@zereight/mcp-gitlab 2.1.30 → 2.1.38

package/build/index.js

@@ -96,13 +96,13 @@ import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middlew
 import { GitLabClientPool } from "./gitlab-client-pool.js";
 import { allTools, readOnlyTools, destructiveTools, deleteTools, parseEnabledToolsets, parseIndividualTools, buildFeatureFlagOverrides, isToolInEnabledToolset, TOOLSET_DEFINITIONS, ALL_TOOLSET_IDS, } from "./tools/registry.js";
 import { BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, // Added
-CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateMergeRequestNoteEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateRepositorySchema, CreateGroupSchema, CreateWikiPageSchema, CreateGroupWikiPageSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UnprotectBranchSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteProjectMilestoneSchema, DeleteWikiPageSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, EditProjectMilestoneSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetBranchSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GitLabBlameEntrySchema, GetDraftNoteSchema, GetFileContentsSchema, GetIssueLinkSchema, GetIssueSchema, GetLabelSchema, GetMergeRequestDiffsSchema, GetMergeRequestSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetDeploymentSchema, GetEnvironmentSchema, GetNamespaceSchema, GitLabCiLintResultSchema, GetPipelineJobOutputSchema, PipelineJobControlSchema, GetPipelineSchema, GetProjectMilestoneSchema, GetProjectSchema, GetRepositoryTreeSchema, GetUsersSchema, GetUserSchema, GitLabUserFullSchema, WhoAmISchema, GitLabCurrentUserSchema, GetWikiPageSchema, GitLabCommitSchema, GitLabCommitStatusSchema, GitLabCompareResultSchema, GitLabContentSchema, GitLabCreateUpdateFileResponseSchema, GitLabDiffSchema, 
+CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateMergeRequestNoteEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateGroupMilestoneSchema, CreateRepositorySchema, CreateGroupSchema, CreateWikiPageSchema, CreateGroupWikiPageSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UnprotectBranchSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupMilestoneSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteProjectMilestoneSchema, DeleteWikiPageSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, EditProjectMilestoneSchema, EditGroupMilestoneSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetBranchSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GitLabBlameEntrySchema, GetDraftNoteSchema, GetFileContentsSchema, GetIssueLinkSchema, GetIssueSchema, GetLabelSchema, GetMergeRequestDiffsSchema, GetMergeRequestSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetGroupMilestoneSchema, GetGroupMilestoneIssuesSchema, GetGroupMilestoneMergeRequestsSchema, GetGroupMilestoneBurndownEventsSchema, GetDeploymentSchema, GetEnvironmentSchema, GetNamespaceSchema, GitLabCiLintResultSchema, GetPipelineJobOutputSchema, PipelineJobControlSchema, GetPipelineSchema, GetProjectMilestoneSchema, GetProjectSchema, GetRepositoryTreeSchema, GetUsersSchema, GetUserSchema, GitLabUserFullSchema, WhoAmISchema, GitLabCurrentUserSchema, GetWikiPageSchema, GitLabCommitSchema, GitLabCommitStatusSchema, GitLabCompareResultSchema, GitLabContentSchema, GitLabCreateUpdateFileResponseSchema, GitLabDiffSchema, 
 // Discussion Schemas
 GitLabDiscussionNoteSchema, // Added
 GitLabDiscussionSchema, 
 // Draft Notes Schemas
-GitLabDraftNoteSchema, GitLabForkSchema, GitLabBranchSchema, GitLabProtectedBranchSchema, GitLabGroupSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestPipelineSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListBranchesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, GitLabCiVariableSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GitLabDependencyProxySchema, GitLabDependencyProxyBlobSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
-GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, GitLabTagSchema, GitLabTagSignatureSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, ListWebhookEventsSchema, GetWebhookEventSchema, HealthCheckSchema, } from "./schemas.js";
+GitLabDraftNoteSchema, GitLabForkSchema, GitLabBranchSchema, GitLabProtectedBranchSchema, GitLabGroupSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestPipelineSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabGroupMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListBranchesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, GitLabCiVariableSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GitLabDependencyProxySchema, GitLabDependencyProxyBlobSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
+GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListGroupMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, GitLabTagSchema, GitLabTagSignatureSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, ListWebhookEventsSchema, GetWebhookEventSchema, HealthCheckSchema, } from "./schemas.js";
 import { randomUUID, timingSafeEqual, } from "node:crypto";
 import { pino } from "pino";
 const logger = pino({
@@ -158,6 +158,7 @@ try {
 catch {
     // Intentionally ignored: version read failure is non-critical
 }
+const SERVER_NAME = process.env.MCP_SERVER_NAME?.trim() || "zereight-gitlab-mcp-server";
 /**
  * Create a new MCP Server instance with request handlers registered.
  * Each transport connection gets its own Server instance to prevent
@@ -203,7 +204,7 @@ function createServer() {
         filteredTools = filteredTools.filter(tool => !hiddenToolSet.has(tool.name));
     }
     const mcpServer = new McpServer({
-        name: "better-gitlab-mcp-server",
+        name: SERVER_NAME,
         version: SERVER_VERSION,
     }, {
         capabilities: {
@@ -1598,12 +1599,10 @@ async function executeGraphQL(query, variables = {}) {
     return json.data;
 }
 /**
- * Resolve a project path and issue IID to a work item GraphQL GID.
+ * Resolve a namespace path and issue IID to a work item GraphQL GID.
  */
 async function resolveWorkItemGID(projectId, issueIid) {
-    // resolveProjectPath handles both project and group paths (including the
-    // group fallback), so work item tools work for group-level namespaces too.
-    const projectPath = await resolveProjectPath(projectId);
+    const { path: projectPath, kind: namespaceKind } = await resolveProjectOrGroupPath(projectId);
     // Resolve work item GID via GraphQL
     const data = await executeGraphQL(`query($path: ID!, $iid: String!) {
       namespace(fullPath: $path) {
@@ -1613,14 +1612,14 @@ async function resolveWorkItemGID(projectId, issueIid) {
       }
     }`, { path: projectPath, iid: String(issueIid) });
     if (!data.namespace?.workItem?.id) {
-        throw new Error(`Work item #${issueIid} not found in project ${projectPath}`);
+        throw new Error(`Work item #${issueIid} not found in namespace ${projectPath}`);
     }
-    return { workItemGID: data.namespace.workItem.id, projectPath };
+    return { workItemGID: data.namespace.workItem.id, projectPath, namespaceKind };
 }
 /**
  * Resolve label names and usernames to GitLab GIDs in a single GraphQL call.
  */
-async function resolveNamesToIds(projectPath, labelNames, usernames) {
+async function resolveNamesToIds(projectPath, namespaceKind, labelNames, usernames) {
     if (!labelNames?.length && !usernames?.length) {
         return { labelIds: [], userIds: [] };
     }
@@ -1631,21 +1630,23 @@ async function resolveNamesToIds(projectPath, labelNames, usernames) {
     // group labels, single round trip with no pagination needed.
     const varDefs = labelNames.map((_, i) => `$l${i}: String!`).join(", ");
     const aliases = labelNames.map((_, i) => `l${i}: labels(title: $l${i}, includeAncestorGroups: true, first: 1) { nodes { id } }`).join(" ");
-    const { project, users } = await executeGraphQL(`query($path: ID!, $usernames: [String!]!${varDefs ? `, ${varDefs}` : ""}) {
-      project(fullPath: $path) { ${aliases || "__typename"} }
+    const rootField = namespaceKind === "group" ? "group" : "project";
+    const data = await executeGraphQL(`query($path: ID!, $usernames: [String!]!${varDefs ? `, ${varDefs}` : ""}) {
+      ${rootField}(fullPath: $path) { ${aliases || "__typename"} }
       users(usernames: $usernames) { nodes { id username } }
     }`, { path: projectPath, usernames, ...labelVars });
-    if (!project) {
-        throw new Error(`Project '${projectPath}' not found or inaccessible`);
+    const labelNamespace = namespaceKind === "group" ? data.group : data.project;
+    if (!labelNamespace) {
+        throw new Error(`Namespace '${projectPath}' not found or inaccessible`);
     }
     const labelIds = labelNames.map((name, i) => {
-        const nodes = project[`l${i}`]?.nodes;
+        const nodes = labelNamespace[`l${i}`]?.nodes;
         if (!nodes?.length)
-            throw new Error(`Label '${name}' not found in project`);
+            throw new Error(`Label '${name}' not found in namespace`);
         return nodes[0].id;
     });
     const userIds = usernames.map(name => {
-        const user = users.nodes.find(u => u.username === name);
+        const user = data.users.nodes.find(u => u.username === name);
         if (!user)
             throw new Error(`User '${name}' not found`);
         return user.id;
@@ -2151,11 +2152,36 @@ async function updateIncidentEscalationStatus(projectPath, incidentIid, status)
     return data.issueSetEscalationStatus.issue;
 }
 /**
- * Resolve a project ID (numeric or path) to its full path_with_namespace.
+ * Resolve a project ID/path or group ID/path to its full namespace path.
+ * Use group:<id-or-path> or project:<id-or-path> to disambiguate numeric IDs.
  */
 async function resolveProjectPath(projectId) {
-    projectId = decodeURIComponent(projectId);
-    const effectiveProjectId = getEffectiveProjectId(projectId);
+    const { path } = await resolveProjectOrGroupPath(projectId);
+    return path;
+}
+/**
+ * Resolve a project or group path and identify which GraphQL root field to use.
+ * Bare numeric IDs resolve as projects for backwards compatibility; use group:<id>
+ * when the numeric value is a GitLab group ID.
+ */
+async function resolveProjectOrGroupPath(projectId) {
+    const decodedProjectId = decodeURIComponent(projectId);
+    const namespaceMatch = decodedProjectId.match(/^(group|project):(.+)$/i);
+    const explicitKind = namespaceMatch?.[1]?.toLowerCase();
+    const requestedProjectId = namespaceMatch ? namespaceMatch[2] : decodedProjectId;
+    if (explicitKind === "group" && GITLAB_ALLOWED_PROJECT_IDS.length > 0) {
+        throw new Error("group:<id-or-path> cannot be used when GITLAB_ALLOWED_PROJECT_IDS is set, because the project allowlist does not cover groups");
+    }
+    const effectiveProjectId = getEffectiveProjectId(requestedProjectId);
+    if (explicitKind === "group") {
+        const groupUrl = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(effectiveProjectId)}`);
+        const groupResponse = await fetch(groupUrl.toString(), {
+            ...getFetchConfig(),
+        });
+        await handleGitLabError(groupResponse);
+        const group = await groupResponse.json();
+        return { path: group.full_path, kind: "group" };
+    }
     const projectUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`);
     const projectResponse = await fetch(projectUrl.toString(), {
         ...getFetchConfig(),
@@ -2164,21 +2190,24 @@ async function resolveProjectPath(projectId) {
     // Numeric IDs must not fall back: group and project IDs share no namespace,
     // so a numeric project 404 should fail immediately rather than silently
     // resolving to an unrelated group with the same integer ID.
-    if (projectResponse.status === 404 && !/^\d+$/.test(effectiveProjectId)) {
+    if (projectResponse.status === 404 &&
+        !explicitKind &&
+        GITLAB_ALLOWED_PROJECT_IDS.length === 0 &&
+        !/^\d+$/.test(effectiveProjectId)) {
         const groupUrl = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(effectiveProjectId)}`);
         const groupResponse = await fetch(groupUrl.toString(), {
             ...getFetchConfig(),
         });
         if (groupResponse.ok) {
             const group = await groupResponse.json();
-            return group.full_path;
+            return { path: group.full_path, kind: "group" };
         }
         // Surface the group error
         await handleGitLabError(groupResponse);
     }
     await handleGitLabError(projectResponse);
     const project = await projectResponse.json();
-    return project.path_with_namespace;
+    return { path: project.path_with_namespace, kind: "project" };
 }
 /**
  * Get a single work item with all widget data.
@@ -2400,10 +2429,11 @@ async function getWorkItem(projectId, iid) {
     return result;
 }
 /**
- * List work items in a project with filters.
+ * List work items in a project or group namespace with filters.
  */
 async function listWorkItems(projectId, options) {
-    const projectPath = await resolveProjectPath(projectId);
+    const namespace = await resolveProjectOrGroupPath(projectId);
+    const rootField = namespace.kind === "group" ? "group" : "project";
     // Map type names to GraphQL enum values
     const typeMap = {
         issue: "ISSUE",
@@ -2417,7 +2447,7 @@ async function listWorkItems(projectId, options) {
         ticket: "TICKET",
     };
     const variables = {
-        path: projectPath,
+        path: namespace.path,
         first: options.first || 20,
     };
     if (options.types && options.types.length > 0) {
@@ -2439,7 +2469,7 @@ async function listWorkItems(projectId, options) {
         variables.after = options.after;
     }
     const data = await executeGraphQL(`query($path: ID!, $types: [IssueType!], $state: IssuableState, $search: String, $assigneeUsernames: [String!], $labelName: [String!], $first: Int, $after: String) {
-      project(fullPath: $path) {
+      ${rootField}(fullPath: $path) {
         workItems(types: $types, state: $state, search: $search, assigneeUsernames: $assigneeUsernames, labelName: $labelName, first: $first, after: $after) {
           nodes {
             id iid title state webUrl workItemType { name }
@@ -2458,8 +2488,9 @@ async function listWorkItems(projectId, options) {
         }
       }
     }`, variables);
-    const workItems = data.project?.workItems?.nodes || [];
-    const pageInfo = data.project?.workItems?.pageInfo || {};
+    const workItemsRoot = namespace.kind === "group" ? data.group : data.project;
+    const workItems = workItemsRoot?.workItems?.nodes || [];
+    const pageInfo = workItemsRoot?.workItems?.pageInfo || {};
     // Flatten widget data for each item
     const items = workItems.map((wi) => {
         const widgets = wi.widgets || [];
@@ -2503,7 +2534,7 @@ async function listWorkItems(projectId, options) {
  * Create a new work item using GraphQL.
  */
 async function createWorkItem(projectId, options) {
-    const projectPath = await resolveProjectPath(projectId);
+    const { path: projectPath, kind: namespaceKind } = await resolveProjectOrGroupPath(projectId);
     const typeName = options.type || "issue";
     const typeGID = await resolveWorkItemTypeGID(projectPath, typeName);
     // Build the input dynamically - only include widgets that have values
@@ -2528,7 +2559,7 @@ async function createWorkItem(projectId, options) {
         variables.description = options.description;
     }
     // Resolve label names and usernames to GIDs in a single GraphQL call
-    const { labelIds, userIds } = await resolveNamesToIds(projectPath, options.labels, options.assignee_usernames);
+    const { labelIds, userIds } = await resolveNamesToIds(projectPath, namespaceKind, options.labels, options.assignee_usernames);
     if (labelIds.length > 0) {
         inputFields.push("$labelIds: [LabelID!]!");
         inputValues.push("labelsWidget: { labelIds: $labelIds }");
@@ -2624,7 +2655,7 @@ async function createWorkItem(projectId, options) {
  * weight, state, status, parent, and children operations.
  */
 async function updateWorkItem(projectId, iid, options) {
-    const { workItemGID, projectPath } = await resolveWorkItemGID(projectId, iid);
+    const { workItemGID, projectPath, namespaceKind } = await resolveWorkItemGID(projectId, iid);
     // Build the main workItemUpdate mutation dynamically
     const inputParts = ["id: $id"];
     const varDefs = ["$id: WorkItemID!"];
@@ -2643,7 +2674,7 @@ async function updateWorkItem(projectId, iid, options) {
     const allLabelNames = [...(options.add_labels || []), ...(options.remove_labels || [])];
     const needsResolve = allLabelNames.length > 0 || options.assignee_usernames?.length;
     const { labelIds: resolvedLabelIds, userIds } = needsResolve
-        ? await resolveNamesToIds(projectPath, allLabelNames.length > 0 ? allLabelNames : undefined, options.assignee_usernames)
+        ? await resolveNamesToIds(projectPath, namespaceKind, allLabelNames.length > 0 ? allLabelNames : undefined, options.assignee_usernames)
         : { labelIds: [], userIds: [] };
     if (options.add_labels || options.remove_labels) {
         const labelParts = [];
@@ -4993,7 +5024,7 @@ async function listPipelines(projectId, options = {}) {
  */
 async function getPipeline(projectId, pipelineId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${pipelineId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5098,7 +5129,7 @@ async function getEnvironment(projectId, environmentId) {
  */
 async function listPipelineJobs(projectId, pipelineId, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${pipelineId}/jobs`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/jobs`);
     // Add all query parameters
     Object.entries(options).forEach(([key, value]) => {
         if (value !== undefined) {
@@ -5130,7 +5161,7 @@ async function listPipelineJobs(projectId, pipelineId, options = {}) {
  */
 async function listPipelineTriggerJobs(projectId, pipelineId, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${pipelineId}/bridges`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/bridges`);
     // Add all query parameters
     Object.entries(options).forEach(([key, value]) => {
         if (value !== undefined) {
@@ -5154,7 +5185,7 @@ async function listPipelineTriggerJobs(projectId, pipelineId, options = {}) {
 }
 async function getPipelineJob(projectId, jobId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${jobId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5177,7 +5208,7 @@ async function getPipelineJob(projectId, jobId) {
 const MAX_JOB_TRACE_LINES = 1000;
 async function getPipelineJobOutput(projectId, jobId, limit, offset) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${jobId}/trace`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/trace`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         headers: {
@@ -5252,7 +5283,7 @@ async function validateProjectCiLint(projectId, options) {
  */
 async function listJobArtifacts(projectId, jobId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${jobId}/artifacts/tree`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts/tree`);
     Object.entries(options).forEach(([key, value]) => {
         if (value !== undefined) {
             if (typeof value === "boolean") {
@@ -5284,7 +5315,7 @@ async function listJobArtifacts(projectId, jobId, options = {}) {
 async function downloadJobArtifacts(projectId, jobId, localPath) {
     projectId = decodeURIComponent(projectId);
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/jobs/${jobId}/artifacts`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5316,7 +5347,7 @@ async function getJobArtifactFile(projectId, jobId, artifactPath) {
         .split("/")
         .map(segment => encodeURIComponent(segment))
         .join("/");
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/jobs/${jobId}/artifacts/${encodedArtifactPath}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts/${encodedArtifactPath}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5363,7 +5394,7 @@ async function createPipeline(projectId, ref, variables, inputs) {
  */
 async function retryPipeline(projectId, pipelineId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${pipelineId}/retry`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/retry`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5381,7 +5412,7 @@ async function retryPipeline(projectId, pipelineId) {
  */
 async function cancelPipeline(projectId, pipelineId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${pipelineId}/cancel`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/cancel`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5400,7 +5431,7 @@ async function cancelPipeline(projectId, pipelineId) {
  */
 async function playPipelineJob(projectId, jobId, variables) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${jobId}/play`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/play`);
     const body = {};
     if (variables && variables.length > 0) {
         body.job_variables_attributes = variables;
@@ -5423,7 +5454,7 @@ async function playPipelineJob(projectId, jobId, variables) {
  */
 async function retryPipelineJob(projectId, jobId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${jobId}/retry`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/retry`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5442,7 +5473,7 @@ async function retryPipelineJob(projectId, jobId) {
  */
 async function cancelPipelineJob(projectId, jobId, force) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${jobId}/cancel`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/cancel`);
     if (force !== undefined) {
         url.searchParams.append("force", force.toString());
     }
@@ -5524,7 +5555,7 @@ async function listProjectMilestones(projectId, options) {
  */
 async function getProjectMilestone(projectId, milestoneId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${milestoneId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5559,7 +5590,7 @@ async function createProjectMilestone(projectId, options) {
  */
 async function editProjectMilestone(projectId, milestoneId, options) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${milestoneId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -5577,7 +5608,7 @@ async function editProjectMilestone(projectId, milestoneId, options) {
  */
 async function deleteProjectMilestone(projectId, milestoneId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${milestoneId}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -5590,9 +5621,14 @@ async function deleteProjectMilestone(projectId, milestoneId) {
  * @param {number} milestoneId - The ID of the milestone
  * @returns {Promise<GitLabIssue[]>} List of issues
  */
-async function getMilestoneIssues(projectId, milestoneId) {
+async function getMilestoneIssues(projectId, milestoneId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${milestoneId}/issues`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/issues`);
+    Object.entries(options).forEach(([key, value]) => {
+        if (value !== undefined) {
+            url.searchParams.append(key, String(value));
+        }
+    });
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5606,9 +5642,14 @@ async function getMilestoneIssues(projectId, milestoneId) {
  * @param {number} milestoneId - The ID of the milestone
  * @returns {Promise<GitLabMergeRequest[]>} List of merge requests
  */
-async function getMilestoneMergeRequests(projectId, milestoneId) {
+async function getMilestoneMergeRequests(projectId, milestoneId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${milestoneId}/merge_requests`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/merge_requests`);
+    Object.entries(options).forEach(([key, value]) => {
+        if (value !== undefined) {
+            url.searchParams.append(key, String(value));
+        }
+    });
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5620,18 +5661,18 @@ async function getMilestoneMergeRequests(projectId, milestoneId) {
  * Promote a project milestone to a group milestone
  * @param {string} projectId - The ID or URL-encoded path of the project
  * @param {number} milestoneId - The ID of the milestone
- * @returns {Promise<GitLabMilestones>} Promoted milestone
+ * @returns {Promise<GitLabGroupMilestones>} Promoted milestone
  */
 async function promoteProjectMilestone(projectId, milestoneId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${milestoneId}/promote`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/promote`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
     });
     await handleGitLabError(response);
     const data = await response.json();
-    return GitLabMilestonesSchema.parse(data);
+    return GitLabGroupMilestonesSchema.parse(data);
 }
 /**
  * Get all burndown chart events for a single milestone
@@ -5639,9 +5680,148 @@ async function promoteProjectMilestone(projectId, milestoneId) {
  * @param {number} milestoneId - The ID of the milestone
  * @returns {Promise<any[]>} Burndown chart events
  */
-async function getMilestoneBurndownEvents(projectId, milestoneId) {
+async function getMilestoneBurndownEvents(projectId, milestoneId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${milestoneId}/burndown_events`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/burndown_events`);
+    Object.entries(options).forEach(([key, value]) => {
+        if (value !== undefined) {
+            url.searchParams.append(key, String(value));
+        }
+    });
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return data;
+}
+/**
+ * List milestones in a GitLab group
+ */
+async function listGroupMilestones(groupId, options) {
+    groupId = decodeURIComponent(groupId);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones`);
+    Object.entries(options).forEach(([key, value]) => {
+        if (value !== undefined) {
+            if (key === "iids" && Array.isArray(value) && value.length > 0) {
+                value.forEach(iid => {
+                    url.searchParams.append("iids[]", iid.toString());
+                });
+            }
+            else {
+                url.searchParams.append(key, value.toString());
+            }
+        }
+    });
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return z.array(GitLabGroupMilestonesSchema).parse(data);
+}
+/**
+ * Get a single milestone in a GitLab group
+ */
+async function getGroupMilestone(groupId, milestoneId) {
+    groupId = decodeURIComponent(groupId);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabGroupMilestonesSchema.parse(data);
+}
+/**
+ * Create a new milestone in a GitLab group
+ */
+async function createGroupMilestone(groupId, options) {
+    groupId = decodeURIComponent(groupId);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones`);
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+        method: "POST",
+        body: JSON.stringify(options),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabGroupMilestonesSchema.parse(data);
+}
+/**
+ * Edit an existing milestone in a GitLab group
+ */
+async function editGroupMilestone(groupId, milestoneId, options) {
+    groupId = decodeURIComponent(groupId);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+        method: "PUT",
+        body: JSON.stringify(options),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabGroupMilestonesSchema.parse(data);
+}
+/**
+ * Delete a milestone from a GitLab group
+ */
+async function deleteGroupMilestone(groupId, milestoneId) {
+    groupId = decodeURIComponent(groupId);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+        method: "DELETE",
+    });
+    await handleGitLabError(response);
+}
+/**
+ * Get all issues assigned to a single group milestone
+ */
+async function getGroupMilestoneIssues(groupId, milestoneId, options = {}) {
+    groupId = decodeURIComponent(groupId);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}/issues`);
+    Object.entries(options).forEach(([key, value]) => {
+        if (value !== undefined) {
+            url.searchParams.append(key, String(value));
+        }
+    });
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return z.array(GitLabIssueSchema).parse(data);
+}
+/**
+ * Get all merge requests assigned to a single group milestone
+ */
+async function getGroupMilestoneMergeRequests(groupId, milestoneId, options = {}) {
+    groupId = decodeURIComponent(groupId);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}/merge_requests`);
+    Object.entries(options).forEach(([key, value]) => {
+        if (value !== undefined) {
+            url.searchParams.append(key, String(value));
+        }
+    });
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return z.array(GitLabMergeRequestSchema).parse(data);
+}
+/**
+ * Get burndown chart events for a group milestone
+ */
+async function getGroupMilestoneBurndownEvents(groupId, milestoneId, options = {}) {
+    groupId = decodeURIComponent(groupId);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}/burndown_events`);
+    Object.entries(options).forEach(([key, value]) => {
+        if (value !== undefined) {
+            url.searchParams.append(key, String(value));
+        }
+    });
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -8327,8 +8507,8 @@ async function handleToolCall(params) {
                 };
             }
             case "get_milestone_issue": {
-                const { project_id, milestone_id } = GetMilestoneIssuesSchema.parse(params.arguments);
-                const issues = await getMilestoneIssues(project_id, milestone_id);
+                const { project_id, milestone_id, ...options } = GetMilestoneIssuesSchema.parse(params.arguments);
+                const issues = await getMilestoneIssues(project_id, milestone_id, options);
                 return {
                     content: [
                         {
@@ -8339,8 +8519,8 @@ async function handleToolCall(params) {
                 };
             }
             case "get_milestone_merge_requests": {
-                const { project_id, milestone_id } = GetMilestoneMergeRequestsSchema.parse(params.arguments);
-                const mergeRequests = await getMilestoneMergeRequests(project_id, milestone_id);
+                const { project_id, milestone_id, ...options } = GetMilestoneMergeRequestsSchema.parse(params.arguments);
+                const mergeRequests = await getMilestoneMergeRequests(project_id, milestone_id, options);
                 return {
                     content: [
                         {
@@ -8363,8 +8543,107 @@ async function handleToolCall(params) {
                 };
             }
             case "get_milestone_burndown_events": {
-                const { project_id, milestone_id } = GetMilestoneBurndownEventsSchema.parse(params.arguments);
-                const events = await getMilestoneBurndownEvents(project_id, milestone_id);
+                const { project_id, milestone_id, ...options } = GetMilestoneBurndownEventsSchema.parse(params.arguments);
+                const events = await getMilestoneBurndownEvents(project_id, milestone_id, options);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(events),
+                        },
+                    ],
+                };
+            }
+            case "list_group_milestones": {
+                const { group_id, ...options } = ListGroupMilestonesSchema.parse(params.arguments);
+                const milestones = await listGroupMilestones(group_id, options);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(milestones),
+                        },
+                    ],
+                };
+            }
+            case "get_group_milestone": {
+                const { group_id, milestone_id } = GetGroupMilestoneSchema.parse(params.arguments);
+                const milestone = await getGroupMilestone(group_id, milestone_id);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(milestone),
+                        },
+                    ],
+                };
+            }
+            case "create_group_milestone": {
+                const { group_id, ...options } = CreateGroupMilestoneSchema.parse(params.arguments);
+                const milestone = await createGroupMilestone(group_id, options);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(milestone),
+                        },
+                    ],
+                };
+            }
+            case "edit_group_milestone": {
+                const { group_id, milestone_id, ...options } = EditGroupMilestoneSchema.parse(params.arguments);
+                const milestone = await editGroupMilestone(group_id, milestone_id, options);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(milestone),
+                        },
+                    ],
+                };
+            }
+            case "delete_group_milestone": {
+                const { group_id, milestone_id } = DeleteGroupMilestoneSchema.parse(params.arguments);
+                await deleteGroupMilestone(group_id, milestone_id);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                status: "success",
+                                message: "Group milestone deleted successfully",
+                            }, null, 2),
+                        },
+                    ],
+                };
+            }
+            case "get_group_milestone_issue": {
+                const { group_id, milestone_id, ...options } = GetGroupMilestoneIssuesSchema.parse(params.arguments);
+                const issues = await getGroupMilestoneIssues(group_id, milestone_id, options);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(issues),
+                        },
+                    ],
+                };
+            }
+            case "get_group_milestone_merge_requests": {
+                const { group_id, milestone_id, ...options } = GetGroupMilestoneMergeRequestsSchema.parse(params.arguments);
+                const mergeRequests = await getGroupMilestoneMergeRequests(group_id, milestone_id, options);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(mergeRequests),
+                        },
+                    ],
+                };
+            }
+            case "get_group_milestone_burndown_events": {
+                const { group_id, milestone_id, ...options } = GetGroupMilestoneBurndownEventsSchema.parse(params.arguments);
+                const events = await getGroupMilestoneBurndownEvents(group_id, milestone_id, options);
                 return {
                     content: [
                         {
@@ -9565,6 +9844,22 @@ async function startStreamableHTTPServer() {
             });
             logger.info({ issuerPath }, "Serving path-aware OAuth metadata for reverse-proxy deployments");
         }
+        // RFC 9728 path-suffixed discovery: clients connecting to /mcp will
+        // request /.well-known/oauth-protected-resource/mcp to discover the
+        // resource identifier. Register this route so the resource field matches
+        // the actual transport URL the client connects to - regardless of
+        // whether the server is deployed behind a path-stripping reverse proxy.
+        if (!issuerPath) {
+            const mcpResourceUrl = `${issuerUrl.origin}/mcp`;
+            app.get("/.well-known/oauth-protected-resource/mcp", (_req, res) => {
+                res.json({
+                    resource: mcpResourceUrl,
+                    authorization_servers: [issuerUrl.href],
+                    scopes_supported: scopesSupported,
+                    resource_name: "GitLab MCP Server",
+                });
+            });
+        }
         // Mounts /.well-known/oauth-authorization-server (shadowed above when basePath set),
         //        /.well-known/oauth-protected-resource, /authorize, /token, /register, /revoke
         // Some proxies include the port in X-Forwarded-For (e.g. "1.2.3.4:5678" or
@@ -9964,10 +10259,14 @@ async function startStreamableHTTPServer() {
     });
     // Health check endpoint
     app.get("/health", (_req, res) => {
-        const isHealthy = Object.keys(streamableTransports).length < MAX_SESSIONS;
+        const activeSessions = Object.keys(streamableTransports).length;
+        const isHealthy = activeSessions < MAX_SESSIONS;
+        if (!isHealthy) {
+            logger.warn({ activeSessions, maxSessions: MAX_SESSIONS }, "Health check degraded: active session capacity reached");
+        }
         res.status(isHealthy ? 200 : 503).json({
             status: isHealthy ? "healthy" : "degraded",
-            activeSessions: Object.keys(streamableTransports).length,
+            activeSessions,
             maxSessions: MAX_SESSIONS,
             uptime: process.uptime(),
         });