@zereight/mcp-gitlab 2.1.67 → 2.1.68

package/build/index.js

@@ -114,7 +114,7 @@ GitLabDiscussionNoteSchema, // Added
 GitLabDiscussionSchema, 
 // Draft Notes Schemas
 GitLabDraftNoteSchema, GitLabForkSchema, GitLabBranchSchema, GitLabProtectedBranchSchema, GitLabGroupSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestPipelineSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabGroupMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineScheduleSchema, GitLabPipelineScheduleVariableSchema, GitLabPipelineSchedulePlayResultSchema, ListPipelineSchedulesSchema, GetPipelineScheduleSchema, ListPipelineSchedulePipelinesSchema, CreatePipelineScheduleSchema, UpdatePipelineScheduleSchema, DeletePipelineScheduleSchema, PlayPipelineScheduleSchema, TakeOwnershipPipelineScheduleSchema, GetPipelineScheduleVariableSchema, CreatePipelineScheduleVariableSchema, UpdatePipelineScheduleVariableSchema, DeletePipelineScheduleVariableSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListBranchesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, GitLabCiVariableSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GitLabDependencyProxySchema, GitLabDependencyProxyBlobSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListProjectVulnerabilitiesSchema, GetVulnerabilitySchema, DismissVulnerabilitySchema, ConfirmVulnerabilitySchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
-GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestsSchema, ListGroupMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListProjectMembersSchema, ListGroupMembersSchema, ListProjectMilestonesSchema, ListGroupMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, OrbitQuerySchema, OrbitSchemaSchema, OrbitStatusSchema, OrbitToolsSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, GitLabTagSchema, GitLabTagSignatureSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, GetMergeRequestDiscussionSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, CreateWebhookSchema, UpdateWebhookSchema, DeleteWebhookSchema, ListWebhookEventsSchema, GetWebhookEventSchema, HealthCheckSchema, } from "./schemas.js";
+GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestsSchema, ListGroupMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListProjectMembersSchema, ListGroupMembersSchema, ListProjectMilestonesSchema, ListGroupMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, OrbitQuerySchema, OrbitSchemaSchema, OrbitStatusSchema, OrbitToolsSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, GitLabTagSchema, GitLabTagSignatureSchema, ListSnippetsSchema, GetSnippetSchema, CreateSnippetSchema, UpdateSnippetSchema, DeleteSnippetSchema, GitLabSnippetSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, GetMergeRequestDiscussionSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, CreateWebhookSchema, UpdateWebhookSchema, DeleteWebhookSchema, ListWebhookEventsSchema, GetWebhookEventSchema, HealthCheckSchema, } from "./schemas.js";
 import { randomUUID, timingSafeEqual, } from "node:crypto";
 import { createLogger } from "./utils/logger.js";
 const logger = createLogger();
@@ -7605,6 +7605,163 @@ async function executeGitLabGraphQL(query, variables = {}) {
         clearTimeout(timeout);
     }
 }
+/**
+ * Build the snippets endpoint URL.
+ *
+ * When projectId is provided, or when a project allowlist is in effect (env
+ * GITLAB_PROJECT_ID / GITLAB_ALLOWED_PROJECT_IDS or a session scope narrowed via
+ * X-GitLab-Allowed-Project-Ids), returns the project snippets endpoint — routing
+ * through getEffectiveProjectId so the effective scope is enforced. Only falls
+ * back to the personal /snippets endpoint when no scope is active at all.
+ */
+function getSnippetsEndpoint(projectId) {
+    const scopeActive = getEffectiveAllowedProjectIds().length > 0 || !!GITLAB_PROJECT_ID;
+    if (projectId || scopeActive) {
+        const decoded = projectId ? decodeURIComponent(projectId) : "";
+        const effectiveProjectId = getEffectiveProjectId(decoded);
+        return `${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/snippets`;
+    }
+    return `${getEffectiveApiUrl()}/snippets`;
+}
+/**
+ * List snippets — project snippets if projectId is given, otherwise personal snippets.
+ */
+async function listSnippets(projectId, options = {}) {
+    const url = new URL(getSnippetsEndpoint(projectId));
+    Object.entries(options).forEach(([key, value]) => {
+        if (value !== undefined) {
+            url.searchParams.append(key, String(value));
+        }
+    });
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabSnippetSchema.array().parse(data);
+}
+/**
+ * Get a snippet's metadata. Use getSnippetRawContent to fetch the raw file content.
+ */
+async function getSnippet(projectId, snippetId) {
+    const response = await fetch(`${getSnippetsEndpoint(projectId)}/${snippetId}`, {
+        ...getFetchConfig(),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabSnippetSchema.parse(data);
+}
+/**
+ * Get the raw content of a single-file snippet via the `/raw` endpoint.
+ * For multi-file snippets, use getSnippetFileRawContent instead.
+ */
+async function getSnippetRawContent(projectId, snippetId) {
+    const response = await fetch(`${getSnippetsEndpoint(projectId)}/${snippetId}/raw`, {
+        ...getFetchConfig(),
+    });
+    await handleGitLabError(response);
+    return await response.text();
+}
+/**
+ * Extract the ref (branch/tag/commit) from a snippet file's raw_url.
+ * Anchors on /snippets/{id}/raw/ so branch names or file paths containing
+ * the word "raw" don't produce a false match.
+ */
+function extractSnippetRef(rawUrl, snippetId, filePath) {
+    const rawMarker = `/snippets/${snippetId}/raw/`;
+    const decoded = decodeURIComponent(new URL(rawUrl).pathname);
+    const markerIdx = decoded.indexOf(rawMarker);
+    if (markerIdx === -1) {
+        throw new Error(`Cannot extract ref from snippet file raw_url: ${rawUrl}`);
+    }
+    const afterRaw = decoded.slice(markerIdx + rawMarker.length); // "{ref}/{filePath}"
+    const fileStart = afterRaw.lastIndexOf("/" + filePath);
+    if (fileStart === -1) {
+        throw new Error(`Cannot locate file path "${filePath}" in snippet file raw_url: ${rawUrl}`);
+    }
+    return afterRaw.slice(0, fileStart);
+}
+/**
+ * Fetch the raw content of one file inside a multi-file snippet.
+ * Accepts an explicit ref (branch/tag/commit) — callers resolve it via
+ * extractSnippetRef or a user-supplied parameter before calling this.
+ */
+async function getSnippetFileRawContent(projectId, snippetId, ref, filePath) {
+    const encodedRef = encodeGitLabPathSegment(ref);
+    const encodedPath = encodeGitLabPathSegment(filePath);
+    const url = `${getSnippetsEndpoint(projectId)}/${snippetId}/files/${encodedRef}/${encodedPath}/raw`;
+    const response = await fetch(url, { ...getFetchConfig() });
+    await handleGitLabError(response);
+    return await response.text();
+}
+function snippetCreateFilesPayload(options) {
+    if (options.files !== undefined && options.files.length > 0) {
+        return options.files;
+    }
+    if (options.file_name !== undefined && options.content !== undefined) {
+        return [{ file_path: options.file_name, content: options.content }];
+    }
+    throw new Error("Provide either files[] (multi-file) or both file_name and content (single-file)");
+}
+/**
+ * Create a snippet — project-scoped if projectId is given, otherwise personal.
+ */
+async function createSnippet(projectId, options) {
+    const { title, description, visibility } = options;
+    const body = {
+        title,
+        visibility: visibility ?? "private",
+        files: snippetCreateFilesPayload(options),
+    };
+    if (description !== undefined) {
+        body.description = description;
+    }
+    const response = await fetch(getSnippetsEndpoint(projectId), {
+        ...getFetchConfig(),
+        method: "POST",
+        body: JSON.stringify(body),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabSnippetSchema.parse(data);
+}
+/**
+ * Update an existing snippet — project-scoped if projectId is given, otherwise personal.
+ */
+async function updateSnippet(projectId, options) {
+    const { snippet_id, title, file_name, content, files, description, visibility } = options;
+    const body = {};
+    if (title !== undefined)
+        body.title = title;
+    if (description !== undefined)
+        body.description = description;
+    if (visibility !== undefined)
+        body.visibility = visibility;
+    if (files !== undefined) {
+        body.files = files;
+    }
+    else if (file_name !== undefined && content !== undefined) {
+        body.files = [{ action: "update", file_path: file_name, content }];
+    }
+    const response = await fetch(`${getSnippetsEndpoint(projectId)}/${snippet_id}`, {
+        ...getFetchConfig(),
+        method: "PUT",
+        body: JSON.stringify(body),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabSnippetSchema.parse(data);
+}
+/**
+ * Delete a snippet — project-scoped if projectId is given, otherwise personal.
+ */
+async function deleteSnippet(projectId, snippetId) {
+    const response = await fetch(`${getSnippetsEndpoint(projectId)}/${snippetId}`, {
+        ...getFetchConfig(),
+        method: "DELETE",
+    });
+    await handleGitLabError(response);
+}
 // Request handlers are now registered inside createServer() factory function
 // to ensure each transport connection gets its own Server instance (GHSA-345p-7cg4-v4c7).
 async function handleToolCall(params) {
@@ -10129,6 +10286,82 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(signature) }],
                 };
             }
+            case "list_snippets": {
+                const args = ListSnippetsSchema.parse(params.arguments);
+                const { project_id, ...options } = args;
+                const snippets = await listSnippets(project_id, options);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(snippets, null, 2) }],
+                };
+            }
+            case "get_snippet": {
+                const args = GetSnippetSchema.parse(params.arguments);
+                const snippet = await getSnippet(args.project_id, args.snippet_id);
+                const result = { ...snippet };
+                if (args.include_content) {
+                    const files = snippet.files ?? [];
+                    if (files.length > 1) {
+                        const firstFile = files[0];
+                        let ref;
+                        if (args.ref !== undefined) {
+                            ref = args.ref;
+                        }
+                        else {
+                            if (!firstFile.raw_url)
+                                throw new Error(`Snippet file "${firstFile.path}" has no raw_url`);
+                            ref = extractSnippetRef(firstFile.raw_url, args.snippet_id, firstFile.path);
+                        }
+                        result.files = await Promise.all(files.map(async (f) => ({
+                            ...f,
+                            content: await getSnippetFileRawContent(args.project_id, args.snippet_id, ref, f.path),
+                        })));
+                    }
+                    else {
+                        const file = files[0];
+                        const filePath = file?.path ?? snippet.file_name ?? undefined;
+                        if (args.ref !== undefined && filePath) {
+                            result.content = await getSnippetFileRawContent(args.project_id, args.snippet_id, args.ref, filePath);
+                        }
+                        else {
+                            result.content = await getSnippetRawContent(args.project_id, args.snippet_id);
+                        }
+                    }
+                }
+                return {
+                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                };
+            }
+            case "create_snippet": {
+                const args = CreateSnippetSchema.parse(params.arguments);
+                const { project_id, ...options } = args;
+                const snippet = await createSnippet(project_id, options);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(snippet, null, 2) }],
+                };
+            }
+            case "update_snippet": {
+                const args = UpdateSnippetSchema.parse(params.arguments);
+                const { project_id, ...options } = args;
+                const snippet = await updateSnippet(project_id, options);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(snippet, null, 2) }],
+                };
+            }
+            case "delete_snippet": {
+                const args = DeleteSnippetSchema.parse(params.arguments);
+                await deleteSnippet(args.project_id, args.snippet_id);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                status: "success",
+                                message: `Snippet ${args.snippet_id} deleted successfully`,
+                            }, null, 2),
+                        },
+                    ],
+                };
+            }
             case "list_webhooks": {
                 const args = ListWebhooksSchema.parse(params.arguments);
                 const webhooks = await listWebhooks(args);

package/build/schemas.js

@@ -3847,6 +3847,193 @@ export const GitLabTagSchema = z.object({
     protected: z.boolean(),
     created_at: z.string().nullable(),
 });
+// --- Snippet schemas ---
+export const ListSnippetsSchema = z
+    .object({
+    project_id: z
+        .coerce.string()
+        .optional()
+        .describe("Project ID or URL-encoded path. Omit for personal snippets, or the configured project when GITLAB_PROJECT_ID / GITLAB_ALLOWED_PROJECT_IDS is set."),
+})
+    .merge(PaginationOptionsSchema);
+export const GetSnippetSchema = z.object({
+    project_id: z
+        .coerce.string()
+        .optional()
+        .describe("Project ID or URL-encoded path. Omit for personal snippets, or the configured project when GITLAB_PROJECT_ID / GITLAB_ALLOWED_PROJECT_IDS is set."),
+    snippet_id: z.coerce.number().describe("The snippet ID"),
+    include_content: coerceBooleanString
+        .optional()
+        .default(false)
+        .describe("Whether to fetch the raw file content (default: false)"),
+    ref: z
+        .string()
+        .optional()
+        .describe("Branch, tag, or commit to fetch content from. Inferred from the snippet's raw_url when omitted."),
+});
+export const SnippetFileSchema = z.object({
+    file_path: z.string().describe("File path within the snippet (e.g., 'src/script.py')"),
+    content: z.string().describe("File content"),
+});
+export const SnippetFileUpdateActionSchema = z
+    .object({
+    action: z
+        .enum(["create", "update", "delete", "move"])
+        .describe("Type of action to perform on the file"),
+    file_path: z
+        .string()
+        .optional()
+        .describe("File path of the snippet file (required for all actions). For 'move', this is the new path; for 'create'/'update'/'delete', the target path."),
+    previous_path: z
+        .string()
+        .optional()
+        .describe("Previous path of the snippet file (required for 'move')."),
+    content: z
+        .string()
+        .optional()
+        .describe("Content of the snippet file (required for 'create' and 'update')."),
+})
+    .superRefine((data, ctx) => {
+    if (data.file_path === undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "file_path is required for all snippet file actions",
+            path: ["file_path"],
+        });
+    }
+    if ((data.action === "create" || data.action === "update") && data.content === undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: `content is required for action: '${data.action}'`,
+            path: ["content"],
+        });
+    }
+    if (data.action === "move" && data.previous_path === undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "previous_path is required for action: 'move'",
+            path: ["previous_path"],
+        });
+    }
+})
+    .describe("Multi-file snippet update action. Mirrors GitLab's PUT /snippets/:id files[] payload.");
+export const CreateSnippetSchema = z
+    .object({
+    project_id: z
+        .coerce.string()
+        .optional()
+        .describe("Project ID or URL-encoded path. Omit for a personal snippet, or the configured project when GITLAB_PROJECT_ID / GITLAB_ALLOWED_PROJECT_IDS is set."),
+    title: z.string().describe("Snippet title"),
+    file_name: z
+        .string()
+        .optional()
+        .describe("File name for a single-file snippet (e.g., 'script.py'). Use together with content. Mutually exclusive with files[]."),
+    content: z
+        .string()
+        .optional()
+        .describe("File content for a single-file snippet. Use together with file_name."),
+    files: z
+        .array(SnippetFileSchema)
+        .optional()
+        .describe("Array of files for a multi-file snippet. Each item needs file_path and content. Mutually exclusive with file_name/content."),
+    description: z.string().optional().describe("Optional snippet description"),
+    visibility: z
+        .enum(["private", "internal", "public"])
+        .optional()
+        .describe("Snippet visibility (default: private)"),
+})
+    .refine(data => (data.files !== undefined && data.files.length > 0) ||
+    (data.file_name !== undefined && data.content !== undefined), {
+    message: "Provide either files[] (multi-file) or both file_name and content (single-file)",
+    path: ["files"],
+})
+    .refine(data => !(data.files !== undefined &&
+    (data.file_name !== undefined || data.content !== undefined)), {
+    message: "Cannot mix files[] with file_name/content — pick one shape",
+    path: ["files"],
+});
+export const UpdateSnippetSchema = z
+    .object({
+    project_id: z
+        .coerce.string()
+        .optional()
+        .describe("Project ID or URL-encoded path. Omit for personal snippets, or the configured project when GITLAB_PROJECT_ID / GITLAB_ALLOWED_PROJECT_IDS is set."),
+    snippet_id: z.coerce.number().describe("The snippet ID to update"),
+    title: z.string().optional().describe("New title"),
+    file_name: z
+        .string()
+        .optional()
+        .describe("File name to update. Provide together with content to replace a single-file snippet's contents."),
+    content: z.string().optional().describe("New file content (requires file_name)"),
+    files: z
+        .array(SnippetFileUpdateActionSchema)
+        .min(1, "files[] must be non-empty when provided")
+        .optional()
+        .describe("Multi-file update actions. Each item has 'action' (create/update/delete/move) plus the relevant path/content fields. Use this for renames (action: 'move' with previous_path), deletions, and additions. Mutually exclusive with file_name/content."),
+    description: z.string().optional().describe("New description"),
+    visibility: z
+        .enum(["private", "internal", "public"])
+        .optional()
+        .describe("New visibility"),
+})
+    .refine(data => data.title !== undefined ||
+    data.content !== undefined ||
+    data.file_name !== undefined ||
+    data.files !== undefined ||
+    data.description !== undefined ||
+    data.visibility !== undefined, { message: "At least one field must be provided to update" })
+    .refine(data => !(data.files !== undefined &&
+    (data.file_name !== undefined || data.content !== undefined)), {
+    message: "Cannot mix files[] with file_name/content — pick one shape",
+    path: ["files"],
+})
+    .refine(data => !(data.content !== undefined && data.file_name === undefined), {
+    message: "content requires file_name",
+    path: ["content"],
+})
+    .refine(data => !(data.file_name !== undefined && data.content === undefined), {
+    message: "file_name requires content — renaming a file alone is not supported (the modern GitLab snippet API requires a files[] action with previous_path)",
+    path: ["file_name"],
+});
+export const DeleteSnippetSchema = z.object({
+    project_id: z
+        .coerce.string()
+        .optional()
+        .describe("Project ID or URL-encoded path. Omit for personal snippets, or the configured project when GITLAB_PROJECT_ID / GITLAB_ALLOWED_PROJECT_IDS is set."),
+    snippet_id: z.coerce.number().describe("The snippet ID to delete"),
+});
+export const GitLabSnippetAuthorSchema = z
+    .object({
+    id: z.number().optional(),
+    username: z.string().optional(),
+    name: z.string().optional(),
+    state: z.string().optional(),
+    avatar_url: z.string().nullable().optional(),
+    web_url: z.string().optional(),
+})
+    .passthrough();
+export const GitLabSnippetFileSchema = z
+    .object({
+    path: z.string(),
+    raw_url: z.string().optional(),
+})
+    .passthrough();
+export const GitLabSnippetSchema = z
+    .object({
+    id: z.number(),
+    title: z.string(),
+    description: z.string().nullable().optional(),
+    visibility: z.string().optional(),
+    author: GitLabSnippetAuthorSchema.optional(),
+    updated_at: z.string().optional(),
+    created_at: z.string().optional(),
+    web_url: z.string().optional(),
+    raw_url: z.string().optional(),
+    file_name: z.string().nullable().optional(),
+    files: z.array(GitLabSnippetFileSchema).optional(),
+    project_id: z.number().nullable().optional(),
+})
+    .passthrough();
 export const GitLabTagSignatureSchema = z.object({
     signature_type: z.literal("X509"),
     verification_status: z.string(),

package/build/scripts/generate-tool-docs.js

@@ -123,6 +123,10 @@ const GROUP_META = {
         title: "GitLab Orbit",
         blurb: "Query the Orbit SDLC knowledge graph (Beta; Premium/Ultimate). Graph queries consume GitLab credits; schema, status, and tool listing are free.",
     },
+    snippets: {
+        title: "Snippets",
+        blurb: "Snippet CRUD — list, get (with optional file content), create, update, and delete personal or project snippets.",
+    },
 };
 const GROUP_ORDER = [
     "projects",
@@ -146,6 +150,7 @@ const GROUP_ORDER = [
     "dependency_proxy",
     "vulnerabilities",
     "orbit",
+    "snippets",
 ];
 // Authoritative classification — uses the `readOnlyTools` set from
 // tools/registry.ts. That set is what the server itself consults to decide

package/build/scripts/tool-coverage/coverage.js

@@ -50,6 +50,7 @@ export const GROUP_ORDER = [
     "dependency_proxy",
     "vulnerabilities",
     "orbit",
+    "snippets",
 ];
 export const GROUP_TITLE = {
     merge_requests: "Merge Requests",
@@ -73,6 +74,7 @@ export const GROUP_TITLE = {
     dependency_proxy: "Dependency Proxy",
     vulnerabilities: "Vulnerabilities",
     orbit: "GitLab Orbit",
+    snippets: "Snippets",
     meta: "Meta & GraphQL",
 };
 export const CANARY_INVOKED = [

package/build/test/test-dynamic-project-scope.js

@@ -5,6 +5,22 @@ import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server
 import { CustomHeaderClient } from "./clients/custom-header-client.js";
 const MOCK_TOKEN = "glpat-dynamic-scope-token";
 const SCOPE_HEADER = "x-gitlab-allowed-project-ids";
+function parseToolJson(result) {
+    assert.ok(result.isError !== true, "tool should succeed");
+    const first = result.content[0];
+    assert.ok(first !== undefined && first.type === "text");
+    return JSON.parse(first.text);
+}
+function snippetTitleFrom(value) {
+    if (value === null || typeof value !== "object" || !("title" in value)) {
+        assert.fail("expected a snippet object with title");
+    }
+    const title = value.title;
+    if (typeof title !== "string") {
+        assert.fail("expected snippet title to be a string");
+    }
+    return title;
+}
 async function connectClient(mcpUrl, scope) {
     const headers = { authorization: `Bearer ${MOCK_TOKEN}` };
     if (scope !== undefined) {
@@ -323,6 +339,150 @@ describe("Dynamic project scope", { concurrency: 1 }, () => {
             }
         });
     });
+    describe("with session-scoped snippet tools", () => {
+        let mockGitLab;
+        const servers = [];
+        let mcpUrl;
+        const snippetHits = [];
+        before(async () => {
+            const mockPort = await findMockServerPort();
+            mockGitLab = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN] });
+            mockGitLab.addMockHandler("get", "/snippets", (_req, res) => {
+                snippetHits.push("personal:list");
+                res.json([{ id: 99, title: "personal snippet of the token owner" }]);
+            });
+            mockGitLab.addMockHandler("get", "/projects/5/snippets", (_req, res) => {
+                snippetHits.push("project:list");
+                res.json([{ id: 42, title: "project snippet" }]);
+            });
+            mockGitLab.addMockHandler("get", "/projects/5/snippets/42", (_req, res) => {
+                snippetHits.push("project:get");
+                res.json({ id: 42, title: "project snippet" });
+            });
+            mockGitLab.addMockHandler("get", "/snippets/42", (_req, res) => {
+                snippetHits.push("personal:get");
+                res.json({ id: 42, title: "personal snippet of the token owner" });
+            });
+            mockGitLab.addMockHandler("delete", "/snippets/99", (_req, res) => {
+                snippetHits.push("personal:delete");
+                res.status(204).end();
+            });
+            mockGitLab.addMockHandler("delete", "/projects/5/snippets/42", (_req, res) => {
+                snippetHits.push("project:delete");
+                res.status(204).end();
+            });
+            mockGitLab.addMockHandler("post", "/snippets", (_req, res) => {
+                snippetHits.push("personal:create");
+                res.json({ id: 99, title: "personal snippet of the token owner" });
+            });
+            mockGitLab.addMockHandler("post", "/projects/5/snippets", (_req, res) => {
+                snippetHits.push("project:create");
+                res.json({ id: 42, title: "project snippet" });
+            });
+            mockGitLab.addMockHandler("put", "/snippets/42", (_req, res) => {
+                snippetHits.push("personal:update");
+                res.json({ id: 42, title: "updated personal snippet" });
+            });
+            mockGitLab.addMockHandler("put", "/projects/5/snippets/42", (_req, res) => {
+                snippetHits.push("project:update");
+                res.json({ id: 42, title: "updated project snippet" });
+            });
+            await mockGitLab.start();
+            const mcpPort = await findAvailablePort(3200);
+            const server = await launchServer({
+                mode: TransportMode.STREAMABLE_HTTP,
+                port: mcpPort,
+                timeout: 5000,
+                env: {
+                    STREAMABLE_HTTP: "true",
+                    REMOTE_AUTHORIZATION: "true",
+                    ENABLE_DYNAMIC_PROJECT_SCOPE: "true",
+                    GITLAB_TOOLSETS: "snippets",
+                    GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
+                },
+            });
+            servers.push(server);
+            mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
+        });
+        after(async () => {
+            cleanupServers(servers);
+            await mockGitLab?.stop();
+        });
+        test("list_snippets without project_id stays within the session scope", async () => {
+            snippetHits.length = 0;
+            const client = await connectClient(mcpUrl, "5");
+            try {
+                const result = await client.callTool("list_snippets", {});
+                assert.ok(result.content, "Should have content");
+                const content = result.content[0];
+                assert.ok("text" in content, "Content should have text");
+                const snippets = JSON.parse(content.text);
+                assert.strictEqual(snippets[0].title, "project snippet");
+            }
+            finally {
+                await client.disconnect();
+            }
+            assert.deepStrictEqual(snippetHits, ["project:list"], "must route to the scoped project, not the personal /snippets endpoint");
+        });
+        test("delete_snippet without project_id stays within the session scope", async () => {
+            snippetHits.length = 0;
+            const client = await connectClient(mcpUrl, "5");
+            try {
+                await client.callTool("delete_snippet", { snippet_id: 42 });
+            }
+            finally {
+                await client.disconnect();
+            }
+            assert.deepStrictEqual(snippetHits, ["project:delete"], "must route to the scoped project, not the personal /snippets endpoint");
+        });
+        test("get_snippet without project_id stays within the session scope", async () => {
+            snippetHits.length = 0;
+            const client = await connectClient(mcpUrl, "5");
+            try {
+                const result = await client.callTool("get_snippet", { snippet_id: 42 });
+                assert.ok(result.content, "Should have content");
+                const content = result.content[0];
+                assert.ok("text" in content, "Content should have text");
+                const snippet = JSON.parse(content.text);
+                assert.strictEqual(snippet.title, "project snippet");
+            }
+            finally {
+                await client.disconnect();
+            }
+            assert.deepStrictEqual(snippetHits, ["project:get"], "must route to the scoped project, not the personal /snippets endpoint");
+        });
+        test("create_snippet without project_id stays within the session scope", async () => {
+            snippetHits.length = 0;
+            const client = await connectClient(mcpUrl, "5");
+            try {
+                const result = await client.callTool("create_snippet", {
+                    title: "scoped create",
+                    file_name: "note.md",
+                    content: "hi",
+                });
+                assert.strictEqual(snippetTitleFrom(parseToolJson(result)), "project snippet");
+            }
+            finally {
+                await client.disconnect();
+            }
+            assert.deepStrictEqual(snippetHits, ["project:create"], "must route to the scoped project, not the personal /snippets endpoint");
+        });
+        test("update_snippet without project_id stays within the session scope", async () => {
+            snippetHits.length = 0;
+            const client = await connectClient(mcpUrl, "5");
+            try {
+                const result = await client.callTool("update_snippet", {
+                    snippet_id: 42,
+                    title: "scoped update",
+                });
+                assert.strictEqual(snippetTitleFrom(parseToolJson(result)), "updated project snippet");
+            }
+            finally {
+                await client.disconnect();
+            }
+            assert.deepStrictEqual(snippetHits, ["project:update"], "must route to the scoped project, not the personal /snippets endpoint");
+        });
+    });
     describe("with ENABLE_DYNAMIC_PROJECT_SCOPE disabled", () => {
         let mockGitLab;
         const servers = [];