@zereight/mcp-gitlab 2.1.64 → 2.1.66

package/build/scripts/generate-tool-docs.js

@@ -289,9 +289,11 @@ function buildIndexPage(groupedToolsList) {
         "Permission modes control which tools are exposed:",
         "",
         "- `GITLAB_PERMISSION_MODE=readonly` — hides every write tool regardless of toggles.",
-        "- `GITLAB_PERMISSION_MODE=modify` — allows create/update but blocks all `delete_*` tools, plus `push_files` `delete`/`move` actions.",
+        "- `GITLAB_PERMISSION_MODE=modify` — allows create/update but blocks delete and teardown tools: every `delete_*` tool, `erase_pipeline_job`, `purge_dependency_proxy_cache`, the destructive teardown verbs `cancel_pipeline`, `cancel_pipeline_job`, `stop_environment`, `stop_stale_environments`, `unprotect_branch`, plus `push_files` `delete`/`move` actions.",
         "- `GITLAB_READ_ONLY_MODE=true` (deprecated) — same as `readonly`; prefer `GITLAB_PERMISSION_MODE=readonly`.",
         "",
+        "The `modify` guard applies to typed tools (`tools/list` and `tools/call`) and to destructive mutations sent through `execute_graphql`: any top-level mutation field whose name contains a deletion verb (`delete`, `destroy`, `remove`, `prune`, `purge`, `erase`) or a teardown verb (`revoke`, `cancel`, `stop`, `terminate`, `unprotect`, `disable`, `deactivate`, `drop`, `unschedule`). See [Environment Variables](../configuration/environment-variables.md#gitlab_permission_mode).",
+        "",
         "See [Environment Variables](../configuration/environment-variables.md)",
         "and [CLI Arguments](../getting-started/cli-arguments.md) for the full list.",
         "",

package/build/test/path-segment-encoding.test.js

@@ -1,7 +1,9 @@
 import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
 import { test } from "node:test";
-const source = readFileSync(new URL("../index.ts", import.meta.url), "utf8");
+import { encodeGitLabPath, encodeGitLabPathSegment } from "../utils/url.js";
+const readSource = (relativePath) => readFileSync(new URL(relativePath, import.meta.url), "utf8");
+const indexSource = readSource("../index.ts");
 const rawPathSegmentPatterns = [
     "/issues/${issueIid}",
     "/merge_requests/${mergeRequestIid}",
@@ -21,22 +23,76 @@ const rawPathSegmentPatterns = [
 ];
 test("GitLab URL path IDs are encoded before interpolation", () => {
     for (const pattern of rawPathSegmentPatterns) {
-        assert.equal(source.includes(pattern), false, `${pattern} must use encodeGitLabPathSegment`);
+        assert.equal(indexSource.includes(pattern), false, `${pattern} must use encodeGitLabPathSegment`);
     }
 });
-test("encoding keeps path traversal payloads inside one URL segment", () => {
-    const payload = "1/../../../../admin/ci/variables";
-    const url = new URL(`https://gitlab.com/api/v4/projects/42/issues/${encodeURIComponent(payload)}/notes`);
-    assert.equal(url.pathname, "/api/v4/projects/42/issues/1%2F..%2F..%2F..%2F..%2Fadmin%2Fci%2Fvariables/notes");
-});
-test("job_id path traversal stays under /jobs/", () => {
-    // GHSA-7c3w-fxgh-frc7 / #587: unencoded job_id with ../ escaped to /api/v4/user
-    const payload = "../../../user";
-    const url = new URL(`https://gitlab.com/api/v4/projects/1/jobs/${encodeURIComponent(payload)}/trace`);
-    assert.equal(url.pathname, "/api/v4/projects/1/jobs/..%2F..%2F..%2Fuser/trace");
-    assert.match(url.pathname, /\/jobs\/[^/]+\/trace$/);
-    assert.equal(url.pathname.includes("/api/v4/user"), false);
-});
-test("malformed percent-encoded segments can still be encoded", () => {
-    assert.equal(encodeURIComponent("bad%zz/path"), "bad%25zz%2Fpath");
+/**
+ * encodeURIComponent() does not validate what it encodes: "../../user" becomes
+ * "..%2F..%2Fuser", which a server that decodes the separator turns back into a
+ * traversal. Every value that lands in a URL path goes through
+ * encodeGitLabPathSegment()/encodeGitLabPath() instead; plain encoding stays only
+ * for query-string values, where a "/" is data and not a path separator.
+ */
+const queryStringEncoders = [
+    "?source_branch=${encodeURIComponent(branchName)}",
+    "?access_token=${encodeURIComponent(token)}",
+];
+const serverSources = [
+    ["index.ts", "../index.ts"],
+    ["downloads/proxy.ts", "../downloads/proxy.ts"],
+    ["oauth-proxy.ts", "../oauth-proxy.ts"],
+];
+for (const [name, relativePath] of serverSources) {
+    test(`${name} validates values before they reach a URL path`, () => {
+        for (const line of readSource(relativePath).split("\n")) {
+            if (!line.includes("encodeURIComponent("))
+                continue;
+            assert.ok(queryStringEncoders.some(allowed => line.includes(allowed)), `${name} encodes a URL value without validating it: ${line.trim()}`);
+        }
+    });
+}
+test("plain encoding of a project path would leave the traversal visible", () => {
+    // The payload this guard exists for: the old encoder emits the separators, so a
+    // server that decodes them routes the request to /api/v4/user.
+    const payload = "../../user";
+    const legacy = `https://gitlab.com/api/v4/projects/${encodeURIComponent(payload)}`;
+    assert.equal(new URL(legacy).pathname, "/api/v4/projects/..%2F..%2Fuser");
+});
+test("the validated encoder keeps an ordinary project path inside one segment", () => {
+    const url = new URL(`https://gitlab.com/api/v4/projects/${encodeGitLabPathSegment("group/project")}/issues/${encodeGitLabPathSegment("1")}/notes`);
+    assert.equal(url.pathname, "/api/v4/projects/group%2Fproject/issues/1/notes");
+});
+test("path traversal payloads are rejected instead of encoded into one segment", () => {
+    // GHSA-7c3w-fxgh-frc7 / #587: an unencoded job_id with ../ escaped to /api/v4/user
+    for (const payload of [
+        "../../../user",
+        "1/../../../../admin/ci/variables",
+        "..%2F..%2Fuser",
+        "..%252F..%252Fuser",
+        "/etc/passwd",
+    ]) {
+        assert.throws(() => encodeGitLabPathSegment(payload), /Cannot use value as a GitLab URL path segment/, payload);
+    }
+});
+test("a slash-separated path cannot start outside its route prefix", () => {
+    assert.throws(() => encodeGitLabPath("/etc/passwd"), /Cannot use value as a GitLab URL path/);
+    assert.throws(() => encodeGitLabPath("1/../../../../admin/ci/variables"), /Cannot use value as a GitLab URL path segment/);
+});
+test("a broken escape next to a valid one is rejected, not passed through", () => {
+    // A guard cannot inspect a value it fails to decode: "%2E%2E%2F%ZZ" still holds a
+    // real escape that may hide a separator, so it must not be forwarded unvalidated.
+    assert.throws(() => encodeGitLabPathSegment("%2E%2E%2F%ZZ"), /Cannot use value as a GitLab URL path segment/);
+});
+test("the artifact path goes through the shared multi-segment validator", () => {
+    // getJobArtifactFile() was the last call site that split the path itself. The
+    // hand-rolled version kept empty segments, so "a//b" reached the URL as an extra
+    // separator instead of being rejected like every other call site.
+    assert.ok(indexSource.includes("const encodedArtifactPath = encodeGitLabPath(artifactPath);"), "artifact paths must go through encodeGitLabPath");
+    assert.equal(indexSource.includes(".map(segment => encodeGitLabPathSegment(segment))"), false, "artifact paths must not be split into segments by hand");
+});
+test("a percent sign that starts no escape stays a literal character", () => {
+    // "bad%zz/path" cannot be decoded either, but it holds no escape at all, so the
+    // guard sees the entire value and the percent sign is encoded as data. Rejecting
+    // it would break every file or branch name containing "%".
+    assert.equal(encodeGitLabPathSegment("bad%zz/path"), "bad%25zz%2Fpath");
 });

package/build/test/response-masking.test.js

@@ -188,6 +188,39 @@ describe("managed response masking at the MCP boundary", { timeout: 30_000 }, ()
             "/api/v4/projects/12/merge_requests",
         ]);
     });
+    test("applies jmespath to JSON tool results at the MCP boundary", async (t) => {
+        const { client } = await startMaskingServer(t, {
+            env: { ENABLE_STRICT_PROJECT_SCOPE: "true", GITLAB_ALLOWED_PROJECT_IDS: "12" },
+        });
+        const { tools } = await client.listTools();
+        const listMrs = tools.find(tool => tool.name === "list_merge_requests");
+        const jmespathSchema = listMrs?.inputSchema?.properties?.jmespath;
+        assert.ok(jmespathSchema, "tools/list should inject optional jmespath on every tool schema");
+        assert.ok((jmespathSchema.description?.length ?? 0) < 120, "jmespath schema description should stay short for tools/list token cost");
+        const result = await client.callTool({
+            name: "list_issues",
+            arguments: { jmespath: "[].title" },
+        });
+        const text = result.content[0]?.text;
+        assert.deepEqual(JSON.parse(text), ["[one]"]);
+        const probe = await client.callTool({
+            name: "list_issues",
+            arguments: { jmespath: "[].starts_with(title, `ProjectOne`)" },
+        });
+        const probeText = probe.content[0]?.text;
+        assert.deepEqual(JSON.parse(probeText), [false], "jmespath must run on masked JSON so callers cannot probe hidden substrings");
+    });
+    test("rejects invalid jmespath before the handler reaches GitLab", async (t) => {
+        const { client, requests } = await startMaskingServer(t, {
+            env: { ENABLE_STRICT_PROJECT_SCOPE: "true", GITLAB_ALLOWED_PROJECT_IDS: "12" },
+        });
+        const result = await client.callTool({
+            name: "list_issues",
+            arguments: { jmespath: "[[[" },
+        });
+        assert.equal(result.isError, true);
+        assert.deepEqual(requests, []);
+    });
     test("keeps optional default-project handlers available with their managed policy", async (t) => {
         const { client, requests } = await startMaskingServer(t);
         const fileResult = await client.callTool({

package/build/test/sse-session-limits.test.js

@@ -0,0 +1,273 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import http from "node:http";
+import { afterEach, describe, test } from "node:test";
+import * as path from "node:path";
+import { findAvailablePort } from "./utils/server-launcher.js";
+const LOOPBACK = "127.0.0.1";
+const SSE_TOKEN = "mcp_sse_secret";
+const SERVER_PATH = path.resolve(process.cwd(), "build/index.js");
+// Keeps connection churn from tripping the per-IP creation limit in tests that
+// are not about rate limiting.
+const UNTHROTTLED = "1000";
+const running = new Set();
+function startSseServer(env, port) {
+    const child = spawn("node", [SERVER_PATH], {
+        env: {
+            ...process.env,
+            GITLAB_API_URL: "https://gitlab.example.com/api/v4",
+            HOST: "0.0.0.0",
+            PORT: String(port),
+            SSE: "true",
+            STREAMABLE_HTTP: "false",
+            REMOTE_AUTHORIZATION: "false",
+            GITLAB_MCP_OAUTH: "false",
+            GITLAB_USE_OAUTH: "false",
+            GITLAB_PERSONAL_ACCESS_TOKEN: "glpat_test",
+            GITLAB_JOB_TOKEN: "",
+            GITLAB_AUTH_COOKIE_PATH: "",
+            SSE_AUTH_TOKEN: SSE_TOKEN,
+            ...env,
+        },
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    running.add(child);
+    child.once("exit", () => running.delete(child));
+    return child;
+}
+async function waitForHealth(port, timeoutMs = 10000) {
+    const deadline = Date.now() + timeoutMs;
+    let lastError;
+    while (Date.now() < deadline) {
+        try {
+            const response = await fetch(`http://${LOOPBACK}:${port}/health`);
+            if (response.ok)
+                return;
+        }
+        catch (error) {
+            lastError = error;
+        }
+        await new Promise(resolve => setTimeout(resolve, 100));
+    }
+    throw new Error(`server did not become healthy: ${String(lastError)}`);
+}
+function openSseConnection(port) {
+    let statusCode;
+    let text = "";
+    let resolveEnded = () => { };
+    const ended = new Promise(resolve => {
+        resolveEnded = resolve;
+    });
+    const request = http.get({
+        host: LOOPBACK,
+        port,
+        path: "/sse",
+        headers: { Authorization: `Bearer ${SSE_TOKEN}`, Accept: "text/event-stream" },
+    }, response => {
+        statusCode = response.statusCode;
+        response.on("data", chunk => {
+            text += chunk.toString();
+        });
+        response.on("end", () => resolveEnded());
+        response.on("close", () => resolveEnded());
+    });
+    request.on("error", () => resolveEnded());
+    return {
+        get statusCode() {
+            return statusCode;
+        },
+        streamText: () => text,
+        close: () => {
+            request.destroy();
+            resolveEnded();
+        },
+        ended,
+    };
+}
+async function waitFor(predicate, timeoutMs = 5000, stepMs = 50) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (predicate())
+            return true;
+        await new Promise(resolve => setTimeout(resolve, stepMs));
+    }
+    return predicate();
+}
+/** Resolves true when the server ends the stream within the window. */
+async function endedWithin(connection, ms) {
+    return Promise.race([
+        connection.ended.then(() => true),
+        new Promise(resolve => setTimeout(() => resolve(false), ms)),
+    ]);
+}
+/** Reads the session id the transport advertises in its opening `endpoint` event. */
+async function readSessionId(connection, timeoutMs = 5000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const match = /data: \/messages\?sessionId=([^\s]+)/.exec(connection.streamText());
+        if (match)
+            return match[1];
+        await new Promise(resolve => setTimeout(resolve, 25));
+    }
+    throw new Error(`SSE stream did not advertise a session id: ${connection.streamText()}`);
+}
+async function postSseMessage(port, sessionId, body) {
+    const response = await fetch(`http://${LOOPBACK}:${port}/messages?sessionId=${sessionId}`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${SSE_TOKEN}`, "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    await response.arrayBuffer();
+    return response.status;
+}
+async function getSseStatus(port) {
+    const response = await fetch(`http://${LOOPBACK}:${port}/sse`, {
+        headers: { Authorization: `Bearer ${SSE_TOKEN}`, Accept: "text/event-stream" },
+    });
+    await response.arrayBuffer();
+    return response.status;
+}
+/**
+ * Connection attempts are rate-limited per IP, so a capacity slot released
+ * asynchronously has to be polled for instead of raced with a single request.
+ */
+async function waitForAcceptedConnection(port, timeoutMs = 5000) {
+    const deadline = Date.now() + timeoutMs;
+    let connection = openSseConnection(port);
+    for (;;) {
+        await waitFor(() => connection.statusCode !== undefined, 2000, 25);
+        if (connection.statusCode === 200)
+            return connection;
+        connection.close();
+        if (Date.now() >= deadline)
+            return connection;
+        await new Promise(resolve => setTimeout(resolve, 100));
+        connection = openSseConnection(port);
+    }
+}
+afterEach(() => {
+    for (const child of running) {
+        if (!child.killed)
+            child.kill("SIGTERM");
+    }
+    running.clear();
+});
+describe("SSE session limits", { concurrency: 1 }, () => {
+    test("rejects new SSE connections once MAX_SESSIONS is reached", async () => {
+        const port = await findAvailablePort(4500);
+        startSseServer({ MAX_SESSIONS: "2", MAX_REQUESTS_PER_MINUTE: UNTHROTTLED }, port);
+        await waitForHealth(port);
+        const first = openSseConnection(port);
+        const second = openSseConnection(port);
+        const bothConnected = await waitFor(() => first.statusCode === 200 && second.statusCode === 200, 5000);
+        assert.ok(bothConnected, "expected the first two SSE connections to be accepted");
+        const rejected = await fetch(`http://${LOOPBACK}:${port}/sse`, {
+            headers: { Authorization: `Bearer ${SSE_TOKEN}`, Accept: "text/event-stream" },
+        });
+        assert.equal(rejected.status, 503);
+        const body = (await rejected.json());
+        assert.match(body.error ?? "", /capacity/i);
+        first.close();
+        second.close();
+    });
+    test("frees the capacity slot when a client closes the stream", async () => {
+        const port = await findAvailablePort(4510);
+        startSseServer({ MAX_SESSIONS: "2", MAX_REQUESTS_PER_MINUTE: UNTHROTTLED }, port);
+        await waitForHealth(port);
+        const first = openSseConnection(port);
+        const second = openSseConnection(port);
+        assert.ok(await waitFor(() => first.statusCode === 200 && second.statusCode === 200, 5000), "expected the first two SSE connections to be accepted");
+        assert.equal(await getSseStatus(port), 503, "expected the server to be at capacity");
+        first.close();
+        // SESSION_TIMEOUT_SECONDS is left at its 3600s default, so the slot can
+        // only come back through the response "close" handler - not the idle sweep.
+        const reclaimed = await waitForAcceptedConnection(port);
+        assert.equal(reclaimed.statusCode, 200, "closing a client connection should free its capacity slot");
+        reclaimed.close();
+        second.close();
+    });
+    test("rate-limits SSE connection creation per client IP", async () => {
+        const port = await findAvailablePort(4520);
+        startSseServer({ MAX_REQUESTS_PER_MINUTE: "2" }, port);
+        await waitForHealth(port);
+        const first = openSseConnection(port);
+        const second = openSseConnection(port);
+        assert.ok(await waitFor(() => first.statusCode === 200 && second.statusCode === 200, 5000), "expected the first two SSE connections to be accepted");
+        const rejected = await fetch(`http://${LOOPBACK}:${port}/sse`, {
+            headers: { Authorization: `Bearer ${SSE_TOKEN}`, Accept: "text/event-stream" },
+        });
+        assert.equal(rejected.status, 429);
+        const body = (await rejected.json());
+        assert.equal(body.error, "Rate limit exceeded");
+        assert.match(body.message ?? "", /per minute/i);
+        first.close();
+        second.close();
+    });
+    test("closes SSE sessions that stay idle", async () => {
+        const port = await findAvailablePort(4530);
+        startSseServer({ SESSION_TIMEOUT_SECONDS: "2" }, port);
+        await waitForHealth(port);
+        const connection = openSseConnection(port);
+        assert.ok(await waitFor(() => connection.statusCode === 200, 5000), "expected the SSE connection to be accepted");
+        const closedByIdleTimeout = await Promise.race([
+            connection.ended.then(() => true),
+            new Promise(resolve => setTimeout(() => resolve(false), 12000)),
+        ]);
+        assert.equal(closedByIdleTimeout, true, "idle SSE session should be closed by the server");
+        connection.close();
+    });
+    test("POST /messages keeps an SSE session alive past the idle timeout", async () => {
+        const port = await findAvailablePort(4540);
+        startSseServer({ SESSION_TIMEOUT_SECONDS: "2" }, port);
+        await waitForHealth(port);
+        const connection = openSseConnection(port);
+        assert.ok(await waitFor(() => connection.statusCode === 200, 5000), "expected the SSE connection to be accepted");
+        const sessionId = await readSessionId(connection);
+        // Ping across several idle windows; every POST /messages must reset activity.
+        const pingStatuses = [];
+        const keepAlive = setInterval(() => {
+            void postSseMessage(port, sessionId, { jsonrpc: "2.0", id: 1, method: "ping" })
+                .then(status => pingStatuses.push(status))
+                .catch(() => undefined);
+        }, 400);
+        try {
+            await new Promise(resolve => setTimeout(resolve, 6000));
+        }
+        finally {
+            clearInterval(keepAlive);
+        }
+        assert.ok(pingStatuses.length >= 8, `expected keep-alive pings to be sent, saw ${pingStatuses.length}`);
+        assert.ok(pingStatuses.every(status => status === 202), `expected every ping to be accepted, saw ${JSON.stringify(pingStatuses)}`);
+        assert.match(connection.streamText(), /"result"/, "expected a ping response on the stream");
+        assert.equal(await endedWithin(connection, 300), false, "POST /messages activity should keep the SSE session open");
+        assert.equal(await endedWithin(connection, 8000), true, "the session should close once POST /messages activity stops");
+        connection.close();
+    });
+    test("treats inherited object keys as unknown SSE sessions", async () => {
+        const port = await findAvailablePort(4560);
+        startSseServer({}, port);
+        await waitForHealth(port);
+        const response = await fetch(`http://${LOOPBACK}:${port}/messages?sessionId=constructor`, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${SSE_TOKEN}`, "Content-Type": "application/json" },
+            body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "ping" }),
+            signal: AbortSignal.timeout(3000),
+        });
+        assert.equal(response.status, 400);
+        assert.match(await response.text(), /No transport found/);
+    });
+    test("reports degraded health while SSE capacity is exhausted", async () => {
+        const port = await findAvailablePort(4550);
+        startSseServer({ MAX_SESSIONS: "1" }, port);
+        await waitForHealth(port);
+        const connection = openSseConnection(port);
+        assert.ok(await waitFor(() => connection.statusCode === 200, 5000), "expected the SSE connection to be accepted");
+        const degraded = await fetch(`http://${LOOPBACK}:${port}/health`);
+        const body = (await degraded.json());
+        assert.equal(degraded.status, 503);
+        assert.equal(body.status, "degraded");
+        assert.equal(body.activeSessions, 1);
+        assert.equal(body.maxSessions, 1);
+        connection.close();
+    });
+});

package/build/test/test-download-attachment.js

@@ -72,6 +72,9 @@ describe('download_attachment', () => {
         mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/uploads/${TEST_SECRET}/image.png`, (_req, res) => { res.set('Content-Type', 'image/png').send(MINIMAL_PNG_BUF); });
         // Plain-text upload endpoint
         mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/uploads/${TEST_SECRET}/document.txt`, (_req, res) => { res.set('Content-Type', 'text/plain').send('hello world'); });
+        // GitLab redirects uploads to its object storage, so the hop after this response
+        // leaves the origin. The destination is a non-public address here.
+        mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/uploads/${TEST_SECRET}/redirected.txt`, (_req, res) => { res.redirect('http://169.254.169.254/latest/meta-data/'); });
     });
     after(async () => {
         await mockGitLab.stop();
@@ -126,6 +129,14 @@ describe('download_attachment', () => {
             raw.result.content.some(c => typeof c.text === 'string' && c.text.toLowerCase().includes('traversal'));
         assert.ok(isRpcError || isContentError, 'Should return an error mentioning directory traversal');
     });
+    test('a redirect to a non-public address is refused', async () => {
+        const raw = await callDownloadAttachment({ project_id: TEST_PROJECT_ID, secret: TEST_SECRET, filename: 'redirected.txt' }, env);
+        const mentionsRefusal = (text) => text.toLowerCase().includes('non-public address');
+        const isRpcError = typeof raw.error?.message === 'string' && mentionsRefusal(raw.error.message);
+        const isContentError = Array.isArray(raw.result?.content) &&
+            raw.result.content.some(c => typeof c.text === 'string' && mentionsRefusal(c.text));
+        assert.ok(isRpcError || isContentError, `Should refuse the redirect instead of following it, got ${JSON.stringify(raw)}`);
+    });
     test('local_path through a symlink directory is rejected', async () => {
         const linkDir = `omc-test-symlink-${RUN_ID}`;
         fs.rmSync(linkDir, { recursive: true, force: true });

package/build/test/test-geteffectiveprojectid.js

@@ -680,7 +680,7 @@ describe('getEffectiveProjectId', { concurrency: 1 }, () => {
                 },
             ];
             for (const { name, args } of calls) {
-                await assert.rejects(client.callTool(name, args), /path segments/);
+                await assert.rejects(client.callTool(name, args), /Cannot use value as a GitLab URL path segment/);
             }
         });
     });

package/build/test/test-job-artifacts.js

@@ -9,6 +9,8 @@ const MOCK_TOKEN = 'glpat-mock-token-12345';
 const TEST_PROJECT_ID = '123';
 const TEST_JOB_ID = '456';
 const NULL_MODE_JOB_ID = '457';
+const REDIRECT_JOB_ID = '789';
+const REDIRECT_TARGET = 'http://169.254.169.254/latest/meta-data/';
 const TEST_ENCODED_ARTIFACT_PATH = 'reports/report#1.txt';
 // Helper to run an MCP tool via the built server
 async function callTool(toolName, args, env) {
@@ -141,6 +143,14 @@ describe('job artifacts tools', () => {
         mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/jobs/999/artifacts/tree`, (req, res) => {
             res.status(404).json({ message: 'Not Found' });
         });
+        // GitLab redirects artifact downloads to its object storage, so the hop after this
+        // response leaves the origin. The destination is a non-public address here.
+        mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/jobs/${REDIRECT_JOB_ID}/artifacts`, (req, res) => {
+            res.redirect(REDIRECT_TARGET);
+        });
+        mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/jobs/${REDIRECT_JOB_ID}/artifacts/report.xml`, (req, res) => {
+            res.redirect(REDIRECT_TARGET);
+        });
         await mockGitLab.start();
         mockGitLabUrl = mockGitLab.getUrl();
         // Relative temp dir — absolute local_path is rejected as traversal
@@ -250,4 +260,16 @@ describe('job artifacts tools', () => {
         });
         assert.strictEqual(result, 'encoded artifact content');
     });
+    test('download_job_artifacts refuses a redirect to a non-public address', async () => {
+        await assert.rejects(() => callTool('download_job_artifacts', { project_id: TEST_PROJECT_ID, job_id: REDIRECT_JOB_ID, local_path: tmpDir }, {
+            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        }), (err) => String(err.message || err).toLowerCase().includes('non-public address'));
+    });
+    test('get_job_artifact_file refuses a redirect to a non-public address', async () => {
+        await assert.rejects(() => callTool('get_job_artifact_file', { project_id: TEST_PROJECT_ID, job_id: REDIRECT_JOB_ID, artifact_path: 'report.xml' }, {
+            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        }), (err) => String(err.message || err).toLowerCase().includes('non-public address'));
+    });
 });