@zereight/mcp-gitlab 2.1.69 → 2.2.0

package/build/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { getConfig, ENABLE_DYNAMIC_API_URL, ENABLE_DYNAMIC_PROJECT_SCOPE, ENABLE_STRICT_PROJECT_SCOPE, GITLAB_AUTH_COOKIE_PATH, GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_DISABLE_VERSION_CHECK, GITLAB_READ_ONLY_MODE, GITLAB_MASKING_ENABLED, GITLAB_MASKING_CONFIG, GITLAB_MASKING_POLICY_FILE, GITLAB_MASKING_WORKSPACE_DIR, GITLAB_PERMISSION_MODE, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, MCP_TRUST_PROXY, USE_GITLAB_WIKI, USE_MILESTONE, USE_OAUTH, USE_PIPELINE, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_OAUTH_ALLOWED_GROUPS_RAW, GITLAB_ALLOWED_GROUPS_RAW, GITLAB_OAUTH_ALLOWED_GROUPS, GITLAB_MCP_COMPACT_RESULTS, GITLAB_MCP_COMPACT_RESULT_CHARS, } from "./config.js";
+import { getConfig, ENABLE_DYNAMIC_API_URL, ENABLE_DYNAMIC_PROJECT_SCOPE, ENABLE_STRICT_PROJECT_SCOPE, GITLAB_AUTH_COOKIE_PATH, GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_DISABLE_VERSION_CHECK, GITLAB_READ_ONLY_MODE, GITLAB_MASKING_ENABLED, GITLAB_MASKING_CONFIG, GITLAB_MASKING_POLICY_FILE, GITLAB_MASKING_WORKSPACE_DIR, GITLAB_PERMISSION_MODE, GITLAB_PERMISSION_MODE_RAW, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, MCP_TRUST_PROXY, USE_GITLAB_WIKI, USE_GITLAB_WIKI_RAW, USE_MILESTONE, USE_MILESTONE_RAW, USE_OAUTH, USE_PIPELINE, USE_PIPELINE_RAW, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_OAUTH_ALLOWED_GROUPS_RAW, GITLAB_ALLOWED_GROUPS_RAW, GITLAB_OAUTH_ALLOWED_GROUPS, GITLAB_MCP_COMPACT_RESULTS, GITLAB_MCP_COMPACT_RESULT_CHARS, GITLAB_MCP_COMPACT_TOOL_NAMES, GITLAB_TOOL_PROFILE, } from "./config.js";
+import { getDeprecatedEnvWarnings } from "./deprecated-env.js";
 /** True when the server is running in remote/network mode (SSE or StreamableHTTP transport). */
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
 const STREAMABLE_HTTP_AUTH_TOKEN = getConfig("streamable-http-auth-token", "STREAMABLE_HTTP_AUTH_TOKEN");
@@ -38,7 +39,8 @@ function buildDownloadUrl(type, params) {
                 header = "JOB-TOKEN";
                 headerValue = String(staticToken);
             }
-            else if (IS_OLD) {
+            else if (IS_OLD && !OAUTH_ACCESS_TOKEN) {
+                // OAuth tokens always use Bearer (see buildAuthHeaders)
                 header = "Private-Token";
                 headerValue = String(staticToken);
             }
@@ -59,17 +61,14 @@ function isConstantTimeSecretMatch(provided, expected) {
 }
 import { loadKeyMaterialFromEnv, looksLikeStatelessSessionId, mintSessionId, openSessionId, } from "./stateless/index.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import express from "express";
 import fetchCookie from "fetch-cookie";
 import fs from "node:fs";
 import { pipeline as streamPipeline } from "node:stream/promises";
 import os from "node:os";
-import { fetch as undiciFetch, File, FormData } from "undici";
+import { fetch as undiciFetch, File, FormData, } from "undici";
 import path from "node:path";
 import { CookieJar, parse as parseCookie } from "tough-cookie";
 import { URL } from "node:url";
@@ -82,18 +81,17 @@ import { formatCliError, formatToolOutput } from "./cli/output.js";
 import { compactMcpToolResult, readOwnRecord } from "./cli/compact-mcp-result.js";
 import { compileDeniedToolsRegex } from "./tools/denied-regex.js";
 import { createGitLabOAuthProvider } from "./oauth-proxy.js";
-import { mcpAuthRouter } from "@modelcontextprotocol/sdk/server/auth/router.js";
-import rateLimit, { ipKeyGenerator } from "express-rate-limit";
 import { normalizeProxyClientIpForRateLimit } from "./utils/proxy-client-ip.js";
 import { getForwardedPublicBaseUrl, getForwardedRequestHost, } from "./utils/forwarded-public-base-url.js";
 import { registerDownloadProxy } from "./downloads/proxy.js";
 import { createDownloadToken } from "./utils/download-token.js";
+import { loadRemoteHttpStack } from "./server/remote-http-stack.js";
 import { determineTransportMode, TransportMode } from "./server/transport-mode.js";
 import { formatPrometheusMetrics } from "./server/metrics.js";
 import { SERVER_VERSION } from "./server/version.js";
 import { isInitializationRequestBody, isUnauthenticatedDiscoveryRequestBody, readAcceptHeader, readMcpSessionIdHeader, redactSessionIdForLog, } from "./server/request-helpers.js";
 export { readMcpSessionIdHeader } from "./server/request-helpers.js";
-import { encodeGitLabPath, encodeGitLabPathSegment, normalizeGitLabApiUrl, } from "./utils/url.js";
+import { encodeGitLabPath, encodeGitLabPathSegment, isCleartextRemoteUrl, normalizeGitLabApiUrl, } from "./utils/url.js";
 import { estimateMergeCommitCount, filterDiffsByPatterns, openSafeOutputWriteStream, readSafeExistingFile, summarizeWebhookEvents, } from "./utils/helpers.js";
 import { graphqlQueryContainsWriteOperation, graphqlQueryContainsDeleteOperation, } from "./utils/graphql-query.js";
 import { resolveNestedWikiUpdateTitle } from "./utils/wiki-title.js";
@@ -108,9 +106,13 @@ import { buildBulkPublishDraftNotesBody, needsGitLab19_2BulkPublish, } from "./u
 import { appendFilterParam, appendFilterParams, cleanMutuallyExclusiveIdUsernameOptions, dropBlankArrayEntries, isBlankFilterValue, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS, sanitizeToolArguments, } from "./utils/tool-args.js";
 import { applyJmespathToToolResult, getJmespathSyntaxError, JMESPATH_TOOL_ARGUMENT, JMESPATH_TOOL_ARGUMENT_DESCRIPTION, omitJmespathArgument, readJmespathExpression, } from "./utils/jmespath-tool-result.js";
 import { parseSearchReplaceBlocks, applySearchReplace, applyUnifiedDiff, } from "./utils/patch-helper.js";
-import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
 import { GitLabClientPool } from "./gitlab-client-pool.js";
-import { allTools, readOnlyTools, destructiveTools, deleteTools, parseEnabledToolsets, parseIndividualTools, buildFeatureFlagOverrides, isToolInEnabledToolset, TOOLSET_DEFINITIONS, ALL_TOOLSET_IDS, } from "./tools/registry.js";
+import { advertisesReadOnly, allTools, readOnlyTools, destructiveTools, deleteTools, parseEnabledToolsets, parseIndividualTools, buildFeatureFlagOverrides, isToolInEnabledToolset, findSmallestToolsetForTool, isToolsetFullyActive, listDiscoverableCategories, TOOLSET_DEFINITIONS, ALL_TOOLSET_IDS, } from "./tools/registry.js";
+import { buildUnavailableToolMessage, isSkippedByDiscoverActivation, } from "./tools/discover-activation.js";
+import { selectExposedTools } from "./tools/exposed-tools.js";
+import { createListedToolsCache, decorateToolsForList, } from "./tools/listed-tools.js";
+import { isExcludedBySlimProfile, shouldApplySlimToolProfile } from "./tools/tool-profile.js";
+import { shouldCompactToolResult } from "./utils/compact-tool-allowlist.js";
 import { BulkPublishDraftNotesSchema, CancelPipelineJobSchema, ErasePipelineJobSchema, CancelPipelineSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, // Added
 CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateMergeRequestNoteEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateGroupMilestoneSchema, CreateRepositorySchema, CreateGroupSchema, CreateWikiPageSchema, CreateGroupWikiPageSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UnprotectBranchSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupMilestoneSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteProjectMilestoneSchema, DeleteWikiPageSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, EditProjectMilestoneSchema, EditGroupMilestoneSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetBranchSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GitLabBlameEntrySchema, GetDraftNoteSchema, GetFileContentsSchema, GetIssueLinkSchema, GetIssueSchema, GetLabelSchema, GetMergeRequestDiffsSchema, GetMergeRequestSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetGroupMilestoneSchema, GetGroupMilestoneIssuesSchema, GetGroupMilestoneMergeRequestsSchema, GetGroupMilestoneBurndownEventsSchema, GetDeploymentSchema, CreateDeploymentSchema, UpdateDeploymentSchema, DeploymentApprovalSchema, ListDeploymentMergeRequestsSchema, GetEnvironmentSchema, UpdateEnvironmentSchema, StopEnvironmentSchema, StopStaleEnvironmentsSchema, DeleteReviewAppEnvironmentsSchema, PipelineTriggerIdSchema, ListPipelineTriggersSchema, CreatePipelineTriggerSchema, UpdatePipelineTriggerSchema, TriggerPipelineSchema, GetNamespaceSchema, GitLabCiLintResultSchema, GetPipelineJobOutputSchema, PipelineJobControlSchema, GetPipelineSchema, GetPipelineVariablesSchema, UpdatePipelineMetadataSchema, DeletePipelineSchema, PipelineReportSchema, WaitForPipelineSchema, WaitForPipelineJobSchema, PlayPipelineJobsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetRepositoryTreeSchema, GetUsersSchema, GetUserSchema, GitLabUserFullSchema, WhoAmISchema, GitLabCurrentUserSchema, GetWikiPageSchema, GitLabCommitSchema, GitLabCommitStatusSchema, GitLabCompareResultSchema, GitLabContentSchema, GitLabCreateUpdateFileResponseSchema, GitLabDiffSchema, 
 // Discussion Schemas
@@ -148,7 +150,7 @@ const MCP_PROMPTS = [
         render: (args) => `Review merge request !${args.merge_request_iid ?? "<iid>"} in project ${args.project_id ?? "<project_id>"}:\n` +
             `1. Call list_merge_request_changed_files to get the changed file list (use excluded_file_patterns for lockfiles/dist/generated files).\n` +
             `2. Call get_merge_request_file_diff in batches of 3-5 files, prioritizing source over config/tests.\n` +
-            `3. Leave findings with create_merge_request_thread (inline, position: new_path/new_line) or create_merge_request_note (general).\n` +
+            `3. Leave inline findings with create_merge_request_thread (position: new_path/new_line). For a general note, call discover_tools with category "merge_requests", then create_merge_request_note.\n` +
             `4. Summarize the review verdict in a final top-level note.`,
     },
     {
@@ -178,6 +180,20 @@ const MCP_PROMPTS = [
             `3. Propose a remediation order, calling out any critical/high items with no available fix.`,
     },
 ];
+/**
+ * Error text for a call to a tool that tools/list omits.
+ * Suggests `discover_tools` only when that call would add the tool.
+ * Regex-denied tools stay blocked, and slim-excluded tools are not activated.
+ */
+function buildToolUnavailableMessage(toolName) {
+    return buildUnavailableToolMessage({
+        toolName,
+        toolset: findSmallestToolsetForTool(toolName),
+        deniedByRegex: GITLAB_DENIED_TOOLS_REGEX?.test(toolName) === true,
+        excludedBySlimProfile: isExcludedFromToolsetListing(toolName),
+        enabledByCurrentToolsets: isToolInEnabledToolset(toolName, enabledToolsets),
+    });
+}
 /**
  * Create a new MCP Server instance with request handlers registered.
  * Each transport connection gets its own Server instance to prevent
@@ -185,44 +201,26 @@ const MCP_PROMPTS = [
  */
 /** Builds an MCP server with the tool list filtered by toolsets, permission mode, and policy. */
 function createServer() {
-    // Precompute filtered tool list once at server creation (Steps 1–5 are static)
-    // Step 1: Toolset filter — keep tools in enabled toolsets
-    const toolsAfterToolsets = allTools.filter(tool => isToolInEnabledToolset(tool.name, enabledToolsets));
-    // Step 2: Add GITLAB_TOOLS (individual tools bypass toolset filter)
-    const toolsetToolNames = new Set(toolsAfterToolsets.map(t => t.name));
-    const toolsAfterIndividual = [
-        ...toolsAfterToolsets,
-        ...allTools.filter(tool => individuallyEnabledTools.has(tool.name) && !toolsetToolNames.has(tool.name)),
-    ];
-    // Step 3: Add legacy flag overrides (USE_PIPELINE, USE_MILESTONE, USE_GITLAB_WIKI)
-    const afterIndividualNames = new Set(toolsAfterIndividual.map(t => t.name));
-    const toolsAfterLegacy = [
-        ...toolsAfterIndividual,
-        ...allTools.filter(tool => featureFlagOverrides.has(tool.name) && !afterIndividualNames.has(tool.name)),
-    ];
-    // Step 4: Permission mode filter (readonly / modify / full)
-    const toolsAfterReadOnly = GITLAB_PERMISSION_MODE === "full"
-        ? toolsAfterLegacy
-        : toolsAfterLegacy.filter(tool => isToolAllowedByPermissionMode(tool.name));
-    // Step 5: Regex denial filter
-    let filteredTools = GITLAB_DENIED_TOOLS_REGEX
-        ? toolsAfterReadOnly.filter(tool => !GITLAB_DENIED_TOOLS_REGEX.test(tool.name))
-        : [...toolsAfterReadOnly];
-    // Step 5.5: Always include discover_tools meta-tool (bypasses toolset filter)
-    const discoverTool = allTools.find(t => t.name === "discover_tools");
-    const filteredToolNames = new Set(filteredTools.map(t => t.name));
-    if (discoverTool && !filteredToolNames.has("discover_tools")) {
-        // Respect permission mode and regex denial filters
-        const passesPermissionMode = isToolAllowedByPermissionMode("discover_tools");
-        const passesRegex = !GITLAB_DENIED_TOOLS_REGEX?.test("discover_tools");
-        if (passesPermissionMode && passesRegex) {
-            filteredTools.push(discoverTool);
-        }
-    }
-    // Step 5.7: Remove hidden policy tools
-    if (hiddenToolSet.size > 0) {
-        filteredTools = filteredTools.filter(tool => !hiddenToolSet.has(tool.name));
-    }
+    const filteredTools = selectExposedTools({
+        tools: allTools,
+        isInEnabledToolset: toolName => isToolInEnabledToolset(toolName, enabledToolsets),
+        individuallyEnabledTools,
+        featureFlagOverrides,
+        isAllowedByPermissionMode: isToolAllowedByPermissionMode,
+        deniedToolsRegex: GITLAB_DENIED_TOOLS_REGEX,
+        hiddenToolNames: hiddenToolSet,
+        applySlimProfile,
+    });
+    const listedToolDecoration = {
+        readOnlyToolNames: new Set([...readOnlyTools].filter(toolName => advertisesReadOnly(toolName))),
+        destructiveToolNames: destructiveTools,
+        approveToolNames: approveToolSet,
+        jmespathArgument: JMESPATH_TOOL_ARGUMENT,
+        jmespathArgumentDescription: JMESPATH_TOOL_ARGUMENT_DESCRIPTION,
+    };
+    const listedToolsCache = { revision: 0 };
+    const decorateListedTools = (tools) => decorateToolsForList(tools, listedToolDecoration);
+    const getListedTools = createListedToolsCache(decorateListedTools);
     const mcpServer = new McpServer({
         name: SERVER_NAME,
         version: SERVER_VERSION,
@@ -261,57 +259,8 @@ function createServer() {
         };
     });
     mcpServer.server.setRequestHandler(ListToolsRequestSchema, async () => {
-        // Step 6: Gemini $schema cleanup + annotations (only dynamic step per request)
-        // <<< START: Remove $schema for Gemini compatibility >>>
-        const tools = filteredTools.map(tool => {
-            const modified = { ...tool };
-            // Safety net: remove $schema if present (toJSONSchema strips it for zod schemas,
-            // but manually-defined schemas like discover_tools may still have it)
-            if (modified.inputSchema &&
-                typeof modified.inputSchema === "object" &&
-                modified.inputSchema !== null) {
-                if ("$schema" in modified.inputSchema) {
-                    modified.inputSchema = { ...modified.inputSchema };
-                    delete modified.inputSchema.$schema;
-                }
-            }
-            // Add MCP tool annotations
-            modified.annotations = {
-                ...(readOnlyTools.has(tool.name) ? { readOnlyHint: true } : {}),
-                ...(destructiveTools.has(tool.name) ? { destructiveHint: true } : {}),
-                ...(approveToolSet.has(tool.name) ? { confirmationHint: true } : {}),
-                openWorldHint: true,
-            };
-            // Inject _confirmed optional parameter for approve-policy tools
-            if (approveToolSet.has(tool.name) && modified.inputSchema?.properties) {
-                modified.inputSchema = {
-                    ...modified.inputSchema,
-                    properties: {
-                        ...modified.inputSchema.properties,
-                        _confirmed: {
-                            type: "boolean",
-                            description: "Set to true to confirm execution of this approval-required tool.",
-                        },
-                    },
-                };
-            }
-            if (modified.inputSchema && typeof modified.inputSchema === "object") {
-                const properties = modified.inputSchema.properties && typeof modified.inputSchema.properties === "object"
-                    ? { ...modified.inputSchema.properties }
-                    : {};
-                if (!(JMESPATH_TOOL_ARGUMENT in properties)) {
-                    properties[JMESPATH_TOOL_ARGUMENT] = {
-                        type: "string",
-                        description: JMESPATH_TOOL_ARGUMENT_DESCRIPTION,
-                    };
-                    modified.inputSchema = { ...modified.inputSchema, properties };
-                }
-            }
-            return modified;
-        });
-        // <<< END: Remove $schema for Gemini compatibility >>>
         return {
-            tools, // return tool list with $schema removed
+            tools: getListedTools(filteredTools, listedToolsCache.revision),
         };
     });
     mcpServer.server.setRequestHandler(CallToolRequestSchema, async (request) => {
@@ -330,9 +279,7 @@ function createServer() {
                 (toolName === "download_release_asset" && !IS_REMOTE);
             const filtered = applyJmespathToToolResult(result, jmespathExpression, {
                 ...completionOptions,
-                maskValue: maskingEngine
-                    ? (value) => maskingEngine.maskValue(value)
-                    : undefined,
+                maskValue: maskingEngine ? (value) => maskingEngine.maskValue(value) : undefined,
             });
             const masked = maskingEngine
                 ? maskingEngine.maskToolResult(filtered, {
@@ -341,7 +288,7 @@ function createServer() {
                 : filtered;
             return compactMcpToolResult({
                 result: masked,
-                enabled: GITLAB_MCP_COMPACT_RESULTS,
+                enabled: shouldCompactToolResult(toolName, GITLAB_MCP_COMPACT_RESULTS, GITLAB_MCP_COMPACT_TOOL_NAMES),
                 maxChars: GITLAB_MCP_COMPACT_RESULT_CHARS,
                 toolName,
                 args: readOwnRecord(request.params.arguments),
@@ -356,7 +303,7 @@ function createServer() {
                 durationMs,
                 error: safeError instanceof Error ? safeError.message : String(safeError),
             }, `tool_call_error: ${toolName} (${durationMs}ms)`);
-            throw safeError;
+            return safeError;
         };
         try {
             const authData = (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH) && sessionId
@@ -418,25 +365,34 @@ function createServer() {
             if (isToolAllowedByPermissionMode(toolName) &&
                 !hiddenAndNotDenied &&
                 !filteredTools.some(t => t.name === toolName)) {
-                throw new Error(`Tool "${toolName}" is not available on this server`);
+                throw new Error(buildToolUnavailableMessage(toolName));
             }
             // Handle discover_tools meta-tool directly (needs access to mcpServer and filteredTools)
             if (toolName === "discover_tools") {
                 const category = request.params.arguments?.category?.trim()?.toLowerCase();
                 const currentToolNames = new Set(filteredTools.map(t => t.name));
+                const isNotActivatable = (name) => isSkippedByDiscoverActivation({
+                    allowedByPermissionMode: isToolAllowedByPermissionMode(name),
+                    deniedByRegex: GITLAB_DENIED_TOOLS_REGEX?.test(name) === true,
+                    hidden: hiddenToolSet.has(name),
+                    excludedBySlimProfile: isExcludedFromToolsetListing(name),
+                });
                 if (!category) {
-                    // List available categories with activation status
-                    const categories = TOOLSET_DEFINITIONS.map(def => ({
-                        id: def.id,
-                        toolCount: def.tools.size,
-                        active: [...def.tools].some(t => currentToolNames.has(t)),
-                        isDefault: def.isDefault,
-                    }));
+                    // Fully listed only. Partial overlap with `core` must stay inactive so
+                    // clients still call discover_tools to add the missing tools. Tools this
+                    // handler skips (slim profile, regex, permission mode, hidden) do not
+                    // keep a toolset inactive.
+                    const categories = listDiscoverableCategories(currentToolNames, isNotActivatable);
                     return logCompletion({
-                        content: [{
+                        content: [
+                            {
                                 type: "text",
-                                text: JSON.stringify({ categories, hint: "Call discover_tools with a category name to activate it" }),
-                            }],
+                                text: JSON.stringify({
+                                    categories,
+                                    hint: "Call discover_tools with a category name to activate it",
+                                }),
+                            },
+                        ],
                     });
                 }
                 if (!ALL_TOOLSET_IDS.has(category)) {
@@ -457,8 +413,8 @@ function createServer() {
                         isError: true,
                     });
                 }
-                // Check if already fully active
-                const alreadyActive = [...toolsetDef.tools].every(t => currentToolNames.has(t));
+                // Same predicate as the category listing `active` flag.
+                const alreadyActive = isToolsetFullyActive(toolsetDef.tools, currentToolNames, isNotActivatable);
                 if (alreadyActive) {
                     return logCompletion({
                         content: [
@@ -476,11 +432,7 @@ function createServer() {
                         continue;
                     if (currentToolNames.has(tool.name))
                         continue;
-                    if (!isToolAllowedByPermissionMode(tool.name))
-                        continue;
-                    if (GITLAB_DENIED_TOOLS_REGEX?.test(tool.name))
-                        continue;
-                    if (hiddenToolSet.has(tool.name))
+                    if (isNotActivatable(tool.name))
                         continue;
                     newTools.push(tool);
                 }
@@ -495,6 +447,7 @@ function createServer() {
                     });
                 }
                 filteredTools.push(...newTools);
+                listedToolsCache.revision += 1;
                 // Notify client that tool list has changed
                 try {
                     await mcpServer.server.sendToolListChanged();
@@ -505,14 +458,16 @@ function createServer() {
                 const addedNames = newTools.map(t => t.name);
                 logger.info({ event: "toolset_activated", category, toolCount: addedNames.length }, `Activated toolset: ${category} (+${addedNames.length} tools)`);
                 return logCompletion({
-                    content: [{
+                    content: [
+                        {
                             type: "text",
                             text: JSON.stringify({
                                 activated: category,
                                 addedTools: addedNames,
                                 totalTools: filteredTools.length,
                             }),
-                        }],
+                        },
+                    ],
                 });
             }
             // Check approve policy: tool is exposed but requires explicit confirmation
@@ -547,8 +502,20 @@ function createServer() {
             return logCompletion(result);
         }
         catch (error) {
-            logError(error);
-            throw error;
+            const isGitLabApiError = error instanceof GitLabApiError;
+            const safeError = logError(error);
+            if (isGitLabApiError) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: safeError instanceof Error ? safeError.message : String(safeError),
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+            throw safeError;
         }
     });
     return mcpServer;
@@ -557,7 +524,10 @@ function createServer() {
  * Validate configuration at startup
  */
 function isLoopbackBindHost(host) {
-    const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
+    const normalized = host
+        .trim()
+        .toLowerCase()
+        .replace(/^\[|\]$/g, "");
     const isIpv4Loopback = /^127(?:\.\d{1,3}){3}$/.test(normalized);
     return (normalized === "localhost" ||
         isIpv4Loopback ||
@@ -565,7 +535,10 @@ function isLoopbackBindHost(host) {
         normalized === "0:0:0:0:0:0:0:1");
 }
 function formatHostWithPort(host, port) {
-    const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
+    const normalized = host
+        .trim()
+        .toLowerCase()
+        .replace(/^\[|\]$/g, "");
     if (!normalized || normalized === "0.0.0.0" || normalized === "::")
         return null;
     if (normalized.includes(":"))
@@ -916,6 +889,12 @@ const hiddenToolSet = new Set((GITLAB_TOOL_POLICY_HIDDEN_RAW || "")
             logger.warn({ event: "unknown_approve_tool", name }, `GITLAB_TOOL_POLICY_APPROVE contains unknown tool: "${name}"`);
         }
     }
+    if (GITLAB_MCP_COMPACT_TOOL_NAMES.size > 0) {
+        const unknownCompactTools = [...GITLAB_MCP_COMPACT_TOOL_NAMES].filter(name => !knownToolNames.has(name));
+        if (unknownCompactTools.length > 0) {
+            logger.warn(`Unknown tool names in GITLAB_MCP_COMPACT_TOOLS (will be ignored): ${unknownCompactTools.join(", ")}`);
+        }
+    }
     for (const name of hiddenToolSet) {
         if (!knownToolNames.has(name)) {
             logger.warn({ event: "unknown_hidden_tool", name }, `GITLAB_TOOL_POLICY_HIDDEN contains unknown tool: "${name}"`);
@@ -1097,12 +1076,15 @@ function buildAuthHeaders() {
     // OAuth token takes priority over PAT when both are set.
     // NOTE: Changed in PR #400 — previously GITLAB_JOB_TOKEN had highest priority.
     // If both GITLAB_PERSONAL_ACCESS_TOKEN and GITLAB_JOB_TOKEN are set, PAT wins.
-    const token = OAUTH_ACCESS_TOKEN || GITLAB_PERSONAL_ACCESS_TOKEN;
-    if (IS_OLD && token) {
-        return { "Private-Token": String(token) };
+    // OAuth tokens always travel as `Authorization: Bearer`, even with GITLAB_IS_OLD: the HTTP
+    // client strips `Authorization` on cross-origin redirects but not `Private-Token`.
+    if (OAUTH_ACCESS_TOKEN) {
+        return { Authorization: `Bearer ${OAUTH_ACCESS_TOKEN}` };
     }
-    if (token) {
-        return { Authorization: `Bearer ${token}` };
+    if (GITLAB_PERSONAL_ACCESS_TOKEN) {
+        return IS_OLD
+            ? { "Private-Token": String(GITLAB_PERSONAL_ACCESS_TOKEN) }
+            : { Authorization: `Bearer ${GITLAB_PERSONAL_ACCESS_TOKEN}` };
     }
     // Fall back to CI job token
     if (GITLAB_JOB_TOKEN) {
@@ -1212,6 +1194,13 @@ const downloadRedirectOptions = () => ({
 const enabledToolsets = parseEnabledToolsets(GITLAB_TOOLSETS_RAW);
 const individuallyEnabledTools = parseIndividualTools(GITLAB_TOOLS_RAW);
 const featureFlagOverrides = buildFeatureFlagOverrides();
+const applySlimProfile = shouldApplySlimToolProfile(GITLAB_TOOL_PROFILE, GITLAB_TOOLSETS_RAW);
+if (GITLAB_TOOL_PROFILE === "slim" && !applySlimProfile) {
+    logger.warn("GITLAB_TOOL_PROFILE=slim is ignored because GITLAB_TOOLSETS is set");
+}
+function isExcludedFromToolsetListing(toolName) {
+    return isExcludedBySlimProfile(toolName, applySlimProfile, individuallyEnabledTools);
+}
 // Warn about potentially confusing configuration
 if (GITLAB_TOOLSETS_RAW && (USE_PIPELINE || USE_MILESTONE || USE_GITLAB_WIKI)) {
     logger.warn("GITLAB_TOOLSETS is set alongside legacy flags (USE_PIPELINE, USE_MILESTONE, USE_GITLAB_WIKI). " +
@@ -1325,6 +1314,12 @@ if (!isCliInvocation(process.argv) &&
     logger.info("Either set GITLAB_PERSONAL_ACCESS_TOKEN or enable OAuth with GITLAB_USE_OAUTH=true");
     process.exit(1);
 }
+class GitLabApiError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "GitLabApiError";
+    }
+}
 /**
  * Utility function for handling GitLab API errors
  * API 에러 처리를 위한 유틸리티 함수 (Utility function for handling API errors)
@@ -1341,12 +1336,12 @@ async function handleGitLabError(response) {
             // before the common tool-call boundary returns/logs it.
             logger.error("GitLab API Rate Limit Exceeded");
             logger.error("User API Key Rate limit exceeded. Please try again later.");
-            const error = new Error(`GitLab API Rate Limit Exceeded: ${errorBody}`);
+            const error = new GitLabApiError(`GitLab API Rate Limit Exceeded: ${errorBody}`);
             throw error;
         }
         else {
             // Handle other API errors
-            const error = new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorBody}`);
+            const error = new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorBody}`);
             throw error;
         }
     }
@@ -1411,7 +1406,7 @@ async function forkProject(projectId, namespace) {
     });
     // Handle case where project already exists
     if (response.status === 409) {
-        throw new Error("Project already exists in the target namespace");
+        throw new GitLabApiError("Project already exists in the target namespace");
     }
     await handleGitLabError(response);
     const data = await response.json();
@@ -1482,7 +1477,7 @@ async function getFileContents(projectId, filePath, ref) {
     });
     // Handle file not found
     if (response.status === 404) {
-        throw new Error(`File not found: ${filePath}`);
+        throw new GitLabApiError(`File not found: ${filePath}`);
     }
     await handleGitLabError(response);
     const data = await response.json();
@@ -1515,7 +1510,7 @@ async function createIssue(projectId, options) {
     // Handle bad request
     if (response.status === 400) {
         const errorBody = await response.text();
-        throw new Error(`Invalid request: ${errorBody}`);
+        throw new GitLabApiError(`Invalid request: ${errorBody}`);
     }
     await handleGitLabError(response);
     const data = await response.json();
@@ -1751,7 +1746,7 @@ async function executeGraphQL(query, variables = {}) {
     });
     if (!response.ok) {
         const errorBody = await response.text();
-        throw new Error(`GraphQL request failed (${response.status}): ${errorBody}`);
+        throw new GitLabApiError(`GraphQL request failed (${response.status}): ${errorBody}`);
     }
     const json = await response.json();
     if (json.errors && json.errors.length > 0) {
@@ -1790,7 +1785,9 @@ async function resolveNamesToIds(projectPath, namespaceKind, labelNames, usernam
     // One alias per label — exact title match via the `title` argument, includes ancestor
     // group labels, single round trip with no pagination needed.
     const varDefs = labelNames.map((_, i) => `$l${i}: String!`).join(", ");
-    const aliases = labelNames.map((_, i) => `l${i}: labels(title: $l${i}, includeAncestorGroups: true, first: 1) { nodes { id } }`).join(" ");
+    const aliases = labelNames
+        .map((_, i) => `l${i}: labels(title: $l${i}, includeAncestorGroups: true, first: 1) { nodes { id } }`)
+        .join(" ");
     const rootField = namespaceKind === "group" ? "group" : "project";
     const data = await executeGraphQL(`query($path: ID!, $usernames: [String!]!${varDefs ? `, ${varDefs}` : ""}) {
       ${rootField}(fullPath: $path) { ${aliases || "__typename"} }
@@ -3200,11 +3197,11 @@ async function createMergeRequest(projectId, options) {
     });
     if (response.status === 400) {
         const errorBody = await response.text();
-        throw new Error(`Invalid request: ${errorBody}`);
+        throw new GitLabApiError(`Invalid request: ${errorBody}`);
     }
     if (!response.ok) {
         const errorBody = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorBody}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorBody}`);
     }
     const data = await response.json();
     return GitLabMergeRequestSchema.parse(data);
@@ -3292,7 +3289,7 @@ async function deleteMergeRequestDiscussionNote(projectId, mergeRequestIid, disc
     });
     if (!response.ok) {
         const errorText = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
     }
 }
 /**
@@ -3385,7 +3382,9 @@ async function updateIssueNote(projectId, issueIid, discussionId, noteId, body,
 async function createIssueNote(projectId, issueIid, discussionId, body, createdAt) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     const basePath = `${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`;
-    const url = new URL(discussionId ? `${basePath}/discussions/${encodeGitLabPathSegment(discussionId)}/notes` : `${basePath}/notes`);
+    const url = new URL(discussionId
+        ? `${basePath}/discussions/${encodeGitLabPathSegment(discussionId)}/notes`
+        : `${basePath}/notes`);
     const payload = { body };
     if (createdAt) {
         payload.created_at = createdAt;
@@ -3452,7 +3451,7 @@ async function deleteMergeRequestNote(projectId, mergeRequestIid, noteId) {
     });
     if (!response.ok) {
         const errorText = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
     }
 }
 // --- Emoji Reactions (REST) ---
@@ -3623,7 +3622,7 @@ async function createOrUpdateFile(projectId, filePath, content, commitMessage, b
     });
     if (!response.ok) {
         const errorBody = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorBody}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorBody}`);
     }
     const data = await response.json();
     return GitLabCreateUpdateFileResponseSchema.parse(data);
@@ -3652,11 +3651,11 @@ async function createCommit(projectId, message, branch, actions) {
     });
     if (response.status === 400) {
         const errorBody = await response.text();
-        throw new Error(`Invalid request: ${errorBody}`);
+        throw new GitLabApiError(`Invalid request: ${errorBody}`);
     }
     if (!response.ok) {
         const errorBody = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorBody}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorBody}`);
     }
     const data = await response.json();
     return GitLabCommitSchema.parse(data);
@@ -3682,7 +3681,7 @@ async function searchProjects(query, page = 1, perPage = 20) {
     });
     if (!response.ok) {
         const errorBody = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorBody}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorBody}`);
     }
     const unfiltered = (await response.json());
     const projects = filterProjectsByAllowlist(unfiltered);
@@ -3769,7 +3768,7 @@ async function createRepository(options) {
     });
     if (!response.ok) {
         const errorBody = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorBody}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorBody}`);
     }
     const data = await response.json();
     return GitLabRepositorySchema.parse(data);
@@ -4195,7 +4194,7 @@ async function getBranchDiffs(projectId, from, to, straight) {
     });
     if (!response.ok) {
         const errorBody = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorBody}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorBody}`);
     }
     const data = await response.json();
     return GitLabCompareResultSchema.parse(data);
@@ -4428,7 +4427,7 @@ noteableIid, body) {
     });
     if (!response.ok) {
         const errorText = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
     }
     return await response.json();
 }
@@ -4443,7 +4442,7 @@ async function getDraftNote(project_id, merge_request_iid, draft_note_id) {
     const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/merge_requests/${encodeGitLabPathSegment(merge_request_iid)}/draft_notes/${encodeGitLabPathSegment(draft_note_id)}`, { ...getFetchConfig() });
     if (!response.ok) {
         const errorText = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
     }
     const data = await response.json();
     return GitLabDraftNoteSchema.parse(data);
@@ -4457,7 +4456,7 @@ async function listDraftNotes(projectId, mergeRequestIid) {
     });
     if (!response.ok) {
         const errorText = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
     }
     const data = await response.json();
     return z.array(GitLabDraftNoteSchema).parse(data);
@@ -4492,7 +4491,7 @@ async function createDraftNote(projectId, mergeRequestIid, body, inReplyToDiscus
     });
     if (!response.ok) {
         const errorText = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
     }
     const data = await response.json();
     return GitLabDraftNoteSchema.parse(data);
@@ -4527,7 +4526,7 @@ async function updateDraftNote(projectId, mergeRequestIid, draftNoteId, body, po
     });
     if (!response.ok) {
         const errorText = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
     }
     const data = await response.json();
     return GitLabDraftNoteSchema.parse(data);
@@ -4548,7 +4547,7 @@ async function deleteDraftNote(projectId, mergeRequestIid, draftNoteId) {
     });
     if (!response.ok) {
         const errorText = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
     }
 }
 /**
@@ -4567,7 +4566,7 @@ async function publishDraftNote(projectId, mergeRequestIid, draftNoteId) {
     });
     if (!response.ok) {
         const errorText = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
     }
     // Handle empty response (204 No Content) or successful response
     const responseText = await response.text();
@@ -4648,7 +4647,7 @@ async function bulkPublishDraftNotes(projectId, mergeRequestIid, options = {}) {
     });
     if (!response.ok) {
         const errorText = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
     }
     // Handle empty response (204 No Content) or successful response
     const responseText = await response.text();
@@ -4679,7 +4678,7 @@ async function resolveMergeRequestThread(projectId, mergeRequestIid, discussionI
     });
     if (!response.ok) {
         const errorText = await response.text();
-        throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
+        throw new GitLabApiError(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
     }
 }
 /**
@@ -5271,7 +5270,7 @@ async function getPipeline(projectId, pipelineId, signal) {
         signal,
     });
     if (response.status === 404) {
-        throw new Error(`Pipeline not found`);
+        throw new GitLabApiError(`Pipeline not found`);
     }
     await handleGitLabError(response);
     const data = await response.json();
@@ -5344,7 +5343,7 @@ async function getDeployment(projectId, deploymentId) {
         ...getFetchConfig(),
     });
     if (response.status === 404) {
-        throw new Error(`Deployment not found`);
+        throw new GitLabApiError(`Deployment not found`);
     }
     await handleGitLabError(response);
     const data = await response.json();
@@ -5358,7 +5357,8 @@ async function deploymentRequest(projectId, path = "", method = "GET", body, que
             url.searchParams.set(key, String(value));
     }
     const response = await fetch(url.toString(), {
-        ...getFetchConfig(), method,
+        ...getFetchConfig(),
+        method,
         body: body === undefined ? undefined : JSON.stringify(body),
     });
     await handleGitLabError(response);
@@ -5396,7 +5396,7 @@ async function getEnvironment(projectId, environmentId) {
         ...getFetchConfig(),
     });
     if (response.status === 404) {
-        throw new Error(`Environment not found`);
+        throw new GitLabApiError(`Environment not found`);
     }
     await handleGitLabError(response);
     const data = await response.json();
@@ -5408,7 +5408,11 @@ async function environmentRequest(projectId, path, method, body, query) {
     for (const [key, value] of Object.entries(query ?? {}))
         if (value !== undefined)
             url.searchParams.set(key, String(value));
-    const response = await fetch(url.toString(), { ...getFetchConfig(), method, body: body === undefined ? undefined : JSON.stringify(body) });
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+        method,
+        body: body === undefined ? undefined : JSON.stringify(body),
+    });
     await handleGitLabError(response);
     return response.status === 204 ? { success: true } : response.json();
 }
@@ -5428,7 +5432,11 @@ async function triggerPipeline(projectId, token, ref, variables, inputs) {
         body.variables = variables;
     if (inputs)
         body.inputs = inputs;
-    const response = await fetch(url.toString(), { ...getFetchConfig(), method: "POST", body: Object.keys(body).length ? JSON.stringify(body) : undefined });
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+        method: "POST",
+        body: Object.keys(body).length ? JSON.stringify(body) : undefined,
+    });
     await handleGitLabError(response);
     return response.json();
 }
@@ -5449,7 +5457,7 @@ async function listPipelineJobs(projectId, pipelineId, options = {}) {
         ...getFetchConfig(),
     });
     if (response.status === 404) {
-        throw new Error(`Pipeline not found`);
+        throw new GitLabApiError(`Pipeline not found`);
     }
     await handleGitLabError(response);
     const data = await response.json();
@@ -5472,7 +5480,7 @@ async function listPipelineTriggerJobs(projectId, pipelineId, options = {}) {
         ...getFetchConfig(),
     });
     if (response.status === 404) {
-        throw new Error(`Pipeline not found`);
+        throw new GitLabApiError(`Pipeline not found`);
     }
     await handleGitLabError(response);
     const data = await response.json();
@@ -5486,7 +5494,7 @@ async function getPipelineJob(projectId, jobId, signal) {
         signal,
     });
     if (response.status === 404) {
-        throw new Error(`Job not found`);
+        throw new GitLabApiError(`Job not found`);
     }
     await handleGitLabError(response);
     const data = await response.json();
@@ -5514,7 +5522,7 @@ async function getPipelineJobOutput(projectId, jobId, limit, offset) {
         },
     });
     if (response.status === 404) {
-        throw new Error(`Job trace not found or job is not finished yet`);
+        throw new GitLabApiError(`Job trace not found or job is not finished yet`);
     }
     await handleGitLabError(response);
     const fullTrace = await response.text();
@@ -5576,7 +5584,7 @@ async function listJobArtifacts(projectId, jobId, options = {}) {
         ...getFetchConfig(),
     });
     if (response.status === 404) {
-        throw new Error(`Job artifacts not found. The job may not have produced artifacts or the job ID is invalid.`);
+        throw new GitLabApiError(`Job artifacts not found. The job may not have produced artifacts or the job ID is invalid.`);
     }
     await handleGitLabError(response);
     const data = await response.json();
@@ -5596,7 +5604,7 @@ async function downloadJobArtifacts(projectId, jobId, localPath) {
     const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts`);
     const response = await fetchWithValidatedRedirects(url.toString(), downloadRedirectOptions());
     if (response.status === 404) {
-        throw new Error(`Job artifacts not found. The job may not have produced artifacts or the job ID is invalid.`);
+        throw new GitLabApiError(`Job artifacts not found. The job may not have produced artifacts or the job ID is invalid.`);
     }
     await handleGitLabError(response);
     const filename = `artifacts_job_${encodeGitLabPathSegment(jobId)}.zip`;
@@ -5622,7 +5630,7 @@ async function getJobArtifactFile(projectId, jobId, artifactPath) {
     const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts/${encodedArtifactPath}`);
     const response = await fetchWithValidatedRedirects(url.toString(), downloadRedirectOptions());
     if (response.status === 404) {
-        throw new Error(`Artifact file not found: ${artifactPath}`);
+        throw new GitLabApiError(`Artifact file not found: ${artifactPath}`);
     }
     await handleGitLabError(response);
     return await response.text();
@@ -6038,10 +6046,10 @@ async function getRepositoryTree(options) {
         queryParams.append("pagination", options.pagination);
     const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(options.project_id))}/repository/tree?${queryParams.toString()}`, { ...getFetchConfig() });
     if (response.status === 404) {
-        throw new Error("Repository or path not found");
+        throw new GitLabApiError("Repository or path not found");
     }
     if (!response.ok) {
-        throw new Error(`Failed to get repository tree: ${response.statusText}`);
+        throw new GitLabApiError(`Failed to get repository tree: ${response.statusText}`);
     }
     const data = await response.json();
     const items = z.array(GitLabTreeItemSchema).parse(data);
@@ -7999,8 +8007,7 @@ async function handleToolCall(params) {
             }
             case "push_files": {
                 const args = PushFilesSchema.parse(params.arguments);
-                if (GITLAB_PERMISSION_MODE === "modify" &&
-                    fileOperationsIncludeDeleteOrMove(args.files)) {
+                if (GITLAB_PERMISSION_MODE === "modify" && fileOperationsIncludeDeleteOrMove(args.files)) {
                     throw new Error("push_files does not allow delete or move actions in modify mode");
                 }
                 const result = await createCommit(args.project_id, args.commit_message, args.branch, args.files.map(f => ({
@@ -8871,7 +8878,14 @@ async function handleToolCall(params) {
                 const args = DeleteWorkItemEmojiReactionSchema.parse(params.arguments);
                 const { workItemGID } = await resolveWorkItemGID(args.project_id, args.iid);
                 const result = await removeGraphQLAwardEmoji(workItemGID, args.name);
-                return { content: [{ type: "text", text: JSON.stringify(result ?? { status: "success", message: "Work item emoji reaction removed" }) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(result ?? { status: "success", message: "Work item emoji reaction removed" }),
+                        },
+                    ],
+                };
             }
             case "create_work_item_note_emoji_reaction": {
                 const args = CreateWorkItemNoteEmojiReactionSchema.parse(params.arguments);
@@ -8881,7 +8895,14 @@ async function handleToolCall(params) {
             case "delete_work_item_note_emoji_reaction": {
                 const args = DeleteWorkItemNoteEmojiReactionSchema.parse(params.arguments);
                 const result = await removeGraphQLAwardEmoji(args.note_id, args.name);
-                return { content: [{ type: "text", text: JSON.stringify(result ?? { status: "success", message: "Work item note emoji reaction removed" }) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(result ?? { status: "success", message: "Work item note emoji reaction removed" }),
+                        },
+                    ],
+                };
             }
             case "get_timeline_events": {
                 const args = GetTimelineEventsSchema.parse(params.arguments);
@@ -9084,23 +9105,55 @@ async function handleToolCall(params) {
             }
             case "get_pipeline_variables": {
                 const { project_id, pipeline_id, page, per_page } = GetPipelineVariablesSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await getPipelineVariables(project_id, pipeline_id, page, per_page)) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await getPipelineVariables(project_id, pipeline_id, page, per_page)),
+                        },
+                    ],
+                };
             }
             case "get_pipeline_test_report": {
                 const { project_id, pipeline_id, page, per_page } = PipelineReportSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await getPipelineReport(project_id, pipeline_id, false, page, per_page)) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await getPipelineReport(project_id, pipeline_id, false, page, per_page)),
+                        },
+                    ],
+                };
             }
             case "get_pipeline_test_report_summary": {
                 const { project_id, pipeline_id, page, per_page } = PipelineReportSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await getPipelineReport(project_id, pipeline_id, true, page, per_page)) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await getPipelineReport(project_id, pipeline_id, true, page, per_page)),
+                        },
+                    ],
+                };
             }
             case "delete_pipeline": {
                 const { project_id, pipeline_id } = DeletePipelineSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await deletePipeline(project_id, pipeline_id)) }] };
+                return {
+                    content: [
+                        { type: "text", text: JSON.stringify(await deletePipeline(project_id, pipeline_id)) },
+                    ],
+                };
             }
             case "update_pipeline_metadata": {
                 const { project_id, pipeline_id, name } = UpdatePipelineMetadataSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await updatePipelineMetadata(project_id, pipeline_id, name)) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await updatePipelineMetadata(project_id, pipeline_id, name)),
+                        },
+                    ],
+                };
             }
             case "list_deployments": {
                 const args = ListDeploymentsSchema.parse(params.arguments);
@@ -9119,23 +9172,58 @@ async function handleToolCall(params) {
             }
             case "create_deployment": {
                 const { project_id, ...body } = CreateDeploymentSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await deploymentRequest(project_id, "", "POST", body)) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await deploymentRequest(project_id, "", "POST", body)),
+                        },
+                    ],
+                };
             }
             case "update_deployment": {
                 const { project_id, deployment_id, ...body } = UpdateDeploymentSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await deploymentRequest(project_id, `/${encodeGitLabPathSegment(deployment_id)}`, "PUT", body)) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await deploymentRequest(project_id, `/${encodeGitLabPathSegment(deployment_id)}`, "PUT", body)),
+                        },
+                    ],
+                };
             }
             case "delete_deployment": {
                 const { project_id, deployment_id } = GetDeploymentSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await deploymentRequest(project_id, `/${encodeGitLabPathSegment(deployment_id)}`, "DELETE")) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await deploymentRequest(project_id, `/${encodeGitLabPathSegment(deployment_id)}`, "DELETE")),
+                        },
+                    ],
+                };
             }
             case "list_deployment_merge_requests": {
                 const { project_id, deployment_id, ...query } = ListDeploymentMergeRequestsSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await deploymentRequest(project_id, `/${encodeGitLabPathSegment(deployment_id)}/merge_requests`, "GET", undefined, query)) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await deploymentRequest(project_id, `/${encodeGitLabPathSegment(deployment_id)}/merge_requests`, "GET", undefined, query)),
+                        },
+                    ],
+                };
             }
             case "approve_deployment": {
                 const { project_id, deployment_id, ...body } = DeploymentApprovalSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await deploymentRequest(project_id, `/${encodeGitLabPathSegment(deployment_id)}/approval`, "POST", body)) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await deploymentRequest(project_id, `/${encodeGitLabPathSegment(deployment_id)}/approval`, "POST", body)),
+                        },
+                    ],
+                };
             }
             case "list_environments": {
                 const args = ListEnvironmentsSchema.parse(params.arguments);
@@ -9154,47 +9242,124 @@ async function handleToolCall(params) {
             }
             case "update_environment": {
                 const { project_id, environment_id, ...body } = UpdateEnvironmentSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await environmentRequest(project_id, `/${encodeGitLabPathSegment(environment_id)}`, "PUT", body)) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await environmentRequest(project_id, `/${encodeGitLabPathSegment(environment_id)}`, "PUT", body)),
+                        },
+                    ],
+                };
             }
             case "delete_environment": {
                 const { project_id, environment_id } = GetEnvironmentSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await environmentRequest(project_id, `/${encodeGitLabPathSegment(environment_id)}`, "DELETE")) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await environmentRequest(project_id, `/${encodeGitLabPathSegment(environment_id)}`, "DELETE")),
+                        },
+                    ],
+                };
             }
             case "stop_environment": {
                 const { project_id, environment_id, force } = StopEnvironmentSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await environmentRequest(project_id, `/${encodeGitLabPathSegment(environment_id)}/stop`, "POST", undefined, { force })) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await environmentRequest(project_id, `/${encodeGitLabPathSegment(environment_id)}/stop`, "POST", undefined, { force })),
+                        },
+                    ],
+                };
             }
             case "stop_stale_environments": {
                 const { project_id, before } = StopStaleEnvironmentsSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await environmentRequest(project_id, "/stop_stale", "POST", undefined, { before })) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await environmentRequest(project_id, "/stop_stale", "POST", undefined, { before })),
+                        },
+                    ],
+                };
             }
             case "delete_review_app_environments": {
                 const { project_id, ...query } = DeleteReviewAppEnvironmentsSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await environmentRequest(project_id, "/review_apps", "DELETE", undefined, query)) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await environmentRequest(project_id, "/review_apps", "DELETE", undefined, query)),
+                        },
+                    ],
+                };
             }
             case "list_pipeline_triggers": {
                 const { project_id } = ListPipelineTriggersSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(redactSensitiveGitLabFields(await pipelineTriggerRequest(project_id))) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(redactSensitiveGitLabFields(await pipelineTriggerRequest(project_id))),
+                        },
+                    ],
+                };
             }
             case "get_pipeline_trigger": {
                 const { project_id, trigger_id } = PipelineTriggerIdSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(redactSensitiveGitLabFields(await pipelineTriggerRequest(project_id, `/${encodeGitLabPathSegment(trigger_id)}`))) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(redactSensitiveGitLabFields(await pipelineTriggerRequest(project_id, `/${encodeGitLabPathSegment(trigger_id)}`))),
+                        },
+                    ],
+                };
             }
             case "create_pipeline_trigger": {
                 const { project_id, ...body } = CreatePipelineTriggerSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await pipelineTriggerRequest(project_id, "", "POST", body)) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await pipelineTriggerRequest(project_id, "", "POST", body)),
+                        },
+                    ],
+                };
             }
             case "update_pipeline_trigger": {
                 const { project_id, trigger_id, ...body } = UpdatePipelineTriggerSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(redactSensitiveGitLabFields(await pipelineTriggerRequest(project_id, `/${encodeGitLabPathSegment(trigger_id)}`, "PUT", body))) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(redactSensitiveGitLabFields(await pipelineTriggerRequest(project_id, `/${encodeGitLabPathSegment(trigger_id)}`, "PUT", body))),
+                        },
+                    ],
+                };
             }
             case "delete_pipeline_trigger": {
                 const { project_id, trigger_id } = PipelineTriggerIdSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await pipelineTriggerRequest(project_id, `/${encodeGitLabPathSegment(trigger_id)}`, "DELETE")) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await pipelineTriggerRequest(project_id, `/${encodeGitLabPathSegment(trigger_id)}`, "DELETE")),
+                        },
+                    ],
+                };
             }
             case "trigger_pipeline": {
                 const { project_id, token, ref, variables, inputs } = TriggerPipelineSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await triggerPipeline(project_id, token, ref, variables, inputs)) }] };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(await triggerPipeline(project_id, token, ref, variables, inputs)),
+                        },
+                    ],
+                };
             }
             case "list_pipeline_jobs": {
                 const { project_id, pipeline_id, ...options } = ListPipelineJobsSchema.parse(params.arguments);
@@ -9561,7 +9726,7 @@ async function handleToolCall(params) {
                 };
             }
             case "play_pipeline_jobs": {
-                const { project_id, job_ids, job_variables_attributes, timeout_seconds, poll_interval_seconds } = PlayPipelineJobsSchema.parse(params.arguments);
+                const { project_id, job_ids, job_variables_attributes, timeout_seconds, poll_interval_seconds, } = PlayPipelineJobsSchema.parse(params.arguments);
                 const jobs = await playPipelineJobs(project_id, job_ids, job_variables_attributes, timeout_seconds, poll_interval_seconds);
                 return { content: [{ type: "text", text: JSON.stringify(jobs) }] };
             }
@@ -9591,7 +9756,11 @@ async function handleToolCall(params) {
             }
             case "erase_pipeline_job": {
                 const { project_id, job_id } = ErasePipelineJobSchema.parse(params.arguments);
-                return { content: [{ type: "text", text: JSON.stringify(await erasePipelineJob(project_id, job_id)) }] };
+                return {
+                    content: [
+                        { type: "text", text: JSON.stringify(await erasePipelineJob(project_id, job_id)) },
+                    ],
+                };
             }
             case "wait_for_pipeline": {
                 const { project_id, pipeline_id, timeout_seconds, poll_interval_seconds } = WaitForPipelineSchema.parse(params.arguments);
@@ -9623,7 +9792,15 @@ async function handleToolCall(params) {
                     }
                     const downloadUrl = buildDownloadUrl("job-artifacts", { project_id, job_id });
                     return {
-                        content: [{ type: "text", text: JSON.stringify({ download_url: downloadUrl, filename: `artifacts_job_${job_id}.zip` }) }],
+                        content: [
+                            {
+                                type: "text",
+                                text: JSON.stringify({
+                                    download_url: downloadUrl,
+                                    filename: `artifacts_job_${job_id}.zip`,
+                                }),
+                            },
+                        ],
                     };
                 }
                 const filePath = await downloadJobArtifacts(project_id, job_id, local_path);
@@ -10126,7 +10303,12 @@ async function handleToolCall(params) {
                         filename: args.filename,
                     });
                     return {
-                        content: [{ type: "text", text: JSON.stringify({ download_url: downloadUrl, filename: args.filename }) }],
+                        content: [
+                            {
+                                type: "text",
+                                text: JSON.stringify({ download_url: downloadUrl, filename: args.filename }),
+                            },
+                        ],
                     };
                 }
                 const result = await downloadAttachment(args.project_id, args.secret, args.filename, args.local_path);
@@ -10232,7 +10414,15 @@ async function handleToolCall(params) {
                         direct_asset_path: args.direct_asset_path,
                     });
                     return {
-                        content: [{ type: "text", text: JSON.stringify({ download_url: downloadUrl, filename: args.direct_asset_path.split("/").pop() || args.direct_asset_path }) }],
+                        content: [
+                            {
+                                type: "text",
+                                text: JSON.stringify({
+                                    download_url: downloadUrl,
+                                    filename: args.direct_asset_path.split("/").pop() || args.direct_asset_path,
+                                }),
+                            },
+                        ],
                     };
                 }
                 const assetContent = await downloadReleaseAsset(args.project_id, args.tag_name, args.direct_asset_path);
@@ -10423,9 +10613,7 @@ async function handleToolCall(params) {
                     const jobResponse = await fetch(jobUrl.toString(), getFetchConfig());
                     authenticated = jobResponse.ok;
                 }
-                const versionMetadata = authenticated
-                    ? await fetchGitLabVersionMetadata()
-                    : null;
+                const versionMetadata = authenticated ? await fetchGitLabVersionMetadata() : null;
                 return {
                     content: [
                         {
@@ -10488,7 +10676,9 @@ async function handleToolCall(params) {
                 });
                 await handleGitLabError(response);
                 return {
-                    content: [{ type: "text", text: JSON.stringify({ status: "deleted", branch: args.branch_name }) }],
+                    content: [
+                        { type: "text", text: JSON.stringify({ status: "deleted", branch: args.branch_name }) },
+                    ],
                 };
             }
             case "list_protected_branches": {
@@ -10563,7 +10753,12 @@ async function handleToolCall(params) {
                 });
                 await handleGitLabError(response);
                 return {
-                    content: [{ type: "text", text: JSON.stringify({ status: "unprotected", branch: args.branch_name }) }],
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({ status: "unprotected", branch: args.branch_name }),
+                        },
+                    ],
                 };
             }
             case "update_default_branch": {
@@ -10579,7 +10774,16 @@ async function handleToolCall(params) {
                 await handleGitLabError(response);
                 const data = await response.json();
                 return {
-                    content: [{ type: "text", text: JSON.stringify({ status: "updated", default_branch: args.default_branch, project: data }) }],
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                status: "updated",
+                                default_branch: args.default_branch,
+                                project: data,
+                            }),
+                        },
+                    ],
                 };
             }
             default:
@@ -10634,6 +10838,7 @@ function buildDownloadProxyDeps() {
  * Start server with traditional SSE transport
  */
 async function startSSEServer() {
+    const { express, rateLimit, ipKeyGenerator, SSEServerTransport } = await loadRemoteHttpStack();
     const app = express();
     const sseAuthToken = getConfig("sse-auth-token", "SSE_AUTH_TOKEN");
     if (MCP_TRUST_PROXY) {
@@ -10670,7 +10875,8 @@ async function startSSEServer() {
         const host = req.headers.host;
         const forwardedHost = MCP_TRUST_PROXY ? getForwardedRequestHost(req, true) : undefined;
         const requestHosts = [host, forwardedHost].filter((value) => Boolean(value));
-        if (requestHosts.length === 0 || !requestHosts.some(requestHost => effectiveHosts.has(requestHost))) {
+        if (requestHosts.length === 0 ||
+            !requestHosts.some(requestHost => effectiveHosts.has(requestHost))) {
             res.status(403).json({ error: "Invalid Host header" });
             return;
         }
@@ -10845,6 +11051,7 @@ async function startSSEServer() {
  * Start server with Streamable HTTP transport
  */
 async function startStreamableHTTPServer() {
+    const { express, rateLimit, ipKeyGenerator, StreamableHTTPServerTransport, mcpAuthRouter, requireBearerAuth, } = await loadRemoteHttpStack();
     const app = express();
     // Session IDs are untrusted map keys. A null prototype prevents inherited
     // names such as "constructor" from masquerading as live transports.
@@ -11377,9 +11584,7 @@ async function startStreamableHTTPServer() {
         // ipKeyGenerator for correct IPv6 subnet handling.
         const rateLimitOptions = { keyGenerator: mcpRateLimitKeyGenerator };
         const parsedRegisterLimit = Number(process.env.OAUTH_REGISTER_RATE_LIMIT_PER_HOUR);
-        const OAUTH_REGISTER_RATE_LIMIT_PER_HOUR = Number.isInteger(parsedRegisterLimit) && parsedRegisterLimit >= 1
-            ? parsedRegisterLimit
-            : 20;
+        const OAUTH_REGISTER_RATE_LIMIT_PER_HOUR = Number.isInteger(parsedRegisterLimit) && parsedRegisterLimit >= 1 ? parsedRegisterLimit : 20;
         const clientRegistrationRateLimitOptions = {
             ...rateLimitOptions,
             windowMs: 60 * 60 * 1000, // 1 hour
@@ -11479,9 +11684,7 @@ async function startStreamableHTTPServer() {
             ? staticMcpBearerAuth
             : (_req, _res, next) => next();
     const rejectUnknownStatefulSession = (req, res, next) => {
-        const usesStatelessSessions = OAUTH_STATELESS_MODE &&
-            STATELESS_MATERIAL &&
-            (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH);
+        const usesStatelessSessions = OAUTH_STATELESS_MODE && STATELESS_MATERIAL && (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH);
         const sessionId = readMcpSessionIdHeader(req);
         if (!usesStatelessSessions && sessionId && !streamableTransports[sessionId]) {
             res.status(404).json({ error: "Session not found" });
@@ -11499,7 +11702,9 @@ async function startStreamableHTTPServer() {
         // entirely and derive the session auth from either the current request
         // headers (init) or a sealed Mcp-Session-Id (subsequent requests).
         // Rate limiting is disabled here because there is no shared counter.
-        if (OAUTH_STATELESS_MODE && STATELESS_MATERIAL && (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH)) {
+        if (OAUTH_STATELESS_MODE &&
+            STATELESS_MATERIAL &&
+            (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH)) {
             await handleStatelessMcpRequest(req, res, STATELESS_MATERIAL, OAUTH_STATELESS_SESSION_TTL_SECONDS);
             return;
         }
@@ -11780,7 +11985,9 @@ async function startStreamableHTTPServer() {
             });
             return;
         }
-        if (OAUTH_STATELESS_MODE && STATELESS_MATERIAL && (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH)) {
+        if (OAUTH_STATELESS_MODE &&
+            STATELESS_MATERIAL &&
+            (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH)) {
             res.setHeader("Allow", "POST");
             res.status(405).json({
                 error: "Method Not Allowed",
@@ -11987,6 +12194,22 @@ async function initializeServerByTransportMode(mode) {
         }
     }
 }
+/**
+ * Construct the OAuth client when OAuth is enabled. No network: the token is
+ * acquired lazily on the first tool call via ensureValidOAuthToken, which
+ * avoids blocking startup and opening a browser on transient boot-time errors.
+ * Shared by the MCP server and the human CLI.
+ */
+function initOAuthClient() {
+    if (!USE_OAUTH) {
+        return;
+    }
+    if (isCleartextRemoteUrl(GITLAB_API_URL)) {
+        throw new Error(`Refusing to send OAuth tokens over cleartext HTTP to ${GITLAB_API_URL}. ` +
+            "Use an https:// GITLAB_API_URL (http:// is only allowed for localhost).");
+    }
+    oauthClient = createGitLabOAuthClient(GITLAB_API_URL.replace(/\/api\/v4$/, ""));
+}
 /**
  * Initialize and run the server
  * Main entry point for server startup
@@ -11999,12 +12222,7 @@ async function runServer() {
         if (USE_OAUTH) {
             logger.info("Using OAuth authentication...");
             try {
-                const gitlabBaseUrl = GITLAB_API_URL.replace(/\/api\/v4$/, "");
-                // Construct the client synchronously (no network). The token is
-                // acquired lazily on the first tool call via ensureValidOAuthToken,
-                // by which point the network is ready. This avoids blocking startup
-                // and avoids opening a browser on transient boot-time network errors.
-                oauthClient = createGitLabOAuthClient(gitlabBaseUrl);
+                initOAuthClient();
                 logger.info("OAuth enabled; token acquired lazily on first use.");
             }
             catch (error) {
@@ -12026,16 +12244,16 @@ async function runServer() {
         }
         logger.info(`Configured GitLab API URLs: ${GITLAB_API_URLS.join(", ")}`);
         logger.info(`Default GitLab API URL: ${GITLAB_API_URL}`);
-        if (GITLAB_ALLOWED_GROUPS_RAW) {
-            if (GITLAB_OAUTH_ALLOWED_GROUPS_RAW) {
-                logger.warn("GITLAB_ALLOWED_GROUPS is set but ignored — GITLAB_OAUTH_ALLOWED_GROUPS takes precedence.");
-            }
-            else {
-                logger.warn("GITLAB_ALLOWED_GROUPS is deprecated. Use GITLAB_OAUTH_ALLOWED_GROUPS instead.");
-            }
-        }
-        if (GITLAB_READ_ONLY_MODE) {
-            logger.warn("GITLAB_READ_ONLY_MODE is deprecated. Use GITLAB_PERMISSION_MODE=readonly or --permission-mode=readonly instead.");
+        for (const warning of getDeprecatedEnvWarnings({
+            readOnlyMode: GITLAB_READ_ONLY_MODE,
+            permissionModeRaw: GITLAB_PERMISSION_MODE_RAW,
+            allowedGroupsRaw: GITLAB_ALLOWED_GROUPS_RAW,
+            oauthAllowedGroupsRaw: GITLAB_OAUTH_ALLOWED_GROUPS_RAW,
+            useWikiRaw: USE_GITLAB_WIKI_RAW,
+            useMilestoneRaw: USE_MILESTONE_RAW,
+            usePipelineRaw: USE_PIPELINE_RAW,
+        })) {
+            logger.warn(warning);
         }
         if (GITLAB_OAUTH_ALLOWED_GROUPS) {
             logger.info(`Group access control enabled for: ${GITLAB_OAUTH_ALLOWED_GROUPS.join(", ")}`);
@@ -12074,6 +12292,7 @@ async function main() {
             process.exit(2);
         }
         try {
+            initOAuthClient();
             const result = await handleToolCall({ name: cli.toolName, arguments: cli.args });
             const masked = maskCliToolResult(cli.toolName, result);
             const formatted = formatToolOutput({