@zereight/mcp-gitlab 2.1.47 → 2.1.48

package/README.ko.md

@@ -80,7 +80,7 @@ npm install -g @zereight/mcp-gitlab
 
 예시는 기존 `mcp-gitlab`보다 충돌 가능성이 낮은 `zereight-mcp-gitlab` 별칭을 사용합니다. MCP 클라이언트가 찾지 못하면 `which zereight-mcp-gitlab`의 절대 경로를 사용하세요.
 
-전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.46`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
+전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.47`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
 
 #### CLI 인자 사용하기(환경 변수 문제가 있는 클라이언트용)
 

package/README.md

@@ -82,7 +82,7 @@ npm install -g @zereight/mcp-gitlab
 
 The examples use `zereight-mcp-gitlab`, a less collision-prone alias for the legacy `mcp-gitlab` binary. If your MCP client cannot find it, use the absolute path from `which zereight-mcp-gitlab`.
 
-No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.1.46`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
+No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.1.47`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
 
 #### Using CLI Arguments (for clients with env var issues)
 

package/README.zh-CN.md

@@ -80,7 +80,7 @@ npm install -g @zereight/mcp-gitlab
 
 示例使用 `zereight-mcp-gitlab`，这是比旧的 `mcp-gitlab` 更不容易冲突的别名。如果 MCP 客户端找不到它，请使用 `which zereight-mcp-gitlab` 输出的绝对路径。
 
-如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.1.46`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
+如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.1.47`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
 
 #### 使用 CLI 参数（适用于环境变量有问题的客户端）
 

package/build/index.js

@@ -85,7 +85,7 @@ import { createDownloadToken } from "./utils/download-token.js";
 import { determineTransportMode, TransportMode } from "./server/transport-mode.js";
 import { formatPrometheusMetrics } from "./server/metrics.js";
 import { SERVER_VERSION } from "./server/version.js";
-import { isInitializationRequestBody, isUnauthenticatedDiscoveryRequestBody, readMcpSessionIdHeader, redactSessionIdForLog, } from "./server/request-helpers.js";
+import { isInitializationRequestBody, isUnauthenticatedDiscoveryRequestBody, readAcceptHeader, readMcpSessionIdHeader, redactSessionIdForLog, } from "./server/request-helpers.js";
 export { readMcpSessionIdHeader } from "./server/request-helpers.js";
 import { normalizeGitLabApiUrl } from "./utils/url.js";
 import { estimateMergeCommitCount, filterDiffsByPatterns, openSafeOutputWriteStream, readSafeExistingFile, summarizeWebhookEvents, } from "./utils/helpers.js";
@@ -162,7 +162,9 @@ function createServer() {
         version: SERVER_VERSION,
     }, {
         capabilities: {
-            tools: {},
+            tools: {
+                listChanged: true,
+            },
         },
     });
     mcpServer.server.setRequestHandler(ListToolsRequestSchema, async () => {
@@ -10511,13 +10513,87 @@ async function startStreamableHTTPServer() {
             await handleRequest();
         }
     });
-    // Reject unsupported methods on /mcp
-    app.get("/mcp", (_req, res) => {
-        res.setHeader("Allow", "POST, DELETE");
-        res.status(405).json({
-            error: "Method Not Allowed",
-            message: "GET /mcp is not supported when STREAMABLE_HTTP is enabled. Use POST to communicate with the MCP server.",
-        });
+    // Streamable HTTP GET endpoint for listening to server-sent events (SSE)
+    app.get("/mcp", mcpRequestRateLimit, mcpBearerAuth, async (req, res) => {
+        const sessionId = readMcpSessionIdHeader(req);
+        const acceptHeader = readAcceptHeader(req);
+        if (!acceptHeader.includes("text/event-stream")) {
+            res.setHeader("Allow", "GET, POST, DELETE");
+            res.status(406).json({
+                error: "Not Acceptable",
+                message: "Client must accept text/event-stream for GET /mcp",
+            });
+            return;
+        }
+        if (!sessionId) {
+            res.setHeader("Allow", "GET, POST, DELETE");
+            res.status(400).json({
+                error: "Bad Request",
+                message: "Mcp-Session-Id header is required for GET /mcp",
+            });
+            return;
+        }
+        if (OAUTH_STATELESS_MODE && STATELESS_MATERIAL && (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH)) {
+            res.setHeader("Allow", "POST");
+            res.status(405).json({
+                error: "Method Not Allowed",
+                message: "GET /mcp SSE stream is not supported in stateless mode. Use POST to communicate with the MCP server.",
+            });
+            return;
+        }
+        const transport = streamableTransports[sessionId];
+        if (!transport) {
+            res.status(404).json({
+                error: "Session not found",
+            });
+            return;
+        }
+        metrics.requestsProcessed++;
+        const usesSessionTimeouts = REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH;
+        if (usesSessionTimeouts) {
+            if (authBySession[sessionId]) {
+                authBySession[sessionId].lastUsed = Date.now();
+            }
+            // Listening on GET /mcp is session activity. Pause inactivity expiry for
+            // the life of the SSE stream so list_changed can still be pushed.
+            clearAuthTimeout(sessionId);
+        }
+        const handleGetRequest = async () => {
+            try {
+                await transport.handleRequest(req, res);
+            }
+            catch (error) {
+                logger.error({ err: error }, "Streamable HTTP GET error");
+                if (!res.headersSent) {
+                    res.status(500).json({
+                        error: "Internal server error",
+                        message: error instanceof Error ? error.message : "Unknown error",
+                    });
+                }
+            }
+        };
+        try {
+            if (usesSessionTimeouts && authBySession[sessionId]) {
+                const authData = authBySession[sessionId];
+                const ctx = {
+                    sessionId,
+                    header: authData.header,
+                    token: authData.token,
+                    lastUsed: authData.lastUsed,
+                    apiUrl: authData.apiUrl,
+                    publicBaseUrl: authData.publicBaseUrl,
+                };
+                await sessionAuthStore.run(ctx, handleGetRequest);
+            }
+            else {
+                await handleGetRequest();
+            }
+        }
+        finally {
+            if (usesSessionTimeouts && streamableTransports[sessionId]) {
+                setAuthTimeout(sessionId);
+            }
+        }
     });
     const getMetricsSnapshot = () => ({
         ...metrics,
@@ -10585,6 +10661,14 @@ async function startStreamableHTTPServer() {
             res.status(404).json({ error: "Session not found" });
         }
     });
+    // Reject unsupported methods on /mcp
+    app.all("/mcp", (_req, res) => {
+        res.setHeader("Allow", "GET, POST, DELETE");
+        res.status(405).json({
+            error: "Method Not Allowed",
+            message: "Method Not Allowed. Use GET, POST, or DELETE to communicate with the MCP server.",
+        });
+    });
     // Start server
     const httpServer = app.listen(Number(PORT), HOST, () => {
         logger.info(`GitLab MCP Server running with Streamable HTTP transport`);

package/build/scripts/generate-server-card.js

@@ -0,0 +1,39 @@
+import fs from "node:fs";
+import path from "node:path";
+import { allTools } from "../tools/registry.js";
+async function main() {
+    const pkgPath = path.resolve(process.cwd(), "package.json");
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+    const serverCard = {
+        serverInfo: {
+            name: pkg.mcpName || pkg.name,
+            version: pkg.version,
+        },
+        authentication: {
+            required: true,
+            schemes: ["bearer", "oauth2"],
+        },
+        tools: allTools.map(t => {
+            const tool = { ...t };
+            if (tool.inputSchema &&
+                typeof tool.inputSchema === "object" &&
+                "$schema" in tool.inputSchema) {
+                const schema = { ...tool.inputSchema };
+                delete schema["$schema"];
+                tool.inputSchema = schema;
+            }
+            return tool;
+        }),
+        resources: [],
+        prompts: [],
+    };
+    const outDir = path.resolve(process.cwd(), ".well-known", "mcp");
+    fs.mkdirSync(outDir, { recursive: true });
+    const outFile = path.join(outDir, "server-card.json");
+    fs.writeFileSync(outFile, JSON.stringify(serverCard, null, 2), "utf8");
+    console.log(`Successfully generated ${outFile} (${allTools.length} tools)`);
+}
+main().catch(err => {
+    console.error("Failed to generate server card:", err);
+    process.exit(1);
+});

package/build/server/request-helpers.js

@@ -61,3 +61,15 @@ export function readMcpSessionIdHeader(req) {
         return undefined;
     return raw.length > 0 ? raw : undefined;
 }
+/**
+ * Normalize an `Accept` header. Duplicate Accept values surface as `string[]`
+ * in Node; joining them preserves `text/event-stream` if any value listed it.
+ */
+export function readAcceptHeader(req) {
+    const raw = req.headers.accept;
+    if (typeof raw === "string")
+        return raw;
+    if (Array.isArray(raw))
+        return raw.filter(value => typeof value === "string").join(", ");
+    return "";
+}

package/build/test/server/request-helpers.test.js

@@ -1,6 +1,6 @@
 import { describe, test } from "node:test";
 import assert from "node:assert";
-import { isInitializationRequestBody, isUnauthenticatedDiscoveryRequestBody, readMcpSessionIdHeader, redactSessionIdForLog, } from "../../server/request-helpers.js";
+import { isInitializationRequestBody, isUnauthenticatedDiscoveryRequestBody, readAcceptHeader, readMcpSessionIdHeader, redactSessionIdForLog, } from "../../server/request-helpers.js";
 describe("streamable request helpers", () => {
     test("redacts stateless session ids and truncates legacy ids", () => {
         assert.strictEqual(redactSessionIdForLog(undefined), "<none>");
@@ -30,4 +30,9 @@ describe("streamable request helpers", () => {
         assert.strictEqual(readMcpSessionIdHeader({ headers: { "mcp-session-id": ["sid-1", "sid-2"] } }), undefined);
         assert.strictEqual(readMcpSessionIdHeader({ headers: {} }), undefined);
     });
+    test("joins duplicate Accept headers so text/event-stream is not dropped", () => {
+        assert.strictEqual(readAcceptHeader({ headers: { accept: "application/json, text/event-stream" } }), "application/json, text/event-stream");
+        assert.strictEqual(readAcceptHeader({ headers: { accept: ["application/json", "text/event-stream"] } }), "application/json, text/event-stream");
+        assert.strictEqual(readAcceptHeader({ headers: {} }), "");
+    });
 });

package/build/test/streamable-http-sse-stream.test.js

@@ -0,0 +1,350 @@
+import { after, before, describe, it } from "node:test";
+import assert from "node:assert";
+import { cleanupServers, findAvailablePort, HOST, launchServer, TransportMode, } from "./utils/server-launcher.js";
+import { findMockServerPort, MockGitLabServer } from "./utils/mock-gitlab-server.js";
+const VALID_TOKEN = "test-token-sse-stream-12345";
+async function postJsonRpc(url, body, headers = {}) {
+    const response = await fetch(url, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json, text/event-stream",
+            ...headers,
+        },
+        body: JSON.stringify(body),
+    });
+    const sessionId = response.headers.get("mcp-session-id");
+    const text = await response.text();
+    const contentType = response.headers.get("content-type") ?? "";
+    if (contentType.includes("text/event-stream")) {
+        const dataLines = text
+            .split("\n")
+            .filter(line => line.startsWith("data: "))
+            .map(line => line.slice(6));
+        const lastLine = dataLines.at(-1);
+        const parsedData = lastLine && lastLine.length > 0 ? JSON.parse(lastLine) : null;
+        return {
+            status: response.status,
+            data: parsedData,
+            sessionId,
+            text,
+        };
+    }
+    const parsedData = text.length > 0 ? JSON.parse(text) : null;
+    return {
+        status: response.status,
+        data: parsedData,
+        sessionId,
+        text,
+    };
+}
+describe("When Streamable HTTP server is running", () => {
+    let mockGitLab = null;
+    let server = null;
+    let mcpUrl = "";
+    before(async () => {
+        const mockPort = await findMockServerPort();
+        mockGitLab = new MockGitLabServer({
+            port: mockPort,
+            validTokens: [VALID_TOKEN],
+        });
+        await mockGitLab.start();
+        const port = await findAvailablePort(3720);
+        server = await launchServer({
+            mode: TransportMode.STREAMABLE_HTTP,
+            port,
+            timeout: 10_000,
+            env: {
+                STREAMABLE_HTTP: "true",
+                REMOTE_AUTHORIZATION: "true",
+                GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",
+                GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
+                GITLAB_TOOLSETS: "merge_requests",
+            },
+        });
+        mcpUrl = `http://${HOST}:${port}/mcp`;
+    });
+    after(async () => {
+        if (server) {
+            await cleanupServers([server]);
+            server = null;
+        }
+        if (mockGitLab) {
+            await mockGitLab.stop();
+            mockGitLab = null;
+        }
+    });
+    describe("with initialize handshake", () => {
+        it("should advertise tools.listChanged capability in server capabilities", async () => {
+            // Given: initialize request body
+            const initBody = {
+                jsonrpc: "2.0",
+                id: 1,
+                method: "initialize",
+                params: {
+                    protocolVersion: "2025-03-26",
+                    capabilities: {},
+                    clientInfo: { name: "test-client", version: "1.0.0" },
+                },
+            };
+            // When: client sends initialize request to /mcp
+            const response = await postJsonRpc(mcpUrl, initBody);
+            // Then: response should be 200 and include tools.listChanged: true
+            assert.strictEqual(response.status, 200, response.text);
+            assert.ok(response.sessionId, "initialize should return Mcp-Session-Id");
+            const result = response.data?.result;
+            assert.ok(typeof result === "object" && result !== null, "Result should be an object");
+            assert.ok(result.capabilities?.tools, "capabilities.tools should be defined");
+            assert.strictEqual(result.capabilities.tools.listChanged, true, "tools.listChanged capability must be true");
+        });
+    });
+    describe("with GET requests on /mcp", () => {
+        it("should return 406 when Accept header lacks text/event-stream", async () => {
+            // Given: GET request without Accept: text/event-stream
+            const response = await fetch(mcpUrl, {
+                method: "GET",
+                headers: {
+                    Accept: "application/json",
+                },
+            });
+            // When: server evaluates the request
+            const body = await response.json();
+            // Then: server should respond with 406 Not Acceptable
+            assert.strictEqual(response.status, 406);
+            assert.strictEqual(body?.error, "Not Acceptable");
+            const allowHeader = response.headers.get("allow");
+            assert.ok(allowHeader?.includes("GET"), "Allow header should contain GET");
+            assert.ok(allowHeader?.includes("POST"), "Allow header should contain POST");
+            assert.ok(allowHeader?.includes("DELETE"), "Allow header should contain DELETE");
+        });
+        it("should return 400 when Mcp-Session-Id header is missing", async () => {
+            // Given: GET request with Accept: text/event-stream but without Mcp-Session-Id
+            const response = await fetch(mcpUrl, {
+                method: "GET",
+                headers: {
+                    Accept: "text/event-stream",
+                },
+            });
+            // When: server evaluates the request
+            const body = await response.json();
+            // Then: server should respond with 400 Bad Request
+            assert.strictEqual(response.status, 400);
+            assert.strictEqual(body?.error, "Bad Request");
+        });
+        it("should return 404 when Mcp-Session-Id does not match any active session", async () => {
+            // Given: GET request with unknown session ID
+            const response = await fetch(mcpUrl, {
+                method: "GET",
+                headers: {
+                    Accept: "text/event-stream",
+                    "Mcp-Session-Id": "non-existent-session-id-12345",
+                },
+            });
+            // When: server evaluates the request
+            const body = await response.json();
+            // Then: server should respond with 404 Session not found
+            assert.strictEqual(response.status, 404);
+            assert.strictEqual(body?.error, "Session not found");
+        });
+        it("should establish SSE stream when valid Mcp-Session-Id and Accept header are provided", async () => {
+            // Given: an initialized session
+            const initBody = {
+                jsonrpc: "2.0",
+                id: 10,
+                method: "initialize",
+                params: {
+                    protocolVersion: "2025-03-26",
+                    capabilities: {},
+                    clientInfo: { name: "sse-stream-client", version: "1.0.0" },
+                },
+            };
+            const initResponse = await postJsonRpc(mcpUrl, initBody);
+            const sessionId = initResponse.sessionId;
+            assert.ok(sessionId, "Session ID should be present");
+            // When: client connects with GET /mcp and Accept: text/event-stream
+            const abortController = new AbortController();
+            const sseResponse = await fetch(mcpUrl, {
+                method: "GET",
+                headers: {
+                    Accept: "text/event-stream",
+                    "Mcp-Session-Id": sessionId,
+                },
+                signal: abortController.signal,
+            });
+            // Then: response should be 200 with Content-Type text/event-stream
+            assert.strictEqual(sseResponse.status, 200);
+            const contentType = sseResponse.headers.get("content-type") ?? "";
+            assert.ok(contentType.includes("text/event-stream"), "Content-Type must be text/event-stream");
+            abortController.abort();
+        });
+        it("should receive list_changed notification over SSE stream when discover_tools runs", async () => {
+            // Given: an authenticated session connected to GET /mcp SSE stream
+            const initBody = {
+                jsonrpc: "2.0",
+                id: 20,
+                method: "initialize",
+                params: {
+                    protocolVersion: "2025-03-26",
+                    capabilities: {},
+                    clientInfo: { name: "sse-notify-client", version: "1.0.0" },
+                },
+            };
+            const initResponse = await postJsonRpc(mcpUrl, initBody, {
+                "Private-Token": VALID_TOKEN,
+            });
+            const sessionId = initResponse.sessionId;
+            assert.ok(sessionId, "Session ID should be present");
+            // Initialized notification
+            await postJsonRpc(mcpUrl, {
+                jsonrpc: "2.0",
+                method: "notifications/initialized",
+            }, {
+                "mcp-session-id": sessionId,
+                "Private-Token": VALID_TOKEN,
+            });
+            const abortController = new AbortController();
+            const sseResponse = await fetch(mcpUrl, {
+                method: "GET",
+                headers: {
+                    Accept: "text/event-stream",
+                    "Mcp-Session-Id": sessionId,
+                    "Private-Token": VALID_TOKEN,
+                },
+                signal: abortController.signal,
+            });
+            assert.strictEqual(sseResponse.status, 200);
+            const streamReader = sseResponse.body?.getReader();
+            assert.ok(streamReader, "SSE response body reader should exist");
+            const decoder = new TextDecoder();
+            let receivedEvents = "";
+            // Background listener to collect SSE chunks
+            const readPromise = (async () => {
+                try {
+                    while (true) {
+                        const { done, value } = await streamReader.read();
+                        if (done)
+                            break;
+                        receivedEvents += decoder.decode(value, { stream: true });
+                        if (receivedEvents.includes("notifications/tools/list_changed")) {
+                            break;
+                        }
+                    }
+                }
+                catch {
+                    // Stream closed or aborted
+                }
+            })();
+            // When: client calls discover_tools to activate pipelines category
+            const discoverResponse = await postJsonRpc(mcpUrl, {
+                jsonrpc: "2.0",
+                id: 21,
+                method: "tools/call",
+                params: {
+                    name: "discover_tools",
+                    arguments: {
+                        category: "pipelines",
+                    },
+                },
+            }, {
+                "mcp-session-id": sessionId,
+                "Private-Token": VALID_TOKEN,
+            });
+            // Then: discover_tools succeeds and list_changed notification arrives on SSE stream
+            assert.strictEqual(discoverResponse.status, 200, discoverResponse.text);
+            let timeoutHandle;
+            try {
+                await Promise.race([
+                    readPromise,
+                    new Promise(resolve => {
+                        timeoutHandle = setTimeout(resolve, 3000);
+                    }),
+                ]);
+            }
+            finally {
+                if (timeoutHandle)
+                    clearTimeout(timeoutHandle);
+            }
+            abortController.abort();
+            assert.ok(receivedEvents.includes("notifications/tools/list_changed"), `SSE stream should receive notifications/tools/list_changed. Received: ${receivedEvents}`);
+        });
+    });
+    describe("with unsupported HTTP methods", () => {
+        it("should return 405 Method Not Allowed for PUT requests", async () => {
+            // Given: PUT request to /mcp
+            const response = await fetch(mcpUrl, { method: "PUT" });
+            // When: server evaluates the method
+            const body = await response.json();
+            // Then: server should respond with 405 Method Not Allowed
+            assert.strictEqual(response.status, 405);
+            assert.strictEqual(body?.error, "Method Not Allowed");
+            const allowHeader = response.headers.get("allow");
+            assert.ok(allowHeader?.includes("GET"), "Allow header must contain GET");
+            assert.ok(allowHeader?.includes("POST"), "Allow header must contain POST");
+            assert.ok(allowHeader?.includes("DELETE"), "Allow header must contain DELETE");
+        });
+    });
+});
+describe("When Streamable HTTP GET SSE is open", { timeout: 20_000 }, () => {
+    describe("with a short session timeout and no POST traffic", () => {
+        it("should keep the session alive for the life of the SSE stream", async () => {
+            const mockPort = await findMockServerPort();
+            const mockGitLab = new MockGitLabServer({
+                port: mockPort,
+                validTokens: [VALID_TOKEN],
+            });
+            await mockGitLab.start();
+            const port = await findAvailablePort(3740);
+            const timeoutServer = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port,
+                timeout: 10_000,
+                env: {
+                    STREAMABLE_HTTP: "true",
+                    REMOTE_AUTHORIZATION: "true",
+                    GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
+                    SESSION_TIMEOUT_SECONDS: "1",
+                },
+            });
+            const timeoutMcpUrl = `http://${HOST}:${port}/mcp`;
+            try {
+                // Given: an authenticated session with an open GET SSE stream
+                const initResponse = await postJsonRpc(timeoutMcpUrl, {
+                    jsonrpc: "2.0",
+                    id: 1,
+                    method: "initialize",
+                    params: {
+                        protocolVersion: "2025-03-26",
+                        capabilities: {},
+                        clientInfo: { name: "sse-keepalive-client", version: "1.0.0" },
+                    },
+                }, { "Private-Token": VALID_TOKEN });
+                const sessionId = initResponse.sessionId;
+                assert.ok(sessionId, "Session ID should be present");
+                const abortController = new AbortController();
+                const sseResponse = await fetch(timeoutMcpUrl, {
+                    method: "GET",
+                    headers: {
+                        Accept: "text/event-stream",
+                        "Mcp-Session-Id": sessionId,
+                        "Private-Token": VALID_TOKEN,
+                    },
+                    signal: abortController.signal,
+                });
+                assert.strictEqual(sseResponse.status, 200);
+                // When: more than SESSION_TIMEOUT_SECONDS elapses with no POST
+                await new Promise(resolve => setTimeout(resolve, 2_000));
+                const listResponse = await postJsonRpc(timeoutMcpUrl, { jsonrpc: "2.0", id: 2, method: "tools/list", params: {} }, {
+                    "mcp-session-id": sessionId,
+                    "Private-Token": VALID_TOKEN,
+                });
+                // Then: the session is still alive
+                assert.strictEqual(listResponse.status, 200, listResponse.text);
+                abortController.abort();
+            }
+            finally {
+                await cleanupServers([timeoutServer]);
+                await mockGitLab.stop();
+            }
+        });
+    });
+});

package/build/test/test-all-transport-server.js

@@ -216,11 +216,17 @@ describe('GitLab MCP Server - Streamable HTTP Transport', () => {
         cleanup();
         console.log('Client disconnected from Streamable HTTP server');
     });
-    test('should return 405 for GET /mcp', async () => {
+    test('should return 406 for GET /mcp without Accept: text/event-stream', async () => {
         const response = await fetch(`http://${HOST}:${port}/mcp`);
-        assert.strictEqual(response.status, 405, 'GET /mcp should respond with 405');
+        assert.strictEqual(response.status, 406, 'GET /mcp should respond with 406 when Accept header is missing text/event-stream');
         const body = await response.json();
-        assert.strictEqual(body?.error, 'Method Not Allowed');
+        assert.strictEqual(body?.error, 'Not Acceptable');
+    });
+    test('should return 405 for unsupported HTTP methods like PUT /mcp', async () => {
+        const response = await fetch(`http://${HOST}:${port}/mcp`, { method: 'PUT' });
+        assert.strictEqual(response.status, 405, 'PUT /mcp should respond with 405');
+        const allowHeader = response.headers.get('allow');
+        assert.ok(allowHeader?.includes('GET') && allowHeader?.includes('POST') && allowHeader?.includes('DELETE'), 'Allow header should contain GET, POST, DELETE');
     });
     test('should list tools via Streamable HTTP', async () => {
         const tools = await client.listTools();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.47",
+  "version": "2.1.48",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [