message}`);
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+    });
+    describe("readonly mode via GITLAB_PERMISSION_MODE", () => {
+        let server;
+        const servers = [];
+        before(async () => {
+            server = await launchMcpServer({ GITLAB_PERMISSION_MODE: "readonly" });
+            servers.push(server);
+        });
+        after(() => cleanupServers(servers));
+        test("exposes only read-only tools", async () => {
+            const names = await getToolNames(server);
+            for (const name of READ_SAMPLE_TOOLS) {
+                assert.ok(names.includes(name), `readonly mode: expected "${name}" to be present`);
+            }
+            for (const name of [...MODIFY_SAMPLE_TOOLS, ...DELETE_SAMPLE_TOOLS]) {
+                assert.ok(!names.includes(name), `readonly mode: expected "${name}" to be absent`);
+            }
+        });
+        test("rejects write tool calls", async () => {
+            const client = await connectClient(server);
+            try {
+                await assert.rejects(() => client.callTool("create_issue", { project_id: "1", title: "t" }), (error) => error.message.includes("not allowed in read-only mode"), "create_issue should be rejected in readonly mode");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+    });
+    describe("legacy GITLAB_READ_ONLY_MODE interaction", () => {
+        const servers = [];
+        after(() => cleanupServers(servers));
+        test("GITLAB_READ_ONLY_MODE=true still behaves as readonly", async () => {
+            const server = await launchMcpServer({ GITLAB_READ_ONLY_MODE: "true" });
+            servers.push(server);
+            const names = await getToolNames(server);
+            assert.ok(names.includes("list_issues"), "read tool should be present");
+            assert.ok(!names.includes("create_issue"), "write tool should be absent");
+            assert.ok(!names.includes("delete_issue"), "delete tool should be absent");
+        });
+        test("GITLAB_READ_ONLY_MODE=true wins over GITLAB_PERMISSION_MODE=full", async () => {
+            const server = await launchMcpServer({
+                GITLAB_READ_ONLY_MODE: "true",
+                GITLAB_PERMISSION_MODE: "full",
+            });
+            servers.push(server);
+            const names = await getToolNames(server);
+            assert.ok(!names.includes("create_issue"), "legacy readonly should take precedence");
+            assert.ok(!names.includes("delete_issue"), "legacy readonly should take precedence");
+        });
+        test("rejects invalid GITLAB_PERMISSION_MODE even when GITLAB_READ_ONLY_MODE=true", async () => {
+            await assert.rejects(launchMcpServer({
+                GITLAB_READ_ONLY_MODE: "true",
+                GITLAB_PERMISSION_MODE: "write",
+            }), (error) => error.message.includes("Server process exited with code 1"), "invalid permission mode should fail startup before legacy override applies");
+        });
+    });
+});

package/build/test/test-protected-branches.js

@@ -10,10 +10,29 @@ function buildProtectedBranch(overrides = {}) {
         id: 1,
         name: TEST_BRANCH,
         push_access_levels: [
-            { access_level: 30, access_level_description: "Developers + Maintainers" },
+            {
+                access_level: 30,
+                access_level_description: "Developers + Maintainers",
+                user_id: null,
+                group_id: null,
+            },
+        ],
+        merge_access_levels: [
+            {
+                access_level: 40,
+                access_level_description: "Maintainers",
+                user_id: null,
+                group_id: null,
+            },
+        ],
+        unprotect_access_levels: [
+            {
+                access_level: 60,
+                access_level_description: "Administrators",
+                user_id: null,
+                group_id: null,
+            },
         ],
-        merge_access_levels: [{ access_level: 40, access_level_description: "Maintainers" }],
-        unprotect_access_levels: [{ access_level: 60, access_level_description: "Administrators" }],
         allow_force_push: false,
         code_owner_approval_required: false,
         ...overrides,
@@ -71,7 +90,7 @@ describe("protected branch tools", () => {
     let mockGitLab;
     let mockGitLabUrl;
     before(async () => {
-        const mockPort = await findMockServerPort(20500, 50);
+        const mockPort = await findMockServerPort();
         mockGitLab = new MockGitLabServer({
             port: mockPort,
             validTokens: [MOCK_TOKEN],