@zereight/mcp-gitlab 2.1.57 → 2.1.58

package/README.ko.md

@@ -98,7 +98,7 @@ npm install -g @zereight/mcp-gitlab
 
 예시는 기존 `mcp-gitlab`보다 충돌 가능성이 낮은 `zereight-mcp-gitlab` 별칭을 사용합니다. MCP 클라이언트가 찾지 못하면 `which zereight-mcp-gitlab`의 절대 경로를 사용하세요.
 
-전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.56`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
+전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.1.57`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
 
 #### CLI 인자 사용하기(환경 변수 문제가 있는 클라이언트용)
 

package/README.md

@@ -103,7 +103,7 @@ npm install -g @zereight/mcp-gitlab
 
 The examples use `zereight-mcp-gitlab`, a less collision-prone alias for the legacy `mcp-gitlab` binary. If your MCP client cannot find it, use the absolute path from `which zereight-mcp-gitlab`.
 
-No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.1.56`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
+No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.1.57`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
 
 #### Using CLI Arguments (for clients with env var issues)
 

package/README.zh-CN.md

@@ -98,7 +98,7 @@ npm install -g @zereight/mcp-gitlab
 
 示例使用 `zereight-mcp-gitlab`，这是比旧的 `mcp-gitlab` 更不容易冲突的别名。如果 MCP 客户端找不到它，请使用 `which zereight-mcp-gitlab` 输出的绝对路径。
 
-如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.1.56`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
+如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.1.57`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
 
 #### 使用 CLI 参数（适用于环境变量有问题的客户端）
 

package/build/config.js

@@ -85,6 +85,8 @@ export const GITLAB_OAUTH_ALLOWED_GROUPS = (() => {
     return groups.length > 0 ? groups : undefined;
 })();
 export const ENABLE_DYNAMIC_API_URL = getConfig("enable-dynamic-api-url", "ENABLE_DYNAMIC_API_URL") === "true";
+export const ENABLE_DYNAMIC_PROJECT_SCOPE = getConfig("enable-dynamic-project-scope", "ENABLE_DYNAMIC_PROJECT_SCOPE") === "true";
+export const ENABLE_STRICT_PROJECT_SCOPE = getConfig("enable-strict-project-scope", "ENABLE_STRICT_PROJECT_SCOPE") === "true";
 // ---------------------------------------------------------------------------
 // Stateless mode (multi-pod safe OAuth / session encoding)
 // ---------------------------------------------------------------------------

package/build/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { getConfig, ENABLE_DYNAMIC_API_URL, GITLAB_AUTH_COOKIE_PATH, GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_DISABLE_VERSION_CHECK, GITLAB_READ_ONLY_MODE, GITLAB_PERMISSION_MODE, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, MCP_TRUST_PROXY, USE_GITLAB_WIKI, USE_MILESTONE, USE_OAUTH, USE_PIPELINE, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_OAUTH_ALLOWED_GROUPS_RAW, GITLAB_ALLOWED_GROUPS_RAW, GITLAB_OAUTH_ALLOWED_GROUPS, } from "./config.js";
+import { getConfig, ENABLE_DYNAMIC_API_URL, ENABLE_DYNAMIC_PROJECT_SCOPE, ENABLE_STRICT_PROJECT_SCOPE, GITLAB_AUTH_COOKIE_PATH, GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_DISABLE_VERSION_CHECK, GITLAB_READ_ONLY_MODE, GITLAB_PERMISSION_MODE, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, MCP_TRUST_PROXY, USE_GITLAB_WIKI, USE_MILESTONE, USE_OAUTH, USE_PIPELINE, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_OAUTH_ALLOWED_GROUPS_RAW, GITLAB_ALLOWED_GROUPS_RAW, GITLAB_OAUTH_ALLOWED_GROUPS, } from "./config.js";
 /** True when the server is running in remote/network mode (SSE or StreamableHTTP transport). */
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
 const STREAMABLE_HTTP_AUTH_TOKEN = getConfig("streamable-http-auth-token", "STREAMABLE_HTTP_AUTH_TOKEN");
@@ -430,6 +430,7 @@ function createServer() {
                     lastUsed: authData.lastUsed,
                     apiUrl: authData.apiUrl,
                     publicBaseUrl: authData.publicBaseUrl,
+                    allowedProjectIds: authData.allowedProjectIds,
                 };
                 // Run the handler within the retrieved context
                 const result = await sessionAuthStore.run(sessionContext, () => handleToolCall(request.params));
@@ -707,6 +708,10 @@ function validateConfiguration() {
     if (enableDynamicApiUrl && !remoteAuth) {
         errors.push("ENABLE_DYNAMIC_API_URL=true requires REMOTE_AUTHORIZATION=true");
     }
+    const enableDynamicProjectScope = getConfig("enable-dynamic-project-scope", "ENABLE_DYNAMIC_PROJECT_SCOPE") === "true";
+    if (enableDynamicProjectScope && !remoteAuth) {
+        errors.push("ENABLE_DYNAMIC_PROJECT_SCOPE=true requires REMOTE_AUTHORIZATION=true");
+    }
     if (errors.length > 0) {
         logger.error("Configuration validation failed:");
         errors.forEach(err => logger.error(`  - ${err}`));
@@ -967,7 +972,8 @@ async function ensureSessionForRequest() {
             redirect: "follow",
         });
         // 401 means auth failed but the request completed - cookies were still exchanged
-        initialSessionRequestMade = response.ok || response.status === 401;
+        // 403 means insufficient scope (e.g. missing User: Read) but auth is valid
+        initialSessionRequestMade = response.ok || response.status === 401 || response.status === 403;
     }
     catch {
         logger.debug("Session warmup request failed, will retry on next request");
@@ -1048,6 +1054,47 @@ function getEffectiveApiUrl() {
     }
     return GITLAB_API_URL;
 }
+/**
+ * Get the effective project allowlist for the current request
+ * In REMOTE_AUTHORIZATION mode with ENABLE_DYNAMIC_PROJECT_SCOPE, reads the scope
+ * narrowed via the X-GitLab-Allowed-Project-Ids header from session context
+ * (already validated against GITLAB_ALLOWED_PROJECT_IDS by parseAuthHeaders)
+ * Otherwise, uses environment GITLAB_ALLOWED_PROJECT_IDS
+ */
+function getEffectiveAllowedProjectIds() {
+    if (ENABLE_DYNAMIC_PROJECT_SCOPE) {
+        const ctx = sessionAuthStore.getStore();
+        if (ctx?.allowedProjectIds && ctx.allowedProjectIds.length > 0) {
+            return ctx.allowedProjectIds;
+        }
+    }
+    return GITLAB_ALLOWED_PROJECT_IDS;
+}
+/**
+ * Reject tools that cannot be limited to allowed projects when
+ * ENABLE_STRICT_PROJECT_SCOPE is set and an allowlist is in effect
+ */
+function rejectIfStrictProjectScope(toolName) {
+    if (ENABLE_STRICT_PROJECT_SCOPE) {
+        rejectIfProjectScopedDeployment(toolName);
+    }
+}
+/**
+ * Filter a project listing down to the effective allowlist
+ * Applies only when ENABLE_STRICT_PROJECT_SCOPE is set and an allowlist is in effect
+ * Allowlist entries may be numeric IDs or full namespace paths
+ */
+function filterProjectsByAllowlist(projects) {
+    if (!ENABLE_STRICT_PROJECT_SCOPE) {
+        return projects;
+    }
+    const allowedProjectIds = getEffectiveAllowedProjectIds();
+    if (allowedProjectIds.length === 0) {
+        return projects;
+    }
+    return projects.filter(project => allowedProjectIds.includes(String(project.id)) ||
+        allowedProjectIds.includes(project.path_with_namespace));
+}
 /**
  * Get fetch configuration with proper client from pool
  * Uses connection pooling when dynamic API URLs are enabled
@@ -1217,20 +1264,21 @@ async function handleGitLabError(response) {
  * @throws {Error} If GITLAB_ALLOWED_PROJECT_IDS is set and the requested project is not in the whitelist
  */
 function getEffectiveProjectId(projectId) {
-    if (GITLAB_ALLOWED_PROJECT_IDS.length > 0) {
+    const allowedProjectIds = getEffectiveAllowedProjectIds();
+    if (allowedProjectIds.length > 0) {
         // If there's only one allowed project, use it as default
-        if (GITLAB_ALLOWED_PROJECT_IDS.length === 1 && !projectId) {
-            return GITLAB_ALLOWED_PROJECT_IDS[0];
+        if (allowedProjectIds.length === 1 && !projectId) {
+            return allowedProjectIds[0];
         }
         // If a project ID is provided, check if it's in the whitelist
-        if (projectId && !GITLAB_ALLOWED_PROJECT_IDS.includes(projectId)) {
-            throw new Error(`Access denied: Project ${projectId} is not in the allowed project list: ${GITLAB_ALLOWED_PROJECT_IDS.join(", ")}`);
+        if (projectId && !allowedProjectIds.includes(projectId)) {
+            throw new Error(`Access denied: Project ${projectId} is not in the allowed project list: ${allowedProjectIds.join(", ")}`);
         }
         // If no project ID provided but we have multiple allowed projects, require an explicit choice
-        if (!projectId && GITLAB_ALLOWED_PROJECT_IDS.length > 1) {
-            throw new Error(`Multiple projects allowed (${GITLAB_ALLOWED_PROJECT_IDS.join(", ")}). Please specify a project ID.`);
+        if (!projectId && allowedProjectIds.length > 1) {
+            throw new Error(`Multiple projects allowed (${allowedProjectIds.join(", ")}). Please specify a project ID.`);
         }
-        return projectId || GITLAB_ALLOWED_PROJECT_IDS[0];
+        return projectId || allowedProjectIds[0];
     }
     // Prioritize the passed projectId over GITLAB_PROJECT_ID to allow querying different projects
     if (projectId) {
@@ -1245,8 +1293,8 @@ function rejectIfProjectScopedDeployment(toolName) {
     if (GITLAB_PROJECT_ID) {
         throw new Error(`${toolName} is not allowed when GITLAB_PROJECT_ID is set (server is locked to a single project)`);
     }
-    if (GITLAB_ALLOWED_PROJECT_IDS.length > 0) {
-        throw new Error(`${toolName} is not allowed when GITLAB_ALLOWED_PROJECT_IDS is set (server access is restricted to configured projects)`);
+    if (getEffectiveAllowedProjectIds().length > 0) {
+        throw new Error(`${toolName} is not allowed while a project allowlist is in effect (GITLAB_ALLOWED_PROJECT_IDS or a session scope restricts access to configured projects)`);
     }
 }
 /**
@@ -1390,9 +1438,11 @@ async function createIssue(projectId, options) {
  */
 async function listIssues(projectId, options = {}) {
     let url;
-    if (projectId) {
-        projectId = decodeURIComponent(projectId); // Decode project ID
-        const effectiveProjectId = getEffectiveProjectId(projectId);
+    if (projectId || (ENABLE_STRICT_PROJECT_SCOPE && getEffectiveAllowedProjectIds().length > 0)) {
+        // In strict scope, never fall back to the instance-wide endpoint;
+        // resolve the default project (or fail for a multi-project allowlist)
+        const decodedProjectId = projectId ? decodeURIComponent(projectId) : "";
+        const effectiveProjectId = getEffectiveProjectId(decodedProjectId);
         url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/issues`);
     }
     else {
@@ -1486,11 +1536,18 @@ function appendMergeRequestFilters(url, options) {
  * @returns {Promise<GitLabMergeRequest[]>} List of merge requests
  */
 async function listMergeRequests(projectId, options = {}) {
-    const decodedProjectId = projectId ? decodeURIComponent(projectId) : undefined;
-    const endpoint = decodedProjectId
-        ? `${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(decodedProjectId))}/merge_requests`
-        : `${getEffectiveApiUrl()}/merge_requests`;
-    const url = new URL(endpoint);
+    const decodedProjectId = projectId ? decodeURIComponent(projectId) : "";
+    let url;
+    if (decodedProjectId ||
+        (ENABLE_STRICT_PROJECT_SCOPE && getEffectiveAllowedProjectIds().length > 0)) {
+        // In strict scope, never fall back to the instance-wide endpoint;
+        // resolve the default project (or fail for a multi-project allowlist)
+        const effectiveProjectId = getEffectiveProjectId(decodedProjectId);
+        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/merge_requests`);
+    }
+    else {
+        url = new URL(`${getEffectiveApiUrl()}/merge_requests`);
+    }
     appendMergeRequestFilters(url, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -2179,8 +2236,8 @@ async function resolveProjectOrGroupPath(projectId) {
     const namespaceMatch = decodedProjectId.match(/^(group|project):(.+)$/i);
     const explicitKind = namespaceMatch?.[1]?.toLowerCase();
     const requestedProjectId = namespaceMatch ? namespaceMatch[2] : decodedProjectId;
-    if (explicitKind === "group" && GITLAB_ALLOWED_PROJECT_IDS.length > 0) {
-        throw new Error("group:<id-or-path> cannot be used when GITLAB_ALLOWED_PROJECT_IDS is set, because the project allowlist does not cover groups");
+    if (explicitKind === "group" && getEffectiveAllowedProjectIds().length > 0) {
+        throw new Error("group:<id-or-path> cannot be used while a project allowlist is in effect (GITLAB_ALLOWED_PROJECT_IDS or a session scope), because the project allowlist does not cover groups");
     }
     const effectiveProjectId = getEffectiveProjectId(requestedProjectId);
     if (explicitKind === "group") {
@@ -2202,7 +2259,7 @@ async function resolveProjectOrGroupPath(projectId) {
     // resolving to an unrelated group with the same integer ID.
     if (projectResponse.status === 404 &&
         !explicitKind &&
-        GITLAB_ALLOWED_PROJECT_IDS.length === 0 &&
+        getEffectiveAllowedProjectIds().length === 0 &&
         !/^\d+$/.test(effectiveProjectId)) {
         const groupUrl = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(effectiveProjectId)}`);
         const groupResponse = await fetch(groupUrl.toString(), {
@@ -3522,14 +3579,19 @@ async function searchProjects(query, page = 1, perPage = 20) {
         const errorBody = await response.text();
         throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorBody}`);
     }
-    const projects = (await response.json());
+    const unfiltered = (await response.json());
+    const projects = filterProjectsByAllowlist(unfiltered);
     const totalCount = response.headers.get("x-total");
     const totalPages = response.headers.get("x-total-pages");
-    // GitLab API doesn't return these headers for results > 10,000
+    const nextPage = response.headers.get("x-next-page");
+    // GitLab API doesn't return the total headers for results > 10,000
+    // Keep the unfiltered totals so callers paginate past pages the allowlist filter thinned out;
+    // without them, total_pages stays unset and next_page carries the continuation signal
     const count = totalCount ? Number.parseInt(totalCount, 10) : projects.length;
     return GitLabSearchResponseSchema.parse({
         count,
-        total_pages: totalPages ? Number.parseInt(totalPages, 10) : Math.ceil(count / perPage),
+        total_pages: totalPages ? Number.parseInt(totalPages, 10) : undefined,
+        next_page: nextPage ? Number.parseInt(nextPage, 10) : undefined,
         current_page: page,
         items: projects,
     });
@@ -4623,7 +4685,7 @@ async function listProjects(options = {}) {
     await handleGitLabError(response);
     // Parse and return the data
     const data = await response.json();
-    return z.array(GitLabProjectSchema).parse(data);
+    return filterProjectsByAllowlist(z.array(GitLabProjectSchema).parse(data));
 }
 /**
  * List labels for a project
@@ -4789,7 +4851,7 @@ async function listGroupProjects(options) {
     });
     await handleGitLabError(response);
     const projects = await response.json();
-    return GitLabProjectSchema.array().parse(projects);
+    return filterProjectsByAllowlist(GitLabProjectSchema.array().parse(projects));
 }
 // Webhook API helper functions
 /**
@@ -4800,6 +4862,7 @@ function buildWebhookBaseUrl(projectId, groupId) {
         projectId = decodeURIComponent(projectId);
         return `${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/hooks`;
     }
+    rejectIfStrictProjectScope("group webhooks");
     const decodedGroupId = decodeURIComponent(groupId);
     return `${getEffectiveApiUrl()}/groups/${encodeURIComponent(decodedGroupId)}/hooks`;
 }
@@ -6813,15 +6876,16 @@ async function resolveProjectFullPath(projectId) {
  * Allowlist entries may be numeric IDs or full namespace paths.
  */
 function assertVulnerabilityProjectAllowed(vulnerabilityId, project) {
-    if (GITLAB_ALLOWED_PROJECT_IDS.length === 0) {
+    const allowedProjectIds = getEffectiveAllowedProjectIds();
+    if (allowedProjectIds.length === 0) {
         return;
     }
     const fullPath = project?.fullPath ?? undefined;
     const numericId = project?.id?.match(/^gid:\/\/gitlab\/Project\/(\d+)$/)?.[1];
-    const allowed = (fullPath !== undefined && GITLAB_ALLOWED_PROJECT_IDS.includes(fullPath)) ||
-        (numericId !== undefined && GITLAB_ALLOWED_PROJECT_IDS.includes(numericId));
+    const allowed = (fullPath !== undefined && allowedProjectIds.includes(fullPath)) ||
+        (numericId !== undefined && allowedProjectIds.includes(numericId));
     if (!allowed) {
-        throw new Error(`Access denied: Vulnerability ${vulnerabilityId} belongs to project ${fullPath ?? numericId ?? "unknown"}, which is not in the allowed project list: ${GITLAB_ALLOWED_PROJECT_IDS.join(", ")}`);
+        throw new Error(`Access denied: Vulnerability ${vulnerabilityId} belongs to project ${fullPath ?? numericId ?? "unknown"}, which is not in the allowed project list: ${allowedProjectIds.join(", ")}`);
     }
 }
 /**
@@ -6831,7 +6895,7 @@ function assertVulnerabilityProjectAllowed(vulnerabilityId, project) {
  * is not configured.
  */
 async function ensureVulnerabilityProjectAllowed(vulnerabilityId) {
-    if (GITLAB_ALLOWED_PROJECT_IDS.length === 0) {
+    if (getEffectiveAllowedProjectIds().length === 0) {
         return;
     }
     const data = await executeGraphQL(`query getVulnerabilityProject($id: VulnerabilityID!) {
@@ -7558,6 +7622,7 @@ async function handleToolCall(params) {
                 };
             }
             case "search_code": {
+                rejectIfStrictProjectScope("search_code");
                 const args = SearchCodeSchema.parse(params.arguments);
                 const results = await searchBlobs({
                     search: args.search,
@@ -7588,6 +7653,7 @@ async function handleToolCall(params) {
                 };
             }
             case "search_group_code": {
+                rejectIfStrictProjectScope("search_group_code");
                 const args = SearchGroupCodeSchema.parse(params.arguments);
                 const results = await searchBlobs({
                     search: args.search,
@@ -7850,6 +7916,7 @@ async function handleToolCall(params) {
                 };
             }
             case "list_todos": {
+                rejectIfStrictProjectScope("list_todos");
                 const args = ListTodosSchema.parse(params.arguments);
                 const todos = await listTodos(args);
                 return {
@@ -7857,6 +7924,7 @@ async function handleToolCall(params) {
                 };
             }
             case "mark_todo_done": {
+                rejectIfStrictProjectScope("mark_todo_done");
                 const args = MarkTodoDoneSchema.parse(params.arguments);
                 const todo = await markTodoDone(args.id);
                 return {
@@ -7864,6 +7932,7 @@ async function handleToolCall(params) {
                 };
             }
             case "mark_all_todos_done": {
+                rejectIfStrictProjectScope("mark_all_todos_done");
                 MarkAllTodosDoneSchema.parse(params.arguments);
                 await markAllTodosDone();
                 return {
@@ -8115,6 +8184,7 @@ async function handleToolCall(params) {
                 };
             }
             case "list_group_members": {
+                rejectIfStrictProjectScope("list_group_members");
                 const args = ListGroupMembersSchema.parse(params.arguments);
                 const { group_id, ...options } = args;
                 const members = await listGroupMembers(group_id, options);
@@ -8637,6 +8707,7 @@ async function handleToolCall(params) {
                 };
             }
             case "list_group_wiki_pages": {
+                rejectIfStrictProjectScope("list_group_wiki_pages");
                 const { group_id, page, per_page, with_content, render_html } = ListGroupWikiPagesSchema.parse(params.arguments);
                 const wikiPages = await listGroupWikiPages(group_id, {
                     page,
@@ -8649,6 +8720,7 @@ async function handleToolCall(params) {
                 };
             }
             case "get_group_wiki_page": {
+                rejectIfStrictProjectScope("get_group_wiki_page");
                 const { group_id, slug, render_html } = GetGroupWikiPageSchema.parse(params.arguments);
                 const wikiPage = await getGroupWikiPage(group_id, slug, render_html);
                 return {
@@ -8656,6 +8728,7 @@ async function handleToolCall(params) {
                 };
             }
             case "create_group_wiki_page": {
+                rejectIfStrictProjectScope("create_group_wiki_page");
                 const { group_id, title, content, format } = CreateGroupWikiPageSchema.parse(params.arguments);
                 const wikiPage = await createGroupWikiPage(group_id, title, content, format);
                 return {
@@ -8663,6 +8736,7 @@ async function handleToolCall(params) {
                 };
             }
             case "update_group_wiki_page": {
+                rejectIfStrictProjectScope("update_group_wiki_page");
                 const { group_id, slug, title, content, format } = UpdateGroupWikiPageSchema.parse(params.arguments);
                 const wikiPage = await updateGroupWikiPage(group_id, slug, title, content, format);
                 return {
@@ -8670,6 +8744,7 @@ async function handleToolCall(params) {
                 };
             }
             case "delete_group_wiki_page": {
+                rejectIfStrictProjectScope("delete_group_wiki_page");
                 const { group_id, slug } = DeleteGroupWikiPageSchema.parse(params.arguments);
                 await deleteGroupWikiPage(group_id, slug);
                 return {
@@ -9192,6 +9267,7 @@ async function handleToolCall(params) {
                 };
             }
             case "list_group_merge_requests": {
+                rejectIfStrictProjectScope("list_group_merge_requests");
                 const { group_id, ...options } = ListGroupMergeRequestsSchema.parse(params.arguments);
                 const cleanedOptions = cleanMutuallyExclusiveIdUsernameOptions(options, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS);
                 const mergeRequests = await listGroupMergeRequests(group_id, cleanedOptions);
@@ -9311,6 +9387,7 @@ async function handleToolCall(params) {
                 };
             }
             case "list_group_milestones": {
+                rejectIfStrictProjectScope("list_group_milestones");
                 const { group_id, ...options } = ListGroupMilestonesSchema.parse(params.arguments);
                 const milestones = await listGroupMilestones(group_id, options);
                 return {
@@ -9323,6 +9400,7 @@ async function handleToolCall(params) {
                 };
             }
             case "get_group_milestone": {
+                rejectIfStrictProjectScope("get_group_milestone");
                 const { group_id, milestone_id } = GetGroupMilestoneSchema.parse(params.arguments);
                 const milestone = await getGroupMilestone(group_id, milestone_id);
                 return {
@@ -9335,6 +9413,7 @@ async function handleToolCall(params) {
                 };
             }
             case "create_group_milestone": {
+                rejectIfStrictProjectScope("create_group_milestone");
                 const { group_id, ...options } = CreateGroupMilestoneSchema.parse(params.arguments);
                 const milestone = await createGroupMilestone(group_id, options);
                 return {
@@ -9347,6 +9426,7 @@ async function handleToolCall(params) {
                 };
             }
             case "edit_group_milestone": {
+                rejectIfStrictProjectScope("edit_group_milestone");
                 const { group_id, milestone_id, ...options } = EditGroupMilestoneSchema.parse(params.arguments);
                 const milestone = await editGroupMilestone(group_id, milestone_id, options);
                 return {
@@ -9359,6 +9439,7 @@ async function handleToolCall(params) {
                 };
             }
             case "delete_group_milestone": {
+                rejectIfStrictProjectScope("delete_group_milestone");
                 const { group_id, milestone_id } = DeleteGroupMilestoneSchema.parse(params.arguments);
                 await deleteGroupMilestone(group_id, milestone_id);
                 return {
@@ -9374,6 +9455,7 @@ async function handleToolCall(params) {
                 };
             }
             case "get_group_milestone_issue": {
+                rejectIfStrictProjectScope("get_group_milestone_issue");
                 const { group_id, milestone_id, ...options } = GetGroupMilestoneIssuesSchema.parse(params.arguments);
                 const issues = await getGroupMilestoneIssues(group_id, milestone_id, options);
                 return {
@@ -9386,6 +9468,7 @@ async function handleToolCall(params) {
                 };
             }
             case "get_group_milestone_merge_requests": {
+                rejectIfStrictProjectScope("get_group_milestone_merge_requests");
                 const { group_id, milestone_id, ...options } = GetGroupMilestoneMergeRequestsSchema.parse(params.arguments);
                 const mergeRequests = await getGroupMilestoneMergeRequests(group_id, milestone_id, options);
                 return {
@@ -9398,6 +9481,7 @@ async function handleToolCall(params) {
                 };
             }
             case "get_group_milestone_burndown_events": {
+                rejectIfStrictProjectScope("get_group_milestone_burndown_events");
                 const { group_id, milestone_id, ...options } = GetGroupMilestoneBurndownEventsSchema.parse(params.arguments);
                 const events = await getGroupMilestoneBurndownEvents(group_id, milestone_id, options);
                 return {
@@ -9455,6 +9539,7 @@ async function handleToolCall(params) {
                 };
             }
             case "list_group_iterations": {
+                rejectIfStrictProjectScope("list_group_iterations");
                 const args = ListGroupIterationsSchema.parse(params.arguments);
                 const iterations = await listGroupIterations(args.group_id, args);
                 return {
@@ -9653,6 +9738,7 @@ async function handleToolCall(params) {
                 };
             }
             case "list_events": {
+                rejectIfStrictProjectScope("list_events");
                 const args = ListEventsSchema.parse(params.arguments);
                 const events = await listEvents(args);
                 return {
@@ -10248,7 +10334,28 @@ async function startStreamableHTTPServer() {
         const privateToken = req.headers["private-token"] || "";
         const jobToken = req.headers["job-token"] || "";
         const dynamicApiUrl = req.headers["x-gitlab-api-url"]?.trim();
+        const requestedProjectScope = req.headers["x-gitlab-allowed-project-ids"]?.trim();
         let apiUrl = GITLAB_API_URL; // Default API URL
+        let allowedProjectIds;
+        // Only process the requested project scope if the feature is enabled
+        if (ENABLE_DYNAMIC_PROJECT_SCOPE && requestedProjectScope !== undefined) {
+            const requested = requestedProjectScope
+                .split(",")
+                .map(id => id.trim())
+                .filter(Boolean);
+            if (requested.length === 0) {
+                logger.warn("Empty X-GitLab-Allowed-Project-Ids provided");
+                return null;
+            }
+            if (GITLAB_ALLOWED_PROJECT_IDS.length > 0) {
+                const outOfScope = requested.filter(id => !GITLAB_ALLOWED_PROJECT_IDS.includes(id));
+                if (outOfScope.length > 0) {
+                    logger.warn(`X-GitLab-Allowed-Project-Ids requested projects outside GITLAB_ALLOWED_PROJECT_IDS: ${outOfScope.join(", ")}`);
+                    return null; // Reject if the header tries to widen the configured allowlist
+                }
+            }
+            allowedProjectIds = requested;
+        }
         // Only process dynamic URL if the feature is enabled
         if (ENABLE_DYNAMIC_API_URL && dynamicApiUrl) {
             try {
@@ -10284,7 +10391,7 @@ async function startStreamableHTTPServer() {
         }
         // Validate token and return AuthData object
         if (token && header && validateToken(token)) {
-            return { header, token, lastUsed: Date.now(), apiUrl };
+            return { header, token, lastUsed: Date.now(), apiUrl, allowedProjectIds };
         }
         return null;
     };
@@ -10434,6 +10541,7 @@ async function startStreamableHTTPServer() {
                 header: headerAuth.header,
                 token: headerAuth.token,
                 apiUrl: headerAuth.apiUrl,
+                allowedProjectIds: headerAuth.allowedProjectIds,
             };
             freshAuthPresent = true;
         }
@@ -10462,7 +10570,12 @@ async function startStreamableHTTPServer() {
             if (looksLikeStatelessSessionId(incomingSid)) {
                 const opened = openSessionId(material, incomingSid, sessionTtlSeconds);
                 if (opened) {
-                    effective = { header: opened.h, token: opened.t, apiUrl: opened.u };
+                    effective = {
+                        header: opened.h,
+                        token: opened.t,
+                        apiUrl: opened.u,
+                        allowedProjectIds: opened.p,
+                    };
                     metrics.statelessAuthFromSealedSid++;
                 }
                 else {
@@ -10508,6 +10621,7 @@ async function startStreamableHTTPServer() {
             header: effective.header,
             token: effective.token,
             apiUrl: effective.apiUrl,
+            allowedProjectIds: effective.allowedProjectIds,
         });
         if (freshAuthPresent) {
             metrics.statelessSidRotated++;
@@ -10526,6 +10640,7 @@ async function startStreamableHTTPServer() {
             lastUsed: Date.now(),
             apiUrl: effective.apiUrl,
             publicBaseUrl: getForwardedPublicBaseUrl(req, MCP_TRUST_PROXY),
+            allowedProjectIds: effective.allowedProjectIds,
         };
         // Step 4: create a fresh transport per request.
         // DNS rebinding protection is enforced by requireMcpHostAndOrigin middleware;
@@ -11052,6 +11167,7 @@ async function startStreamableHTTPServer() {
                 lastUsed: authData.lastUsed,
                 apiUrl: authData.apiUrl,
                 publicBaseUrl: authData.publicBaseUrl,
+                allowedProjectIds: authData.allowedProjectIds,
             };
             // Run the entire request handling within AsyncLocalStorage context
             await sessionAuthStore.run(ctx, handleRequest);
@@ -11130,6 +11246,7 @@ async function startStreamableHTTPServer() {
                     lastUsed: authData.lastUsed,
                     apiUrl: authData.apiUrl,
                     publicBaseUrl: authData.publicBaseUrl,
+                    allowedProjectIds: authData.allowedProjectIds,
                 };
                 await sessionAuthStore.run(ctx, handleGetRequest);
             }

package/build/schemas.js

@@ -1229,6 +1229,7 @@ export const GitLabCreateUpdateFileResponseSchema = z.object({
 export const GitLabSearchResponseSchema = z.object({
     count: z.coerce.number().optional(),
     total_pages: z.coerce.number().optional(),
+    next_page: z.coerce.number().optional(),
     current_page: z.coerce.number().optional(),
     items: z.array(GitLabRepositorySchema),
 });

package/build/stateless/session-id.js

@@ -35,6 +35,9 @@ export function mintSessionId(material, input) {
         h: input.header,
         t: input.token,
         u: input.apiUrl,
+        ...(input.allowedProjectIds && input.allowedProjectIds.length > 0
+            ? { p: input.allowedProjectIds }
+            : {}),
     };
     return seal(material, STATELESS_PURPOSES.SESSION_ID, payload);
 }
@@ -51,7 +54,9 @@ export function openSessionId(material, sid, ttlSeconds, now) {
             payload.h !== "JOB-TOKEN") ||
             typeof payload.t !== "string" ||
             payload.t.length === 0 ||
-            typeof payload.u !== "string") {
+            typeof payload.u !== "string" ||
+            (payload.p !== undefined &&
+                (!Array.isArray(payload.p) || payload.p.some(id => typeof id !== "string")))) {
             return null;
         }
         return payload;

package/build/test/stateless/session-id.test.js

@@ -19,6 +19,32 @@ function load(current, previous) {
     return m;
 }
 describe("mintSessionId / openSessionId", () => {
+    test("seals and restores a narrowed project scope", () => {
+        const s = secret();
+        const a = load(s);
+        const b = load(s);
+        const sid = mintSessionId(a, {
+            header: "Private-Token",
+            token: "glpat-ABCDEFG123456789-abcdef",
+            apiUrl: "https://gitlab.example.com/api/v4",
+            allowedProjectIds: ["42", "org/theorg"],
+        });
+        const opened = openSessionId(b, sid, 3600);
+        assert.ok(opened);
+        assert.deepEqual(opened.p, ["42", "org/theorg"]);
+    });
+    test("omits the scope field when no scope was narrowed", () => {
+        const s = secret();
+        const m = load(s);
+        const sid = mintSessionId(m, {
+            header: "Private-Token",
+            token: "glpat-ABCDEFG123456789-abcdef",
+            apiUrl: "https://gitlab.example.com/api/v4",
+        });
+        const opened = openSessionId(m, sid, 3600);
+        assert.ok(opened);
+        assert.equal(opened.p, undefined);
+    });
     test("roundtrips across pods", () => {
         const s = secret();
         const a = load(s);

package/build/test/test-dynamic-project-scope.js

@@ -0,0 +1,362 @@
+import { describe, test, before, after } from "node:test";
+import assert from "node:assert";
+import { cleanupServers, findAvailablePort, HOST, launchServer, TransportMode, } from "./utils/server-launcher.js";
+import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
+import { CustomHeaderClient } from "./clients/custom-header-client.js";
+const MOCK_TOKEN = "glpat-dynamic-scope-token";
+const SCOPE_HEADER = "x-gitlab-allowed-project-ids";
+async function connectClient(mcpUrl, scope) {
+    const headers = { authorization: `Bearer ${MOCK_TOKEN}` };
+    if (scope !== undefined) {
+        headers[SCOPE_HEADER] = scope;
+    }
+    const client = new CustomHeaderClient(headers);
+    await client.connect(mcpUrl);
+    return client;
+}
+async function getProjectId(client, projectId) {
+    const result = await client.callTool("get_project", { project_id: projectId });
+    assert.ok(result.content, "Should have content");
+    const content = result.content[0];
+    assert.ok("text" in content, "Content should have text");
+    const project = JSON.parse(content.text);
+    return project.id.toString();
+}
+describe("Dynamic project scope", { concurrency: 1 }, () => {
+    describe("with GITLAB_ALLOWED_PROJECT_IDS set", () => {
+        let mockGitLab;
+        const servers = [];
+        let mcpUrl;
+        before(async () => {
+            const mockPort = await findMockServerPort();
+            mockGitLab = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN] });
+            mockGitLab.addMockHandler("get", "/projects", (req, res) => {
+                if (req.query.search === "no-totals") {
+                    const requestedPage = Number(req.query.page ?? "1");
+                    if (requestedPage < 3) {
+                        res.set("x-next-page", String(requestedPage + 1));
+                    }
+                }
+                else {
+                    res.set("x-total", "3");
+                    res.set("x-total-pages", "2");
+                }
+                res.json(["1", "2", "3"].map(id => ({
+                    id: Number(id),
+                    name: `Project ${id}`,
+                    path: `project-${id}`,
+                    path_with_namespace: `group/project-${id}`,
+                    description: null,
+                    visibility: "private",
+                    namespace: { id: 1, name: "Group", path: "group", kind: "group", full_path: "group" },
+                })));
+            });
+            await mockGitLab.start();
+            const mcpPort = await findAvailablePort(3200);
+            const server = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port: mcpPort,
+                timeout: 5000,
+                env: {
+                    STREAMABLE_HTTP: "true",
+                    REMOTE_AUTHORIZATION: "true",
+                    ENABLE_DYNAMIC_PROJECT_SCOPE: "true",
+                    ENABLE_STRICT_PROJECT_SCOPE: "true",
+                    GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
+                    GITLAB_ALLOWED_PROJECT_IDS: "1,2",
+                },
+            });
+            servers.push(server);
+            mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
+        });
+        after(async () => {
+            cleanupServers(servers);
+            await mockGitLab?.stop();
+        });
+        test("header narrows the allowlist to the requested projects", async () => {
+            const client = await connectClient(mcpUrl, "1");
+            try {
+                assert.strictEqual(await getProjectId(client, ""), "1");
+                await assert.rejects(() => client.callTool("get_project", { project_id: "2" }), /Access denied/);
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("project outside GITLAB_ALLOWED_PROJECT_IDS rejects the session", async () => {
+            const client = new CustomHeaderClient({
+                authorization: `Bearer ${MOCK_TOKEN}`,
+                [SCOPE_HEADER]: "1,3",
+            });
+            let connected = false;
+            try {
+                await client.connect(mcpUrl);
+                connected = true;
+                await client.callTool("get_project", { project_id: "1" });
+            }
+            catch {
+                // Expected: the session is rejected before any tool call is possible.
+            }
+            finally {
+                await client.disconnect();
+            }
+            assert.strictEqual(connected, false, "out-of-scope header must not initialize a session");
+        });
+        test("empty header rejects the session", async () => {
+            const client = new CustomHeaderClient({
+                authorization: `Bearer ${MOCK_TOKEN}`,
+                [SCOPE_HEADER]: "  ",
+            });
+            let connected = false;
+            try {
+                await client.connect(mcpUrl);
+                connected = true;
+                await client.callTool("get_project", { project_id: "1" });
+            }
+            catch {
+                // Expected: the session is rejected before any tool call is possible.
+            }
+            finally {
+                await client.disconnect();
+            }
+            assert.strictEqual(connected, false, "an empty header must not initialize a session");
+        });
+        test("scoped session refuses non-scopable tools", async () => {
+            const client = await connectClient(mcpUrl, "1");
+            try {
+                await assert.rejects(() => client.callTool("execute_graphql", { query: "query { currentUser { id } }" }), /not allowed while a project allowlist is in effect/);
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("session without the header keeps the full env allowlist", async () => {
+            const client = await connectClient(mcpUrl);
+            try {
+                assert.strictEqual(await getProjectId(client, "2"), "2");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("list_issues without project_id stays within the session scope", async () => {
+            const client = await connectClient(mcpUrl, "1");
+            try {
+                const result = await client.callTool("list_issues", {});
+                assert.ok(result.content, "Should have content");
+                const content = result.content[0];
+                assert.ok("text" in content, "Content should have text");
+                const issues = JSON.parse(content.text);
+                assert.ok(issues.every(issue => issue.web_url.includes("/project/1/")), "Should only return issues of the scoped project");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("list_todos is refused under strict scope", async () => {
+            const client = await connectClient(mcpUrl, "1");
+            try {
+                await assert.rejects(() => client.callTool("list_todos", {}), /not allowed while a project allowlist is in effect/);
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("search_repositories keeps the unfiltered pagination totals", async () => {
+            const client = await connectClient(mcpUrl, "1");
+            try {
+                const result = await client.callTool("search_repositories", { search: "project" });
+                assert.ok(result.content, "Should have content");
+                const content = result.content[0];
+                assert.ok("text" in content, "Content should have text");
+                const search = JSON.parse(content.text);
+                assert.deepStrictEqual(search.items.map(item => item.id), ["1"]);
+                assert.strictEqual(search.count, 3, "count must reflect the unfiltered GitLab total");
+                assert.strictEqual(search.total_pages, 2, "total_pages must cover the unfiltered pages");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("search_repositories follows next_page across all pages when totals are missing", async () => {
+            const client = await connectClient(mcpUrl, "1");
+            try {
+                let page = 1;
+                const visited = [];
+                while (page !== undefined) {
+                    const result = await client.callTool("search_repositories", {
+                        search: "no-totals",
+                        page,
+                    });
+                    assert.ok(result.content, "Should have content");
+                    const content = result.content[0];
+                    assert.ok("text" in content, "Content should have text");
+                    const search = JSON.parse(content.text);
+                    assert.strictEqual(search.total_pages, undefined, "total_pages must stay unset");
+                    assert.deepStrictEqual(search.items.map(item => item.id), ["1"]);
+                    visited.push(search.current_page);
+                    page = search.next_page;
+                }
+                assert.deepStrictEqual(visited, [1, 2, 3], "next_page must make every page reachable");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("list_projects is filtered to the session scope", async () => {
+            const client = await connectClient(mcpUrl, "1");
+            try {
+                const result = await client.callTool("list_projects", {});
+                assert.ok(result.content, "Should have content");
+                const content = result.content[0];
+                assert.ok("text" in content, "Content should have text");
+                const projects = JSON.parse(content.text);
+                assert.deepStrictEqual(projects.map(project => project.id), ["1"]);
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("list_projects is filtered to the env allowlist without the header", async () => {
+            const client = await connectClient(mcpUrl);
+            try {
+                const result = await client.callTool("list_projects", {});
+                assert.ok(result.content, "Should have content");
+                const content = result.content[0];
+                assert.ok("text" in content, "Content should have text");
+                const projects = JSON.parse(content.text);
+                assert.deepStrictEqual(projects.map(project => project.id), ["1", "2"]);
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+    });
+    describe("without GITLAB_ALLOWED_PROJECT_IDS", () => {
+        let mockGitLab;
+        const servers = [];
+        let mcpUrl;
+        before(async () => {
+            const mockPort = await findMockServerPort();
+            mockGitLab = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN] });
+            mockGitLab.addRootHandler("post", "/api/graphql", (req, res) => {
+                const { query } = req.body;
+                if (query.includes("vulnerability(")) {
+                    res.json({
+                        data: {
+                            vulnerability: {
+                                id: "gid://gitlab/Vulnerability/42",
+                                title: "Mock vulnerability",
+                                project: {
+                                    id: "gid://gitlab/Project/8",
+                                    name: "Other project",
+                                    fullPath: "other/project",
+                                },
+                            },
+                        },
+                    });
+                    return;
+                }
+                res.status(500).json({ message: `Unexpected GraphQL query: ${query}` });
+            });
+            await mockGitLab.start();
+            const mcpPort = await findAvailablePort(3200);
+            const server = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port: mcpPort,
+                timeout: 5000,
+                env: {
+                    STREAMABLE_HTTP: "true",
+                    REMOTE_AUTHORIZATION: "true",
+                    ENABLE_DYNAMIC_PROJECT_SCOPE: "true",
+                    GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
+                },
+            });
+            servers.push(server);
+            mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
+        });
+        after(async () => {
+            cleanupServers(servers);
+            await mockGitLab?.stop();
+        });
+        test("header bounds an otherwise unrestricted server", async () => {
+            const client = await connectClient(mcpUrl, "7");
+            try {
+                assert.strictEqual(await getProjectId(client, ""), "7");
+                await assert.rejects(() => client.callTool("get_project", { project_id: "8" }), /Access denied/);
+                await assert.rejects(() => client.callTool("execute_graphql", { query: "query { currentUser { id } }" }), /not allowed while a project allowlist is in effect/);
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("session without the header stays unrestricted", async () => {
+            const client = await connectClient(mcpUrl);
+            try {
+                assert.strictEqual(await getProjectId(client, "8"), "8");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("scoped session cannot reach vulnerabilities of other projects", async () => {
+            const client = await connectClient(mcpUrl, "7");
+            try {
+                await assert.rejects(() => client.callTool("get_vulnerability", { vulnerability_id: "42" }), /Access denied/);
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+        test("unscoped session can reach vulnerabilities", async () => {
+            const client = await connectClient(mcpUrl);
+            try {
+                const result = await client.callTool("get_vulnerability", { vulnerability_id: "42" });
+                assert.ok(result.content, "Should have content");
+                const content = result.content[0];
+                assert.ok("text" in content, "Content should have text");
+                const vulnerability = JSON.parse(content.text);
+                assert.strictEqual(vulnerability.project.fullPath, "other/project");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+    });
+    describe("with ENABLE_DYNAMIC_PROJECT_SCOPE disabled", () => {
+        let mockGitLab;
+        const servers = [];
+        let mcpUrl;
+        before(async () => {
+            const mockPort = await findMockServerPort();
+            mockGitLab = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN] });
+            await mockGitLab.start();
+            const mcpPort = await findAvailablePort(3200);
+            const server = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port: mcpPort,
+                timeout: 5000,
+                env: {
+                    STREAMABLE_HTTP: "true",
+                    REMOTE_AUTHORIZATION: "true",
+                    GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
+                },
+            });
+            servers.push(server);
+            mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
+        });
+        after(async () => {
+            cleanupServers(servers);
+            await mockGitLab?.stop();
+        });
+        test("header is ignored when the feature flag is off", async () => {
+            const client = await connectClient(mcpUrl, "1");
+            try {
+                assert.strictEqual(await getProjectId(client, "2"), "2");
+            }
+            finally {
+                await client.disconnect();
+            }
+        });
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.57",
+  "version": "2.1.58",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [