@zereight/mcp-gitlab 2.1.41 → 2.1.43

package/build/test/utils/bulk-publish-options.test.js

@@ -0,0 +1,32 @@
+import assert from "node:assert/strict";
+import { describe, test } from "node:test";
+import { buildBulkPublishDraftNotesBody, needsGitLab19_2BulkPublish, } from "../../utils/bulk-publish-options.js";
+describe("When buildBulkPublishDraftNotesBody runs", () => {
+    describe("with no-op defaults", () => {
+        test("should omit internal false and empty note", () => {
+            assert.deepEqual(buildBulkPublishDraftNotesBody({ internal: false, note: "" }), {});
+        });
+    });
+    describe("with meaningful 19.2 fields", () => {
+        test("should keep reviewer_state, note, and internal true", () => {
+            assert.deepEqual(buildBulkPublishDraftNotesBody({
+                reviewer_state: "reviewed",
+                note: "LGTM",
+                internal: true,
+            }), { reviewer_state: "reviewed", note: "LGTM", internal: true });
+        });
+    });
+});
+describe("When needsGitLab19_2BulkPublish runs", () => {
+    describe("with an empty body", () => {
+        test("should return false", () => {
+            assert.equal(needsGitLab19_2BulkPublish({}), false);
+            assert.equal(needsGitLab19_2BulkPublish(buildBulkPublishDraftNotesBody({ internal: false })), false);
+        });
+    });
+    describe("with a non-empty body", () => {
+        test("should return true", () => {
+            assert.equal(needsGitLab19_2BulkPublish({ reviewer_state: "reviewed" }), true);
+        });
+    });
+});

package/build/test/utils/gitlab-version-gate.test.js

@@ -0,0 +1,74 @@
+import assert from "node:assert/strict";
+import { describe, test } from "node:test";
+import { assertGitLabVersionAtLeast, isGitLabVersionAtLeast, parseGitLabVersion, } from "../../utils/gitlab-version-gate.js";
+function versionFetcher(version) {
+    return async () => version;
+}
+function bulkPublishRequirement() {
+    return {
+        major: 19,
+        minor: 2,
+        feature: "reviewer_state, note, and internal on bulk_publish_draft_notes",
+        retryHint: "Omit reviewer_state, note, and internal, then retry.",
+    };
+}
+describe("When parseGitLabVersion runs", () => {
+    describe("with a release suffix", () => {
+        test("should parse major.minor.patch from ee builds", () => {
+            assert.deepEqual(parseGitLabVersion("19.2.0-ee"), {
+                major: 19,
+                minor: 2,
+                patch: 0,
+            });
+        });
+    });
+    describe("with a malformed string", () => {
+        test("should return null", () => {
+            assert.equal(parseGitLabVersion("unknown"), null);
+            assert.equal(parseGitLabVersion(""), null);
+        });
+    });
+});
+describe("When isGitLabVersionAtLeast compares versions", () => {
+    describe("with a version at or above the floor", () => {
+        test("should return true", () => {
+            assert.equal(isGitLabVersionAtLeast("19.2.0-ee", 19, 2), true);
+            assert.equal(isGitLabVersionAtLeast("19.3.1", 19, 2), true);
+            assert.equal(isGitLabVersionAtLeast("20.0.0", 19, 2), true);
+        });
+    });
+    describe("with a version below the floor", () => {
+        test("should return false", () => {
+            assert.equal(isGitLabVersionAtLeast("19.1.9-ee", 19, 2), false);
+            assert.equal(isGitLabVersionAtLeast("17.5.0", 19, 2), false);
+        });
+    });
+    describe("with an unparseable version", () => {
+        test("should return null", () => {
+            assert.equal(isGitLabVersionAtLeast("not-a-version", 19, 2), null);
+        });
+    });
+});
+describe("When assertGitLabVersionAtLeast runs", () => {
+    describe("with an older instance version", () => {
+        test("should throw a retryable error", async () => {
+            await assert.rejects(() => assertGitLabVersionAtLeast(bulkPublishRequirement(), versionFetcher("17.5.0-ee")), (error) => {
+                assert.ok(error instanceof Error);
+                assert.match(error.message, /GitLab 19\.2\+/);
+                assert.match(error.message, /17\.5\.0-ee/);
+                assert.match(error.message, /Omit reviewer_state/);
+                return true;
+            });
+        });
+    });
+    describe("with a new enough instance version", () => {
+        test("should resolve without throwing", async () => {
+            await assertGitLabVersionAtLeast(bulkPublishRequirement(), versionFetcher("19.2.0-ee"));
+        });
+    });
+    describe("with an unknown instance version", () => {
+        test("should fail open and resolve", async () => {
+            await assertGitLabVersionAtLeast(bulkPublishRequirement(), versionFetcher(null));
+        });
+    });
+});

package/build/tools/registry.js

@@ -1,7 +1,7 @@
 import { zodToJsonSchema } from "zod-to-json-schema";
 import { toJSONSchema } from "../utils/schema.js";
 import { USE_GITLAB_WIKI, USE_MILESTONE, USE_PIPELINE, SSE, STREAMABLE_HTTP, } from "../config.js";
-import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateGroupMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UnprotectBranchSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupMilestoneSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadAttachmentRemoteSchema, DownloadJobArtifactsSchema, DownloadJobArtifactsRemoteSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, EditGroupMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, HealthCheckSchema, GetBranchSchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GetDeploymentSchema, GetDraftNoteSchema, GetEnvironmentSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetGroupMilestoneSchema, GetGroupMilestoneIssuesSchema, GetGroupMilestoneMergeRequestsSchema, GetGroupMilestoneBurndownEventsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, PipelineJobControlSchema, GetPipelineSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetTimelineEventsSchema, GetUsersSchema, GetUserSchema, WhoAmISchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListBranchesSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupMilestonesSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListPipelinesSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, } from "../schemas.js";
+import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateGroupMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UnprotectBranchSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupMilestoneSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadAttachmentRemoteSchema, DownloadJobArtifactsSchema, DownloadJobArtifactsRemoteSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, EditGroupMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, HealthCheckSchema, GetBranchSchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GetDeploymentSchema, GetDraftNoteSchema, GetEnvironmentSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetGroupMilestoneSchema, GetGroupMilestoneIssuesSchema, GetGroupMilestoneMergeRequestsSchema, GetGroupMilestoneBurndownEventsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, PipelineJobControlSchema, GetPipelineSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetTimelineEventsSchema, GetUsersSchema, GetUserSchema, WhoAmISchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListBranchesSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupMilestonesSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListPipelinesSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListProjectVulnerabilitiesSchema, GetVulnerabilitySchema, DismissVulnerabilitySchema, ConfirmVulnerabilitySchema, } from "../schemas.js";
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
 // Define all available tools
 export const allTools = [
@@ -267,7 +267,7 @@ export const allTools = [
     },
     {
         name: "bulk_publish_draft_notes",
-        description: "Publish all draft notes for a merge request",
+        description: "Publish all draft notes for a merge request. Optionally sets reviewer_state and posts a summary note (GitLab 19.2+). Can set reviewer_state even with no drafts.",
         inputSchema: toJSONSchema(BulkPublishDraftNotesSchema),
     },
     // --- Merge request emoji reaction tools ---
@@ -1083,6 +1083,27 @@ export const allTools = [
         description: "Schedule purge of all cached dependency proxy blobs for a group",
         inputSchema: toJSONSchema(PurgeDependencyProxyCacheSchema),
     },
+    // --- Vulnerability tools ---
+    {
+        name: "list_project_vulnerabilities",
+        description: "List vulnerabilities for a project with optional state, severity, and report type filters (GraphQL-backed, cursor pagination)",
+        inputSchema: toJSONSchema(ListProjectVulnerabilitiesSchema),
+    },
+    {
+        name: "get_vulnerability",
+        description: "Get full details of a specific vulnerability",
+        inputSchema: toJSONSchema(GetVulnerabilitySchema),
+    },
+    {
+        name: "dismiss_vulnerability",
+        description: "Dismiss a vulnerability with a reason (acceptable_risk, false_positive, used_in_tests, mitigating_control, not_applicable) and optional comment",
+        inputSchema: toJSONSchema(DismissVulnerabilitySchema),
+    },
+    {
+        name: "confirm_vulnerability",
+        description: "Confirm a vulnerability as a real finding requiring remediation",
+        inputSchema: toJSONSchema(ConfirmVulnerabilitySchema),
+    },
     // --- Meta tool: Dynamic tool discovery ---
     {
         name: "discover_tools",
@@ -1217,6 +1238,8 @@ export const readOnlyTools = new Set([
     "get_group_variable",
     "get_dependency_proxy_settings",
     "list_dependency_proxy_blobs",
+    "list_project_vulnerabilities",
+    "get_vulnerability",
 ]);
 // Define which tools are destructive (data loss potential)
 export const destructiveTools = new Set([
@@ -1653,6 +1676,16 @@ export const TOOLSET_DEFINITIONS = [
             "purge_dependency_proxy_cache",
         ]),
     },
+    {
+        id: "vulnerabilities",
+        isDefault: false,
+        tools: new Set([
+            "list_project_vulnerabilities",
+            "get_vulnerability",
+            "dismiss_vulnerability",
+            "confirm_vulnerability",
+        ]),
+    },
 ];
 // Derived lookup: tool name → toolset ID
 export const TOOLSET_BY_TOOL_NAME = new Map();

package/build/utils/bulk-publish-options.js

@@ -0,0 +1,21 @@
+/**
+ * Build the POST body. Omit no-op defaults (`internal: false`, empty `note`)
+ * so older GitLab instances are not sent unknown fields.
+ */
+export function buildBulkPublishDraftNotesBody(options) {
+    const body = {};
+    if (options.reviewer_state !== undefined) {
+        body.reviewer_state = options.reviewer_state;
+    }
+    if (options.note) {
+        body.note = options.note;
+    }
+    if (options.internal === true) {
+        body.internal = true;
+    }
+    return body;
+}
+/** True when the body needs GitLab 19.2+ bulk_publish fields. */
+export function needsGitLab19_2BulkPublish(body) {
+    return Object.keys(body).length > 0;
+}

package/build/utils/gitlab-version-gate.js

@@ -0,0 +1,47 @@
+/**
+ * Call-time GitLab instance version gate.
+ *
+ * Use when a tool exposes optional params that only exist on newer GitLab.
+ * Schemas stay static; check before the API call and throw a retryable error.
+ * Fail-open when the instance version cannot be fetched or parsed.
+ */
+const VERSION_CORE = /^(\d+)\.(\d+)(?:\.(\d+))?/;
+/** Parse strings like "19.2.0-ee" / "17.5.3". Returns null if unparseable. */
+export function parseGitLabVersion(version) {
+    const match = VERSION_CORE.exec(version.trim());
+    if (!match)
+        return null;
+    const major = Number.parseInt(match[1], 10);
+    const minor = Number.parseInt(match[2], 10);
+    const patch = match[3] ? Number.parseInt(match[3], 10) : 0;
+    if (!Number.isFinite(major) || !Number.isFinite(minor) || !Number.isFinite(patch)) {
+        return null;
+    }
+    return { major, minor, patch };
+}
+/**
+ * Compare a GitLab version string against a major.minor floor.
+ * Returns null when the version string cannot be parsed.
+ */
+export function isGitLabVersionAtLeast(version, major, minor) {
+    const parsed = parseGitLabVersion(version);
+    if (!parsed)
+        return null;
+    if (parsed.major !== major)
+        return parsed.major > major;
+    return parsed.minor >= minor;
+}
+/**
+ * Throws when the instance is known to be older than `requirement`.
+ * Does nothing when the version is unknown (fail-open).
+ */
+export async function assertGitLabVersionAtLeast(requirement, fetchVersion) {
+    const current = await fetchVersion();
+    if (current === null)
+        return;
+    const ok = isGitLabVersionAtLeast(current, requirement.major, requirement.minor);
+    if (ok === null || ok)
+        return;
+    throw new Error(`GitLab ${requirement.major}.${requirement.minor}+ required for ${requirement.feature} ` +
+        `(instance reports ${current}). ${requirement.retryHint}`);
+}

package/build/utils/logger.js

@@ -0,0 +1,51 @@
+import { pino } from "pino";
+const REDACT_PATHS = [
+    "token",
+    "*.token",
+    "ctx.token",
+    "context.token",
+    "authData.token",
+    "auth.token",
+    "headers.authorization",
+    "headers.Authorization",
+    'headers["private-token"]',
+    'headers["Private-Token"]',
+    'headers["job-token"]',
+    'headers["JOB-TOKEN"]',
+    'headers["mcp-session-id"]',
+    'headers["Mcp-Session-Id"]',
+    "sessionId",
+    "*.sessionId",
+    "ctx.sessionId",
+    "context.sessionId",
+];
+/**
+ * Create a pino logger with consistent redaction, level, format, and
+ * destination across the entire codebase.
+ *
+ * - LOG_LEVEL (default "info") controls the minimum severity.
+ * - LOG_FORMAT=json disables pino-pretty and outputs newline-delimited JSON
+ *   to stderr.
+ * - All loggers redact the same set of sensitive fields.
+ */
+export function createLogger(name) {
+    const isJson = process.env.LOG_FORMAT === "json";
+    return pino({
+        ...(name && { name }),
+        level: process.env.LOG_LEVEL || "info",
+        redact: {
+            paths: REDACT_PATHS,
+            censor: "[REDACTED]",
+        },
+        ...(!isJson && {
+            transport: {
+                target: "pino-pretty",
+                options: {
+                    colorize: true,
+                    levelFirst: true,
+                    destination: 2,
+                },
+            },
+        }),
+    }, ...(isJson ? [pino.destination(2)] : []));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.41",
+  "version": "2.1.43",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [