@zereight/mcp-gitlab 2.1.68 → 2.1.70

package/build/utils/url.js

@@ -17,6 +17,21 @@ export function normalizeGitLabApiUrl(url) {
     }
     return normalizedUrl;
 }
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
+/**
+ * True when the URL is plain `http://` to a non-loopback host, i.e. credentials sent
+ * to it would cross the network in cleartext. Unparseable URLs return false (they are
+ * rejected by the config validation instead).
+ */
+export function isCleartextRemoteUrl(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === "http:" && !LOOPBACK_HOSTNAMES.has(parsed.hostname);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Dot segments anywhere in a decoded value, including after a percent-encoded
  * separator ("..%2F..%2Fuser" decodes to a path-traversal sequence).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.68",
+  "version": "2.1.70",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [