@zereight/mcp-gitlab 2.1.56 → 2.1.58

package/README.ko.md

@@ -17,7 +17,7 @@ PAT, OAuth, 읽기 전용 모드, 동적 API URL, 원격 인증을 지원하며
 
 ### 왜 이 GitLab MCP를 사용하나요?
 
-- **217개 도구 + `discover_tools`** — 작은 toolset으로 시작하고, 런타임에 카테고리 활성화
+- **232개 도구 + `discover_tools`** — 작은 toolset으로 시작하고, 런타임에 카테고리 활성화
 - **MR 2단계 리뷰** — `list_merge_request_changed_files` → 배치 `get_merge_request_file_diff`
 - **Agent Skill 내장** — `skills/gitlab-mcp/` 워크플로우 가이드
 - **유연한 인증** — Personal Access Token, 로컬 OAuth2 브라우저 플로우, MCP OAuth 프록시, 요청별 원격 인증
@@ -30,9 +30,9 @@ PAT, OAuth, 읽기 전용 모드, 동적 API URL, 원격 인증을 지원하며
 | | @zereight/mcp-gitlab | GitLab MCP A (커뮤니티 CQRS형) |
 |---|----------------------|--------------------------------|
 | **적합한 경우** | AI 에이전트 워크플로우 | 엔터프라이즈 멀티 인스턴스 / 그룹형 도구 |
-| **도구 모델** | ~217개 세분화 도구 + `discover_tools` | ~50–60개 `browse_*` / `manage_*` 그룹 도구 |
+| **도구 모델** | ~232개 세분화 도구 + `discover_tools` | ~50–60개 `browse_*` / `manage_*` 그룹 도구 |
 | **MR 리뷰** | 2단계 배치 diff | 서버마다 다름 |
-| **Node.js** | >=18 | 보통 >=24 |
+| **Node.js** | >=18.17 | 보통 >=24 |
 | **라이선스** | MIT | 서버마다 다름 |
 
 [전체 비교 →](./docs/comparison/community-gitlab-mcp-a.md)
@@ -98,7 +98,7 @@ npm install -g @zereight/mcp-gitlab
 
 예시는 기존 `mcp-gitlab`보다 충돌 가능성이 낮은 `zereight-mcp-gitlab` 별칭을 사용합니다. MCP 클라이언트가 찾지 못하면 `which zereight-mcp-gitlab`의 절대 경로를 사용하세요.
 
-전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.55`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
+전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.57`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
 
 #### CLI 인자 사용하기(환경 변수 문제가 있는 클라이언트용)
 

package/README.md

@@ -22,7 +22,7 @@ Supports PAT, OAuth, read-only mode, dynamic API URLs, and remote authorization
 
 ### Why use this GitLab MCP?
 
-- **229 tools + `discover_tools`** — start with a small toolset; activate more at runtime without CQRS-style grouping
+- **232 tools + `discover_tools`** — start with a small toolset; activate more at runtime without CQRS-style grouping
 - **MR 2-step review** — `list_merge_request_changed_files` → batched `get_merge_request_file_diff`
 - **Agent Skill built in** — workflow guidance in `skills/gitlab-mcp/`
 - **Flexible auth** — Personal Access Token, local OAuth2 browser flow, MCP OAuth proxy, and per-request remote authorization
@@ -35,9 +35,9 @@ Supports PAT, OAuth, read-only mode, dynamic API URLs, and remote authorization
 | | @zereight/mcp-gitlab | GitLab MCP A (community CQRS-style) |
 |---|----------------------|-------------------------------------|
 | **Best for** | AI agent workflows | Enterprise multi-instance / grouped tools |
-| **Tool model** | ~229 granular tools + `discover_tools` | ~50–60 grouped `browse_*` / `manage_*` tools |
+| **Tool model** | ~232 granular tools + `discover_tools` | ~50–60 grouped `browse_*` / `manage_*` tools |
 | **MR review** | 2-step batched diff | Varies |
-| **Node.js** | >=18 | Often >=24 |
+| **Node.js** | >=18.17 | Often >=24 |
 | **License** | MIT | Varies |
 
 [Full comparison →](./docs/comparison/community-gitlab-mcp-a.md)
@@ -103,7 +103,7 @@ npm install -g @zereight/mcp-gitlab
 
 The examples use `zereight-mcp-gitlab`, a less collision-prone alias for the legacy `mcp-gitlab` binary. If your MCP client cannot find it, use the absolute path from `which zereight-mcp-gitlab`.
 
-No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.1.55`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
+No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.1.57`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
 
 #### Using CLI Arguments (for clients with env var issues)
 
@@ -777,30 +777,33 @@ Register the skill directory in your AI client to get optimal tool usage guidanc
 204. `get_timeline_events` - List timeline events for an incident. Returns chronological events with notes, timestamps, and tags
 205. `create_timeline_event` - Create a timeline event on an incident. Supports tags: 'Start time', 'End time', 'Impact detected', 'Response initiated', 'Impact mitigated', 'Cause identified'
 206. `list_webhooks` - List all configured webhooks for a GitLab project or group. Provide either project_id or group_id
-207. `list_webhook_events` - List recent webhook events (past 7 days) for a project or group webhook. Use summary mode for overview, then get_webhook_event for full details
-208. `get_webhook_event` - Get full details of a specific webhook event by ID, including request/response payloads
-209. `search_code` - Search for code across all projects on the GitLab instance (requires advanced search or exact code search to be enabled)
-210. `search_project_code` - Search for code within a specific GitLab project (requires advanced search or exact code search to be enabled)
-211. `search_group_code` - Search for code within a specific GitLab group (requires advanced search or exact code search to be enabled)
-212. `list_project_variables` - List CI/CD variables for a project with optional environment scope filter
-213. `get_project_variable` - Get a single CI/CD variable from a project by key, with optional environment scope filter
-214. `create_project_variable` - Create a new CI/CD variable in a project
-215. `update_project_variable` - Update an existing CI/CD variable in a project, with optional filter to disambiguate by environment scope
-216. `delete_project_variable` - Delete a CI/CD variable from a project, with optional filter to disambiguate by environment scope
-217. `list_group_variables` - List CI/CD variables for a group with optional environment scope filter
-218. `get_group_variable` - Get a single CI/CD variable from a group by key, with optional environment scope filter
-219. `create_group_variable` - Create a new CI/CD variable in a group
-220. `update_group_variable` - Update an existing CI/CD variable in a group, with optional filter to disambiguate by environment scope
-221. `delete_group_variable` - Delete a CI/CD variable from a group, with optional filter to disambiguate by environment scope
-222. `get_dependency_proxy_settings` - Get dependency proxy settings for a group (enabled status, blob count, total size, image prefix, TTL policy)
-223. `update_dependency_proxy_settings` - Update dependency proxy settings for a group (enable/disable, credentials for authenticated Docker Hub pulls)
-224. `list_dependency_proxy_blobs` - List cached dependency proxy blobs for a group with cursor-based pagination
-225. `purge_dependency_proxy_cache` - Schedule purge of all cached dependency proxy blobs for a group
-226. `list_project_vulnerabilities` - List vulnerabilities for a project with optional state, severity, and report type filters (GraphQL-backed, cursor pagination)
-227. `get_vulnerability` - Get full details of a specific vulnerability
-228. `dismiss_vulnerability` - Dismiss a vulnerability with a reason (acceptable_risk, false_positive, used_in_tests, mitigating_control, not_applicable) and optional comment
-229. `confirm_vulnerability` - Confirm a vulnerability as a real finding requiring remediation
-230. `discover_tools` - Discover and activate additional tool categories for this session. Available categories: merge_requests, issues, repositories, branches, projects, labels, ci, groups, pipelines, milestones, wiki, releases, tags, users, workitems, webhooks, search, variables, dependency_proxy, vulnerabilities. Already-active categories are listed in the response.
+207. `create_webhook` - Create a webhook on a GitLab project or group
+208. `update_webhook` - Update an existing project or group webhook
+209. `delete_webhook` - Delete a project or group webhook
+210. `list_webhook_events` - List recent webhook events (past 7 days) for a project or group webhook. Use summary mode for overview, then get_webhook_event for full details
+211. `get_webhook_event` - Get full details of a specific webhook event by ID, including request/response payloads
+212. `search_code` - Search for code across all projects on the GitLab instance (requires advanced search or exact code search to be enabled)
+213. `search_project_code` - Search for code within a specific GitLab project (requires advanced search or exact code search to be enabled)
+214. `search_group_code` - Search for code within a specific GitLab group (requires advanced search or exact code search to be enabled)
+215. `list_project_variables` - List CI/CD variables for a project with optional environment scope filter
+216. `get_project_variable` - Get a single CI/CD variable from a project by key, with optional environment scope filter
+217. `create_project_variable` - Create a new CI/CD variable in a project
+218. `update_project_variable` - Update an existing CI/CD variable in a project, with optional filter to disambiguate by environment scope
+219. `delete_project_variable` - Delete a CI/CD variable from a project, with optional filter to disambiguate by environment scope
+220. `list_group_variables` - List CI/CD variables for a group with optional environment scope filter
+221. `get_group_variable` - Get a single CI/CD variable from a group by key, with optional environment scope filter
+222. `create_group_variable` - Create a new CI/CD variable in a group
+223. `update_group_variable` - Update an existing CI/CD variable in a group, with optional filter to disambiguate by environment scope
+224. `delete_group_variable` - Delete a CI/CD variable from a group, with optional filter to disambiguate by environment scope
+225. `get_dependency_proxy_settings` - Get dependency proxy settings for a group (enabled status, blob count, total size, image prefix, TTL policy)
+226. `update_dependency_proxy_settings` - Update dependency proxy settings for a group (enable/disable, credentials for authenticated Docker Hub pulls)
+227. `list_dependency_proxy_blobs` - List cached dependency proxy blobs for a group with cursor-based pagination
+228. `purge_dependency_proxy_cache` - Schedule purge of all cached dependency proxy blobs for a group
+229. `list_project_vulnerabilities` - List vulnerabilities for a project with optional state, severity, and report type filters (GraphQL-backed, cursor pagination)
+230. `get_vulnerability` - Get full details of a specific vulnerability
+231. `dismiss_vulnerability` - Dismiss a vulnerability with a reason (acceptable_risk, false_positive, used_in_tests, mitigating_control, not_applicable) and optional comment
+232. `confirm_vulnerability` - Confirm a vulnerability as a real finding requiring remediation
+233. `discover_tools` - Discover and activate additional tool categories for this session. Available categories: merge_requests, issues, repositories, branches, projects, labels, ci, groups, pipelines, milestones, wiki, releases, tags, users, workitems, webhooks, search, variables, dependency_proxy, vulnerabilities. Already-active categories are listed in the response.
 
 <!-- TOOLS-END -->
 

package/README.zh-CN.md

@@ -17,7 +17,7 @@
 
 ### 为什么使用这个 GitLab MCP？
 
-- **217 个工具 + `discover_tools`** — 从小型 toolset 开始，运行时按需激活类别
+- **232 个工具 + `discover_tools`** — 从小型 toolset 开始，运行时按需激活类别
 - **MR 两步审查** — `list_merge_request_changed_files` → 批量 `get_merge_request_file_diff`
 - **内置 Agent Skill** — `skills/gitlab-mcp/` 工作流指南
 - **认证灵活** — Personal Access Token、本地 OAuth2 浏览器流程、MCP OAuth 代理、按请求远程授权
@@ -30,9 +30,9 @@
 | | @zereight/mcp-gitlab | GitLab MCP A（社区 CQRS 型） |
 |---|----------------------|------------------------------|
 | **更适合** | AI 代理工作流 | 企业多实例 / 分组工具 |
-| **工具模型** | ~217 个细粒度工具 + `discover_tools` | ~50–60 个 `browse_*` / `manage_*` 分组工具 |
+| **工具模型** | ~232 个细粒度工具 + `discover_tools` | ~50–60 个 `browse_*` / `manage_*` 分组工具 |
 | **MR 审查** | 两步批量 diff | 因服务器而异 |
-| **Node.js** | >=18 | 通常 >=24 |
+| **Node.js** | >=18.17 | 通常 >=24 |
 | **许可证** | MIT | 因服务器而异 |
 
 [完整对比 →](./docs/comparison/community-gitlab-mcp-a.md)
@@ -98,7 +98,7 @@ npm install -g @zereight/mcp-gitlab
 
 示例使用 `zereight-mcp-gitlab`，这是比旧的 `mcp-gitlab` 更不容易冲突的别名。如果 MCP 客户端找不到它，请使用 `which zereight-mcp-gitlab` 输出的绝对路径。
 
-如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.1.55`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
+如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.1.57`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
 
 #### 使用 CLI 参数（适用于环境变量有问题的客户端）
 

package/build/auth-retry.js

@@ -5,34 +5,55 @@
  * importing index.ts (which has heavy side effects: starts the MCP server,
  * reads env vars, etc.).
  */
-import { Headers } from "node-fetch";
+function isTupleArray(headers) {
+    if (!Array.isArray(headers))
+        return false;
+    return headers.every(entry => Array.isArray(entry) &&
+        entry.length >= 2 &&
+        typeof entry[0] === "string" &&
+        typeof entry[1] === "string");
+}
+function hasForEach(headers) {
+    return "forEach" in headers && typeof headers.forEach === "function";
+}
+function isPlainStringHeaders(headers) {
+    return Object.values(headers).every(value => typeof value === "string");
+}
 /**
  * Convert various header representations to a plain Record<string, string>.
  */
 export function headersToPlainObject(headers) {
-    if (!headers)
+    if (!headers || typeof headers !== "object")
         return {};
-    if (headers instanceof Headers) {
+    if (isTupleArray(headers)) {
+        return Object.fromEntries(headers);
+    }
+    if (hasForEach(headers)) {
         const obj = {};
-        headers.forEach((value, key) => { obj[key] = value; });
+        headers.forEach((value, key) => {
+            obj[key] = value;
+        });
         return obj;
     }
-    if (Array.isArray(headers)) {
-        return Object.fromEntries(headers);
+    if (isPlainStringHeaders(headers)) {
+        return headers;
     }
-    return headers;
+    return {};
 }
 /**
- * Detect request bodies that cannot be replayed (streams, FormData).
+ * Detect request bodies that cannot be replayed (streams).
  */
+function hasCallableMethod(body, name) {
+    return name in body && typeof Reflect.get(body, name) === "function";
+}
 export function isNonReplayableBody(body) {
-    if (!body)
+    if (!body || typeof body !== "object")
         return false;
-    // Stream-like objects (has .pipe or .read)
-    if (typeof body.pipe === "function" || typeof body.read === "function")
+    if (hasCallableMethod(body, "pipe"))
         return true;
-    // form-data instances (duck-type check since FormData is dynamically imported)
-    if (typeof body.getBuffer === "function" && typeof body.getBoundary === "function")
+    if (hasCallableMethod(body, "read"))
+        return true;
+    if (hasCallableMethod(body, "getReader"))
         return true;
     return false;
 }
@@ -41,24 +62,19 @@ export function isNonReplayableBody(body) {
  * On a 401, force-refreshes the OAuth token and retries the request once.
  * The retry calls baseFetch directly (not the wrapper), so infinite loops are impossible.
  * In non-OAuth mode, the wrapper is a transparent pass-through.
- *
- * When called without `config`, falls back to module globals in index.ts.
- * When called with `config` (tests), uses injected dependencies.
  */
 export function wrapWithAuthRetry(baseFetch, config) {
     let refreshLock = null;
     const log = config.logger ?? { info: () => { }, error: () => { } };
-    return (async (url, options) => {
+    const wrapped = async (url, options) => {
         const response = await baseFetch(url, options);
         if (response.status === 401 && config.isOAuthEnabled()) {
-            // Skip retry for non-replayable bodies (streams, FormData) since the first request consumed them
             if (isNonReplayableBody(options?.body)) {
                 log.info("Received 401 but request body is not replayable (stream/FormData), skipping retry.");
                 return response;
             }
             log.info("Received 401, force-refreshing OAuth token and retrying...");
             try {
-                // Mutex: coalesce concurrent refresh attempts into a single in-flight request
                 if (!refreshLock) {
                     refreshLock = config.refreshToken(true).finally(() => {
                         refreshLock = null;
@@ -77,5 +93,6 @@ export function wrapWithAuthRetry(baseFetch, config) {
             }
         }
         return response;
-    });
+    };
+    return wrapped;
 }

package/build/config.js

@@ -85,6 +85,8 @@ export const GITLAB_OAUTH_ALLOWED_GROUPS = (() => {
     return groups.length > 0 ? groups : undefined;
 })();
 export const ENABLE_DYNAMIC_API_URL = getConfig("enable-dynamic-api-url", "ENABLE_DYNAMIC_API_URL") === "true";
+export const ENABLE_DYNAMIC_PROJECT_SCOPE = getConfig("enable-dynamic-project-scope", "ENABLE_DYNAMIC_PROJECT_SCOPE") === "true";
+export const ENABLE_STRICT_PROJECT_SCOPE = getConfig("enable-strict-project-scope", "ENABLE_STRICT_PROJECT_SCOPE") === "true";
 // ---------------------------------------------------------------------------
 // Stateless mode (multi-pod safe OAuth / session encoding)
 // ---------------------------------------------------------------------------

package/build/downloads/proxy.js

@@ -1,3 +1,5 @@
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
 import { decryptDownloadToken } from "../utils/download-token.js";
 const DEFAULT_DOWNLOAD_TIMEOUT_MS = 120_000;
 function canonicalizeQueryParams(params) {
@@ -156,10 +158,9 @@ export function registerDownloadProxy(app, deps) {
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), downloadTimeoutMs);
         try {
-            const agent = deps.getAgentFunctionForUrl(apiUrl);
             const gitlabResponse = await deps.fetch(gitlabUrl, {
                 headers,
-                agent,
+                dispatcher: deps.getDispatcherForUrl(apiUrl),
                 signal: controller.signal,
             });
             if (!gitlabResponse.ok) {
@@ -177,12 +178,11 @@ export function registerDownloadProxy(app, deps) {
                 res.setHeader("Content-Disposition", contentDisposition);
             if (contentLength)
                 res.setHeader("Content-Length", contentLength);
-            if (gitlabResponse.body) {
-                gitlabResponse.body.pipe(res);
-            }
-            else {
+            if (!gitlabResponse.body) {
                 res.status(502).json({ error: "No response body from GitLab" });
+                return;
             }
+            await pipeline(Readable.fromWeb(gitlabResponse.body), res);
         }
         catch (error) {
             deps.logger.error({ err: error }, "Download proxy error");