@zereight/mcp-gitlab 2.1.41 → 2.1.43

package/README.ko.md

@@ -80,7 +80,7 @@ npm install -g @zereight/mcp-gitlab
 
 예시는 기존 `mcp-gitlab`보다 충돌 가능성이 낮은 `zereight-mcp-gitlab` 별칭을 사용합니다. MCP 클라이언트가 찾지 못하면 `which zereight-mcp-gitlab`의 절대 경로를 사용하세요.
 
-전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.40`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
+전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.42`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
 
 #### CLI 인자 사용하기(환경 변수 문제가 있는 클라이언트용)
 
@@ -479,7 +479,7 @@ node build/index.js
 AI 에이전트가 skill/instruction 로딩을 지원하는 경우(Claude Code, GitHub Copilot, Cursor 등), [`skills/gitlab-mcp/`](./skills/gitlab-mcp/)에 미리 작성된 skill 파일을 사용할 수 있습니다.
 
 - **[SKILL.md](./skills/gitlab-mcp/SKILL.md)** — 도구셋 개요, 핵심 워크플로우, 파라미터 힌트를 담은 핵심 가이드
-- **[reference/](./skills/gitlab-mcp/reference/)** — 코드 리뷰, 머지 리퀘스트, 이슈, 파이프라인용 상세 워크플로우 문서
+- **[reference/](./skills/gitlab-mcp/reference/)** — 코드 리뷰, 머지 리퀘스트, 이슈, 파이프라인, 취약점 트리아지용 상세 워크플로우 문서
 
 `skills` CLI로 설치:
 
@@ -491,7 +491,7 @@ AI 클라이언트에 skill 디렉터리를 등록하면 전체 ListTools 응답
 
 ## 도구 🛠️
 
-전체 도구 목록은 영어 README의 [Tools 섹션](./README.md#tools-%EF%B8%8F)을 참고하세요. 현재 서버는 머지 리퀘스트, 이슈, 파이프라인, 배포, 환경, 아티팩트, 마일스톤, 위키, 저장소, 릴리스, 사용자, 이벤트, work item, 웹훅, 코드 검색, GraphQL 실행 도구를 제공합니다.
+전체 도구 목록은 영어 README의 [Tools 섹션](./README.md#tools-%EF%B8%8F)을 참고하세요. 현재 서버는 머지 리퀘스트, 이슈, 파이프라인, 배포, 환경, 아티팩트, 마일스톤, 위키, 저장소, 릴리스, 사용자, 이벤트, work item, 웹훅, 코드 검색, CI/CD 변수, dependency proxy, 취약점 트리아지, GraphQL 실행 도구를 제공합니다.
 
 ### Wiki 페이지 제목과 slug
 

package/README.md

@@ -1,5 +1,7 @@
 # GitLab MCP Server
 
+[![MCP Toplist](https://mcptoplist.com/badge/io.github.zereight%2Fgitlab-mcp.svg)](https://mcptoplist.com/server/io.github.zereight%2Fgitlab-mcp)
+
 [English](./README.md) | [한국어](./README.ko.md) | [简体中文](./README.zh-CN.md)
 
 📖 **[Documentation →](https://zereight.github.io/gitlab-mcp/)** Setup guides, environment variables, and the full tool reference live on the hosted docs site.
@@ -80,7 +82,7 @@ npm install -g @zereight/mcp-gitlab
 
 The examples use `zereight-mcp-gitlab`, a less collision-prone alias for the legacy `mcp-gitlab` binary. If your MCP client cannot find it, use the absolute path from `which zereight-mcp-gitlab`.
 
-No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.1.40`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
+No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.1.42`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
 
 #### Using CLI Arguments (for clients with env var issues)
 
@@ -523,7 +525,7 @@ No `headers` field is needed — Claude.ai obtains the token via OAuth automatic
 Pre-built skill files are available in [`skills/gitlab-mcp/`](./skills/gitlab-mcp/) for AI agents that support skill/instruction loading (Claude Code, GitHub Copilot, Cursor, etc.).
 
 - **[SKILL.md](./skills/gitlab-mcp/SKILL.md)** — Core guide (~800 tokens) with toolset overview, key workflows, and parameter hints
-- **[reference/](./skills/gitlab-mcp/reference/)** — Detailed workflow docs for code review, merge requests, issues, and pipelines
+- **[reference/](./skills/gitlab-mcp/reference/)** — Detailed workflow docs for code review, merge requests, issues, pipelines, and vulnerability triage
 
 Install with the `skills` CLI:
 
@@ -751,7 +753,11 @@ Register the skill directory in your AI client to get optimal tool usage guidanc
 209. `update_dependency_proxy_settings` - Update dependency proxy settings for a group (enable/disable, credentials for authenticated Docker Hub pulls)
 210. `list_dependency_proxy_blobs` - List cached dependency proxy blobs for a group with cursor-based pagination
 211. `purge_dependency_proxy_cache` - Schedule purge of all cached dependency proxy blobs for a group
-212. `discover_tools` - Discover and activate additional tool categories for this session. Available categories: merge_requests, issues, repositories, branches, projects, labels, ci, groups, pipelines, milestones, wiki, releases, tags, users, workitems, webhooks, search, variables, dependency_proxy. Already-active categories are listed in the response.
+212. `list_project_vulnerabilities` - List vulnerabilities for a project with optional state, severity, and report type filters (GraphQL-backed, cursor pagination)
+213. `get_vulnerability` - Get full details of a specific vulnerability
+214. `dismiss_vulnerability` - Dismiss a vulnerability with a reason (acceptable_risk, false_positive, used_in_tests, mitigating_control, not_applicable) and optional comment
+215. `confirm_vulnerability` - Confirm a vulnerability as a real finding requiring remediation
+216. `discover_tools` - Discover and activate additional tool categories for this session. Available categories: merge_requests, issues, repositories, branches, projects, labels, ci, groups, pipelines, milestones, wiki, releases, tags, users, workitems, webhooks, search, variables, dependency_proxy, vulnerabilities. Already-active categories are listed in the response.
 
 <!-- TOOLS-END -->
 

package/README.zh-CN.md

@@ -80,7 +80,7 @@ npm install -g @zereight/mcp-gitlab
 
 示例使用 `zereight-mcp-gitlab`，这是比旧的 `mcp-gitlab` 更不容易冲突的别名。如果 MCP 客户端找不到它，请使用 `which zereight-mcp-gitlab` 输出的绝对路径。
 
-如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.1.40`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
+如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.1.42`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
 
 #### 使用 CLI 参数（适用于环境变量有问题的客户端）
 
@@ -479,7 +479,7 @@ node build/index.js
 对于支持 skill/instruction 加载的 AI 代理（Claude Code、GitHub Copilot、Cursor 等），[`skills/gitlab-mcp/`](./skills/gitlab-mcp/) 中提供了预构建 skill 文件。
 
 - **[SKILL.md](./skills/gitlab-mcp/SKILL.md)** — 核心指南，包含工具集概览、关键工作流和参数提示
-- **[reference/](./skills/gitlab-mcp/reference/)** — 代码审查、合并请求、议题和流水线的详细工作流文档
+- **[reference/](./skills/gitlab-mcp/reference/)** — 代码审查、合并请求、议题、流水线和漏洞分类的详细工作流文档
 
 使用 `skills` CLI 安装：
 
@@ -491,7 +491,7 @@ npx skills add zereight/gitlab-mcp --skill gitlab-mcp-skill
 
 ## 工具 🛠️
 
-完整工具列表请参考英文 README 的 [Tools 部分](./README.md#tools-%EF%B8%8F)。当前服务器提供合并请求、议题、流水线、部署、环境、制品、里程碑、Wiki、仓库、发布、用户、事件、work item、webhook、代码搜索和 GraphQL 执行相关工具。
+完整工具列表请参考英文 README 的 [Tools 部分](./README.md#tools-%EF%B8%8F)。当前服务器提供合并请求、议题、流水线、部署、环境、制品、里程碑、Wiki、仓库、发布、用户、事件、work item、webhook、代码搜索、CI/CD 变量、dependency proxy、漏洞分类和 GraphQL 执行相关工具。
 
 ### Wiki 页面标题与 slug
 

package/build/downloads/proxy.js

@@ -100,8 +100,9 @@ export function registerDownloadProxy(app, deps) {
             try {
                 apiUrl = deps.resolveTrustedGitLabApiUrl(requestedApiUrl);
             }
-            catch {
-                res.status(400).json({ error: "Invalid X-GitLab-API-URL" });
+            catch (error) {
+                const message = error instanceof Error ? error.message : "Invalid X-GitLab-API-URL";
+                res.status(400).json({ error: message });
                 return;
             }
         }

package/build/index.js

@@ -90,6 +90,8 @@ import { graphqlQueryContainsWriteOperation, graphqlQueryContainsDeleteOperation
 import { resolveNestedWikiUpdateTitle } from "./utils/wiki-title.js";
 import { redactSensitiveGitLabFields } from "./utils/redact-sensitive.js";
 import { checkForNewVersion } from "./utils/version-check.js";
+import { assertGitLabVersionAtLeast } from "./utils/gitlab-version-gate.js";
+import { buildBulkPublishDraftNotesBody, needsGitLab19_2BulkPublish, } from "./utils/bulk-publish-options.js";
 import { cleanMutuallyExclusiveIdUsernameOptions, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS, sanitizeToolArguments, } from "./utils/tool-args.js";
 import { parseSearchReplaceBlocks, applySearchReplace, applyUnifiedDiff, } from "./utils/patch-helper.js";
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
@@ -101,47 +103,11 @@ CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMerg
 GitLabDiscussionNoteSchema, // Added
 GitLabDiscussionSchema, 
 // Draft Notes Schemas
-GitLabDraftNoteSchema, GitLabForkSchema, GitLabBranchSchema, GitLabProtectedBranchSchema, GitLabGroupSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestPipelineSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabGroupMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListBranchesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, GitLabCiVariableSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GitLabDependencyProxySchema, GitLabDependencyProxyBlobSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
+GitLabDraftNoteSchema, GitLabForkSchema, GitLabBranchSchema, GitLabProtectedBranchSchema, GitLabGroupSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestPipelineSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabGroupMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListBranchesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, GitLabCiVariableSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GitLabDependencyProxySchema, GitLabDependencyProxyBlobSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListProjectVulnerabilitiesSchema, GetVulnerabilitySchema, DismissVulnerabilitySchema, ConfirmVulnerabilitySchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
 GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListGroupMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, GitLabTagSchema, GitLabTagSignatureSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, ListWebhookEventsSchema, GetWebhookEventSchema, HealthCheckSchema, } from "./schemas.js";
 import { randomUUID, timingSafeEqual, } from "node:crypto";
-import { pino } from "pino";
-const logger = pino({
-    level: process.env.LOG_LEVEL || "info",
-    // Redact sensitive values that must never appear in logs. Covers both
-    // typical auth-context property names and common HTTP header-bag shapes
-    // that tool/fetch wrappers may include when logging errors.
-    redact: {
-        paths: [
-            "token",
-            "*.token",
-            "ctx.token",
-            "context.token",
-            "authData.token",
-            "auth.token",
-            "headers.authorization",
-            "headers.Authorization",
-            'headers["private-token"]',
-            'headers["Private-Token"]',
-            'headers["job-token"]',
-            'headers["JOB-TOKEN"]',
-            'headers["mcp-session-id"]',
-            'headers["Mcp-Session-Id"]',
-            "sessionId",
-            "*.sessionId",
-            "ctx.sessionId",
-            "context.sessionId",
-        ],
-        censor: "[REDACTED]",
-    },
-    transport: {
-        target: "pino-pretty",
-        options: {
-            colorize: true,
-            levelFirst: true,
-            destination: 2,
-        },
-    },
-});
+import { createLogger } from "./utils/logger.js";
+const logger = createLogger();
 /**
  * Read version from package.json
  */
@@ -1144,7 +1110,8 @@ function resolveTrustedGitLabApiUrl(value) {
     }
     const allowedApiUrl = GITLAB_ALLOWED_API_URLS_BY_HOST.get(parsed.host);
     if (!allowedApiUrl) {
-        throw new Error(`GitLab API URL host is not allowed: ${parsed.host}`);
+        throw new Error(`GitLab API URL host is not allowed: ${parsed.host}. ` +
+            "Add the host to GITLAB_ALLOWED_HOSTS or GITLAB_API_URL.");
     }
     return allowedApiUrl;
 }
@@ -4424,19 +4391,49 @@ async function publishDraftNote(projectId, mergeRequestIid, draftNoteId) {
         };
     }
 }
+async function fetchGitLabInstanceVersion() {
+    try {
+        const response = await fetch(`${getEffectiveApiUrl()}/version`, {
+            ...getFetchConfig(),
+        });
+        if (!response.ok)
+            return null;
+        const data = await response.json();
+        if (typeof data === "object" &&
+            data !== null &&
+            "version" in data &&
+            typeof data.version === "string") {
+            return data.version;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Publish all draft notes for a merge request
  * @param {string} projectId - The ID or URL-encoded path of the project
  * @param {number|string} mergeRequestIid - The internal ID of the merge request
+ * @param {BulkPublishDraftNotesBody} options - Optional GitLab 19.2+ bulk_publish body fields
  * @returns {Promise<GitLabDiscussionNote[]>} Array of published notes
  */
-async function bulkPublishDraftNotes(projectId, mergeRequestIid) {
+async function bulkPublishDraftNotes(projectId, mergeRequestIid, options = {}) {
     projectId = decodeURIComponent(projectId);
     const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/bulk_publish`);
+    const body = buildBulkPublishDraftNotesBody(options);
+    if (needsGitLab19_2BulkPublish(body)) {
+        await assertGitLabVersionAtLeast({
+            major: 19,
+            minor: 2,
+            feature: "reviewer_state, note, and internal on bulk_publish_draft_notes",
+            retryHint: "Omit reviewer_state, note, and internal, then retry.",
+        }, fetchGitLabInstanceVersion);
+    }
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST", // Changed from PUT to POST
-        body: JSON.stringify({}), // Send empty body for POST request
+        body: JSON.stringify(body),
     });
     if (!response.ok) {
         const errorText = await response.text();
@@ -6421,6 +6418,262 @@ async function purgeDependencyProxyCache(groupId) {
     const response = await fetch(url.toString(), { ...getFetchConfig(), method: "DELETE" });
     await handleGitLabError(response);
 }
+// --- Vulnerability functions (GraphQL) ---
+//
+// The REST Vulnerabilities API is deprecated and silently ignores filter
+// params on list and reason/comment on dismiss. GitLab recommends the
+// GraphQL API for vulnerability management, which supports all of these.
+/** Convert a numeric vulnerability ID (or an existing Vulnerability GID) to a GraphQL global ID. */
+function toVulnerabilityGid(vulnerabilityId) {
+    if (/^\d+$/.test(vulnerabilityId)) {
+        return `gid://gitlab/Vulnerability/${vulnerabilityId}`;
+    }
+    if (/^gid:\/\/gitlab\/Vulnerability\/\d+$/.test(vulnerabilityId)) {
+        return vulnerabilityId;
+    }
+    throw new Error(`Invalid vulnerability ID "${vulnerabilityId}": expected a numeric ID or a gid://gitlab/Vulnerability/<id> global ID`);
+}
+/**
+ * Resolve a project ID or path to the full namespace path required by
+ * GraphQL's `project(fullPath:)` query. Numeric IDs are resolved via a
+ * REST lookup; paths are returned as-is (decoded).
+ */
+async function resolveProjectFullPath(projectId) {
+    const decoded = decodeURIComponent(getEffectiveProjectId(decodeURIComponent(projectId)));
+    if (!/^\d+$/.test(decoded)) {
+        return decoded;
+    }
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(decoded)}`);
+    const response = await fetch(url.toString(), { ...getFetchConfig() });
+    await handleGitLabError(response);
+    const project = (await response.json());
+    if (!project.path_with_namespace) {
+        throw new Error(`Could not resolve full path for project ${decoded}`);
+    }
+    return project.path_with_namespace;
+}
+/**
+ * Enforce GITLAB_ALLOWED_PROJECT_IDS for vulnerability tools. Vulnerability
+ * GIDs are globally unique rather than project-scoped, so the boundary must
+ * be checked against the project the vulnerability actually belongs to —
+ * mirroring what getEffectiveProjectId does for project-scoped REST calls.
+ * Allowlist entries may be numeric IDs or full namespace paths.
+ */
+function assertVulnerabilityProjectAllowed(vulnerabilityId, project) {
+    if (GITLAB_ALLOWED_PROJECT_IDS.length === 0) {
+        return;
+    }
+    const fullPath = project?.fullPath ?? undefined;
+    const numericId = project?.id?.match(/^gid:\/\/gitlab\/Project\/(\d+)$/)?.[1];
+    const allowed = (fullPath !== undefined && GITLAB_ALLOWED_PROJECT_IDS.includes(fullPath)) ||
+        (numericId !== undefined && GITLAB_ALLOWED_PROJECT_IDS.includes(numericId));
+    if (!allowed) {
+        throw new Error(`Access denied: Vulnerability ${vulnerabilityId} belongs to project ${fullPath ?? numericId ?? "unknown"}, which is not in the allowed project list: ${GITLAB_ALLOWED_PROJECT_IDS.join(", ")}`);
+    }
+}
+/**
+ * Pre-flight allowlist check for vulnerability mutations: resolves the
+ * vulnerability's project and verifies it against GITLAB_ALLOWED_PROJECT_IDS
+ * before any write is issued. No-op (no extra request) when the allowlist
+ * is not configured.
+ */
+async function ensureVulnerabilityProjectAllowed(vulnerabilityId) {
+    if (GITLAB_ALLOWED_PROJECT_IDS.length === 0) {
+        return;
+    }
+    const data = await executeGraphQL(`query getVulnerabilityProject($id: VulnerabilityID!) {
+      vulnerability(id: $id) {
+        project {
+          id
+          fullPath
+        }
+      }
+    }`, { id: toVulnerabilityGid(vulnerabilityId) });
+    if (!data.vulnerability) {
+        throw new Error(`Vulnerability not found: ${vulnerabilityId}`);
+    }
+    assertVulnerabilityProjectAllowed(vulnerabilityId, data.vulnerability.project);
+}
+/** Shared GraphQL selection set for vulnerability objects. */
+const VULNERABILITY_FIELDS = `
+  id
+  title
+  description
+  state
+  severity
+  reportType
+  detectedAt
+  confirmedAt
+  resolvedAt
+  dismissedAt
+  dismissalReason
+  webUrl
+  scanner {
+    name
+    externalId
+    vendor
+  }
+  identifiers {
+    externalType
+    externalId
+    name
+    url
+  }
+  links {
+    name
+    url
+  }
+  location {
+    ... on VulnerabilityLocationSast {
+      file
+      startLine
+      endLine
+    }
+    ... on VulnerabilityLocationSecretDetection {
+      file
+      startLine
+      endLine
+    }
+    ... on VulnerabilityLocationDependencyScanning {
+      file
+      dependency {
+        package {
+          name
+        }
+        version
+      }
+    }
+    ... on VulnerabilityLocationContainerScanning {
+      image
+      operatingSystem
+      dependency {
+        package {
+          name
+        }
+        version
+      }
+    }
+    ... on VulnerabilityLocationDast {
+      path
+      hostname
+    }
+  }
+`;
+async function listProjectVulnerabilities(projectId, options = {}) {
+    const fullPath = await resolveProjectFullPath(projectId);
+    const variables = {
+        fullPath,
+        first: Math.min(options.first ?? 20, 100),
+    };
+    if (options.state)
+        variables.state = [options.state.toUpperCase()];
+    if (options.severity)
+        variables.severity = [options.severity.toUpperCase()];
+    if (options.report_type)
+        variables.reportType = [options.report_type.toUpperCase()];
+    if (options.after)
+        variables.after = options.after;
+    const data = await executeGraphQL(`query listProjectVulnerabilities(
+      $fullPath: ID!
+      $state: [VulnerabilityState!]
+      $severity: [VulnerabilitySeverity!]
+      $reportType: [VulnerabilityReportType!]
+      $first: Int
+      $after: String
+    ) {
+      project(fullPath: $fullPath) {
+        vulnerabilities(
+          state: $state
+          severity: $severity
+          reportType: $reportType
+          first: $first
+          after: $after
+        ) {
+          nodes {
+            ${VULNERABILITY_FIELDS}
+          }
+          pageInfo {
+            endCursor
+            hasNextPage
+          }
+        }
+      }
+    }`, variables);
+    if (!data.project) {
+        throw new Error(`Project not found or not accessible: ${fullPath}`);
+    }
+    return {
+        vulnerabilities: data.project.vulnerabilities.nodes,
+        pageInfo: data.project.vulnerabilities.pageInfo,
+    };
+}
+async function getVulnerability(vulnerabilityId) {
+    const data = await executeGraphQL(`query getVulnerability($id: VulnerabilityID!) {
+      vulnerability(id: $id) {
+        ${VULNERABILITY_FIELDS}
+        project {
+          id
+          name
+          fullPath
+        }
+      }
+    }`, { id: toVulnerabilityGid(vulnerabilityId) });
+    if (!data.vulnerability) {
+        throw new Error(`Vulnerability not found: ${vulnerabilityId}`);
+    }
+    assertVulnerabilityProjectAllowed(vulnerabilityId, data.vulnerability.project);
+    return data.vulnerability;
+}
+async function dismissVulnerability(vulnerabilityId, reason, comment) {
+    await ensureVulnerabilityProjectAllowed(vulnerabilityId);
+    const input = {
+        id: toVulnerabilityGid(vulnerabilityId),
+        dismissalReason: reason.toUpperCase(),
+    };
+    if (comment)
+        input.comment = comment;
+    const data = await executeGraphQL(`mutation dismissVulnerability($input: VulnerabilityDismissInput!) {
+      vulnerabilityDismiss(input: $input) {
+        vulnerability {
+          id
+          state
+          dismissedAt
+          dismissalReason
+        }
+        errors
+      }
+    }`, { input });
+    if (data.vulnerabilityDismiss.errors?.length) {
+        throw new Error(`Failed to dismiss vulnerability: ${data.vulnerabilityDismiss.errors.join(", ")}`);
+    }
+    if (!data.vulnerabilityDismiss.vulnerability) {
+        throw new Error(`Vulnerability not returned after dismissal (id: ${vulnerabilityId})`);
+    }
+    return data.vulnerabilityDismiss.vulnerability;
+}
+async function confirmVulnerability(vulnerabilityId, comment) {
+    await ensureVulnerabilityProjectAllowed(vulnerabilityId);
+    const input = { id: toVulnerabilityGid(vulnerabilityId) };
+    if (comment)
+        input.comment = comment;
+    const data = await executeGraphQL(`mutation confirmVulnerability($input: VulnerabilityConfirmInput!) {
+      vulnerabilityConfirm(input: $input) {
+        vulnerability {
+          id
+          state
+          confirmedAt
+        }
+        errors
+      }
+    }`, { input });
+    if (data.vulnerabilityConfirm.errors?.length) {
+        throw new Error(`Failed to confirm vulnerability: ${data.vulnerabilityConfirm.errors.join(", ")}`);
+    }
+    if (!data.vulnerabilityConfirm.vulnerability) {
+        throw new Error(`Vulnerability not returned after confirmation (id: ${vulnerabilityId})`);
+    }
+    return data.vulnerabilityConfirm.vulnerability;
+}
 /**
  * Upload a file to a GitLab project for use in markdown content.
  *
@@ -7612,8 +7865,8 @@ async function handleToolCall(params) {
             }
             case "bulk_publish_draft_notes": {
                 const args = BulkPublishDraftNotesSchema.parse(params.arguments);
-                const { project_id, merge_request_iid } = args;
-                const publishedNotes = await bulkPublishDraftNotes(project_id, merge_request_iid);
+                const { project_id, merge_request_iid, ...options } = args;
+                const publishedNotes = await bulkPublishDraftNotes(project_id, merge_request_iid, options);
                 return {
                     content: [{ type: "text", text: JSON.stringify(publishedNotes) }],
                 };
@@ -8837,6 +9090,28 @@ async function handleToolCall(params) {
                     ],
                 };
             }
+            // --- Vulnerability tools ---
+            case "list_project_vulnerabilities": {
+                const args = ListProjectVulnerabilitiesSchema.parse(params.arguments);
+                const { project_id, ...options } = args;
+                const result = await listProjectVulnerabilities(project_id, options);
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
+            }
+            case "get_vulnerability": {
+                const args = GetVulnerabilitySchema.parse(params.arguments);
+                const result = await getVulnerability(args.vulnerability_id);
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
+            }
+            case "dismiss_vulnerability": {
+                const args = DismissVulnerabilitySchema.parse(params.arguments);
+                const result = await dismissVulnerability(args.vulnerability_id, args.reason, args.comment);
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
+            }
+            case "confirm_vulnerability": {
+                const args = ConfirmVulnerabilitySchema.parse(params.arguments);
+                const result = await confirmVulnerability(args.vulnerability_id, args.comment);
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
+            }
             case "upload_markdown": {
                 if (IS_REMOTE) {
                     const args = MarkdownUploadRemoteSchema.parse(params.arguments);
@@ -9464,8 +9739,9 @@ async function startStreamableHTTPServer() {
             try {
                 apiUrl = resolveTrustedGitLabApiUrl(dynamicApiUrl);
             }
-            catch {
-                logger.warn(`Invalid X-GitLab-API-URL provided: ${dynamicApiUrl}. Auth will fail.`);
+            catch (error) {
+                const reason = error instanceof Error ? error.message : "Invalid X-GitLab-API-URL";
+                logger.warn(`Invalid X-GitLab-API-URL provided: ${dynamicApiUrl}. ${reason}`);
                 return null; // Reject if URL is malformed or not allowed
             }
         }

package/build/oauth-proxy.js

@@ -47,11 +47,11 @@
 import { InvalidTokenError, ServerError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
 import { OAuthTokensSchema } from "@modelcontextprotocol/sdk/shared/auth.js";
 import { randomUUID, randomBytes, createHash } from "node:crypto";
-import { pino } from "pino";
 import { looksLikeStatelessClientId, mintClientId, openClientId, } from "./stateless/client-id.js";
 import { looksLikeStatelessState, mintPendingAuthState, openPendingAuthState, } from "./stateless/pending-auth.js";
 import { looksLikeStatelessStoredTokensCode, mintStoredTokensCode, openStoredTokensCode, } from "./stateless/stored-tokens.js";
-const logger = pino({ name: "gitlab-mcp-oauth-proxy" });
+import { createLogger } from "./utils/logger.js";
+const logger = createLogger("gitlab-mcp-oauth-proxy");
 // ---------------------------------------------------------------------------
 // GitLab OAuth Server Provider
 // ---------------------------------------------------------------------------

package/build/oauth.js

@@ -9,11 +9,8 @@ import { execFile } from "child_process";
 import { promisify } from "util";
 import open from "open";
 import pkceChallenge from "pkce-challenge";
-import { pino } from "pino";
-const logger = pino({
-    name: "gitlab-mcp-oauth",
-    level: process.env.LOG_LEVEL || "info",
-}, pino.destination(2));
+import { createLogger } from "./utils/logger.js";
+const logger = createLogger("gitlab-mcp-oauth");
 const execFileAsync = promisify(execFile);
 function escapeHtml(str) {
     const map = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" };