@zereight/mcp-gitlab 2.1.62 → 2.1.63

package/build/test/utils/masking.test.js

@@ -0,0 +1,384 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { describe, test } from "node:test";
+import { createMaskingEngine, createMaskingPolicyResolver } from "../../masking/engine.js";
+import { getManagedMaskingProjectIds } from "../../masking/project-scope.js";
+import { allTools } from "../../tools/registry.js";
+describe("response masking", () => {
+    test("is a no-op and does not read a config when disabled", () => {
+        const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-mask-"));
+        const engine = createMaskingEngine({
+            enabled: false,
+            workspaceDir: workspace,
+            configPath: "missing.json",
+        });
+        assert.equal(engine, undefined);
+    });
+    test("applies built-in rules and literal keyword rules", () => {
+        const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-mask-"));
+        fs.writeFileSync(path.join(workspace, ".gitlab-mcp-mask.json"), JSON.stringify({
+            version: 1,
+            builtins: { ipv4: { replacement: "[Address]" } },
+            rules: [
+                {
+                    id: "company",
+                    type: "keyword",
+                    match: "Example Corp",
+                    replacement: "Our organization",
+                },
+                { id: "token", type: "regex", pattern: "TOKEN-[0-9]+", replacement: "[Token]" },
+            ],
+        }));
+        const engine = createMaskingEngine({ enabled: true, workspaceDir: workspace });
+        assert.ok(engine);
+        assert.equal(engine.maskText("Example Corp 10.20.30.40 TOKEN-123"), "Our organization [Address] [Token]");
+    });
+    test("masks nested tool text without recursively masking replacements", () => {
+        const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-mask-"));
+        fs.writeFileSync(path.join(workspace, "rules.json"), JSON.stringify({
+            version: 1,
+            rules: [
+                { id: "a", type: "keyword", match: "Example Corp", replacement: "Customer Corp" },
+                {
+                    id: "b",
+                    type: "keyword",
+                    match: "Customer Corp",
+                    replacement: "Customer organization",
+                },
+            ],
+        }));
+        const engine = createMaskingEngine({
+            enabled: true,
+            workspaceDir: workspace,
+            configPath: "rules.json",
+        });
+        assert.ok(engine);
+        const result = engine.maskToolResult({
+            content: [{ type: "text", text: JSON.stringify({ description: "Example Corp" }) }],
+            structuredContent: { nested: "Example Corp" },
+        });
+        assert.equal(result.content[0].text, '{"description":"Customer Corp"}');
+        assert.deepEqual(result.structuredContent, { nested: "Customer Corp" });
+    });
+    test("masks plain text blocks and returned error messages", () => {
+        const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-mask-"));
+        const engine = createMaskingEngine({ enabled: true, workspaceDir: workspace });
+        assert.ok(engine);
+        const result = engine.maskToolResult({
+            content: [{ type: "text", text: "Connect to 10.20.30.40 with glpat-abcdefghijklmnopqrst" }],
+        });
+        assert.equal(result.content[0].text, "Connect to [IP address] with [Token masked]");
+        const error = engine.maskError(new Error("Failed at 10.20.30.40"));
+        assert.equal(error instanceof Error && error.message, "Failed at [IP address]");
+    });
+    test("masks every documented GitLab token prefix", () => {
+        const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-mask-"));
+        const engine = createMaskingEngine({ enabled: true, workspaceDir: workspace });
+        assert.ok(engine);
+        const suffix = "abcdefghijklmnopqrst";
+        const prefixes = [
+            "glpat",
+            "glrt",
+            "glptt",
+            "gldt",
+            "glcbt",
+            "glsoat",
+            "gloas",
+            "glagent",
+            "glft",
+            "glimt",
+        ];
+        assert.equal(engine.maskText(prefixes.map(prefix => `${prefix}-${suffix}`).join(" ")), prefixes.map(() => "[Token masked]").join(" "));
+    });
+    test("covers the full union of overlapping secrets without merging adjacent matches", t => {
+        const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-mask-"));
+        const configPath = path.join(workspace, "rules.json");
+        t.after(() => {
+            fs.unlinkSync(configPath);
+            fs.rmdirSync(workspace);
+        });
+        fs.writeFileSync(configPath, JSON.stringify({
+            rules: [
+                { id: "label", type: "keyword", match: "token=glpat-", replacement: "[label]" },
+                { id: "first", type: "keyword", match: "abc", replacement: "[first]" },
+                { id: "second", type: "keyword", match: "cde", replacement: "[second]" },
+                { id: "third", type: "keyword", match: "efg", replacement: "[third]" },
+            ],
+        }));
+        const engine = createMaskingEngine({ enabled: true, configPath });
+        assert.ok(engine);
+        assert.equal(engine.maskText("token=glpat-ABCDEFGHIJKLMNOPQRST"), "[label]");
+        assert.equal(engine.maskText("abcdefg"), "[first]");
+        assert.equal(engine.maskText("abccde"), "[first][second]");
+    });
+    test("preserves plain text primitives and applies numeric keyword rules", t => {
+        const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-mask-"));
+        const configPath = path.join(workspace, "rules.json");
+        t.after(() => {
+            fs.unlinkSync(configPath);
+            fs.rmdirSync(workspace);
+        });
+        fs.writeFileSync(configPath, JSON.stringify({
+            rules: [{ id: "number", type: "keyword", match: "123456", replacement: "[number]" }],
+        }));
+        const engine = createMaskingEngine({ enabled: true, configPath });
+        assert.ok(engine);
+        const texts = ["9007199254740993\n", "123456\n", "true\n", '"ordinary text"\n'];
+        const result = engine.maskToolResult({ content: texts.map(text => ({ type: "text", text })) });
+        assert.deepEqual(result.content.map(block => block.text), ["9007199254740993\n", "[number]\n", "true\n", '"ordinary text"\n']);
+        assert.equal(engine.maskToolResult({
+            content: [{ type: "text", text: '{"123456":9007199254740993}\n' }],
+        }, { textFormat: "plain" }).content[0].text, '{"[number]":9007199254740993}\n');
+    });
+    test("preserves JSON numbers and formatting while masking escaped string values", t => {
+        const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-mask-"));
+        t.after(() => fs.rmdirSync(workspace));
+        const engine = createMaskingEngine({ enabled: true, workspaceDir: workspace });
+        assert.ok(engine);
+        const text = '{\n  "id": 9007199254740993, "host": "10.20.30.\\u0034\\u0030",\n' +
+            '  "download_url": "http://10.20.30.40/file", "nested": ["10.20.30.40"]\n}\n';
+        assert.equal(engine.maskToolResult({ content: [{ type: "text", text }] }).content[0].text, '{\n  "id": 9007199254740993, "host": "[IP address]",\n' +
+            '  "download_url": "[Download URL masked]", "nested": ["[IP address]"]\n}\n');
+        const unchanged = '{ "id": 9007199254740993, "value": "ordinary" }\n';
+        assert.equal(engine.maskToolResult({ content: [{ type: "text", text: unchanged }] }).content[0].text, unchanged);
+    });
+    test("masks compressed IPv6 addresses", () => {
+        const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-mask-"));
+        const engine = createMaskingEngine({ enabled: true, workspaceDir: workspace });
+        assert.ok(engine);
+        assert.equal(engine.maskText("Hosts: 2001:db8::1, fe80::1234, ::1, and 2001:db8:0:0:0:0:0:1"), "Hosts: [IP address], [IP address], [IP address], and [IP address]");
+        assert.equal(engine.maskText("Version 1:2:3 is not an IPv6 address"), "Version 1:2:3 is not an IPv6 address");
+    });
+    test("rejects invalid and empty-match regex rules", () => {
+        const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-mask-"));
+        const configPath = path.join(workspace, "bad.json");
+        fs.writeFileSync(configPath, JSON.stringify({ rules: [{ id: "bad", type: "regex", pattern: "", replacement: "x" }] }));
+        assert.throws(() => createMaskingEngine({ enabled: true, workspaceDir: workspace, configPath: "bad.json" }), /must not be empty/);
+    });
+    test("fails closed when an explicitly configured file is missing", () => {
+        const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-mask-"));
+        assert.throws(() => createMaskingEngine({ enabled: true, workspaceDir: workspace, configPath: "missing.json" }), /Configured masking config does not exist/);
+        assert.throws(() => createMaskingPolicyResolver({
+            enabled: true,
+            workspaceDir: workspace,
+            configPath: "missing.json",
+        }), /Configured masking config does not exist/);
+    });
+    test("selects a server-owned policy by normalized GitLab instance and project", () => {
+        const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-mask-"));
+        const policyPath = path.join(workspace, "managed-policies.json");
+        fs.writeFileSync(policyPath, JSON.stringify({
+            version: 1,
+            policyGroups: {
+                customer: {
+                    rules: [
+                        {
+                            id: "customer",
+                            type: "keyword",
+                            match: "Customer Corp",
+                            replacement: "[customer]",
+                        },
+                    ],
+                },
+            },
+            bindings: [
+                {
+                    gitlabInstance: "https://gitlab.example.test",
+                    projectIds: [12, 13],
+                    policyGroup: "customer",
+                },
+            ],
+        }));
+        const resolver = createMaskingPolicyResolver({
+            enabled: true,
+            workspaceDir: workspace,
+            policyFilePath: "managed-policies.json",
+        });
+        assert.ok(resolver);
+        assert.equal(resolver
+            .select({ gitlabInstance: "https://gitlab.example.test/api/v4", projectIds: ["12"] })
+            .maskText("Customer Corp"), "[customer]");
+        assert.throws(() => resolver.select({
+            gitlabInstance: "https://another.example.test/api/v4",
+            projectIds: [12],
+        }), /No managed masking policy/);
+        assert.throws(() => resolver.select({ gitlabInstance: "https://gitlab.example.test", projectIds: [14] }), /No managed masking policy/);
+        assert.throws(() => resolver.select({ gitlabInstance: "https://gitlab.example.test", hasProjectScope: false }), /project-less tool/);
+    });
+    test("rejects a workspace group that conflicts with the server binding", () => {
+        const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-mask-"));
+        fs.writeFileSync(path.join(workspace, ".gitlab-mcp-mask.json"), JSON.stringify({ version: 2, mode: "managed", policyGroup: "one" }));
+        fs.writeFileSync(path.join(workspace, "managed-policies.json"), JSON.stringify({
+            version: 1,
+            policyGroups: { one: {}, two: {} },
+            bindings: [
+                { gitlabInstance: "https://gitlab.example.test", projectIds: [12], policyGroup: "two" },
+            ],
+        }));
+        const resolver = createMaskingPolicyResolver({
+            enabled: true,
+            workspaceDir: workspace,
+            policyFilePath: "managed-policies.json",
+        });
+        assert.ok(resolver);
+        assert.throws(() => resolver.select({ gitlabInstance: "https://gitlab.example.test", projectIds: [12] }), /does not match/);
+    });
+    test("rejects project paths and calls spanning managed policy groups", () => {
+        const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-mask-"));
+        const policyPath = path.join(workspace, "managed-policies.json");
+        fs.writeFileSync(policyPath, JSON.stringify({
+            version: 1,
+            policyGroups: { one: {}, two: {} },
+            bindings: [
+                { gitlabInstance: "https://gitlab.example.test", projectIds: [12], policyGroup: "one" },
+                { gitlabInstance: "https://gitlab.example.test", projectIds: [13], policyGroup: "two" },
+            ],
+        }));
+        const resolver = createMaskingPolicyResolver({
+            enabled: true,
+            workspaceDir: workspace,
+            policyFilePath: "managed-policies.json",
+        });
+        assert.ok(resolver);
+        assert.throws(() => resolver.select({
+            gitlabInstance: "https://gitlab.example.test",
+            projectIds: ["group/project"],
+        }), /numeric project IDs/);
+        assert.throws(() => resolver.select({ gitlabInstance: "https://gitlab.example.test", projectIds: [12, 13] }), /span policy groups/);
+    });
+    test("derives managed scope only from project fields declared by the tool", () => {
+        const globalTool = { properties: { search: { type: "string" } } };
+        assert.deepEqual(getManagedMaskingProjectIds(globalTool, { project_id: "12", search: "example" }), { hasProjectScope: false, projectIds: [] });
+        const projectTool = {
+            properties: { project_id: { type: "string" }, target_project_id: { type: "string" } },
+        };
+        assert.deepEqual(getManagedMaskingProjectIds(projectTool, { project_id: "12", target_project_id: "13" }), { hasProjectScope: true, projectIds: ["12", "13"] });
+        assert.deepEqual(getManagedMaskingProjectIds(projectTool, {}, () => "12"), { hasProjectScope: true, projectIds: ["12"] });
+    });
+    test("includes the default primary project alongside explicit and nested references", () => {
+        const createMergeRequest = allTools.find(tool => tool.name === "create_merge_request");
+        const updateWorkItem = allTools.find(tool => tool.name === "update_work_item");
+        assert.ok(createMergeRequest);
+        assert.ok(updateWorkItem);
+        assert.deepEqual(getManagedMaskingProjectIds(createMergeRequest.inputSchema, {
+            project_id: "",
+            target_project_id: "13",
+        }, () => "12"), { hasProjectScope: true, projectIds: ["12", "13"] });
+        assert.deepEqual(getManagedMaskingProjectIds(updateWorkItem.inputSchema, {
+            project_id: "",
+            children_to_add: [{ project_id: "13", iid: 1 }],
+        }, () => "12"), { hasProjectScope: true, projectIds: ["12", "13"] });
+    });
+    test("treats absent optional filters as unscoped and absent required projects as scoped", () => {
+        for (const name of ["list_issues", "list_merge_requests", "list_todos"]) {
+            const tool = allTools.find(tool => tool.name === name);
+            assert.ok(tool, name);
+            assert.deepEqual(getManagedMaskingProjectIds(tool.inputSchema, {}), {
+                hasProjectScope: false,
+                projectIds: [],
+            });
+        }
+        const getIssue = allTools.find(tool => tool.name === "get_issue");
+        assert.ok(getIssue);
+        assert.deepEqual(getManagedMaskingProjectIds(getIssue.inputSchema, {}), {
+            hasProjectScope: true,
+            projectIds: [],
+        });
+        const groupMergeRequests = allTools.find(tool => tool.name === "list_group_merge_requests");
+        assert.ok(groupMergeRequests);
+        assert.deepEqual(getManagedMaskingProjectIds(groupMergeRequests.inputSchema, {
+            group_id: "99",
+            source_project_id: "12",
+        }, () => "12"), { hasProjectScope: false, projectIds: [] });
+    });
+    test("does not use a default project for a selected group scope", () => {
+        const webhookTool = {
+            properties: {
+                project_id: { type: "string" },
+                group_id: { type: "string" },
+            },
+        };
+        assert.deepEqual(getManagedMaskingProjectIds(webhookTool, { group_id: "99" }, () => "12"), { hasProjectScope: false, projectIds: [] });
+    });
+    test("collects nested declared project references", () => {
+        const workItemTool = {
+            properties: {
+                project_id: { type: "string" },
+                children_to_add: {
+                    type: "array",
+                    items: {
+                        type: "object",
+                        properties: { project_id: { type: "string" }, iid: { type: "number" } },
+                    },
+                },
+                linked_items_to_remove: {
+                    type: "array",
+                    items: {
+                        type: "object",
+                        properties: { project_id: { type: "string" }, iid: { type: "number" } },
+                    },
+                },
+            },
+        };
+        assert.deepEqual(getManagedMaskingProjectIds(workItemTool, {
+            project_id: "12",
+            children_to_add: [{ project_id: "13", iid: 1 }],
+            linked_items_to_remove: [{ project_id: "14", iid: 2 }],
+        }), { hasProjectScope: true, projectIds: ["12", "13", "14"] });
+    });
+    test("uses the registered work item schema to reject cross-project actions", () => {
+        const updateWorkItem = allTools.find(tool => tool.name === "update_work_item");
+        assert.ok(updateWorkItem);
+        assert.deepEqual(getManagedMaskingProjectIds(updateWorkItem.inputSchema, {
+            project_id: "12",
+            children_to_add: [{ project_id: "13", iid: 1 }],
+            linked_items_to_add: [{ project_id: "14", iid: 2 }],
+        }), { hasProjectScope: true, projectIds: ["12", "13", "14"] });
+    });
+    test("uses the registered webhook schema without selecting a default project for a group", () => {
+        const listWebhooks = allTools.find(tool => tool.name === "list_webhooks");
+        assert.ok(listWebhooks);
+        assert.deepEqual(getManagedMaskingProjectIds(listWebhooks.inputSchema, { group_id: "99" }, () => "12"), { hasProjectScope: false, projectIds: [] });
+    });
+    test("allows project-less tools only with the explicit built-in fallback", () => {
+        const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-mask-"));
+        const policyPath = path.join(workspace, "managed-policies.json");
+        fs.writeFileSync(policyPath, JSON.stringify({
+            version: 1,
+            policyGroups: {},
+            bindings: [],
+            unboundProjectBehavior: "builtin",
+        }));
+        const resolver = createMaskingPolicyResolver({
+            enabled: true,
+            workspaceDir: workspace,
+            policyFilePath: "managed-policies.json",
+        });
+        assert.ok(resolver);
+        assert.equal(resolver
+            .select({ gitlabInstance: "https://gitlab.example.test", hasProjectScope: false })
+            .maskText("10.20.30.40"), "[IP address]");
+        assert.throws(() => resolver.select({ gitlabInstance: "https://gitlab.example.test", hasProjectScope: true }), /requires a project ID/);
+    });
+    test("allows only explicitly designated unscoped tools to use built-in masking", () => {
+        const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "gitlab-mask-"));
+        const policyPath = path.join(workspace, "managed-policies.json");
+        fs.writeFileSync(policyPath, JSON.stringify({ version: 1, policyGroups: {}, bindings: [] }));
+        const resolver = createMaskingPolicyResolver({
+            enabled: true,
+            workspaceDir: workspace,
+            policyFilePath: "managed-policies.json",
+        });
+        assert.ok(resolver);
+        assert.equal(resolver
+            .select({
+            gitlabInstance: "https://gitlab.example.test",
+            hasProjectScope: false,
+            allowBuiltinForUnscoped: true,
+        })
+            .maskText("10.20.30.40"), "[IP address]");
+        assert.throws(() => resolver.select({ gitlabInstance: "https://gitlab.example.test", hasProjectScope: false }), /project-less tool/);
+    });
+});

package/build/tools/registry.js

@@ -1,7 +1,7 @@
 import { toJSONSchema } from "../utils/schema.js";
 import { USE_GITLAB_WIKI, USE_MILESTONE, USE_PIPELINE, SSE, STREAMABLE_HTTP, } from "../config.js";
 import { getToolDescription } from "./tool-descriptions.js";
-import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, ErasePipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateGroupMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWebhookSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UnprotectBranchSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupMilestoneSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWebhookSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadAttachmentRemoteSchema, DownloadJobArtifactsSchema, DownloadJobArtifactsRemoteSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, EditGroupMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, HealthCheckSchema, GetBranchSchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GetDeploymentSchema, CreateDeploymentSchema, UpdateDeploymentSchema, DeploymentApprovalSchema, ListDeploymentMergeRequestsSchema, GetDraftNoteSchema, GetEnvironmentSchema, UpdateEnvironmentSchema, StopEnvironmentSchema, StopStaleEnvironmentsSchema, DeleteReviewAppEnvironmentsSchema, PipelineTriggerIdSchema, ListPipelineTriggersSchema, CreatePipelineTriggerSchema, UpdatePipelineTriggerSchema, TriggerPipelineSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetGroupMilestoneSchema, GetGroupMilestoneIssuesSchema, GetGroupMilestoneMergeRequestsSchema, GetGroupMilestoneBurndownEventsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, PipelineJobControlSchema, GetPipelineSchema, GetPipelineVariablesSchema, UpdatePipelineMetadataSchema, DeletePipelineSchema, PipelineReportSchema, WaitForPipelineSchema, WaitForPipelineJobSchema, PlayPipelineJobsSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetTimelineEventsSchema, GetUsersSchema, GetUserSchema, WhoAmISchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListBranchesSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupMilestonesSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListGroupMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListPipelinesSchema, ListPipelineSchedulesSchema, GetPipelineScheduleSchema, ListPipelineSchedulePipelinesSchema, CreatePipelineScheduleSchema, UpdatePipelineScheduleSchema, DeletePipelineScheduleSchema, PlayPipelineScheduleSchema, TakeOwnershipPipelineScheduleSchema, GetPipelineScheduleVariableSchema, CreatePipelineScheduleVariableSchema, UpdatePipelineScheduleVariableSchema, DeletePipelineScheduleVariableSchema, ListGroupMembersSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, OrbitQuerySchema, OrbitSchemaSchema, OrbitStatusSchema, OrbitToolsSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWebhookSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListProjectVulnerabilitiesSchema, GetVulnerabilitySchema, DismissVulnerabilitySchema, ConfirmVulnerabilitySchema, } from "../schemas.js";
+import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, ErasePipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateGroupMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWebhookSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UnprotectBranchSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupMilestoneSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWebhookSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadAttachmentRemoteSchema, DownloadJobArtifactsSchema, DownloadJobArtifactsRemoteSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, EditGroupMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, HealthCheckSchema, GetBranchSchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GetDeploymentSchema, CreateDeploymentSchema, UpdateDeploymentSchema, DeploymentApprovalSchema, ListDeploymentMergeRequestsSchema, GetDraftNoteSchema, GetEnvironmentSchema, UpdateEnvironmentSchema, StopEnvironmentSchema, StopStaleEnvironmentsSchema, DeleteReviewAppEnvironmentsSchema, PipelineTriggerIdSchema, ListPipelineTriggersSchema, CreatePipelineTriggerSchema, UpdatePipelineTriggerSchema, TriggerPipelineSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestDiscussionSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetGroupMilestoneSchema, GetGroupMilestoneIssuesSchema, GetGroupMilestoneMergeRequestsSchema, GetGroupMilestoneBurndownEventsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, PipelineJobControlSchema, GetPipelineSchema, GetPipelineVariablesSchema, UpdatePipelineMetadataSchema, DeletePipelineSchema, PipelineReportSchema, WaitForPipelineSchema, WaitForPipelineJobSchema, PlayPipelineJobsSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetTimelineEventsSchema, GetUsersSchema, GetUserSchema, WhoAmISchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListBranchesSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupMilestonesSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListGroupMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListPipelinesSchema, ListPipelineSchedulesSchema, GetPipelineScheduleSchema, ListPipelineSchedulePipelinesSchema, CreatePipelineScheduleSchema, UpdatePipelineScheduleSchema, DeletePipelineScheduleSchema, PlayPipelineScheduleSchema, TakeOwnershipPipelineScheduleSchema, GetPipelineScheduleVariableSchema, CreatePipelineScheduleVariableSchema, UpdatePipelineScheduleVariableSchema, DeletePipelineScheduleVariableSchema, ListGroupMembersSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, OrbitQuerySchema, OrbitSchemaSchema, OrbitStatusSchema, OrbitToolsSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWebhookSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListProjectVulnerabilitiesSchema, GetVulnerabilitySchema, DismissVulnerabilitySchema, ConfirmVulnerabilitySchema, } from "../schemas.js";
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
 // Define all available tools
 export const allTools = [
@@ -195,6 +195,11 @@ export const allTools = [
         description: "List discussion items for a merge request",
         inputSchema: toJSONSchema(ListMergeRequestDiscussionsSchema),
     },
+    {
+        name: "get_merge_request_discussion",
+        description: "Get a single discussion item for a merge request",
+        inputSchema: toJSONSchema(GetMergeRequestDiscussionSchema),
+    },
     {
         name: "delete_merge_request_discussion_note",
         description: "Delete a discussion note on a merge request",
@@ -1286,6 +1291,7 @@ export const readOnlyTools = new Set([
     "get_draft_note",
     "list_draft_notes",
     "mr_discussions",
+    "get_merge_request_discussion",
     "list_issues",
     "list_todos",
     "my_issues",
@@ -1594,6 +1600,7 @@ export const TOOLSET_DEFINITIONS = [
             "list_group_merge_requests",
             "get_branch_diffs",
             "mr_discussions",
+            "get_merge_request_discussion",
             "create_merge_request_note",
             "update_merge_request_note",
             "delete_merge_request_note",

package/build/tools/tool-descriptions.js

@@ -22,6 +22,7 @@ const TOOL_GUIDANCE = {
     create_merge_request_thread: "Use this to start a review thread on a merge request; use `create_merge_request_note` for an unthreaded note and `create_merge_request_discussion_note` to reply to an existing thread. The operation creates remote review content, requires note permission, and returns the discussion or a position/permission/validation error.",
     resolve_merge_request_thread: "Use this to mark an existing merge request review thread resolved; use `update_merge_request_discussion_note` when the note text itself must change. The operation changes review state, requires permission to resolve discussions, and returns the updated discussion or a missing-thread/permission error.",
     mr_discussions: "Use this to list complete discussion threads for a merge request; use `get_merge_request_notes` when only flat notes are needed. It is read-only and returns threaded discussion items, while invalid merge request identifiers, missing resources, and permission failures are reported as errors.",
+    get_merge_request_discussion: "Use this to fetch one known merge request discussion by discussion identifier; use `mr_discussions` for a collection and `get_merge_request_note` for a flat note. It is read-only and returns the discussion item or an error for an invalid identifier, missing discussion, or insufficient permission.",
     create_merge_request_discussion_note: "Use this to reply inside an existing merge request discussion; use `create_merge_request_thread` to start a new thread and `create_merge_request_note` for a top-level note. The operation creates remote review content, requires note permission, and returns the new note or a missing-discussion/position/permission error.",
     get_merge_request_note: "Use this to fetch one known merge request note by note identifier; use `get_merge_request_notes` for a collection and `mr_discussions` for threaded context. It is read-only and returns the note object or an error for an invalid identifier, missing note, or insufficient permission.",
     get_merge_request_notes: "Use this to list flat notes on a merge request; use `mr_discussions` when thread structure and resolution state are required. It is read-only and returns note records, while invalid identifiers, missing resources, and pagination or permission errors are reported by GitLab.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.62",
+  "version": "2.1.63",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [