@zereight/mcp-gitlab 2.1.55 → 2.1.57

package/build/schemas.js

@@ -4091,6 +4091,14 @@ export const CreateTimelineEventSchema = z.object({
         .describe("Timeline event tags to attach. Available: 'Start time', 'End time', 'Impact detected', 'Response initiated', 'Impact mitigated', 'Cause identified'."),
 });
 // --- Webhook schemas ---
+function hasExactlyOneWebhookScope(data) {
+    const hasProject = Boolean(data.project_id);
+    const hasGroup = Boolean(data.group_id);
+    return (hasProject || hasGroup) && !(hasProject && hasGroup);
+}
+const EXACTLY_ONE_WEBHOOK_SCOPE = {
+    message: "Provide exactly one of project_id or group_id",
+};
 export const ListWebhooksSchema = z
     .object({
     project_id: z.coerce
@@ -4103,9 +4111,7 @@ export const ListWebhooksSchema = z
         .describe("Group ID or URL-encoded path. Provide either project_id or group_id, not both."),
 })
     .merge(PaginationOptionsSchema)
-    .refine(data => (data.project_id || data.group_id) && !(data.project_id && data.group_id), {
-    message: "Provide exactly one of project_id or group_id",
-});
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
 export const ListWebhookEventsSchema = z
     .object({
     project_id: z.coerce
@@ -4128,9 +4134,7 @@ export const ListWebhookEventsSchema = z
     per_page: z.number().max(20).optional().default(20).describe("Number of events per page"),
     page: z.coerce.number().optional().describe("Page number for pagination"),
 })
-    .refine(data => (data.project_id || data.group_id) && !(data.project_id && data.group_id), {
-    message: "Provide exactly one of project_id or group_id",
-});
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
 export const GetWebhookEventSchema = z
     .object({
     project_id: z.coerce
@@ -4148,9 +4152,115 @@ export const GetWebhookEventSchema = z
         .optional()
         .describe("If known, the page where the event is located (from list_webhook_events). Skips auto-pagination and fetches only this page."),
 })
-    .refine(data => (data.project_id || data.group_id) && !(data.project_id && data.group_id), {
-    message: "Provide exactly one of project_id or group_id",
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
+const WebhookCustomHeaderSchema = z.object({
+    key: z.string().min(1).describe("Custom header name"),
+    value: z.string().describe("Custom header value"),
 });
+const WebhookMutationFields = {
+    url: z.string().url().describe("Webhook destination URL"),
+    name: z.string().optional().describe("Display name for the webhook"),
+    description: z.string().optional().describe("Description of the webhook"),
+    token: z
+        .string()
+        .optional()
+        .describe("Secret token to validate received payloads. Not returned by GitLab in responses."),
+    signing_token: z
+        .string()
+        .optional()
+        .describe("HMAC signing token in whsec_<base64> form, where the Base64 suffix encodes a 32-byte key. Used for the webhook-signature header. Not returned by GitLab in responses."),
+    enable_ssl_verification: z
+        .boolean()
+        .optional()
+        .describe("Verify SSL when delivering the webhook"),
+    push_events: z.boolean().optional().describe("Trigger on push events"),
+    push_events_branch_filter: z
+        .string()
+        .optional()
+        .describe("Only trigger push events for matching branches"),
+    branch_filter_strategy: z
+        .enum(["wildcard", "regex", "all_branches"])
+        .optional()
+        .describe("How push_events_branch_filter is interpreted"),
+    issues_events: z.boolean().optional().describe("Trigger on issue events"),
+    confidential_issues_events: z
+        .boolean()
+        .optional()
+        .describe("Trigger on confidential issue events"),
+    merge_requests_events: z.boolean().optional().describe("Trigger on merge request events"),
+    tag_push_events: z.boolean().optional().describe("Trigger on tag push events"),
+    note_events: z.boolean().optional().describe("Trigger on note/comment events"),
+    confidential_note_events: z
+        .boolean()
+        .optional()
+        .describe("Trigger on confidential note events"),
+    job_events: z.boolean().optional().describe("Trigger on job events"),
+    pipeline_events: z.boolean().optional().describe("Trigger on pipeline events"),
+    wiki_page_events: z.boolean().optional().describe("Trigger on wiki page events"),
+    deployment_events: z.boolean().optional().describe("Trigger on deployment events"),
+    feature_flag_events: z.boolean().optional().describe("Trigger on feature flag events"),
+    releases_events: z.boolean().optional().describe("Trigger on release events"),
+    milestone_events: z.boolean().optional().describe("Trigger on milestone events"),
+    resource_access_token_events: z
+        .boolean()
+        .optional()
+        .describe("Trigger on access token expiry events"),
+    resource_deploy_token_events: z
+        .boolean()
+        .optional()
+        .describe("Trigger on project deploy token expiry events (project webhooks)"),
+    member_events: z.boolean().optional().describe("Trigger on member events (group webhooks)"),
+    project_events: z.boolean().optional().describe("Trigger on project events (group webhooks)"),
+    subgroup_events: z.boolean().optional().describe("Trigger on subgroup events (group webhooks)"),
+    custom_webhook_template: z
+        .string()
+        .optional()
+        .describe("Custom JSON payload template for the webhook"),
+    custom_headers: z
+        .array(WebhookCustomHeaderSchema)
+        .optional()
+        .describe("Custom HTTP headers sent with the webhook. Each item has key and value strings."),
+};
+export const CreateWebhookSchema = z
+    .object({
+    project_id: z.coerce
+        .string()
+        .optional()
+        .describe("Project ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    group_id: z.coerce
+        .string()
+        .optional()
+        .describe("Group ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    ...WebhookMutationFields,
+})
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
+export const UpdateWebhookSchema = z
+    .object({
+    project_id: z.coerce
+        .string()
+        .optional()
+        .describe("Project ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    group_id: z.coerce
+        .string()
+        .optional()
+        .describe("Group ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    hook_id: z.coerce.number().describe("ID of the webhook to update"),
+    ...WebhookMutationFields,
+})
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
+export const DeleteWebhookSchema = z
+    .object({
+    project_id: z.coerce
+        .string()
+        .optional()
+        .describe("Project ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    group_id: z.coerce
+        .string()
+        .optional()
+        .describe("Group ID or URL-encoded path. Provide either project_id or group_id, not both."),
+    hook_id: z.coerce.number().describe("ID of the webhook to delete"),
+})
+    .refine(hasExactlyOneWebhookScope, EXACTLY_ONE_WEBHOOK_SCOPE);
 export const HealthCheckSchema = z.object({});
 // --- CI/CD Variable types ---
 export const GitLabCiVariableSchema = z.object({

package/build/scripts/generate-tool-docs.js

@@ -101,7 +101,7 @@ const GROUP_META = {
     },
     webhooks: {
         title: "Webhooks",
-        blurb: "List webhooks configured on projects or groups, and inspect recent webhook events.",
+        blurb: "Create, update, and delete project or group webhooks, and inspect recent webhook events.",
     },
     search: {
         title: "Search",

package/build/server/request-helpers.js

@@ -34,7 +34,10 @@ export function isUnauthenticatedDiscoveryRequestBody(body) {
         if (typeof m !== "object" || m === null)
             return false;
         const method = m.method;
-        return (method === "initialize" || method === "notifications/initialized" || method === "tools/list");
+        return (method === "initialize" ||
+            method === "notifications/initialized" ||
+            method === "tools/list" ||
+            method === "server/discover");
     };
     if (Array.isArray(body))
         return body.every(isDiscoveryMethod);

package/build/test/no-proxy-test.js

@@ -134,5 +134,16 @@ describe('NO_PROXY Pattern Matching', () => {
         assert.strictEqual(agent1.constructor.name, 'Agent', 'Should match case-insensitively (lowercase)');
         assert.strictEqual(agent2.constructor.name, 'Agent', 'Should match case-insensitively (uppercase)');
     });
+    test('should re-evaluate NO_PROXY for redirect origins', () => {
+        const pool = new GitLabClientPool({
+            httpProxy: 'http://proxy.example.com:8080',
+            httpsProxy: 'http://proxy.example.com:8080',
+            noProxy: 'gitlab.internal.com',
+        });
+        const proxyToBypass = pool.getDispatcherForOrigin('https://gitlab.external.com/api/v4', 'https://gitlab.internal.com/api/v4');
+        const bypassToProxy = pool.getDispatcherForOrigin('https://gitlab.internal.com/api/v4', 'https://gitlab.external.com/api/v4');
+        assert.strictEqual(proxyToBypass.constructor.name, 'Agent', 'redirect onto NO_PROXY host should bypass');
+        assert.notStrictEqual(bypassToProxy.constructor.name, 'Agent', 'redirect onto proxied host should use proxy');
+    });
 });
 console.log('✅ NO_PROXY tests completed');

package/build/test/remote-auth-tests.js

@@ -4,7 +4,6 @@
  */
 import { describe, test, after, before } from 'node:test';
 import assert from 'node:assert';
-import fetch from 'node-fetch';
 import { launchServer, findAvailablePort, cleanupServers, TransportMode, checkHealthEndpoint, HOST } from './utils/server-launcher.js';
 console.log('🔐 Remote Authorization Tests');
 console.log('');

package/build/test/server/request-helpers.test.js

@@ -16,12 +16,22 @@ describe("streamable request helpers", () => {
     });
     test("allows only discovery methods in unauthenticated discovery bodies", () => {
         assert.strictEqual(isUnauthenticatedDiscoveryRequestBody({ method: "tools/list" }), true);
+        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody({ method: "server/discover" }), true);
         assert.strictEqual(isUnauthenticatedDiscoveryRequestBody([
             { method: "initialize" },
             { method: "notifications/initialized" },
             { method: "tools/list" },
+            { method: "server/discover" },
         ]), true);
-        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody([{ method: "tools/list" }, { method: "call_tool" }]), false);
+        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody([
+            { method: "tools/list" },
+            { method: "call_tool" },
+            { method: "tools/call" },
+        ]), false);
+        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody([
+            { method: "server/discover" },
+            { method: "tools/call" },
+        ]), false);
         assert.strictEqual(isUnauthenticatedDiscoveryRequestBody(undefined), false);
     });
     test("normalizes Mcp-Session-Id headers", () => {

package/build/test/streamable-http-unauthenticated-discovery.test.js

@@ -106,6 +106,54 @@ describe("Streamable HTTP unauthenticated tool discovery", { timeout: 20_000 },
         assert.ok(Array.isArray(listResponse.data.result?.tools), "tools/list should return tools");
         assert.ok(listResponse.data.result.tools.length > 0, "tools/list should not be empty");
     });
+    test("allows unauthenticated server/discover in individual and batch requests", async () => {
+        const { server, mcpUrl } = await launchRemoteAuthServer({
+            GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",
+        });
+        servers.push(server);
+        const preInitDiscover = await rawMcpRequest(mcpUrl, {
+            jsonrpc: "2.0",
+            id: 10,
+            method: "server/discover",
+            params: {},
+        });
+        assert.strictEqual(preInitDiscover.status, 400, preInitDiscover.text);
+        assert.match(preInitDiscover.data?.error?.message ?? "", /Server not initialized/i, "server/discover should pass the auth gate before MCP initialization errors");
+        const sessionId = await initialize(mcpUrl);
+        const initialized = await rawMcpRequest(mcpUrl, { jsonrpc: "2.0", method: "notifications/initialized" }, { "mcp-session-id": sessionId });
+        assert.ok([200, 202, 204].includes(initialized.status), initialized.text);
+        const discoverResponse = await rawMcpRequest(mcpUrl, { jsonrpc: "2.0", id: 11, method: "server/discover", params: {} }, { "mcp-session-id": sessionId });
+        assert.strictEqual(discoverResponse.status, 200, discoverResponse.text);
+        assert.strictEqual(discoverResponse.data?.id, 11);
+        assert.strictEqual(discoverResponse.data?.error?.code, -32601);
+        assert.match(discoverResponse.data?.error?.message ?? "", /Method not found/i);
+        const batchResponse = await rawMcpRequest(mcpUrl, [
+            { jsonrpc: "2.0", id: 12, method: "server/discover", params: {} },
+            { jsonrpc: "2.0", id: 13, method: "tools/list", params: {} },
+        ], { "mcp-session-id": sessionId });
+        assert.strictEqual(batchResponse.status, 200, batchResponse.text);
+        assert.ok(Array.isArray(batchResponse.data.result?.tools), "batch tools/list should return tools");
+        assert.ok(batchResponse.data.result.tools.length > 0, "batch tools/list should not be empty");
+    });
+    test("rejects unauthenticated discovery batch when tools/call is included", async () => {
+        const { server, mcpUrl } = await launchRemoteAuthServer({
+            GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",
+        });
+        servers.push(server);
+        const response = await rawMcpRequest(mcpUrl, [
+            { jsonrpc: "2.0", id: 20, method: "server/discover", params: {} },
+            {
+                jsonrpc: "2.0",
+                id: 21,
+                method: "tools/call",
+                params: {
+                    name: "get_project",
+                    arguments: { project_id: "123" },
+                },
+            },
+        ]);
+        assert.strictEqual(response.status, 401, response.text);
+    });
     test("expires unauthenticated discovery sessions and frees capacity", async () => {
         const { server, mcpUrl } = await launchRemoteAuthServer({
             GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY: "true",

package/build/test/test-auth-retry.js

@@ -6,20 +6,18 @@
  */
 import { describe, test } from "node:test";
 import assert from "node:assert";
-import { Headers, Response } from "node-fetch";
+import { Readable } from "node:stream";
+import { Response } from "undici";
 import { headersToPlainObject, isNonReplayableBody, wrapWithAuthRetry, } from "../auth-retry.js";
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
 function mockFetch(status) {
-    return (async () => new Response("", { status }));
+    return async () => new Response("", { status });
 }
 function mockFetchThenRetry() {
     let callCount = 0;
-    return (async () => {
+    return async () => {
         callCount++;
         return new Response("", { status: callCount === 1 ? 401 : 200 });
-    });
+    };
 }
 function makeConfig(overrides) {
     return {
@@ -30,9 +28,6 @@ function makeConfig(overrides) {
         ...overrides,
     };
 }
-// ---------------------------------------------------------------------------
-// headersToPlainObject
-// ---------------------------------------------------------------------------
 describe("headersToPlainObject", () => {
     test("null returns empty object", () => {
         assert.deepStrictEqual(headersToPlainObject(null), {});
@@ -63,9 +58,6 @@ describe("headersToPlainObject", () => {
         });
     });
 });
-// ---------------------------------------------------------------------------
-// isNonReplayableBody
-// ---------------------------------------------------------------------------
 describe("isNonReplayableBody", () => {
     test("null returns false", () => {
         assert.strictEqual(isNonReplayableBody(null), false);
@@ -85,16 +77,15 @@ describe("isNonReplayableBody", () => {
     test("object with .read() returns true (stream-like)", () => {
         assert.strictEqual(isNonReplayableBody({ read: () => { } }), true);
     });
-    test("object with .getBuffer() and .getBoundary() returns true (FormData-like)", () => {
-        assert.strictEqual(isNonReplayableBody({ getBuffer: () => { }, getBoundary: () => { } }), true);
-    });
-    test("object with only .getBuffer() (no .getBoundary()) returns false", () => {
-        assert.strictEqual(isNonReplayableBody({ getBuffer: () => { } }), false);
+    test("Web ReadableStream returns true", () => {
+        const stream = new ReadableStream({
+            start(controller) {
+                controller.close();
+            },
+        });
+        assert.strictEqual(isNonReplayableBody(stream), true);
     });
 });
-// ---------------------------------------------------------------------------
-// wrapWithAuthRetry
-// ---------------------------------------------------------------------------
 describe("wrapWithAuthRetry", () => {
     test("non-401 response passes through unchanged", async () => {
         const wrapped = wrapWithAuthRetry(mockFetch(200), makeConfig());
@@ -137,7 +128,29 @@ describe("wrapWithAuthRetry", () => {
         });
         const wrapped = wrapWithAuthRetry(mockFetch(401), config);
         const res = await wrapped("http://example.com", {
-            body: { pipe: () => { } }, // stream-like
+            body: Readable.from([]),
+            duplex: "half",
+        });
+        assert.strictEqual(res.status, 401);
+        assert.strictEqual(refreshCalled, false);
+    });
+    test("401 with Web ReadableStream body skips retry", async () => {
+        let refreshCalled = false;
+        const config = makeConfig({
+            refreshToken: async () => {
+                refreshCalled = true;
+                return "tok";
+            },
+        });
+        const stream = new ReadableStream({
+            start(controller) {
+                controller.close();
+            },
+        });
+        const wrapped = wrapWithAuthRetry(mockFetch(401), config);
+        const res = await wrapped("http://example.com", {
+            body: stream,
+            duplex: "half",
         });
         assert.strictEqual(res.status, 401);
         assert.strictEqual(refreshCalled, false);
@@ -148,27 +161,21 @@ describe("wrapWithAuthRetry", () => {
         const config = makeConfig({
             refreshToken: () => {
                 refreshCount++;
-                return new Promise((resolve) => {
+                return new Promise(resolve => {
                     resolveRefresh = resolve;
                 });
             },
             buildAuthHeaders: () => ({ Authorization: "Bearer stamped" }),
         });
-        // Each call returns 401 first, then 200 on retry
         let callCount = 0;
-        const base = (async () => {
+        const base = async () => {
             callCount++;
-            // First two calls are the initial requests (both 401)
-            // Next two are the retries (both 200)
             return new Response("", { status: callCount <= 2 ? 401 : 200 });
-        });
+        };
         const wrapped = wrapWithAuthRetry(base, config);
-        // Fire two concurrent requests
         const p1 = wrapped("http://example.com/a");
         const p2 = wrapped("http://example.com/b");
-        // Wait a tick for both to hit the refresh path
-        await new Promise((r) => setTimeout(r, 10));
-        // Resolve the single pending refresh
+        await new Promise(r => setTimeout(r, 10));
         resolveRefresh("stamped-token");
         const [r1, r2] = await Promise.all([p1, p2]);
         assert.strictEqual(r1.status, 200);

package/build/test/test-permission-mode.js

@@ -58,6 +58,7 @@ const DELETE_SAMPLE_TOOLS = [
     "delete_milestone",
     "delete_group_milestone",
     "delete_project_variable",
+    "delete_webhook",
 ];
 const MODIFY_SAMPLE_TOOLS = [
     "create_issue",

package/build/test/test-toolset-filtering.js

@@ -31,7 +31,7 @@ const TOOLSET_TOOL_COUNTS = {
     users: 7,
     search: 3,
     workitems: 18,
-    webhooks: 3,
+    webhooks: 6,
     groups: 1,
     variables: 10,
     dependency_proxy: 4,
@@ -83,7 +83,7 @@ const TOOLSET_SAMPLE_TOOLS = {
     tags: ["list_tags", "create_tag", "get_tag_signature"],
     users: ["get_users", "upload_markdown", "download_attachment"],
     search: ["search_code", "search_project_code", "search_group_code"],
-    webhooks: ["list_webhooks", "list_webhook_events", "get_webhook_event"],
+    webhooks: ["list_webhooks", "create_webhook", "update_webhook", "delete_webhook", "list_webhook_events", "get_webhook_event"],
     groups: ["create_group"],
     variables: ["list_project_variables", "create_project_variable", "delete_project_variable", "list_group_variables", "create_group_variable", "delete_group_variable"],
     dependency_proxy: ["get_dependency_proxy_settings", "list_dependency_proxy_blobs", "purge_dependency_proxy_cache"],

package/build/test/test-webhooks.js

@@ -0,0 +1,218 @@
+import { describe, test, before, after } from "node:test";
+import assert from "node:assert";
+import { spawn } from "child_process";
+import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
+const MOCK_TOKEN = "glpat-mock-token-webhooks";
+const TEST_PROJECT_ID = "123";
+const TEST_GROUP_ID = "my-group";
+const TEST_HOOK_ID = 42;
+const MOCK_PROJECT_HOOK = {
+    id: TEST_HOOK_ID,
+    url: "https://example.com/hook",
+    name: "AI Hook",
+    description: "Registered by MCP",
+    project_id: Number(TEST_PROJECT_ID),
+    push_events: true,
+    issues_events: false,
+    enable_ssl_verification: true,
+};
+const MOCK_GROUP_HOOK = {
+    id: TEST_HOOK_ID,
+    url: "https://example.com/group-hook",
+    name: "Group Hook",
+    group_id: 3,
+    push_events: true,
+    member_events: true,
+    enable_ssl_verification: true,
+};
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function callTool(toolName, args, env) {
+    return new Promise((resolve, reject) => {
+        const proc = spawn("node", ["build/index.js"], {
+            stdio: ["pipe", "pipe", "pipe"],
+            env: { ...process.env, ...env },
+        });
+        let output = "";
+        let errorOutput = "";
+        proc.stdout?.on("data", (d) => (output += d));
+        proc.stderr?.on("data", (d) => (errorOutput += d));
+        proc.on("close", code => {
+            if (code !== 0) {
+                return reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
+            }
+            const line = output.split("\n").find(l => l.startsWith("{"));
+            if (!line)
+                return reject(new Error("No JSON output found"));
+            try {
+                const response = JSON.parse(line);
+                if (response.error) {
+                    reject(new Error(response.error?.message ?? String(response.error)));
+                }
+                else {
+                    const content = response.result?.content?.[0]?.text;
+                    resolve(content ? JSON.parse(content) : response.result);
+                }
+            }
+            catch (e) {
+                reject(e);
+            }
+        });
+        proc.stdin?.end(JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "tools/call",
+            params: { name: toolName, arguments: args },
+        }) + "\n");
+    });
+}
+describe("When managing webhooks", () => {
+    let mockServer;
+    let baseEnv;
+    let lastCreateBody;
+    let lastUpdateBody;
+    let lastDeletePath;
+    before(async () => {
+        mockServer = new MockGitLabServer({
+            port: await findMockServerPort(),
+            validTokens: [MOCK_TOKEN],
+        });
+        mockServer.addMockHandler("post", `/projects/${TEST_PROJECT_ID}/hooks`, (req, res) => {
+            lastCreateBody = isRecord(req.body) ? req.body : undefined;
+            res.status(201).json({ ...MOCK_PROJECT_HOOK, ...lastCreateBody });
+        });
+        mockServer.addMockHandler("put", `/projects/${TEST_PROJECT_ID}/hooks/${TEST_HOOK_ID}`, (req, res) => {
+            lastUpdateBody = isRecord(req.body) ? req.body : undefined;
+            res.json({ ...MOCK_PROJECT_HOOK, ...lastUpdateBody, id: TEST_HOOK_ID });
+        });
+        mockServer.addMockHandler("delete", `/projects/${TEST_PROJECT_ID}/hooks/${TEST_HOOK_ID}`, (req, res) => {
+            lastDeletePath = req.path;
+            res.status(204).send();
+        });
+        mockServer.addMockHandler("post", `/groups/${TEST_GROUP_ID}/hooks`, (req, res) => {
+            lastCreateBody = isRecord(req.body) ? req.body : undefined;
+            res.status(201).json({ ...MOCK_GROUP_HOOK, ...lastCreateBody });
+        });
+        mockServer.addMockHandler("put", `/groups/${TEST_GROUP_ID}/hooks/${TEST_HOOK_ID}`, (req, res) => {
+            lastUpdateBody = isRecord(req.body) ? req.body : undefined;
+            res.json({ ...MOCK_GROUP_HOOK, ...lastUpdateBody, id: TEST_HOOK_ID });
+        });
+        mockServer.addMockHandler("delete", `/groups/${TEST_GROUP_ID}/hooks/${TEST_HOOK_ID}`, (req, res) => {
+            lastDeletePath = req.path;
+            res.status(204).send();
+        });
+        await mockServer.start();
+        baseEnv = {
+            GITLAB_API_URL: mockServer.getUrl() + "/api/v4",
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+            GITLAB_TOOLSETS: "webhooks",
+            GITLAB_READ_ONLY_MODE: "false",
+        };
+    });
+    after(async () => {
+        if (mockServer)
+            await mockServer.stop();
+    });
+    describe("with create_webhook on a project", () => {
+        test("should create a webhook and return the GitLab response", async () => {
+            lastCreateBody = undefined;
+            const result = await callTool("create_webhook", {
+                project_id: TEST_PROJECT_ID,
+                url: "https://example.com/hook",
+                name: "AI Hook",
+                push_events: true,
+                issues_events: true,
+            }, baseEnv);
+            assert.deepStrictEqual(lastCreateBody, {
+                url: "https://example.com/hook",
+                name: "AI Hook",
+                push_events: true,
+                issues_events: true,
+            });
+            assert.ok(isRecord(result));
+            assert.strictEqual(result.url, "https://example.com/hook");
+            assert.strictEqual(result.name, "AI Hook");
+        });
+    });
+    describe("with update_webhook on a project", () => {
+        test("should update a webhook and return the GitLab response", async () => {
+            lastUpdateBody = undefined;
+            const result = await callTool("update_webhook", {
+                project_id: TEST_PROJECT_ID,
+                hook_id: TEST_HOOK_ID,
+                url: "https://example.com/hook-updated",
+                name: "Renamed Hook",
+            }, baseEnv);
+            assert.deepStrictEqual(lastUpdateBody, {
+                url: "https://example.com/hook-updated",
+                name: "Renamed Hook",
+            });
+            assert.ok(isRecord(result));
+            assert.strictEqual(result.url, "https://example.com/hook-updated");
+        });
+    });
+    describe("with delete_webhook on a project", () => {
+        test("should delete a webhook and return a deleted status", async () => {
+            lastDeletePath = undefined;
+            const result = await callTool("delete_webhook", {
+                project_id: TEST_PROJECT_ID,
+                hook_id: TEST_HOOK_ID,
+            }, baseEnv);
+            assert.strictEqual(lastDeletePath, `/projects/${TEST_PROJECT_ID}/hooks/${TEST_HOOK_ID}`);
+            assert.deepStrictEqual(result, { status: "deleted", hook_id: TEST_HOOK_ID });
+        });
+    });
+    describe("with create_webhook on a group", () => {
+        test("should create a group webhook", async () => {
+            lastCreateBody = undefined;
+            const result = await callTool("create_webhook", {
+                group_id: TEST_GROUP_ID,
+                url: "https://example.com/group-hook",
+                member_events: true,
+            }, baseEnv);
+            assert.ok(lastCreateBody);
+            assert.strictEqual(lastCreateBody["url"], "https://example.com/group-hook");
+            assert.strictEqual(lastCreateBody["member_events"], true);
+            assert.ok(isRecord(result));
+            assert.strictEqual(result["url"], "https://example.com/group-hook");
+        });
+    });
+    describe("with update_webhook on a group", () => {
+        test("should update a group webhook", async () => {
+            lastUpdateBody = undefined;
+            const result = await callTool("update_webhook", {
+                group_id: TEST_GROUP_ID,
+                hook_id: TEST_HOOK_ID,
+                url: "https://example.com/group-hook-updated",
+                name: "Renamed Group Hook",
+            }, baseEnv);
+            assert.deepStrictEqual(lastUpdateBody, {
+                url: "https://example.com/group-hook-updated",
+                name: "Renamed Group Hook",
+            });
+            assert.ok(isRecord(result));
+            assert.strictEqual(result.url, "https://example.com/group-hook-updated");
+        });
+    });
+    describe("with delete_webhook on a group", () => {
+        test("should delete a group webhook", async () => {
+            lastDeletePath = undefined;
+            const result = await callTool("delete_webhook", {
+                group_id: TEST_GROUP_ID,
+                hook_id: TEST_HOOK_ID,
+            }, baseEnv);
+            assert.strictEqual(lastDeletePath, `/groups/${TEST_GROUP_ID}/hooks/${TEST_HOOK_ID}`);
+            assert.deepStrictEqual(result, { status: "deleted", hook_id: TEST_HOOK_ID });
+        });
+    });
+    describe("with invalid scope", () => {
+        test("should reject when both project_id and group_id are provided", async () => {
+            await assert.rejects(() => callTool("create_webhook", {
+                project_id: TEST_PROJECT_ID,
+                group_id: TEST_GROUP_ID,
+                url: "https://example.com/hook",
+            }, baseEnv), /project_id or group_id/);
+        });
+    });
+});