@zereight/mcp-gitlab 2.1.58 → 2.1.60

package/build/schemas.js

@@ -119,6 +119,8 @@ export const GitLabPipelineJobSchema = z.object({
     web_url: z.string().optional(),
     allow_failure: z.coerce.boolean().optional(),
     retried: z.coerce.boolean().optional(),
+    when: z.string().optional(),
+    needs: z.array(z.unknown()).optional(),
     tag_list: z.array(z.string()).optional(),
     runner: z
         .object({
@@ -257,6 +259,38 @@ export const GetPipelineSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     pipeline_id: z.coerce.string().describe("The ID of the pipeline"),
 });
+export const GetPipelineVariablesSchema = GetPipelineSchema.merge(PaginationOptionsSchema);
+export const UpdatePipelineMetadataSchema = GetPipelineSchema.extend({
+    name: z.string().min(1).describe("New pipeline name"),
+});
+export const DeletePipelineSchema = GetPipelineSchema;
+export const PipelineReportSchema = GetPipelineSchema.merge(PaginationOptionsSchema);
+export const PlayPipelineJobsSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
+    job_ids: z
+        .array(z.coerce.string())
+        .min(1)
+        .refine((jobIds) => new Set(jobIds).size === jobIds.length, "job_ids must not contain duplicates")
+        .describe("Job IDs to play, in dependency order"),
+    job_variables_attributes: z
+        .array(z.object({ key: z.string(), value: z.string() }))
+        .optional()
+        .describe("Custom job variables to use when running each job"),
+    timeout_seconds: z.coerce
+        .number()
+        .int()
+        .min(1)
+        .max(600)
+        .optional()
+        .describe("Maximum seconds to wait for each job to reach a terminal status (applied per job; total duration scales with the batch size)"),
+    poll_interval_seconds: z.coerce
+        .number()
+        .int()
+        .min(1)
+        .max(30)
+        .optional()
+        .describe("Seconds between status polls while waiting for each job"),
+});
 export const GitLabMergeRequestPipelineSchema = z.object({
     id: z.coerce.string(),
     sha: z.string(),
@@ -380,6 +414,28 @@ export const GetCiCatalogResourceSchema = z.union([
     message: "Provide exactly one of id or full_path",
 });
 // Deployment related schemas
+const GitLabDeploymentApprovalUserSchema = z.object({
+    id: z.coerce.string().optional(),
+    username: z.string().optional(),
+    name: z.string().optional(),
+    state: z.string().optional(),
+    avatar_url: z.string().nullable().optional(),
+    web_url: z.string().optional(),
+});
+const GitLabDeploymentApprovalSchema = z.object({
+    user: GitLabDeploymentApprovalUserSchema.optional(),
+    status: z.string().optional(),
+    created_at: z.string().optional(),
+    comment: z.string().nullable().optional(),
+});
+const GitLabDeploymentApprovalRuleSchema = z.object({
+    user_id: z.coerce.string().nullable().optional(),
+    group_id: z.coerce.string().nullable().optional(),
+    access_level: z.coerce.number().nullable().optional(),
+    access_level_description: z.string().nullable().optional(),
+    required_approvals: z.coerce.number().optional(),
+    deployment_approvals: z.array(GitLabDeploymentApprovalSchema).optional(),
+});
 export const GitLabDeploymentSchema = z.object({
     id: z.coerce.string(),
     iid: z.coerce.string().optional(),
@@ -427,6 +483,11 @@ export const GitLabDeploymentSchema = z.object({
     })
         .optional(),
     web_url: z.string().optional(),
+    pending_approval_count: z.coerce.number().optional(),
+    approvals: z.array(GitLabDeploymentApprovalSchema).optional(),
+    approval_summary: z
+        .object({ rules: z.array(GitLabDeploymentApprovalRuleSchema).optional() })
+        .optional(),
 });
 export const ListDeploymentsSchema = z
     .object({
@@ -457,6 +518,19 @@ export const GetDeploymentSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     deployment_id: z.coerce.string().describe("The ID of the deployment"),
 });
+export const CreateDeploymentSchema = z.object({
+    project_id: z.coerce.string(), environment: z.string(), sha: z.string(), ref: z.string(),
+    tag: z.boolean(), status: z.enum(["running", "success", "failed", "canceled"]),
+});
+export const UpdateDeploymentSchema = GetDeploymentSchema.extend({
+    status: z.enum(["running", "success", "failed", "canceled"]),
+});
+export const DeploymentApprovalSchema = GetDeploymentSchema.extend({
+    status: z.enum(["approved", "rejected"]),
+    comment: z.string().optional(),
+    represented_as: z.string().optional(),
+});
+export const ListDeploymentMergeRequestsSchema = GetDeploymentSchema.merge(PaginationOptionsSchema);
 // Environment related schemas
 const GitLabEnvironmentLastDeploymentSchema = z.object({
     id: z.coerce.string().optional(),
@@ -496,6 +570,31 @@ export const GetEnvironmentSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     environment_id: z.coerce.string().describe("The ID of the environment"),
 });
+export const UpdateEnvironmentSchema = GetEnvironmentSchema.extend({
+    external_url: z.string().url().nullable().optional(),
+    tier: z.enum(["production", "staging", "testing", "development", "other"]).optional(),
+    auto_stop_setting: z.enum(["always", "with_action"]).optional(),
+});
+export const StopEnvironmentSchema = GetEnvironmentSchema.extend({ force: coerceBooleanString.optional() });
+export const StopStaleEnvironmentsSchema = z.object({ project_id: z.coerce.string(), before: z.string() });
+export const DeleteReviewAppEnvironmentsSchema = z.object({
+    project_id: z.coerce.string(), before: z.string().optional(), limit: z.coerce.number().optional(),
+    dry_run: coerceBooleanString
+        .optional()
+        .describe("Preview the cleanup when true (default); set to false to schedule deletion one week later"),
+});
+export const PipelineTriggerIdSchema = z.object({ project_id: z.coerce.string(), trigger_id: z.coerce.string() });
+export const ListPipelineTriggersSchema = z.object({ project_id: z.coerce.string() });
+export const CreatePipelineTriggerSchema = z.object({ project_id: z.coerce.string(), description: z.string() });
+export const UpdatePipelineTriggerSchema = PipelineTriggerIdSchema.extend({ description: z.string() });
+export const TriggerPipelineSchema = z.object({
+    project_id: z.coerce.string(), token: z.string(), ref: z.string(),
+    variables: z.record(z.string()).optional(),
+    inputs: z
+        .record(z.unknown())
+        .optional()
+        .describe("Structured pipeline inputs; supported from GitLab 17.10 behind a feature flag and generally available from GitLab 18.1. Omit on older GitLab versions."),
+});
 // Schema for creating a new pipeline
 export const CreatePipelineSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
@@ -771,15 +870,51 @@ export const PlayPipelineJobSchema = z.object({
     }))
         .optional()
         .describe("Custom job variables to use when running the job"),
+    job_inputs: z.record(z.unknown()).optional().describe("Typed job input values"),
 });
 // Schema for retrying a job
-export const RetryPipelineJobSchema = PipelineJobControlSchema;
+export const RetryPipelineJobSchema = PipelineJobControlSchema.extend({
+    job_inputs: z.record(z.unknown()).optional().describe("Typed job input values"),
+});
 // Schema for canceling a job
 export const CancelPipelineJobSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     job_id: z.coerce.string().describe("The ID of the job"),
     force: z.coerce.boolean().optional().describe("Force cancellation of the job"),
 });
+export const ErasePipelineJobSchema = PipelineJobControlSchema;
+export const WaitForPipelineSchema = GetPipelineSchema.extend({
+    timeout_seconds: z.coerce
+        .number()
+        .int()
+        .min(1)
+        .max(600)
+        .optional()
+        .describe("Maximum seconds to wait for this pipeline to reach a terminal status"),
+    poll_interval_seconds: z.coerce
+        .number()
+        .int()
+        .min(1)
+        .max(30)
+        .optional()
+        .describe("Seconds between status polls while waiting for this pipeline"),
+});
+export const WaitForPipelineJobSchema = PipelineJobControlSchema.extend({
+    timeout_seconds: z.coerce
+        .number()
+        .int()
+        .min(1)
+        .max(600)
+        .optional()
+        .describe("Maximum seconds to wait for this job to reach a terminal status"),
+    poll_interval_seconds: z.coerce
+        .number()
+        .int()
+        .min(1)
+        .max(30)
+        .optional()
+        .describe("Seconds between status polls while waiting for this job"),
+});
 // User schemas
 export const GitLabUserSchema = z.object({
     username: z.string().optional(), // Changed from login to match GitLab API
@@ -2360,8 +2495,7 @@ export const ListGroupMergeRequestsSchema = ListMergeRequestsSchema.omit({
     project_id: true,
 }).extend({
     group_id: z.coerce.string().describe("Group ID or URL-encoded path"),
-    non_archived: z.coerce
-        .boolean()
+    non_archived: coerceBooleanString
         .optional()
         .describe("Return merge requests from non-archived projects only. Defaults to true."),
     source_project_id: z.coerce
@@ -4500,3 +4634,23 @@ export const ConfirmVulnerabilitySchema = z.object({
         .describe("The ID of the vulnerability to confirm (numeric or GraphQL global ID)"),
     comment: z.string().optional().describe("Optional comment explaining the confirmation"),
 });
+// --- GitLab Orbit (knowledge graph) ---
+// Query the Orbit property graph: groups, projects, MRs, pipelines, issues,
+// vulnerabilities, and source code indexed as one queryable graph.
+// Requires Premium/Ultimate; Beta; query calls consume GitLab credits.
+export const OrbitQuerySchema = z.object({
+    query: z
+        .record(z.string(), z.unknown())
+        .describe("GitLab Orbit query DSL object (see the Orbit query-language reference for node/edge types and operators)"),
+    format: z
+        .enum(["raw", "llm"])
+        .optional()
+        .default("llm")
+        .describe("Response format: 'raw' for structured JSON, 'llm' for compact agent-optimized text (default)"),
+});
+// Schema for fetching the current Orbit graph schema (node/edge types)
+export const OrbitSchemaSchema = z.object({});
+// Schema for checking Orbit indexing status
+export const OrbitStatusSchema = z.object({});
+// Schema for listing the MCP tool definitions Orbit exposes
+export const OrbitToolsSchema = z.object({});

package/build/scripts/check-skill-sync.js

@@ -22,6 +22,11 @@ const REFERENCE_FIELD_ALLOWLIST = new Set([
     "new_file",
     "new_path",
     "old_path",
+    "name",
+    "page",
+    "per_page",
+    "pipeline_id",
+    "job_inputs",
     "project_id",
     "renamed_file",
 ]);

package/build/scripts/generate-tool-docs.js

@@ -119,6 +119,10 @@ const GROUP_META = {
         title: "Vulnerabilities",
         blurb: "AI-assisted vulnerability triage — list findings, inspect details, dismiss with reason, or confirm for remediation. Backed by the GitLab GraphQL API; requires GitLab Ultimate.",
     },
+    orbit: {
+        title: "GitLab Orbit",
+        blurb: "Query the Orbit SDLC knowledge graph (Beta; Premium/Ultimate). Graph queries consume GitLab credits; schema, status, and tool listing are free.",
+    },
 };
 const GROUP_ORDER = [
     "projects",
@@ -141,6 +145,7 @@ const GROUP_ORDER = [
     "search",
     "dependency_proxy",
     "vulnerabilities",
+    "orbit",
 ];
 // Authoritative classification — uses the `readOnlyTools` set from
 // tools/registry.ts. That set is what the server itself consults to decide

package/build/test/test-deployment-tools.js

@@ -62,7 +62,7 @@ async function callTool(toolName, args, env) {
             env: {
                 ...process.env,
                 ...env,
-                GITLAB_READ_ONLY_MODE: "true",
+                GITLAB_READ_ONLY_MODE: env.GITLAB_READ_ONLY_MODE ?? "true",
                 USE_PIPELINE: "true",
             },
         });
@@ -238,8 +238,62 @@ describe("deployment and environment tools", () => {
                     stage: "deploy",
                     pipeline: { id: "190349", status: "success", ref: "master", sha: "abc123" },
                 },
+                pending_approval_count: 1,
+                approvals: [
+                    {
+                        user: {
+                            id: "100",
+                            username: "security-user-1",
+                            name: "Security User",
+                            state: "active",
+                            web_url: "https://gitlab.example.com/security-user-1",
+                        },
+                        status: "approved",
+                        created_at: "2026-02-20T16:33:00.000Z",
+                        comment: "Looks good to me",
+                    },
+                ],
+                approval_summary: {
+                    rules: [
+                        {
+                            group_id: "134",
+                            access_level: null,
+                            access_level_description: "security-group",
+                            required_approvals: 2,
+                            deployment_approvals: [
+                                {
+                                    user: {
+                                        id: "100",
+                                        username: "security-user-1",
+                                        name: "Security User",
+                                        state: "active",
+                                        web_url: "https://gitlab.example.com/security-user-1",
+                                    },
+                                    status: "approved",
+                                    created_at: "2026-02-20T16:33:00.000Z",
+                                    comment: "Looks good to me",
+                                },
+                            ],
+                        },
+                    ],
+                },
             });
         });
+        mockGitLab.addMockHandler("post", `/projects/${TEST_PROJECT_ID}/deployments`, (_req, res) => {
+            res.status(201).json({ id: "created-deployment", status: "created" });
+        });
+        mockGitLab.addMockHandler("put", `/projects/${TEST_PROJECT_ID}/deployments/${TEST_DEPLOYMENT_ID}`, (_req, res) => {
+            res.json({ id: TEST_DEPLOYMENT_ID, status: "success" });
+        });
+        mockGitLab.addMockHandler("delete", `/projects/${TEST_PROJECT_ID}/deployments/${TEST_DEPLOYMENT_ID}`, (_req, res) => {
+            res.status(204).send();
+        });
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/deployments/${TEST_DEPLOYMENT_ID}/merge_requests`, (_req, res) => {
+            res.json([{ iid: TEST_MERGE_REQUEST_IID, title: "Shipped change" }]);
+        });
+        mockGitLab.addMockHandler("post", `/projects/${TEST_PROJECT_ID}/deployments/${TEST_DEPLOYMENT_ID}/approval`, (_req, res) => {
+            res.json({ id: TEST_DEPLOYMENT_ID, status: "approved" });
+        });
         mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/environments`, (req, res) => {
             res.json([
                 {
@@ -298,6 +352,35 @@ describe("deployment and environment tools", () => {
         assert.strictEqual(result.id, TEST_DEPLOYMENT_ID);
         assert.strictEqual(result.ref, "master");
         assert.strictEqual(result.status, "success");
+        assert.strictEqual(result.pending_approval_count, 1);
+        assert.strictEqual(result.approvals[0].status, "approved");
+        assert.strictEqual(result.approvals[0].user.username, "security-user-1");
+        assert.strictEqual(result.approval_summary.rules[0].group_id, "134");
+        assert.strictEqual(result.approval_summary.rules[0].deployment_approvals[0].comment, "Looks good to me");
+    });
+    test("supports deployment lifecycle and approval operations", async () => {
+        const env = {
+            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+            GITLAB_READ_ONLY_MODE: "false",
+        };
+        const created = await callTool("create_deployment", {
+            project_id: TEST_PROJECT_ID,
+            environment: "stage",
+            sha: "abc123",
+            ref: "master",
+            tag: false,
+            status: "running",
+        }, env);
+        assert.strictEqual(created.id, "created-deployment");
+        const updated = await callTool("update_deployment", { project_id: TEST_PROJECT_ID, deployment_id: TEST_DEPLOYMENT_ID, status: "success" }, env);
+        assert.strictEqual(updated.status, "success");
+        const mergeRequests = await callTool("list_deployment_merge_requests", { project_id: TEST_PROJECT_ID, deployment_id: TEST_DEPLOYMENT_ID }, env);
+        assert.strictEqual(mergeRequests[0].iid, TEST_MERGE_REQUEST_IID);
+        const approval = await callTool("approve_deployment", { project_id: TEST_PROJECT_ID, deployment_id: TEST_DEPLOYMENT_ID, status: "approved" }, env);
+        assert.strictEqual(approval.status, "approved");
+        const deleted = await callTool("delete_deployment", { project_id: TEST_PROJECT_ID, deployment_id: TEST_DEPLOYMENT_ID }, env);
+        assert.deepStrictEqual(deleted, { success: true });
     });
     test("list_environments returns environment list", async () => {
         const result = await callTool("list_environments", { project_id: TEST_PROJECT_ID }, {

package/build/test/test-orbit.js

@@ -0,0 +1,155 @@
+import { describe, test, before, after } from "node:test";
+import assert from "node:assert";
+import { spawn } from "child_process";
+import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
+const MOCK_TOKEN = "glpat-mock-token-12345";
+const mockSchema = {
+    nodes: [{ name: "Project", properties: ["id", "name"] }],
+    edges: [{ name: "HAS_MERGE_REQUEST", from: "Project", to: "MergeRequest" }],
+};
+const mockStatus = {
+    status: "ready",
+    last_indexed_at: "2026-09-05T10:00:00Z",
+    indexed_groups: 3,
+};
+const mockTools = {
+    tools: [{ name: "orbit_query", description: "Execute a graph query" }],
+};
+const mockQueryRaw = {
+    results: [{ project: "group/a", failures: 7 }],
+};
+const mockQueryLlm = "Top failing project: group/a (7 failures).";
+function baseEnv(mockGitLabUrl) {
+    return {
+        GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+        GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        GITLAB_TOOLSETS: "orbit",
+    };
+}
+async function callToolAsync(env, name, args) {
+    return new Promise((resolve, reject) => {
+        const proc = spawn("node", ["build/index.js"], {
+            stdio: ["pipe", "pipe", "pipe"],
+            env: { ...process.env, ...env },
+        });
+        let output = "";
+        let errorOutput = "";
+        proc.stdout?.on("data", (chunk) => (output += chunk));
+        proc.stderr?.on("data", (chunk) => (errorOutput += chunk));
+        proc.on("close", code => {
+            if (code !== 0) {
+                return reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
+            }
+            const line = output.split("\n").find(entry => entry.startsWith("{"));
+            if (!line) {
+                return reject(new Error("No JSON output found"));
+            }
+            try {
+                const response = JSON.parse(line);
+                if (response.error) {
+                    reject(new Error(JSON.stringify(response.error)));
+                    return;
+                }
+                const content = response.result?.content?.[0]?.text;
+                if (content === undefined) {
+                    reject(new Error("No tool result content"));
+                    return;
+                }
+                resolve(content);
+            }
+            catch (error) {
+                reject(error);
+            }
+        });
+        proc.stdin?.end(JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "tools/call",
+            params: { name, arguments: args },
+        }) + "\n");
+    });
+}
+describe("orbit tools", () => {
+    let mockGitLab;
+    let mockGitLabUrl;
+    let lastQueryBody = null;
+    before(async () => {
+        const mockPort = await findMockServerPort();
+        mockGitLab = new MockGitLabServer({
+            port: mockPort,
+            validTokens: [MOCK_TOKEN],
+        });
+        mockGitLab.addMockHandler("get", "/orbit/schema", (_req, res) => {
+            res.json(mockSchema);
+        });
+        mockGitLab.addMockHandler("get", "/orbit/status", (_req, res) => {
+            res.json(mockStatus);
+        });
+        mockGitLab.addMockHandler("get", "/orbit/tools", (_req, res) => {
+            res.json(mockTools);
+        });
+        mockGitLab.addMockHandler("post", "/orbit/query", (req, res) => {
+            lastQueryBody = req.body;
+            if (req.body?.format === "raw") {
+                res.json(mockQueryRaw);
+                return;
+            }
+            res.type("text/plain").send(mockQueryLlm);
+        });
+        await mockGitLab.start();
+        mockGitLabUrl = mockGitLab.getUrl();
+    });
+    after(async () => {
+        await mockGitLab.stop();
+    });
+    test("orbit_get_schema returns the graph schema", async () => {
+        const text = await callToolAsync(baseEnv(mockGitLabUrl), "orbit_get_schema", {});
+        assert.deepEqual(JSON.parse(text), mockSchema);
+    });
+    test("orbit_get_status returns indexing status", async () => {
+        const text = await callToolAsync(baseEnv(mockGitLabUrl), "orbit_get_status", {});
+        assert.deepEqual(JSON.parse(text), mockStatus);
+    });
+    test("orbit_list_tools returns tool definitions", async () => {
+        const text = await callToolAsync(baseEnv(mockGitLabUrl), "orbit_list_tools", {});
+        assert.deepEqual(JSON.parse(text), mockTools);
+    });
+    test("orbit_query with format=raw returns structured JSON", async () => {
+        const query = { node: "Project", limit: 5 };
+        const text = await callToolAsync(baseEnv(mockGitLabUrl), "orbit_query", {
+            query,
+            format: "raw",
+        });
+        assert.deepEqual(JSON.parse(text), mockQueryRaw);
+        assert.deepEqual(lastQueryBody, { query, format: "raw" });
+    });
+    test("orbit_query defaults to llm format and passes text through", async () => {
+        const query = { node: "Project", limit: 5 };
+        const text = await callToolAsync(baseEnv(mockGitLabUrl), "orbit_query", { query });
+        assert.equal(text, mockQueryLlm);
+        assert.deepEqual(lastQueryBody, { query, format: "llm" });
+    });
+    for (const toolName of [
+        "orbit_query",
+        "orbit_get_schema",
+        "orbit_get_status",
+        "orbit_list_tools",
+    ]) {
+        test(`${toolName} is refused under strict project scope`, async () => {
+            const env = {
+                ...baseEnv(mockGitLabUrl),
+                ENABLE_STRICT_PROJECT_SCOPE: "true",
+                GITLAB_ALLOWED_PROJECT_IDS: "1,2",
+            };
+            const args = toolName === "orbit_query" ? { query: {} } : {};
+            let message = "";
+            try {
+                message = await callToolAsync(env, toolName, args);
+            }
+            catch (error) {
+                message = error.message;
+            }
+            assert.match(message, /not allowed while a project allowlist is in effect/);
+        });
+    }
+});

package/build/test/test-permission-mode.js

@@ -67,6 +67,7 @@ const MODIFY_SAMPLE_TOOLS = [
     "create_branch",
     "push_files",
     "merge_merge_request",
+    "stop_stale_environments",
 ];
 const READ_SAMPLE_TOOLS = ["list_issues", "get_project", "list_merge_requests"];
 describe("Permission Mode", { concurrency: 1 }, () => {

package/build/test/test-toolset-filtering.js

@@ -23,7 +23,7 @@ const TOOLSET_TOOL_COUNTS = {
     projects: 11,
     labels: 5,
     ci: 4,
-    pipelines: 31,
+    pipelines: 56,
     milestones: 17,
     wiki: 10,
     releases: 7,
@@ -36,6 +36,7 @@ const TOOLSET_TOOL_COUNTS = {
     variables: 10,
     dependency_proxy: 4,
     vulnerabilities: 4,
+    orbit: 4,
 };
 const LEGACY_PIPELINE_CI_TOOL_COUNT = 2;
 const LEGACY_PIPELINE_TOOL_COUNT = TOOLSET_TOOL_COUNTS.pipelines + LEGACY_PIPELINE_CI_TOOL_COUNT;
@@ -62,6 +63,7 @@ const NON_DEFAULT_TOOLSETS = [
     "variables",
     "dependency_proxy",
     "vulnerabilities",
+    "orbit",
 ];
 // discover_tools meta-tool is always force-injected (Step 5.5)
 const DISCOVER_TOOLS_COUNT = 1;