@zereight/mcp-gitlab 2.1.69 → 2.2.0

package/build/tools/registry.js

@@ -1,5 +1,5 @@
 import { toJSONSchema } from "../utils/schema.js";
-import { USE_GITLAB_WIKI, USE_MILESTONE, USE_PIPELINE, SSE, STREAMABLE_HTTP, } from "../config.js";
+import { USE_GITLAB_WIKI, USE_MILESTONE, USE_PIPELINE, SSE, STREAMABLE_HTTP } from "../config.js";
 import { getToolDescription } from "./tool-descriptions.js";
 import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, ErasePipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateGroupMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWebhookSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UnprotectBranchSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupMilestoneSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWebhookSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadAttachmentRemoteSchema, DownloadJobArtifactsSchema, DownloadJobArtifactsRemoteSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, EditGroupMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, HealthCheckSchema, GetBranchSchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GetDeploymentSchema, CreateDeploymentSchema, UpdateDeploymentSchema, DeploymentApprovalSchema, ListDeploymentMergeRequestsSchema, GetDraftNoteSchema, GetEnvironmentSchema, UpdateEnvironmentSchema, StopEnvironmentSchema, StopStaleEnvironmentsSchema, DeleteReviewAppEnvironmentsSchema, PipelineTriggerIdSchema, ListPipelineTriggersSchema, CreatePipelineTriggerSchema, UpdatePipelineTriggerSchema, TriggerPipelineSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestDiscussionSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetGroupMilestoneSchema, GetGroupMilestoneIssuesSchema, GetGroupMilestoneMergeRequestsSchema, GetGroupMilestoneBurndownEventsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, PipelineJobControlSchema, GetPipelineSchema, GetPipelineVariablesSchema, UpdatePipelineMetadataSchema, DeletePipelineSchema, PipelineReportSchema, WaitForPipelineSchema, WaitForPipelineJobSchema, PlayPipelineJobsSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetTimelineEventsSchema, GetUsersSchema, GetUserSchema, WhoAmISchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListBranchesSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupMilestonesSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListGroupMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListPipelinesSchema, ListPipelineSchedulesSchema, GetPipelineScheduleSchema, ListPipelineSchedulePipelinesSchema, CreatePipelineScheduleSchema, UpdatePipelineScheduleSchema, DeletePipelineScheduleSchema, PlayPipelineScheduleSchema, TakeOwnershipPipelineScheduleSchema, GetPipelineScheduleVariableSchema, CreatePipelineScheduleVariableSchema, UpdatePipelineScheduleVariableSchema, DeletePipelineScheduleVariableSchema, ListGroupMembersSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, OrbitQuerySchema, OrbitSchemaSchema, OrbitStatusSchema, OrbitToolsSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, ListSnippetsSchema, GetSnippetSchema, CreateSnippetSchema, UpdateSnippetSchema, DeleteSnippetSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWebhookSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListProjectVulnerabilitiesSchema, GetVulnerabilitySchema, DismissVulnerabilitySchema, ConfirmVulnerabilitySchema, } from "../schemas.js";
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
@@ -359,7 +359,7 @@ export const allTools = [
     },
     {
         name: "get_issue",
-        description: "Get details of a specific issue. Returns a slim milestone by default; set full_response=true for the complete milestone object",
+        description: "Get details of a specific issue. Returns the issue with a slim nested milestone by default; set full_response=true for the complete milestone object",
         inputSchema: toJSONSchema(GetIssueSchema),
     },
     {
@@ -559,10 +559,26 @@ export const allTools = [
         description: "Get variables configured for a pipeline",
         inputSchema: toJSONSchema(GetPipelineVariablesSchema),
     },
-    { name: "get_pipeline_test_report", description: "Get pipeline test report", inputSchema: toJSONSchema(PipelineReportSchema) },
-    { name: "get_pipeline_test_report_summary", description: "Get pipeline test report summary", inputSchema: toJSONSchema(PipelineReportSchema) },
-    { name: "delete_pipeline", description: "Delete a pipeline. Requires the project Owner role, cannot be undone, and does not automatically delete child pipelines.", inputSchema: toJSONSchema(DeletePipelineSchema) },
-    { name: "update_pipeline_metadata", description: "Update pipeline metadata", inputSchema: toJSONSchema(UpdatePipelineMetadataSchema) },
+    {
+        name: "get_pipeline_test_report",
+        description: "Get pipeline test report",
+        inputSchema: toJSONSchema(PipelineReportSchema),
+    },
+    {
+        name: "get_pipeline_test_report_summary",
+        description: "Get pipeline test report summary",
+        inputSchema: toJSONSchema(PipelineReportSchema),
+    },
+    {
+        name: "delete_pipeline",
+        description: "Delete a pipeline. Requires the project Owner role, cannot be undone, and does not automatically delete child pipelines.",
+        inputSchema: toJSONSchema(DeletePipelineSchema),
+    },
+    {
+        name: "update_pipeline_metadata",
+        description: "Update pipeline metadata",
+        inputSchema: toJSONSchema(UpdatePipelineMetadataSchema),
+    },
     {
         name: "list_deployments",
         description: "List deployments with filtering options",
@@ -573,11 +589,31 @@ export const allTools = [
         description: "Get deployment details, including approval_summary, approvals, and pending_approval_count when GitLab provides them",
         inputSchema: toJSONSchema(GetDeploymentSchema),
     },
-    { name: "create_deployment", description: "Create a deployment", inputSchema: toJSONSchema(CreateDeploymentSchema) },
-    { name: "update_deployment", description: "Update a deployment status", inputSchema: toJSONSchema(UpdateDeploymentSchema) },
-    { name: "delete_deployment", description: "Delete a deployment", inputSchema: toJSONSchema(GetDeploymentSchema) },
-    { name: "list_deployment_merge_requests", description: "List merge requests shipped with a deployment", inputSchema: toJSONSchema(ListDeploymentMergeRequestsSchema) },
-    { name: "approve_deployment", description: "Approve or reject a protected-environment deployment", inputSchema: toJSONSchema(DeploymentApprovalSchema) },
+    {
+        name: "create_deployment",
+        description: "Create a deployment",
+        inputSchema: toJSONSchema(CreateDeploymentSchema),
+    },
+    {
+        name: "update_deployment",
+        description: "Update a deployment status",
+        inputSchema: toJSONSchema(UpdateDeploymentSchema),
+    },
+    {
+        name: "delete_deployment",
+        description: "Delete a deployment",
+        inputSchema: toJSONSchema(GetDeploymentSchema),
+    },
+    {
+        name: "list_deployment_merge_requests",
+        description: "List merge requests shipped with a deployment",
+        inputSchema: toJSONSchema(ListDeploymentMergeRequestsSchema),
+    },
+    {
+        name: "approve_deployment",
+        description: "Approve or reject a protected-environment deployment",
+        inputSchema: toJSONSchema(DeploymentApprovalSchema),
+    },
     {
         name: "list_environments",
         description: "List environments in a project",
@@ -588,17 +624,61 @@ export const allTools = [
         description: "Get details of a specific environment",
         inputSchema: toJSONSchema(GetEnvironmentSchema),
     },
-    { name: "update_environment", description: "Update an environment", inputSchema: toJSONSchema(UpdateEnvironmentSchema) },
-    { name: "delete_environment", description: "Delete a stopped environment", inputSchema: toJSONSchema(GetEnvironmentSchema) },
-    { name: "stop_environment", description: "Stop an environment", inputSchema: toJSONSchema(StopEnvironmentSchema) },
-    { name: "stop_stale_environments", description: "Stop eligible stale environments; protected environments are excluded and environments are stopped, not deleted", inputSchema: toJSONSchema(StopStaleEnvironmentsSchema) },
-    { name: "delete_review_app_environments", description: "Schedule deletion of stopped review-app environments one week later; dry_run defaults to true and actual scheduling requires dry_run=false", inputSchema: toJSONSchema(DeleteReviewAppEnvironmentsSchema) },
-    { name: "list_pipeline_triggers", description: "List project pipeline trigger tokens", inputSchema: toJSONSchema(ListPipelineTriggersSchema) },
-    { name: "get_pipeline_trigger", description: "Get a project pipeline trigger", inputSchema: toJSONSchema(PipelineTriggerIdSchema) },
-    { name: "create_pipeline_trigger", description: "Create a project pipeline trigger", inputSchema: toJSONSchema(CreatePipelineTriggerSchema) },
-    { name: "update_pipeline_trigger", description: "Update a project pipeline trigger", inputSchema: toJSONSchema(UpdatePipelineTriggerSchema) },
-    { name: "delete_pipeline_trigger", description: "Delete a project pipeline trigger", inputSchema: toJSONSchema(PipelineTriggerIdSchema) },
-    { name: "trigger_pipeline", description: "Trigger a pipeline with a pipeline trigger token", inputSchema: toJSONSchema(TriggerPipelineSchema) },
+    {
+        name: "update_environment",
+        description: "Update an environment",
+        inputSchema: toJSONSchema(UpdateEnvironmentSchema),
+    },
+    {
+        name: "delete_environment",
+        description: "Delete a stopped environment",
+        inputSchema: toJSONSchema(GetEnvironmentSchema),
+    },
+    {
+        name: "stop_environment",
+        description: "Stop an environment",
+        inputSchema: toJSONSchema(StopEnvironmentSchema),
+    },
+    {
+        name: "stop_stale_environments",
+        description: "Stop eligible stale environments; protected environments are excluded and environments are stopped, not deleted",
+        inputSchema: toJSONSchema(StopStaleEnvironmentsSchema),
+    },
+    {
+        name: "delete_review_app_environments",
+        description: "Schedule deletion of stopped review-app environments one week later; dry_run defaults to true and actual scheduling requires dry_run=false",
+        inputSchema: toJSONSchema(DeleteReviewAppEnvironmentsSchema),
+    },
+    {
+        name: "list_pipeline_triggers",
+        description: "List project pipeline trigger tokens",
+        inputSchema: toJSONSchema(ListPipelineTriggersSchema),
+    },
+    {
+        name: "get_pipeline_trigger",
+        description: "Get a project pipeline trigger",
+        inputSchema: toJSONSchema(PipelineTriggerIdSchema),
+    },
+    {
+        name: "create_pipeline_trigger",
+        description: "Create a project pipeline trigger",
+        inputSchema: toJSONSchema(CreatePipelineTriggerSchema),
+    },
+    {
+        name: "update_pipeline_trigger",
+        description: "Update a project pipeline trigger",
+        inputSchema: toJSONSchema(UpdatePipelineTriggerSchema),
+    },
+    {
+        name: "delete_pipeline_trigger",
+        description: "Delete a project pipeline trigger",
+        inputSchema: toJSONSchema(PipelineTriggerIdSchema),
+    },
+    {
+        name: "trigger_pipeline",
+        description: "Trigger a pipeline with a pipeline trigger token",
+        inputSchema: toJSONSchema(TriggerPipelineSchema),
+    },
     {
         name: "list_pipeline_jobs",
         description: "List all jobs in a specific pipeline",
@@ -734,9 +814,21 @@ export const allTools = [
         description: "Cancel a running pipeline job",
         inputSchema: toJSONSchema(CancelPipelineJobSchema),
     },
-    { name: "erase_pipeline_job", description: "Erase a pipeline job log and artifacts", inputSchema: toJSONSchema(ErasePipelineJobSchema) },
-    { name: "wait_for_pipeline", description: "Wait for a pipeline to reach a terminal status", inputSchema: toJSONSchema(WaitForPipelineSchema) },
-    { name: "wait_for_job", description: "Wait for a job to reach a terminal status", inputSchema: toJSONSchema(WaitForPipelineJobSchema) },
+    {
+        name: "erase_pipeline_job",
+        description: "Erase a pipeline job log and artifacts",
+        inputSchema: toJSONSchema(ErasePipelineJobSchema),
+    },
+    {
+        name: "wait_for_pipeline",
+        description: "Wait for a pipeline to reach a terminal status",
+        inputSchema: toJSONSchema(WaitForPipelineSchema),
+    },
+    {
+        name: "wait_for_job",
+        description: "Wait for a job to reach a terminal status",
+        inputSchema: toJSONSchema(WaitForPipelineJobSchema),
+    },
     {
         name: "list_job_artifacts",
         description: "List artifact files in a job's archive",
@@ -1432,6 +1524,12 @@ export const readOnlyTools = new Set([
     "orbit_get_status",
     "orbit_list_tools",
 ]);
+// Stays in readOnlyTools so readonly mode can still run queries, but mutations
+// are allowed in other permission modes and rejected only at call time.
+const MIXED_ACCESS_TOOLS = new Set(["execute_graphql"]);
+export function advertisesReadOnly(toolName) {
+    return readOnlyTools.has(toolName) && !MIXED_ACCESS_TOOLS.has(toolName);
+}
 // Define which tools are destructive (data loss potential)
 export const destructiveTools = new Set([
     "delete_pipeline",
@@ -1620,8 +1718,52 @@ export const pipelineToolNames = new Set([
 ]);
 export const TOOLSET_DEFINITIONS = [
     {
-        id: "merge_requests",
+        id: "core",
         isDefault: true,
+        tools: new Set([
+            "list_merge_requests",
+            "get_merge_request",
+            "get_merge_request_approval_state",
+            "list_merge_request_changed_files",
+            "get_merge_request_file_diff",
+            "list_merge_request_diffs",
+            "get_merge_request_diffs",
+            "mr_discussions",
+            "get_merge_request_discussion",
+            "get_merge_request_note",
+            "get_merge_request_notes",
+            "create_merge_request",
+            "create_merge_request_thread",
+            "resolve_merge_request_thread",
+            "update_merge_request",
+            "list_issues",
+            "my_issues",
+            "get_issue",
+            "create_issue",
+            "update_issue",
+            "create_issue_note",
+            "list_issue_discussions",
+            "update_issue_description_patch",
+            "get_file_contents",
+            "get_repository_tree",
+            "search_repositories",
+            "get_branch",
+            "list_branches",
+            "list_commits",
+            "get_commit",
+            "get_commit_diff",
+            "get_file_blame",
+            "get_project",
+            "list_projects",
+            "list_project_members",
+            "list_labels",
+            "whoami",
+            "health_check",
+        ]),
+    },
+    {
+        id: "merge_requests",
+        isDefault: false,
         tools: new Set([
             "merge_merge_request",
             "approve_merge_request",
@@ -1672,7 +1814,7 @@ export const TOOLSET_DEFINITIONS = [
     },
     {
         id: "issues",
-        isDefault: true,
+        isDefault: false,
         tools: new Set([
             "create_issue",
             "list_issues",
@@ -1702,7 +1844,7 @@ export const TOOLSET_DEFINITIONS = [
     },
     {
         id: "repositories",
-        isDefault: true,
+        isDefault: false,
         tools: new Set([
             "search_repositories",
             "create_repository",
@@ -1715,7 +1857,7 @@ export const TOOLSET_DEFINITIONS = [
     },
     {
         id: "branches",
-        isDefault: true,
+        isDefault: false,
         tools: new Set([
             "create_branch",
             "get_branch",
@@ -1736,7 +1878,7 @@ export const TOOLSET_DEFINITIONS = [
     },
     {
         id: "projects",
-        isDefault: true,
+        isDefault: false,
         tools: new Set([
             "get_project",
             "list_projects",
@@ -1753,18 +1895,12 @@ export const TOOLSET_DEFINITIONS = [
     },
     {
         id: "labels",
-        isDefault: true,
-        tools: new Set([
-            "list_labels",
-            "get_label",
-            "create_label",
-            "update_label",
-            "delete_label",
-        ]),
+        isDefault: false,
+        tools: new Set(["list_labels", "get_label", "create_label", "update_label", "delete_label"]),
     },
     {
         id: "ci",
-        isDefault: true,
+        isDefault: false,
         tools: new Set([
             "validate_ci_lint",
             "validate_project_ci_lint",
@@ -1774,7 +1910,7 @@ export const TOOLSET_DEFINITIONS = [
     },
     {
         id: "groups",
-        isDefault: true,
+        isDefault: false,
         tools: new Set(["create_group"]),
     },
     {
@@ -1894,13 +2030,7 @@ export const TOOLSET_DEFINITIONS = [
     {
         id: "tags",
         isDefault: false,
-        tools: new Set([
-            "list_tags",
-            "get_tag",
-            "create_tag",
-            "delete_tag",
-            "get_tag_signature",
-        ]),
+        tools: new Set(["list_tags", "get_tag", "create_tag", "delete_tag", "get_tag_signature"]),
     },
     {
         id: "snippets",
@@ -1915,7 +2045,7 @@ export const TOOLSET_DEFINITIONS = [
     },
     {
         id: "users",
-        isDefault: true,
+        isDefault: false,
         tools: new Set([
             "get_users",
             "get_user",
@@ -2009,18 +2139,29 @@ export const TOOLSET_DEFINITIONS = [
         tools: new Set(["orbit_query", "orbit_get_schema", "orbit_get_status", "orbit_list_tools"]),
     },
 ];
-// Derived lookup: tool name → toolset ID
-export const TOOLSET_BY_TOOL_NAME = new Map();
+// Derived lookup: tool name → toolset IDs. Most tools belong to one category.
+// The default `core` toolset intentionally overlaps with the full opt-in
+// categories so users get a small starter surface without losing the ability
+// to enable complete categories later.
+export const TOOLSETS_BY_TOOL_NAME = new Map();
 for (const def of TOOLSET_DEFINITIONS) {
     for (const tool of def.tools) {
-        if (TOOLSET_BY_TOOL_NAME.has(tool)) {
-            console.warn(`Tool "${tool}" is defined in multiple toolsets: "${TOOLSET_BY_TOOL_NAME.get(tool)}" and "${def.id}"`);
-        }
-        TOOLSET_BY_TOOL_NAME.set(tool, def.id);
+        const toolsets = TOOLSETS_BY_TOOL_NAME.get(tool) ?? new Set();
+        toolsets.add(def.id);
+        TOOLSETS_BY_TOOL_NAME.set(tool, toolsets);
     }
 }
 export const DEFAULT_TOOLSET_IDS = new Set(TOOLSET_DEFINITIONS.filter(d => d.isDefault).map(d => d.id));
 export const ALL_TOOLSET_IDS = new Set(TOOLSET_DEFINITIONS.map(d => d.id));
+/**
+ * Smallest toolset containing the tool, i.e. the cheapest category to activate for it.
+ * Returns undefined for tools outside every toolset (e.g. `execute_graphql`) and unknown names.
+ */
+export function findSmallestToolsetForTool(toolName) {
+    const candidates = TOOLSET_DEFINITIONS.filter(d => d.tools.has(toolName));
+    const smallest = candidates.reduce((best, d) => (best === undefined || d.tools.size < best.tools.size ? d : best), undefined);
+    return smallest?.id;
+}
 // Update discover_tools description with all known categories (must be after TOOLSET_DEFINITIONS)
 const discoverTool = allTools.find(t => t.name === "discover_tools");
 if (discoverTool) {
@@ -2080,9 +2221,37 @@ export function buildFeatureFlagOverrides() {
     return overrides;
 }
 export function isToolInEnabledToolset(toolName, enabledToolsets) {
-    const toolsetId = TOOLSET_BY_TOOL_NAME.get(toolName);
+    const toolsetIds = TOOLSETS_BY_TOOL_NAME.get(toolName);
     // Tools not in any toolset (e.g. execute_graphql) are excluded by default
-    if (toolsetId === undefined)
+    if (toolsetIds === undefined)
         return false;
-    return enabledToolsets.has(toolsetId);
+    for (const toolsetId of toolsetIds) {
+        if (enabledToolsets.has(toolsetId))
+            return true;
+    }
+    return false;
+}
+/**
+ * True only when every tool in the set is already exposed.
+ * Partial overlap (for example `core` sharing names with `merge_requests`) is not active.
+ * `isExcluded` covers tools the caller will not list; those do not keep the toolset inactive.
+ * An empty set is fully active, matching `Array.prototype.every`.
+ */
+export function isToolsetFullyActive(tools, currentToolNames, isExcluded) {
+    for (const toolName of tools) {
+        if (currentToolNames.has(toolName) || isExcluded?.(toolName)) {
+            continue;
+        }
+        return false;
+    }
+    return true;
+}
+/** Category listing returned by `discover_tools` when no category argument is given. */
+export function listDiscoverableCategories(currentToolNames, isExcluded) {
+    return TOOLSET_DEFINITIONS.map(def => ({
+        id: def.id,
+        toolCount: def.tools.size,
+        active: isToolsetFullyActive(def.tools, currentToolNames, isExcluded),
+        isDefault: def.isDefault,
+    }));
 }

package/build/tools/tool-profile.js

@@ -0,0 +1,66 @@
+export const TOOL_PROFILES = ["full", "slim"];
+/**
+ * Tools omitted from the initial list when `GITLAB_TOOL_PROFILE=slim` and
+ * `GITLAB_TOOLSETS` is unset. `discover_tools` does not add them back.
+ * `GITLAB_TOOLS` can still name one explicitly.
+ */
+export const SLIM_PROFILE_EXCLUDED_TOOLS = new Set([
+    "get_draft_note",
+    "list_draft_notes",
+    "create_draft_note",
+    "update_draft_note",
+    "delete_draft_note",
+    "publish_draft_note",
+    "bulk_publish_draft_notes",
+    "list_merge_request_emoji_reactions",
+    "list_merge_request_note_emoji_reactions",
+    "create_merge_request_emoji_reaction",
+    "delete_merge_request_emoji_reaction",
+    "create_merge_request_note_emoji_reaction",
+    "delete_merge_request_note_emoji_reaction",
+    "list_issue_emoji_reactions",
+    "list_issue_note_emoji_reactions",
+    "create_issue_emoji_reaction",
+    "delete_issue_emoji_reaction",
+    "create_issue_note_emoji_reaction",
+    "delete_issue_note_emoji_reaction",
+    "list_labels",
+    "get_label",
+    "create_label",
+    "update_label",
+    "delete_label",
+    "validate_ci_lint",
+    "validate_project_ci_lint",
+    "list_ci_catalog_resources",
+    "get_ci_catalog_resource",
+    "create_group",
+]);
+export function parseToolProfile(raw) {
+    if (raw === undefined) {
+        return "full";
+    }
+    const normalized = raw.trim().toLowerCase();
+    if (normalized === "" || normalized === "full") {
+        return "full";
+    }
+    if (normalized === "slim") {
+        return "slim";
+    }
+    throw new Error(`Invalid GITLAB_TOOL_PROFILE: "${raw}". Expected one of: ${TOOL_PROFILES.join(", ")}`);
+}
+/** Slim applies only when the caller did not pin an explicit toolset list. */
+export function shouldApplySlimToolProfile(profile, toolsetsRaw) {
+    if (profile !== "slim") {
+        return false;
+    }
+    return toolsetsRaw === undefined || toolsetsRaw.trim() === "";
+}
+export function isExcludedBySlimProfile(toolName, applySlimProfile, explicitlyEnabledTools) {
+    if (!applySlimProfile) {
+        return false;
+    }
+    if (explicitlyEnabledTools.has(toolName)) {
+        return false;
+    }
+    return SLIM_PROFILE_EXCLUDED_TOOLS.has(toolName);
+}

package/build/utils/compact-tool-allowlist.js

@@ -0,0 +1,14 @@
+/** Tool names that compact oversized replies even when global compact mode is off. */
+export function parseCompactToolAllowlist(raw) {
+    if (raw === undefined || raw.trim() === "") {
+        return new Set();
+    }
+    const names = raw
+        .split(",")
+        .map(name => name.trim())
+        .filter(name => name.length > 0);
+    return new Set(names);
+}
+export function shouldCompactToolResult(toolName, globalEnabled, allowlist) {
+    return globalEnabled || allowlist.has(toolName);
+}

package/build/utils/logger.js

@@ -1,4 +1,6 @@
+import { createRequire } from "node:module";
 import { pino } from "pino";
+const require = createRequire(import.meta.url);
 const REDACT_PATHS = [
     "token",
     "*.token",
@@ -23,6 +25,31 @@ const REDACT_PATHS = [
     "arguments.approval_password",
     "params.arguments.approval_password",
 ];
+function isPrettyFactory(value) {
+    return typeof value === "function";
+}
+function isPrettyModule(value) {
+    if (typeof value !== "object" || value === null || !("default" in value)) {
+        return false;
+    }
+    return isPrettyFactory(value.default);
+}
+/**
+ * Pretty-print in process. The worker transport has the same text format, but
+ * it spawns a thread on every logger, including stdio MCP startup.
+ * LOG_FORMAT=json still skips pino-pretty entirely.
+ */
+function createPrettyStream() {
+    const loaded = require("pino-pretty");
+    const options = { colorize: true, levelFirst: true, destination: 2 };
+    if (isPrettyFactory(loaded)) {
+        return loaded(options);
+    }
+    if (isPrettyModule(loaded)) {
+        return loaded.default(options);
+    }
+    throw new Error("pino-pretty did not export a stream factory");
+}
 /**
  * Create a pino logger with consistent redaction, level, format, and
  * destination across the entire codebase.
@@ -30,26 +57,21 @@ const REDACT_PATHS = [
  * - LOG_LEVEL (default "info") controls the minimum severity.
  * - LOG_FORMAT=json disables pino-pretty and outputs newline-delimited JSON
  *   to stderr.
+ * - Any other value, including unset, keeps human-readable pino-pretty output.
  * - All loggers redact the same set of sensitive fields.
  */
 export function createLogger(name) {
     const isJson = process.env.LOG_FORMAT === "json";
-    return pino({
+    const options = {
         ...(name && { name }),
         level: process.env.LOG_LEVEL || "info",
         redact: {
             paths: REDACT_PATHS,
             censor: "[REDACTED]",
         },
-        ...(!isJson && {
-            transport: {
-                target: "pino-pretty",
-                options: {
-                    colorize: true,
-                    levelFirst: true,
-                    destination: 2,
-                },
-            },
-        }),
-    }, ...(isJson ? [pino.destination(2)] : []));
+    };
+    if (isJson) {
+        return pino(options, pino.destination(2));
+    }
+    return pino(options, createPrettyStream());
 }

package/build/utils/url.js

@@ -17,6 +17,21 @@ export function normalizeGitLabApiUrl(url) {
     }
     return normalizedUrl;
 }
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
+/**
+ * True when the URL is plain `http://` to a non-loopback host, i.e. credentials sent
+ * to it would cross the network in cleartext. Unparseable URLs return false (they are
+ * rejected by the config validation instead).
+ */
+export function isCleartextRemoteUrl(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === "http:" && !LOOPBACK_HOSTNAMES.has(parsed.hostname);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Dot segments anywhere in a decoded value, including after a percent-encoded
  * separator ("..%2F..%2Fuser" decodes to a path-traversal sequence).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.69",
+  "version": "2.2.0",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
@@ -44,10 +44,10 @@
     "npm": ">=9.0.0"
   },
   "scripts": {
-    "build": "tsc && node -e \"require('fs').chmodSync('build/index.js', '755')\"",
+    "build": "node -e \"require('fs').rmSync('build',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && node -e \"require('fs').chmodSync('build/index.js', '755')\"",
     "prepare": "npm run build",
     "dev": "npm run build && node build/index.js",
-    "watch": "tsc --watch",
+    "watch": "tsc -p tsconfig.build.json --watch",
     "deploy": "npm publish --access public",
     "changelog": "auto-changelog -p",
     "test": "npm run test:all",