@zereight/mcp-gitlab 2.1.55 → 2.1.57

package/README.ko.md

@@ -17,7 +17,7 @@ PAT, OAuth, 읽기 전용 모드, 동적 API URL, 원격 인증을 지원하며
 
 ### 왜 이 GitLab MCP를 사용하나요?
 
-- **217개 도구 + `discover_tools`** — 작은 toolset으로 시작하고, 런타임에 카테고리 활성화
+- **232개 도구 + `discover_tools`** — 작은 toolset으로 시작하고, 런타임에 카테고리 활성화
 - **MR 2단계 리뷰** — `list_merge_request_changed_files` → 배치 `get_merge_request_file_diff`
 - **Agent Skill 내장** — `skills/gitlab-mcp/` 워크플로우 가이드
 - **유연한 인증** — Personal Access Token, 로컬 OAuth2 브라우저 플로우, MCP OAuth 프록시, 요청별 원격 인증
@@ -30,9 +30,9 @@ PAT, OAuth, 읽기 전용 모드, 동적 API URL, 원격 인증을 지원하며
 | | @zereight/mcp-gitlab | GitLab MCP A (커뮤니티 CQRS형) |
 |---|----------------------|--------------------------------|
 | **적합한 경우** | AI 에이전트 워크플로우 | 엔터프라이즈 멀티 인스턴스 / 그룹형 도구 |
-| **도구 모델** | ~217개 세분화 도구 + `discover_tools` | ~50–60개 `browse_*` / `manage_*` 그룹 도구 |
+| **도구 모델** | ~232개 세분화 도구 + `discover_tools` | ~50–60개 `browse_*` / `manage_*` 그룹 도구 |
 | **MR 리뷰** | 2단계 배치 diff | 서버마다 다름 |
-| **Node.js** | >=18 | 보통 >=24 |
+| **Node.js** | >=18.17 | 보통 >=24 |
 | **라이선스** | MIT | 서버마다 다름 |
 
 [전체 비교 →](./docs/comparison/community-gitlab-mcp-a.md)
@@ -98,7 +98,7 @@ npm install -g @zereight/mcp-gitlab
 
 예시는 기존 `mcp-gitlab`보다 충돌 가능성이 낮은 `zereight-mcp-gitlab` 별칭을 사용합니다. MCP 클라이언트가 찾지 못하면 `which zereight-mcp-gitlab`의 절대 경로를 사용하세요.
 
-전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.54`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
+전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.56`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
 
 #### CLI 인자 사용하기(환경 변수 문제가 있는 클라이언트용)
 
@@ -288,7 +288,7 @@ MCP 클라이언트 설정:
 | `STREAMABLE_HTTP`                                                | 예   | 반드시 `true`                                                                                                           |
 | `ENABLE_DYNAMIC_API_URL`                                         | 선택 | 요청별 `X-GitLab-API-URL` 헤더 허용                                                                                     |
 | `GITLAB_ALLOWED_HOSTS`                                           | 선택 | 허용할 `X-GitLab-API-URL` 호스트의 쉼표 구분 목록; `GITLAB_API_URL` 호스트는 항상 허용                                  |
-| `GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY`                    | 선택 | 인증 없이 `initialize`, `notifications/initialized`, `tools/list`만 허용(도구 호출은 여전히 인증 필요)                  |
+| `GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY`                    | 선택 | 인증 없이 `initialize`, `notifications/initialized`, `tools/list`, `server/discover`만 허용(도구 호출은 여전히 인증 필요)                  |
 | `MCP_SERVER_URL` / `MCP_ALLOWED_HOSTS` / `MCP_ALLOWED_ORIGINS` | 선택 | DNS rebinding 방지를 위한 허용 `/mcp` 호스트/오리진 값                                                                  |
 | `MCP_TRUST_PROXY`                                                | 선택 | 리버스 프록시 뒤에서 `Forwarded` / `X-Forwarded-*` 헤더 신뢰(다운로드 URL, Express `req.ip`, `/mcp` IP rate limit, OAuth rate limit) |
 

package/README.md

@@ -22,7 +22,7 @@ Supports PAT, OAuth, read-only mode, dynamic API URLs, and remote authorization
 
 ### Why use this GitLab MCP?
 
-- **229 tools + `discover_tools`** — start with a small toolset; activate more at runtime without CQRS-style grouping
+- **232 tools + `discover_tools`** — start with a small toolset; activate more at runtime without CQRS-style grouping
 - **MR 2-step review** — `list_merge_request_changed_files` → batched `get_merge_request_file_diff`
 - **Agent Skill built in** — workflow guidance in `skills/gitlab-mcp/`
 - **Flexible auth** — Personal Access Token, local OAuth2 browser flow, MCP OAuth proxy, and per-request remote authorization
@@ -35,9 +35,9 @@ Supports PAT, OAuth, read-only mode, dynamic API URLs, and remote authorization
 | | @zereight/mcp-gitlab | GitLab MCP A (community CQRS-style) |
 |---|----------------------|-------------------------------------|
 | **Best for** | AI agent workflows | Enterprise multi-instance / grouped tools |
-| **Tool model** | ~229 granular tools + `discover_tools` | ~50–60 grouped `browse_*` / `manage_*` tools |
+| **Tool model** | ~232 granular tools + `discover_tools` | ~50–60 grouped `browse_*` / `manage_*` tools |
 | **MR review** | 2-step batched diff | Varies |
-| **Node.js** | >=18 | Often >=24 |
+| **Node.js** | >=18.17 | Often >=24 |
 | **License** | MIT | Varies |
 
 [Full comparison →](./docs/comparison/community-gitlab-mcp-a.md)
@@ -103,7 +103,7 @@ npm install -g @zereight/mcp-gitlab
 
 The examples use `zereight-mcp-gitlab`, a less collision-prone alias for the legacy `mcp-gitlab` binary. If your MCP client cannot find it, use the absolute path from `which zereight-mcp-gitlab`.
 
-No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.1.54`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
+No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.1.56`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
 
 #### Using CLI Arguments (for clients with env var issues)
 
@@ -316,7 +316,7 @@ the token to GitLab on behalf of the caller.
 | `STREAMABLE_HTTP`                             | ✅       | Must be `true`                                                                                                          |
 | `ENABLE_DYNAMIC_API_URL`                      | optional | Allow per-request GitLab URL via `X-GitLab-API-URL` header                                                              |
 | `GITLAB_ALLOWED_HOSTS`                        | optional | Comma-separated allowed `X-GitLab-API-URL` hosts; `GITLAB_API_URL` hosts are always allowed                             |
-| `GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY` | optional | Allow unauthenticated `initialize`, `notifications/initialized`, and `tools/list` only (tool calls still require auth)  |
+| `GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY` | optional | Allow unauthenticated `initialize`, `notifications/initialized`, `tools/list`, and `server/discover` only (tool calls still require auth)  |
 | `MCP_SERVER_URL` / `MCP_ALLOWED_HOSTS` / `MCP_ALLOWED_ORIGINS` | optional | Allowed public `/mcp` host/origin values for DNS rebinding protection                                   |
 | `MCP_TRUST_PROXY`                             | optional | Trust `Forwarded` / `X-Forwarded-*` headers behind a reverse proxy (download URLs, Express `req.ip`, `/mcp` IP rate limits, OAuth rate limits) |
 
@@ -777,30 +777,33 @@ Register the skill directory in your AI client to get optimal tool usage guidanc
 204. `get_timeline_events` - List timeline events for an incident. Returns chronological events with notes, timestamps, and tags
 205. `create_timeline_event` - Create a timeline event on an incident. Supports tags: 'Start time', 'End time', 'Impact detected', 'Response initiated', 'Impact mitigated', 'Cause identified'
 206. `list_webhooks` - List all configured webhooks for a GitLab project or group. Provide either project_id or group_id
-207. `list_webhook_events` - List recent webhook events (past 7 days) for a project or group webhook. Use summary mode for overview, then get_webhook_event for full details
-208. `get_webhook_event` - Get full details of a specific webhook event by ID, including request/response payloads
-209. `search_code` - Search for code across all projects on the GitLab instance (requires advanced search or exact code search to be enabled)
-210. `search_project_code` - Search for code within a specific GitLab project (requires advanced search or exact code search to be enabled)
-211. `search_group_code` - Search for code within a specific GitLab group (requires advanced search or exact code search to be enabled)
-212. `list_project_variables` - List CI/CD variables for a project with optional environment scope filter
-213. `get_project_variable` - Get a single CI/CD variable from a project by key, with optional environment scope filter
-214. `create_project_variable` - Create a new CI/CD variable in a project
-215. `update_project_variable` - Update an existing CI/CD variable in a project, with optional filter to disambiguate by environment scope
-216. `delete_project_variable` - Delete a CI/CD variable from a project, with optional filter to disambiguate by environment scope
-217. `list_group_variables` - List CI/CD variables for a group with optional environment scope filter
-218. `get_group_variable` - Get a single CI/CD variable from a group by key, with optional environment scope filter
-219. `create_group_variable` - Create a new CI/CD variable in a group
-220. `update_group_variable` - Update an existing CI/CD variable in a group, with optional filter to disambiguate by environment scope
-221. `delete_group_variable` - Delete a CI/CD variable from a group, with optional filter to disambiguate by environment scope
-222. `get_dependency_proxy_settings` - Get dependency proxy settings for a group (enabled status, blob count, total size, image prefix, TTL policy)
-223. `update_dependency_proxy_settings` - Update dependency proxy settings for a group (enable/disable, credentials for authenticated Docker Hub pulls)
-224. `list_dependency_proxy_blobs` - List cached dependency proxy blobs for a group with cursor-based pagination
-225. `purge_dependency_proxy_cache` - Schedule purge of all cached dependency proxy blobs for a group
-226. `list_project_vulnerabilities` - List vulnerabilities for a project with optional state, severity, and report type filters (GraphQL-backed, cursor pagination)
-227. `get_vulnerability` - Get full details of a specific vulnerability
-228. `dismiss_vulnerability` - Dismiss a vulnerability with a reason (acceptable_risk, false_positive, used_in_tests, mitigating_control, not_applicable) and optional comment
-229. `confirm_vulnerability` - Confirm a vulnerability as a real finding requiring remediation
-230. `discover_tools` - Discover and activate additional tool categories for this session. Available categories: merge_requests, issues, repositories, branches, projects, labels, ci, groups, pipelines, milestones, wiki, releases, tags, users, workitems, webhooks, search, variables, dependency_proxy, vulnerabilities. Already-active categories are listed in the response.
+207. `create_webhook` - Create a webhook on a GitLab project or group
+208. `update_webhook` - Update an existing project or group webhook
+209. `delete_webhook` - Delete a project or group webhook
+210. `list_webhook_events` - List recent webhook events (past 7 days) for a project or group webhook. Use summary mode for overview, then get_webhook_event for full details
+211. `get_webhook_event` - Get full details of a specific webhook event by ID, including request/response payloads
+212. `search_code` - Search for code across all projects on the GitLab instance (requires advanced search or exact code search to be enabled)
+213. `search_project_code` - Search for code within a specific GitLab project (requires advanced search or exact code search to be enabled)
+214. `search_group_code` - Search for code within a specific GitLab group (requires advanced search or exact code search to be enabled)
+215. `list_project_variables` - List CI/CD variables for a project with optional environment scope filter
+216. `get_project_variable` - Get a single CI/CD variable from a project by key, with optional environment scope filter
+217. `create_project_variable` - Create a new CI/CD variable in a project
+218. `update_project_variable` - Update an existing CI/CD variable in a project, with optional filter to disambiguate by environment scope
+219. `delete_project_variable` - Delete a CI/CD variable from a project, with optional filter to disambiguate by environment scope
+220. `list_group_variables` - List CI/CD variables for a group with optional environment scope filter
+221. `get_group_variable` - Get a single CI/CD variable from a group by key, with optional environment scope filter
+222. `create_group_variable` - Create a new CI/CD variable in a group
+223. `update_group_variable` - Update an existing CI/CD variable in a group, with optional filter to disambiguate by environment scope
+224. `delete_group_variable` - Delete a CI/CD variable from a group, with optional filter to disambiguate by environment scope
+225. `get_dependency_proxy_settings` - Get dependency proxy settings for a group (enabled status, blob count, total size, image prefix, TTL policy)
+226. `update_dependency_proxy_settings` - Update dependency proxy settings for a group (enable/disable, credentials for authenticated Docker Hub pulls)
+227. `list_dependency_proxy_blobs` - List cached dependency proxy blobs for a group with cursor-based pagination
+228. `purge_dependency_proxy_cache` - Schedule purge of all cached dependency proxy blobs for a group
+229. `list_project_vulnerabilities` - List vulnerabilities for a project with optional state, severity, and report type filters (GraphQL-backed, cursor pagination)
+230. `get_vulnerability` - Get full details of a specific vulnerability
+231. `dismiss_vulnerability` - Dismiss a vulnerability with a reason (acceptable_risk, false_positive, used_in_tests, mitigating_control, not_applicable) and optional comment
+232. `confirm_vulnerability` - Confirm a vulnerability as a real finding requiring remediation
+233. `discover_tools` - Discover and activate additional tool categories for this session. Available categories: merge_requests, issues, repositories, branches, projects, labels, ci, groups, pipelines, milestones, wiki, releases, tags, users, workitems, webhooks, search, variables, dependency_proxy, vulnerabilities. Already-active categories are listed in the response.
 
 <!-- TOOLS-END -->
 

package/README.zh-CN.md

@@ -17,7 +17,7 @@
 
 ### 为什么使用这个 GitLab MCP？
 
-- **217 个工具 + `discover_tools`** — 从小型 toolset 开始，运行时按需激活类别
+- **232 个工具 + `discover_tools`** — 从小型 toolset 开始，运行时按需激活类别
 - **MR 两步审查** — `list_merge_request_changed_files` → 批量 `get_merge_request_file_diff`
 - **内置 Agent Skill** — `skills/gitlab-mcp/` 工作流指南
 - **认证灵活** — Personal Access Token、本地 OAuth2 浏览器流程、MCP OAuth 代理、按请求远程授权
@@ -30,9 +30,9 @@
 | | @zereight/mcp-gitlab | GitLab MCP A（社区 CQRS 型） |
 |---|----------------------|------------------------------|
 | **更适合** | AI 代理工作流 | 企业多实例 / 分组工具 |
-| **工具模型** | ~217 个细粒度工具 + `discover_tools` | ~50–60 个 `browse_*` / `manage_*` 分组工具 |
+| **工具模型** | ~232 个细粒度工具 + `discover_tools` | ~50–60 个 `browse_*` / `manage_*` 分组工具 |
 | **MR 审查** | 两步批量 diff | 因服务器而异 |
-| **Node.js** | >=18 | 通常 >=24 |
+| **Node.js** | >=18.17 | 通常 >=24 |
 | **许可证** | MIT | 因服务器而异 |
 
 [完整对比 →](./docs/comparison/community-gitlab-mcp-a.md)
@@ -98,7 +98,7 @@ npm install -g @zereight/mcp-gitlab
 
 示例使用 `zereight-mcp-gitlab`，这是比旧的 `mcp-gitlab` 更不容易冲突的别名。如果 MCP 客户端找不到它，请使用 `which zereight-mcp-gitlab` 输出的绝对路径。
 
-如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.1.54`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
+如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.1.56`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
 
 #### 使用 CLI 参数（适用于环境变量有问题的客户端）
 
@@ -289,7 +289,7 @@ MCP 客户端配置：
 | `STREAMABLE_HTTP`                                                | 是   | 必须为 `true`                                                                                                           |
 | `ENABLE_DYNAMIC_API_URL`                                         | 可选 | 允许按请求通过 `X-GitLab-API-URL` 请求头指定 GitLab URL                                                                 |
 | `GITLAB_ALLOWED_HOSTS`                                           | 可选 | 允许的 `X-GitLab-API-URL` 主机逗号分隔列表；`GITLAB_API_URL` 中的主机始终允许                                          |
-| `GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY`                    | 可选 | 仅允许未认证的 `initialize`、`notifications/initialized`、`tools/list`（工具调用仍需认证）                                |
+| `GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY`                    | 可选 | 仅允许未认证的 `initialize`、`notifications/initialized`、`tools/list`、`server/discover`（工具调用仍需认证）                                |
 | `MCP_SERVER_URL` / `MCP_ALLOWED_HOSTS` / `MCP_ALLOWED_ORIGINS` | 可选 | 用于 DNS rebinding 防护的允许 `/mcp` 主机/来源值                                                                        |
 | `MCP_TRUST_PROXY`                                                | 可选 | 在反向代理后信任 `Forwarded` / `X-Forwarded-*` 请求头（下载 URL、Express `req.ip`、`/mcp` IP 速率限制、OAuth 速率限制） |
 

package/build/auth-retry.js

@@ -5,34 +5,55 @@
  * importing index.ts (which has heavy side effects: starts the MCP server,
  * reads env vars, etc.).
  */
-import { Headers } from "node-fetch";
+function isTupleArray(headers) {
+    if (!Array.isArray(headers))
+        return false;
+    return headers.every(entry => Array.isArray(entry) &&
+        entry.length >= 2 &&
+        typeof entry[0] === "string" &&
+        typeof entry[1] === "string");
+}
+function hasForEach(headers) {
+    return "forEach" in headers && typeof headers.forEach === "function";
+}
+function isPlainStringHeaders(headers) {
+    return Object.values(headers).every(value => typeof value === "string");
+}
 /**
  * Convert various header representations to a plain Record<string, string>.
  */
 export function headersToPlainObject(headers) {
-    if (!headers)
+    if (!headers || typeof headers !== "object")
         return {};
-    if (headers instanceof Headers) {
+    if (isTupleArray(headers)) {
+        return Object.fromEntries(headers);
+    }
+    if (hasForEach(headers)) {
         const obj = {};
-        headers.forEach((value, key) => { obj[key] = value; });
+        headers.forEach((value, key) => {
+            obj[key] = value;
+        });
         return obj;
     }
-    if (Array.isArray(headers)) {
-        return Object.fromEntries(headers);
+    if (isPlainStringHeaders(headers)) {
+        return headers;
     }
-    return headers;
+    return {};
 }
 /**
- * Detect request bodies that cannot be replayed (streams, FormData).
+ * Detect request bodies that cannot be replayed (streams).
  */
+function hasCallableMethod(body, name) {
+    return name in body && typeof Reflect.get(body, name) === "function";
+}
 export function isNonReplayableBody(body) {
-    if (!body)
+    if (!body || typeof body !== "object")
         return false;
-    // Stream-like objects (has .pipe or .read)
-    if (typeof body.pipe === "function" || typeof body.read === "function")
+    if (hasCallableMethod(body, "pipe"))
         return true;
-    // form-data instances (duck-type check since FormData is dynamically imported)
-    if (typeof body.getBuffer === "function" && typeof body.getBoundary === "function")
+    if (hasCallableMethod(body, "read"))
+        return true;
+    if (hasCallableMethod(body, "getReader"))
         return true;
     return false;
 }
@@ -41,24 +62,19 @@ export function isNonReplayableBody(body) {
  * On a 401, force-refreshes the OAuth token and retries the request once.
  * The retry calls baseFetch directly (not the wrapper), so infinite loops are impossible.
  * In non-OAuth mode, the wrapper is a transparent pass-through.
- *
- * When called without `config`, falls back to module globals in index.ts.
- * When called with `config` (tests), uses injected dependencies.
  */
 export function wrapWithAuthRetry(baseFetch, config) {
     let refreshLock = null;
     const log = config.logger ?? { info: () => { }, error: () => { } };
-    return (async (url, options) => {
+    const wrapped = async (url, options) => {
         const response = await baseFetch(url, options);
         if (response.status === 401 && config.isOAuthEnabled()) {
-            // Skip retry for non-replayable bodies (streams, FormData) since the first request consumed them
             if (isNonReplayableBody(options?.body)) {
                 log.info("Received 401 but request body is not replayable (stream/FormData), skipping retry.");
                 return response;
             }
             log.info("Received 401, force-refreshing OAuth token and retrying...");
             try {
-                // Mutex: coalesce concurrent refresh attempts into a single in-flight request
                 if (!refreshLock) {
                     refreshLock = config.refreshToken(true).finally(() => {
                         refreshLock = null;
@@ -77,5 +93,6 @@ export function wrapWithAuthRetry(baseFetch, config) {
             }
         }
         return response;
-    });
+    };
+    return wrapped;
 }

package/build/downloads/proxy.js

@@ -1,3 +1,5 @@
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
 import { decryptDownloadToken } from "../utils/download-token.js";
 const DEFAULT_DOWNLOAD_TIMEOUT_MS = 120_000;
 function canonicalizeQueryParams(params) {
@@ -156,10 +158,9 @@ export function registerDownloadProxy(app, deps) {
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), downloadTimeoutMs);
         try {
-            const agent = deps.getAgentFunctionForUrl(apiUrl);
             const gitlabResponse = await deps.fetch(gitlabUrl, {
                 headers,
-                agent,
+                dispatcher: deps.getDispatcherForUrl(apiUrl),
                 signal: controller.signal,
             });
             if (!gitlabResponse.ok) {
@@ -177,12 +178,11 @@ export function registerDownloadProxy(app, deps) {
                 res.setHeader("Content-Disposition", contentDisposition);
             if (contentLength)
                 res.setHeader("Content-Length", contentLength);
-            if (gitlabResponse.body) {
-                gitlabResponse.body.pipe(res);
-            }
-            else {
+            if (!gitlabResponse.body) {
                 res.status(502).json({ error: "No response body from GitLab" });
+                return;
             }
+            await pipeline(Readable.fromWeb(gitlabResponse.body), res);
         }
         catch (error) {
             deps.logger.error({ err: error }, "Download proxy error");