@zereight/mcp-gitlab 2.1.54 → 2.1.56

package/README.ko.md

@@ -98,7 +98,7 @@ npm install -g @zereight/mcp-gitlab
 
 예시는 기존 `mcp-gitlab`보다 충돌 가능성이 낮은 `zereight-mcp-gitlab` 별칭을 사용합니다. MCP 클라이언트가 찾지 못하면 `which zereight-mcp-gitlab`의 절대 경로를 사용하세요.
 
-전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.53`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
+전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.55`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
 
 #### CLI 인자 사용하기(환경 변수 문제가 있는 클라이언트용)
 
@@ -288,7 +288,7 @@ MCP 클라이언트 설정:
 | `STREAMABLE_HTTP`                                                | 예   | 반드시 `true`                                                                                                           |
 | `ENABLE_DYNAMIC_API_URL`                                         | 선택 | 요청별 `X-GitLab-API-URL` 헤더 허용                                                                                     |
 | `GITLAB_ALLOWED_HOSTS`                                           | 선택 | 허용할 `X-GitLab-API-URL` 호스트의 쉼표 구분 목록; `GITLAB_API_URL` 호스트는 항상 허용                                  |
-| `GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY`                    | 선택 | 인증 없이 `initialize`, `notifications/initialized`, `tools/list`만 허용(도구 호출은 여전히 인증 필요)                  |
+| `GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY`                    | 선택 | 인증 없이 `initialize`, `notifications/initialized`, `tools/list`, `server/discover`만 허용(도구 호출은 여전히 인증 필요)                  |
 | `MCP_SERVER_URL` / `MCP_ALLOWED_HOSTS` / `MCP_ALLOWED_ORIGINS` | 선택 | DNS rebinding 방지를 위한 허용 `/mcp` 호스트/오리진 값                                                                  |
 | `MCP_TRUST_PROXY`                                                | 선택 | 리버스 프록시 뒤에서 `Forwarded` / `X-Forwarded-*` 헤더 신뢰(다운로드 URL, Express `req.ip`, `/mcp` IP rate limit, OAuth rate limit) |
 

package/README.md

@@ -103,7 +103,7 @@ npm install -g @zereight/mcp-gitlab
 
 The examples use `zereight-mcp-gitlab`, a less collision-prone alias for the legacy `mcp-gitlab` binary. If your MCP client cannot find it, use the absolute path from `which zereight-mcp-gitlab`.
 
-No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.1.53`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
+No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.1.55`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
 
 #### Using CLI Arguments (for clients with env var issues)
 
@@ -316,7 +316,7 @@ the token to GitLab on behalf of the caller.
 | `STREAMABLE_HTTP`                             | ✅       | Must be `true`                                                                                                          |
 | `ENABLE_DYNAMIC_API_URL`                      | optional | Allow per-request GitLab URL via `X-GitLab-API-URL` header                                                              |
 | `GITLAB_ALLOWED_HOSTS`                        | optional | Comma-separated allowed `X-GitLab-API-URL` hosts; `GITLAB_API_URL` hosts are always allowed                             |
-| `GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY` | optional | Allow unauthenticated `initialize`, `notifications/initialized`, and `tools/list` only (tool calls still require auth)  |
+| `GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY` | optional | Allow unauthenticated `initialize`, `notifications/initialized`, `tools/list`, and `server/discover` only (tool calls still require auth)  |
 | `MCP_SERVER_URL` / `MCP_ALLOWED_HOSTS` / `MCP_ALLOWED_ORIGINS` | optional | Allowed public `/mcp` host/origin values for DNS rebinding protection                                   |
 | `MCP_TRUST_PROXY`                             | optional | Trust `Forwarded` / `X-Forwarded-*` headers behind a reverse proxy (download URLs, Express `req.ip`, `/mcp` IP rate limits, OAuth rate limits) |
 

package/README.zh-CN.md

@@ -98,7 +98,7 @@ npm install -g @zereight/mcp-gitlab
 
 示例使用 `zereight-mcp-gitlab`，这是比旧的 `mcp-gitlab` 更不容易冲突的别名。如果 MCP 客户端找不到它，请使用 `which zereight-mcp-gitlab` 输出的绝对路径。
 
-如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.1.53`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
+如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.1.55`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
 
 #### 使用 CLI 参数（适用于环境变量有问题的客户端）
 
@@ -289,7 +289,7 @@ MCP 客户端配置：
 | `STREAMABLE_HTTP`                                                | 是   | 必须为 `true`                                                                                                           |
 | `ENABLE_DYNAMIC_API_URL`                                         | 可选 | 允许按请求通过 `X-GitLab-API-URL` 请求头指定 GitLab URL                                                                 |
 | `GITLAB_ALLOWED_HOSTS`                                           | 可选 | 允许的 `X-GitLab-API-URL` 主机逗号分隔列表；`GITLAB_API_URL` 中的主机始终允许                                          |
-| `GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY`                    | 可选 | 仅允许未认证的 `initialize`、`notifications/initialized`、`tools/list`（工具调用仍需认证）                                |
+| `GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY`                    | 可选 | 仅允许未认证的 `initialize`、`notifications/initialized`、`tools/list`、`server/discover`（工具调用仍需认证）                                |
 | `MCP_SERVER_URL` / `MCP_ALLOWED_HOSTS` / `MCP_ALLOWED_ORIGINS` | 可选 | 用于 DNS rebinding 防护的允许 `/mcp` 主机/来源值                                                                        |
 | `MCP_TRUST_PROXY`                                                | 可选 | 在反向代理后信任 `Forwarded` / `X-Forwarded-*` 请求头（下载 URL、Express `req.ip`、`/mcp` IP 速率限制、OAuth 速率限制） |
 

package/build/index.js

@@ -10112,7 +10112,9 @@ async function startSSEServer() {
  */
 async function startStreamableHTTPServer() {
     const app = express();
-    const streamableTransports = {};
+    // Session IDs are untrusted map keys. A null prototype prevents inherited
+    // names such as "constructor" from masquerading as live transports.
+    const streamableTransports = Object.create(null);
     const authTimeouts = {};
     // Configuration and limits
     const MAX_SESSIONS = Number.parseInt(process.env.MAX_SESSIONS || "1000", 10);
@@ -10713,8 +10715,19 @@ async function startStreamableHTTPServer() {
         : STREAMABLE_HTTP_AUTH_TOKEN && !REMOTE_AUTHORIZATION
             ? staticMcpBearerAuth
             : (_req, _res, next) => next();
+    const rejectUnknownStatefulSession = (req, res, next) => {
+        const usesStatelessSessions = OAUTH_STATELESS_MODE &&
+            STATELESS_MATERIAL &&
+            (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH);
+        const sessionId = readMcpSessionIdHeader(req);
+        if (!usesStatelessSessions && sessionId && !streamableTransports[sessionId]) {
+            res.status(404).json({ error: "Session not found" });
+            return;
+        }
+        next();
+    };
     // Streamable HTTP endpoint - handles both session creation and message handling
-    app.post("/mcp", mcpRequestRateLimit, mcpBearerAuth, async (req, res) => {
+    app.post("/mcp", rejectUnknownStatefulSession, mcpRequestRateLimit, mcpBearerAuth, async (req, res) => {
         const sessionId = readMcpSessionIdHeader(req);
         const publicBaseUrl = getForwardedPublicBaseUrl(req, MCP_TRUST_PROXY);
         // Track request
@@ -10984,7 +10997,7 @@ async function startStreamableHTTPServer() {
         }
     });
     // Streamable HTTP GET endpoint for listening to server-sent events (SSE)
-    app.get("/mcp", mcpRequestRateLimit, mcpBearerAuth, async (req, res) => {
+    app.get("/mcp", rejectUnknownStatefulSession, mcpRequestRateLimit, mcpBearerAuth, async (req, res) => {
         const sessionId = readMcpSessionIdHeader(req);
         const acceptHeader = readAcceptHeader(req);
         if (!acceptHeader.includes("text/event-stream")) {
@@ -11104,7 +11117,7 @@ async function startStreamableHTTPServer() {
         });
     });
     // to delete a mcp server session explicitly
-    app.delete("/mcp", mcpRequestRateLimit, mcpBearerAuth, async (req, res) => {
+    app.delete("/mcp", rejectUnknownStatefulSession, mcpRequestRateLimit, mcpBearerAuth, async (req, res) => {
         const sessionId = readMcpSessionIdHeader(req);
         if (!sessionId) {
             res.status(400).json({ error: "mcp-session-id header is required" });

package/build/server/request-helpers.js

@@ -34,7 +34,10 @@ export function isUnauthenticatedDiscoveryRequestBody(body) {
         if (typeof m !== "object" || m === null)
             return false;
         const method = m.method;
-        return (method === "initialize" || method === "notifications/initialized" || method === "tools/list");
+        return (method === "initialize" ||
+            method === "notifications/initialized" ||
+            method === "tools/list" ||
+            method === "server/discover");
     };
     if (Array.isArray(body))
         return body.every(isDiscoveryMethod);

package/build/test/remote-auth-simple-test.js

@@ -255,36 +255,22 @@ describe('Remote Authorization', { concurrency: 1 }, () => {
             await new Promise(resolve => setTimeout(resolve, TIMEOUT_TEST_WAIT_MS));
             await waitForSessionDecrease(mcpUrl, beforeTimeout);
             console.log('  ✓ Timeout closed transport and released active session slot');
-            // Step 3: Try to make request WITHOUT auth header - should fail with 401
-            try {
-                const response = await fetch(mcpUrl, {
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/json',
-                        'mcp-session-id': sessionId,
-                    },
-                    body: JSON.stringify({
-                        jsonrpc: '2.0',
-                        id: 1,
-                        method: 'tools/list'
-                    })
-                });
-                if (!response.ok) {
-                    assert.strictEqual(response.status, 401, 'Should return 401 Unauthorized');
-                    console.log(`  ✓ Request correctly failed with status ${response.status}`);
-                    const body = await response.text();
-                    console.log(`  ℹ️  Error: ${body.substring(0, 100)}...`);
-                }
-                else {
-                    assert.fail('Should have failed due to expired auth token');
-                }
-            }
-            catch (error) {
-                // Network errors are also acceptable
-                assert.ok(error instanceof Error, 'Should throw error');
-                console.log('  ✓ Request correctly failed after timeout');
-                console.log(`  ℹ️  Error: ${error.message.substring(0, 100)}...`);
-            }
+            // Step 3: A stale stateful session must return the MCP re-initialization signal.
+            const response = await fetch(mcpUrl, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'mcp-session-id': sessionId,
+                },
+                body: JSON.stringify({
+                    jsonrpc: '2.0',
+                    id: 1,
+                    method: 'tools/list'
+                })
+            });
+            assert.strictEqual(response.status, 404, 'Should return 404 Session Not Found');
+            assert.deepStrictEqual(await response.json(), { error: 'Session not found' });
+            console.log('  ✓ Expired session returned 404 so the client can re-initialize');
             await clientWithAuth.disconnect();
         });
     });

package/build/test/server/request-helpers.test.js

@@ -16,12 +16,22 @@ describe("streamable request helpers", () => {
     });
     test("allows only discovery methods in unauthenticated discovery bodies", () => {
         assert.strictEqual(isUnauthenticatedDiscoveryRequestBody({ method: "tools/list" }), true);
+        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody({ method: "server/discover" }), true);
         assert.strictEqual(isUnauthenticatedDiscoveryRequestBody([
             { method: "initialize" },
             { method: "notifications/initialized" },
             { method: "tools/list" },
+            { method: "server/discover" },
         ]), true);
-        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody([{ method: "tools/list" }, { method: "call_tool" }]), false);
+        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody([
+            { method: "tools/list" },
+            { method: "call_tool" },
+            { method: "tools/call" },
+        ]), false);
+        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody([
+            { method: "server/discover" },
+            { method: "tools/call" },
+        ]), false);
         assert.strictEqual(isUnauthenticatedDiscoveryRequestBody(undefined), false);
     });
     test("normalizes Mcp-Session-Id headers", () => {

package/build/test/streamable-http-unauthenticated-discovery.test.js

@@ -106,21 +106,87 @@ describe("Streamable HTTP unauthenticated tool discovery", { timeout: 20_000 },
         assert.ok(Array.isArray(listResponse.data.result?.tools), "tools/list should return tools");
         assert.ok(listResponse.data.result.tools.length > 0, "tools/list should not be empty");
     });
+    test("allows unauthenticated server/discover in individual and batch requests", async () => {
+        const { server, mcpUrl } = await launchRemoteAuthServer({
+            GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",
+        });
+        servers.push(server);
+        const preInitDiscover = await rawMcpRequest(mcpUrl, {
+            jsonrpc: "2.0",
+            id: 10,
+            method: "server/discover",
+            params: {},
+        });
+        assert.strictEqual(preInitDiscover.status, 400, preInitDiscover.text);
+        assert.match(preInitDiscover.data?.error?.message ?? "", /Server not initialized/i, "server/discover should pass the auth gate before MCP initialization errors");
+        const sessionId = await initialize(mcpUrl);
+        const initialized = await rawMcpRequest(mcpUrl, { jsonrpc: "2.0", method: "notifications/initialized" }, { "mcp-session-id": sessionId });
+        assert.ok([200, 202, 204].includes(initialized.status), initialized.text);
+        const discoverResponse = await rawMcpRequest(mcpUrl, { jsonrpc: "2.0", id: 11, method: "server/discover", params: {} }, { "mcp-session-id": sessionId });
+        assert.strictEqual(discoverResponse.status, 200, discoverResponse.text);
+        assert.strictEqual(discoverResponse.data?.id, 11);
+        assert.strictEqual(discoverResponse.data?.error?.code, -32601);
+        assert.match(discoverResponse.data?.error?.message ?? "", /Method not found/i);
+        const batchResponse = await rawMcpRequest(mcpUrl, [
+            { jsonrpc: "2.0", id: 12, method: "server/discover", params: {} },
+            { jsonrpc: "2.0", id: 13, method: "tools/list", params: {} },
+        ], { "mcp-session-id": sessionId });
+        assert.strictEqual(batchResponse.status, 200, batchResponse.text);
+        assert.ok(Array.isArray(batchResponse.data.result?.tools), "batch tools/list should return tools");
+        assert.ok(batchResponse.data.result.tools.length > 0, "batch tools/list should not be empty");
+    });
+    test("rejects unauthenticated discovery batch when tools/call is included", async () => {
+        const { server, mcpUrl } = await launchRemoteAuthServer({
+            GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",
+        });
+        servers.push(server);
+        const response = await rawMcpRequest(mcpUrl, [
+            { jsonrpc: "2.0", id: 20, method: "server/discover", params: {} },
+            {
+                jsonrpc: "2.0",
+                id: 21,
+                method: "tools/call",
+                params: {
+                    name: "get_project",
+                    arguments: { project_id: "123" },
+                },
+            },
+        ]);
+        assert.strictEqual(response.status, 401, response.text);
+    });
     test("expires unauthenticated discovery sessions and frees capacity", async () => {
         const { server, mcpUrl } = await launchRemoteAuthServer({
             GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",
             MAX_SESSIONS: "1",
+            MAX_REQUESTS_PER_MINUTE: "1",
+            MCP_TRUST_PROXY: "true",
             SESSION_TIMEOUT_SECONDS: "1",
         });
         servers.push(server);
-        await initialize(mcpUrl);
+        const expiredSessionId = await initialize(mcpUrl);
         await new Promise(resolve => setTimeout(resolve, 2_000));
+        const expiredResponse = await rawMcpRequest(mcpUrl, { jsonrpc: "2.0", id: 2, method: "tools/list", params: {} }, { "mcp-session-id": expiredSessionId });
+        assert.strictEqual(expiredResponse.status, 404, expiredResponse.text);
+        assert.deepStrictEqual(expiredResponse.data, { error: "Session not found" });
         const healthResponse = await fetch(mcpUrl.replace("/mcp", "/health"));
         assert.strictEqual(healthResponse.status, 200);
-        const nextSession = await rawMcpRequest(mcpUrl, initializeBody);
+        const nextSession = await rawMcpRequest(mcpUrl, initializeBody, {
+            "x-forwarded-for": "192.0.2.10",
+        });
         assert.strictEqual(nextSession.status, 200, nextSession.text);
         assert.ok(nextSession.sessionId, "expired discovery session should free capacity");
     });
+    test("rejects inherited object-property names as unknown session IDs", async () => {
+        const { server, mcpUrl } = await launchRemoteAuthServer({
+            GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",
+        });
+        servers.push(server);
+        for (const sessionId of ["constructor", "toString", "__proto__"]) {
+            const response = await rawMcpRequest(mcpUrl, { jsonrpc: "2.0", id: 2, method: "tools/list", params: {} }, { "mcp-session-id": sessionId });
+            assert.strictEqual(response.status, 404, `${sessionId}: ${response.text}`);
+            assert.deepStrictEqual(response.data, { error: "Session not found" });
+        }
+    });
     test("still blocks unauthenticated tools/call when discovery is enabled", async () => {
         const { server, mcpUrl } = await launchRemoteAuthServer({
             GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",

package/build/test/utils/version-check.test.js

@@ -1,8 +1,50 @@
 import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { describe, test } from "node:test";
-import { checkForNewVersion, isNewerVersion } from "../../utils/version-check.js";
+import { checkForNewVersion, fetchLatestVersion, isNewerVersion } from "../../utils/version-check.js";
 function fetchReturning(status, body) {
-    return (async () => new Response(JSON.stringify(body), { status }));
+    return async () => new Response(JSON.stringify(body), { status });
+}
+function fetchCapturing(calls, status, body) {
+    return async (url, init) => {
+        const headers = new Headers(init?.headers);
+        calls.push({
+            url: url.toString(),
+            authorization: headers.get("authorization"),
+            redirect: init?.redirect,
+        });
+        return new Response(JSON.stringify(body), { status });
+    };
+}
+function throwingResolver() {
+    throw new Error("npm not found");
+}
+async function withNpmrc(contents, run, globalContents = "") {
+    const configDir = mkdtempSync(join(tmpdir(), "gitlab-mcp-npmrc-"));
+    const userconfigPath = join(configDir, ".npmrc");
+    const globalconfigPath = join(configDir, "global.npmrc");
+    writeFileSync(userconfigPath, contents);
+    writeFileSync(globalconfigPath, globalContents);
+    const previousUserconfig = process.env.NPM_CONFIG_USERCONFIG;
+    const previousGlobalconfig = process.env.NPM_CONFIG_GLOBALCONFIG;
+    process.env.NPM_CONFIG_USERCONFIG = userconfigPath;
+    process.env.NPM_CONFIG_GLOBALCONFIG = globalconfigPath;
+    try {
+        await run();
+    }
+    finally {
+        if (previousUserconfig === undefined)
+            delete process.env.NPM_CONFIG_USERCONFIG;
+        else
+            process.env.NPM_CONFIG_USERCONFIG = previousUserconfig;
+        if (previousGlobalconfig === undefined)
+            delete process.env.NPM_CONFIG_GLOBALCONFIG;
+        else
+            process.env.NPM_CONFIG_GLOBALCONFIG = previousGlobalconfig;
+        rmSync(configDir, { recursive: true, force: true });
+    }
 }
 describe("When isNewerVersion compares versions", () => {
     test("should detect newer patch, minor, and major versions", () => {
@@ -30,18 +72,14 @@ describe("When checkForNewVersion runs", () => {
         assert.equal(latest, null);
     });
     test("should return null without fetching when current version is unknown", async () => {
-        let called = false;
-        const spyFetch = (async () => {
-            called = true;
-            return new Response("{}", { status: 200 });
-        });
-        assert.equal(await checkForNewVersion("unknown", spyFetch), null);
-        assert.equal(called, false);
+        const calls = [];
+        assert.equal(await checkForNewVersion("unknown", fetchCapturing(calls, 200, {})), null);
+        assert.equal(calls.length, 0);
     });
     test("should return null on registry errors instead of throwing", async () => {
-        const failingFetch = (async () => {
+        const failingFetch = async () => {
             throw new Error("network down");
-        });
+        };
         assert.equal(await checkForNewVersion("2.1.29", failingFetch), null);
         assert.equal(await checkForNewVersion("2.1.29", fetchReturning(500, {})), null);
     });
@@ -50,3 +88,152 @@ describe("When checkForNewVersion runs", () => {
         assert.equal(latest, null);
     });
 });
+describe("When fetchLatestVersion resolves the registry", () => {
+    test("should fetch from the resolved registry instead of a hardcoded one", async () => {
+        const calls = [];
+        const latest = await fetchLatestVersion(fetchCapturing(calls, 200, { version: "2.1.31" }), 3000, () => "https://npm.internal.example/");
+        assert.equal(latest, "2.1.31");
+        assert.equal(calls[0]?.url, "https://npm.internal.example/@zereight/mcp-gitlab/latest");
+    });
+    test("should fall back to the public registry when the resolver throws", async () => {
+        const calls = [];
+        const latest = await fetchLatestVersion(fetchCapturing(calls, 200, { version: "2.1.31" }), 3000, throwingResolver);
+        assert.equal(latest, null);
+        assert.equal(calls.length, 0);
+    });
+    test("should fall back to the public registry when the resolved value has no hostname", async () => {
+        const calls = [];
+        const latest = await fetchLatestVersion(fetchCapturing(calls, 200, { version: "2.1.31" }), 3000, () => "https:///");
+        assert.equal(latest, "2.1.31");
+        assert.equal(calls[0]?.url, "https://registry.npmjs.org/@zereight/mcp-gitlab/latest");
+    });
+    test("should fall back to the public registry when the resolved value has a query string", async () => {
+        const calls = [];
+        const latest = await fetchLatestVersion(fetchCapturing(calls, 200, { version: "2.1.31" }), 3000, () => "https://registry.example/npm?tenant=a");
+        assert.equal(latest, "2.1.31");
+        assert.equal(calls[0]?.url, "https://registry.npmjs.org/@zereight/mcp-gitlab/latest");
+    });
+});
+describe("When resolving the registry from npm config", () => {
+    describe("with a scoped @zereight:registry", () => {
+        test("should prefer the scoped registry over the unscoped one", async () => {
+            await withNpmrc("registry=https://unscoped.example/\n@zereight:registry=https://scoped.example/\n", async () => {
+                const calls = [];
+                const latest = await fetchLatestVersion(fetchCapturing(calls, 200, { version: "2.1.31" }));
+                assert.equal(latest, "2.1.31");
+                assert.equal(calls[0]?.url, "https://scoped.example/@zereight/mcp-gitlab/latest");
+            });
+        });
+    });
+});
+describe("When fetchLatestVersion authenticates against a protected registry", () => {
+    describe("with a scoped _authToken in .npmrc", () => {
+        test("should send a Bearer token only to that HTTPS registry", async () => {
+            await withNpmrc([
+                "registry=https://unscoped.example/",
+                "@zereight:registry=https://scoped.example/",
+                "//scoped.example/:_authToken=scoped-registry-token",
+            ].join("\n"), async () => {
+                const calls = [];
+                const latest = await fetchLatestVersion(fetchCapturing(calls, 200, { version: "2.1.31" }));
+                assert.equal(latest, "2.1.31");
+                assert.equal(calls[0]?.url, "https://scoped.example/@zereight/mcp-gitlab/latest");
+                assert.equal(calls[0]?.authorization, "Bearer scoped-registry-token");
+            });
+        });
+        test("should refuse to follow redirects when a token is attached", async () => {
+            await withNpmrc([
+                "@zereight:registry=https://scoped.example/",
+                "//scoped.example/:_authToken=scoped-registry-token",
+            ].join("\n"), async () => {
+                const calls = [];
+                await fetchLatestVersion(fetchCapturing(calls, 200, { version: "2.1.31" }));
+                assert.equal(calls[0]?.redirect, "error");
+            });
+        });
+    });
+    describe("without a matching token", () => {
+        test("should omit Authorization", async () => {
+            await withNpmrc("@zereight:registry=https://scoped.example/\n", async () => {
+                const calls = [];
+                await fetchLatestVersion(fetchCapturing(calls, 200, { version: "2.1.31" }));
+                assert.equal(calls[0]?.authorization, null);
+                assert.equal(calls[0]?.redirect, undefined);
+            });
+        });
+    });
+    describe("when the token is on a parent registry path", () => {
+        test("should fall back to the host-level _authToken", async () => {
+            await withNpmrc([
+                "@zereight:registry=https://scoped.example/npm",
+                "//scoped.example/:_authToken=host-level-token",
+            ].join("\n"), async () => {
+                const calls = [];
+                const latest = await fetchLatestVersion(fetchCapturing(calls, 200, { version: "2.1.31" }));
+                assert.equal(latest, "2.1.31");
+                assert.equal(calls[0]?.url, "https://scoped.example/npm/@zereight/mcp-gitlab/latest");
+                assert.equal(calls[0]?.authorization, "Bearer host-level-token");
+            });
+        });
+    });
+    describe("when both a path token and a host token exist", () => {
+        test("should prefer the more specific path token", async () => {
+            await withNpmrc([
+                "@zereight:registry=https://scoped.example/npm",
+                "//scoped.example/npm/:_authToken=path-token",
+                "//scoped.example/:_authToken=host-level-token",
+            ].join("\n"), async () => {
+                const calls = [];
+                await fetchLatestVersion(fetchCapturing(calls, 200, { version: "2.1.31" }));
+                assert.equal(calls[0]?.authorization, "Bearer path-token");
+            });
+        });
+    });
+    describe("when the token is only in the global npmrc", () => {
+        test("should send a Bearer token from globalconfig", async () => {
+            await withNpmrc("@zereight:registry=https://scoped.example/\n", async () => {
+                const calls = [];
+                await fetchLatestVersion(fetchCapturing(calls, 200, { version: "2.1.31" }));
+                assert.equal(calls[0]?.authorization, "Bearer global-registry-token");
+            }, "//scoped.example/:_authToken=global-registry-token\n");
+        });
+    });
+    describe("when the registry path contains underscores", () => {
+        test("should send a Bearer token for an Azure Artifacts-style registry path", async () => {
+            const registry = "https://pkgs.dev.azure.com/org/_packaging/feed/npm/registry";
+            const authKey = "//pkgs.dev.azure.com/org/_packaging/feed/npm/registry/:_authToken";
+            await withNpmrc([`@zereight:registry=${registry}`, `${authKey}=azure-feed-token`].join("\n"), async () => {
+                const calls = [];
+                const latest = await fetchLatestVersion(fetchCapturing(calls, 200, { version: "2.1.31" }));
+                assert.equal(latest, "2.1.31");
+                assert.equal(calls[0]?.url, `${registry}/@zereight/mcp-gitlab/latest`);
+                assert.equal(calls[0]?.authorization, "Bearer azure-feed-token");
+            });
+        });
+    });
+    describe("with a token for a different host", () => {
+        test("should omit Authorization", async () => {
+            await withNpmrc([
+                "@zereight:registry=https://scoped.example/",
+                "//other.example/:_authToken=other-host-token",
+            ].join("\n"), async () => {
+                const calls = [];
+                await fetchLatestVersion(fetchCapturing(calls, 200, { version: "2.1.31" }));
+                assert.equal(calls[0]?.authorization, null);
+            });
+        });
+    });
+    describe("when the registry is HTTP", () => {
+        test("should omit Authorization even if a token is configured", async () => {
+            await withNpmrc([
+                "@zereight:registry=http://insecure.example/",
+                "//insecure.example/:_authToken=http-registry-token",
+            ].join("\n"), async () => {
+                const calls = [];
+                await fetchLatestVersion(fetchCapturing(calls, 200, { version: "2.1.31" }));
+                assert.equal(calls[0]?.url, "http://insecure.example/@zereight/mcp-gitlab/latest");
+                assert.equal(calls[0]?.authorization, null);
+            });
+        });
+    });
+});

package/build/utils/version-check.js

@@ -1,5 +1,176 @@
-const NPM_REGISTRY_LATEST_URL = "https://registry.npmjs.org/@zereight/mcp-gitlab/latest";
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";
+const PACKAGE_LATEST_PATH = "@zereight/mcp-gitlab/latest";
 const RELEASE_VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
+const AUTH_TOKEN_KEY_PATTERN = /^\/\/[-A-Za-z0-9.]+(?::\d+)?(?:\/[-A-Za-z0-9._]+)*\/:_authToken$/;
+const NPMRC_ENV_PATTERN = /\$\{([A-Za-z_]\w*)\}/g;
+/**
+ * A configured registry is only used when it parses as a plain HTTP(S) URL
+ * with a hostname. A query or fragment is rejected too: the package path is
+ * appended to this value with plain string concatenation below, so a query
+ * string like "?tenant=a" would swallow the appended path instead of the
+ * request reaching the intended endpoint.
+ */
+function isUsableRegistryUrl(registry) {
+    try {
+        const parsed = new URL(registry);
+        return ((parsed.protocol === "http:" || parsed.protocol === "https:") &&
+            parsed.hostname !== "" &&
+            parsed.search === "" &&
+            parsed.hash === "");
+    }
+    catch {
+        return false;
+    }
+}
+/** Runs `npm config get <key>` and returns the trimmed value, or null if unavailable/unset. */
+async function npmConfigGet(key) {
+    try {
+        // On Windows "npm" resolves to npm.cmd, which execFile can't launch
+        // directly — route through cmd.exe instead. Command and args are fixed
+        // literals (only `key` varies, and only with our own constant inputs), so
+        // this doesn't open a shell-injection surface.
+        const isWindows = process.platform === "win32";
+        const { stdout } = await execFileAsync(isWindows ? "cmd.exe" : "npm", isWindows ? ["/d", "/s", "/c", "npm", "config", "get", key] : ["config", "get", key], { timeout: 5000, windowsHide: true });
+        const value = stdout.trim().replace(/\/$/, "");
+        return value && value !== "undefined" ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolves the npm registry to use, honoring `.npmrc` / `npm_config_registry`.
+ * Package-scoped config (`@zereight:registry`) takes precedence, matching how
+ * npm itself resolves the registry for a scoped package like this one.
+ */
+async function resolveConfiguredRegistry() {
+    const scoped = await npmConfigGet("@zereight:registry");
+    if (scoped)
+        return scoped;
+    const unscoped = await npmConfigGet("registry");
+    if (unscoped)
+        return unscoped;
+    return DEFAULT_NPM_REGISTRY;
+}
+function authTokenConfigKeys(registry) {
+    if (!isUsableRegistryUrl(registry))
+        return [];
+    const parsed = new URL(registry);
+    if (parsed.protocol !== "https:")
+        return [];
+    const keys = [];
+    let path = parsed.pathname.replace(/\/$/, "");
+    while (true) {
+        const key = `//${parsed.host}${path}/:_authToken`;
+        if (AUTH_TOKEN_KEY_PATTERN.test(key))
+            keys.push(key);
+        if (path === "")
+            break;
+        const slash = path.lastIndexOf("/");
+        path = slash <= 0 ? "" : path.slice(0, slash);
+    }
+    return keys;
+}
+async function npmrcCandidatePaths() {
+    const paths = [];
+    const configuredGlobal = process.env.NPM_CONFIG_GLOBALCONFIG;
+    const globalconfig = configuredGlobal || (await npmConfigGet("globalconfig"));
+    if (globalconfig)
+        paths.push(globalconfig);
+    paths.push(process.env.NPM_CONFIG_USERCONFIG ?? join(homedir(), ".npmrc"));
+    paths.push(join(process.cwd(), ".npmrc"));
+    return paths;
+}
+function unquoteNpmrcValue(value) {
+    if (value.length >= 2) {
+        const start = value[0];
+        const end = value[value.length - 1];
+        if ((start === '"' && end === '"') || (start === "'" && end === "'")) {
+            return value.slice(1, -1);
+        }
+    }
+    return value;
+}
+function expandNpmrcEnv(value) {
+    return value.replace(NPMRC_ENV_PATTERN, (_match, name) => process.env[name] ?? "");
+}
+function parseNpmrc(content) {
+    const entries = new Map();
+    for (const rawLine of content.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#") || line.startsWith(";"))
+            continue;
+        const separator = line.indexOf("=");
+        if (separator <= 0)
+            continue;
+        const key = line.slice(0, separator).trim();
+        const value = expandNpmrcEnv(unquoteNpmrcValue(line.slice(separator + 1).trim()));
+        entries.set(key, value);
+    }
+    return entries;
+}
+async function readNpmrcFile(path) {
+    try {
+        return parseNpmrc(await readFile(path, "utf8"));
+    }
+    catch {
+        return new Map();
+    }
+}
+/**
+ * Reads `//host[:port][/path]/:_authToken` from npmrc files, then walks up
+ * parent paths to `//host/:_authToken`, matching npm-registry-fetch.
+ * `npm config get` refuses to print protected auth keys, so this parses the
+ * files npm itself would consult instead of asking the CLI.
+ */
+async function resolveRegistryAuthToken(registry) {
+    const keys = authTokenConfigKeys(registry);
+    if (keys.length === 0)
+        return null;
+    const merged = new Map();
+    for (const path of await npmrcCandidatePaths()) {
+        const entries = await readNpmrcFile(path);
+        for (const [entryKey, value] of entries)
+            merged.set(entryKey, value);
+    }
+    for (const key of keys) {
+        const token = merged.get(key);
+        if (token)
+            return token;
+    }
+    return null;
+}
+function requestIsUnderRegistry(registry, requestUrl) {
+    try {
+        const parsedRegistry = new URL(registry);
+        const parsedRequest = new URL(requestUrl);
+        if (parsedRegistry.protocol !== "https:" || parsedRequest.protocol !== "https:")
+            return false;
+        if (parsedRegistry.origin !== parsedRequest.origin)
+            return false;
+        const basePath = parsedRegistry.pathname.replace(/\/$/, "");
+        if (basePath === "")
+            return true;
+        return parsedRequest.pathname === basePath || parsedRequest.pathname.startsWith(`${basePath}/`);
+    }
+    catch {
+        return false;
+    }
+}
+function readVersionField(data) {
+    if (typeof data !== "object" || data === null)
+        return null;
+    if (!("version" in data))
+        return null;
+    const version = data.version;
+    return typeof version === "string" ? version : null;
+}
 export function isNewerVersion(candidate, current) {
     const parse = (version) => version.split(".").map(part => Number.parseInt(part, 10));
     const a = parse(candidate);
@@ -12,16 +183,27 @@ export function isNewerVersion(candidate, current) {
     }
     return false;
 }
-export async function fetchLatestVersion(fetchFn = fetch, timeoutMs = 3000) {
+export async function fetchLatestVersion(fetchFn = fetch, timeoutMs = 3000, resolveRegistry = resolveConfiguredRegistry) {
     try {
-        const response = await fetchFn(NPM_REGISTRY_LATEST_URL, {
+        const resolved = (await resolveRegistry()).replace(/\/$/, "");
+        const registry = isUsableRegistryUrl(resolved) ? resolved : DEFAULT_NPM_REGISTRY;
+        const registryLatestUrl = `${registry}/${PACKAGE_LATEST_PATH}`;
+        const headers = { accept: "application/json" };
+        const init = {
             signal: AbortSignal.timeout(timeoutMs),
-            headers: { accept: "application/json" },
-        });
+            headers,
+        };
+        const token = await resolveRegistryAuthToken(registry).catch(() => null);
+        if (token && requestIsUnderRegistry(registry, registryLatestUrl)) {
+            headers.authorization = `Bearer ${token}`;
+            // Never follow redirects with a token attached — fetch would otherwise
+            // forward Authorization to a different origin.
+            init.redirect = "error";
+        }
+        const response = await fetchFn(registryLatestUrl, init);
         if (!response.ok)
             return null;
-        const data = (await response.json());
-        return typeof data.version === "string" ? data.version : null;
+        return readVersionField(await response.json());
     }
     catch {
         // Fail silent: the update check must never break or delay server startup

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.54",
+  "version": "2.1.56",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [