@zereight/mcp-gitlab 2.1.70 → 2.2.1

package/build/tools/registry.js

@@ -1,5 +1,5 @@
 import { toJSONSchema } from "../utils/schema.js";
-import { USE_GITLAB_WIKI, USE_MILESTONE, USE_PIPELINE, SSE, STREAMABLE_HTTP, } from "../config.js";
+import { USE_GITLAB_WIKI, USE_MILESTONE, USE_PIPELINE, SSE, STREAMABLE_HTTP } from "../config.js";
 import { getToolDescription } from "./tool-descriptions.js";
 import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, ErasePipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateGroupMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWebhookSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UnprotectBranchSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupMilestoneSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWebhookSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadAttachmentRemoteSchema, DownloadJobArtifactsSchema, DownloadJobArtifactsRemoteSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, EditGroupMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, HealthCheckSchema, GetBranchSchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GetDeploymentSchema, CreateDeploymentSchema, UpdateDeploymentSchema, DeploymentApprovalSchema, ListDeploymentMergeRequestsSchema, GetDraftNoteSchema, GetEnvironmentSchema, UpdateEnvironmentSchema, StopEnvironmentSchema, StopStaleEnvironmentsSchema, DeleteReviewAppEnvironmentsSchema, PipelineTriggerIdSchema, ListPipelineTriggersSchema, CreatePipelineTriggerSchema, UpdatePipelineTriggerSchema, TriggerPipelineSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestDiscussionSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetGroupMilestoneSchema, GetGroupMilestoneIssuesSchema, GetGroupMilestoneMergeRequestsSchema, GetGroupMilestoneBurndownEventsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, PipelineJobControlSchema, GetPipelineSchema, GetPipelineVariablesSchema, UpdatePipelineMetadataSchema, DeletePipelineSchema, PipelineReportSchema, WaitForPipelineSchema, WaitForPipelineJobSchema, PlayPipelineJobsSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetTimelineEventsSchema, GetUsersSchema, GetUserSchema, WhoAmISchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListBranchesSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupMilestonesSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListGroupMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListPipelinesSchema, ListPipelineSchedulesSchema, GetPipelineScheduleSchema, ListPipelineSchedulePipelinesSchema, CreatePipelineScheduleSchema, UpdatePipelineScheduleSchema, DeletePipelineScheduleSchema, PlayPipelineScheduleSchema, TakeOwnershipPipelineScheduleSchema, GetPipelineScheduleVariableSchema, CreatePipelineScheduleVariableSchema, UpdatePipelineScheduleVariableSchema, DeletePipelineScheduleVariableSchema, ListGroupMembersSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, OrbitQuerySchema, OrbitSchemaSchema, OrbitStatusSchema, OrbitToolsSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, ListSnippetsSchema, GetSnippetSchema, CreateSnippetSchema, UpdateSnippetSchema, DeleteSnippetSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWebhookSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListProjectVulnerabilitiesSchema, GetVulnerabilitySchema, DismissVulnerabilitySchema, ConfirmVulnerabilitySchema, } from "../schemas.js";
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
@@ -132,27 +132,27 @@ export const allTools = [
     },
     {
         name: "get_merge_request",
-        description: "Get details of a merge request (mergeRequestIid or branchName required). Set include_summaries=true for deployment/commit/approval summaries",
+        description: "Get details of a merge request (merge_request_iid or source_branch required). Set include_summaries=true for deployment/commit/approval summaries",
         inputSchema: toJSONSchema(GetMergeRequestSchema),
     },
     {
         name: "get_merge_request_diffs",
-        description: "Get the changes/diffs of a merge request (mergeRequestIid or branchName required)",
+        description: "Get the changes/diffs of a merge request (merge_request_iid or source_branch required)",
         inputSchema: toJSONSchema(GetMergeRequestDiffsSchema),
     },
     {
         name: "list_merge_request_changed_files",
-        description: "List changed file paths in a merge request without diff content (mergeRequestIid or branchName required)",
+        description: "List changed file paths in a merge request without diff content (merge_request_iid or source_branch required)",
         inputSchema: toJSONSchema(ListMergeRequestChangedFilesSchema),
     },
     {
         name: "list_merge_request_diffs",
-        description: "List merge request diffs with pagination (mergeRequestIid or branchName required)",
+        description: "List merge request diffs with pagination (merge_request_iid or source_branch required)",
         inputSchema: toJSONSchema(ListMergeRequestDiffsSchema),
     },
     {
         name: "get_merge_request_file_diff",
-        description: "Get diffs for specific files from a merge request (mergeRequestIid or branchName required)",
+        description: "Get diffs for specific files from a merge request (merge_request_iid or source_branch required)",
         inputSchema: toJSONSchema(GetMergeRequestFileDiffSchema),
     },
     {
@@ -172,7 +172,7 @@ export const allTools = [
     },
     {
         name: "update_merge_request",
-        description: "Update a merge request (mergeRequestIid or branchName required)",
+        description: "Update a merge request (merge_request_iid or source_branch required)",
         inputSchema: toJSONSchema(UpdateMergeRequestSchema),
     },
     {
@@ -359,7 +359,7 @@ export const allTools = [
     },
     {
         name: "get_issue",
-        description: "Get details of a specific issue. Returns a slim milestone by default; set full_response=true for the complete milestone object",
+        description: "Get details of a specific issue. Returns the issue with a slim nested milestone by default; set full_response=true for the complete milestone object",
         inputSchema: toJSONSchema(GetIssueSchema),
     },
     {
@@ -559,10 +559,26 @@ export const allTools = [
         description: "Get variables configured for a pipeline",
         inputSchema: toJSONSchema(GetPipelineVariablesSchema),
     },
-    { name: "get_pipeline_test_report", description: "Get pipeline test report", inputSchema: toJSONSchema(PipelineReportSchema) },
-    { name: "get_pipeline_test_report_summary", description: "Get pipeline test report summary", inputSchema: toJSONSchema(PipelineReportSchema) },
-    { name: "delete_pipeline", description: "Delete a pipeline. Requires the project Owner role, cannot be undone, and does not automatically delete child pipelines.", inputSchema: toJSONSchema(DeletePipelineSchema) },
-    { name: "update_pipeline_metadata", description: "Update pipeline metadata", inputSchema: toJSONSchema(UpdatePipelineMetadataSchema) },
+    {
+        name: "get_pipeline_test_report",
+        description: "Get pipeline test report",
+        inputSchema: toJSONSchema(PipelineReportSchema),
+    },
+    {
+        name: "get_pipeline_test_report_summary",
+        description: "Get pipeline test report summary",
+        inputSchema: toJSONSchema(PipelineReportSchema),
+    },
+    {
+        name: "delete_pipeline",
+        description: "Delete a pipeline. Requires the project Owner role, cannot be undone, and does not automatically delete child pipelines.",
+        inputSchema: toJSONSchema(DeletePipelineSchema),
+    },
+    {
+        name: "update_pipeline_metadata",
+        description: "Update pipeline metadata",
+        inputSchema: toJSONSchema(UpdatePipelineMetadataSchema),
+    },
     {
         name: "list_deployments",
         description: "List deployments with filtering options",
@@ -573,11 +589,31 @@ export const allTools = [
         description: "Get deployment details, including approval_summary, approvals, and pending_approval_count when GitLab provides them",
         inputSchema: toJSONSchema(GetDeploymentSchema),
     },
-    { name: "create_deployment", description: "Create a deployment", inputSchema: toJSONSchema(CreateDeploymentSchema) },
-    { name: "update_deployment", description: "Update a deployment status", inputSchema: toJSONSchema(UpdateDeploymentSchema) },
-    { name: "delete_deployment", description: "Delete a deployment", inputSchema: toJSONSchema(GetDeploymentSchema) },
-    { name: "list_deployment_merge_requests", description: "List merge requests shipped with a deployment", inputSchema: toJSONSchema(ListDeploymentMergeRequestsSchema) },
-    { name: "approve_deployment", description: "Approve or reject a protected-environment deployment", inputSchema: toJSONSchema(DeploymentApprovalSchema) },
+    {
+        name: "create_deployment",
+        description: "Create a deployment",
+        inputSchema: toJSONSchema(CreateDeploymentSchema),
+    },
+    {
+        name: "update_deployment",
+        description: "Update a deployment status",
+        inputSchema: toJSONSchema(UpdateDeploymentSchema),
+    },
+    {
+        name: "delete_deployment",
+        description: "Delete a deployment",
+        inputSchema: toJSONSchema(GetDeploymentSchema),
+    },
+    {
+        name: "list_deployment_merge_requests",
+        description: "List merge requests shipped with a deployment",
+        inputSchema: toJSONSchema(ListDeploymentMergeRequestsSchema),
+    },
+    {
+        name: "approve_deployment",
+        description: "Approve or reject a protected-environment deployment",
+        inputSchema: toJSONSchema(DeploymentApprovalSchema),
+    },
     {
         name: "list_environments",
         description: "List environments in a project",
@@ -588,17 +624,61 @@ export const allTools = [
         description: "Get details of a specific environment",
         inputSchema: toJSONSchema(GetEnvironmentSchema),
     },
-    { name: "update_environment", description: "Update an environment", inputSchema: toJSONSchema(UpdateEnvironmentSchema) },
-    { name: "delete_environment", description: "Delete a stopped environment", inputSchema: toJSONSchema(GetEnvironmentSchema) },
-    { name: "stop_environment", description: "Stop an environment", inputSchema: toJSONSchema(StopEnvironmentSchema) },
-    { name: "stop_stale_environments", description: "Stop eligible stale environments; protected environments are excluded and environments are stopped, not deleted", inputSchema: toJSONSchema(StopStaleEnvironmentsSchema) },
-    { name: "delete_review_app_environments", description: "Schedule deletion of stopped review-app environments one week later; dry_run defaults to true and actual scheduling requires dry_run=false", inputSchema: toJSONSchema(DeleteReviewAppEnvironmentsSchema) },
-    { name: "list_pipeline_triggers", description: "List project pipeline trigger tokens", inputSchema: toJSONSchema(ListPipelineTriggersSchema) },
-    { name: "get_pipeline_trigger", description: "Get a project pipeline trigger", inputSchema: toJSONSchema(PipelineTriggerIdSchema) },
-    { name: "create_pipeline_trigger", description: "Create a project pipeline trigger", inputSchema: toJSONSchema(CreatePipelineTriggerSchema) },
-    { name: "update_pipeline_trigger", description: "Update a project pipeline trigger", inputSchema: toJSONSchema(UpdatePipelineTriggerSchema) },
-    { name: "delete_pipeline_trigger", description: "Delete a project pipeline trigger", inputSchema: toJSONSchema(PipelineTriggerIdSchema) },
-    { name: "trigger_pipeline", description: "Trigger a pipeline with a pipeline trigger token", inputSchema: toJSONSchema(TriggerPipelineSchema) },
+    {
+        name: "update_environment",
+        description: "Update an environment",
+        inputSchema: toJSONSchema(UpdateEnvironmentSchema),
+    },
+    {
+        name: "delete_environment",
+        description: "Delete a stopped environment",
+        inputSchema: toJSONSchema(GetEnvironmentSchema),
+    },
+    {
+        name: "stop_environment",
+        description: "Stop an environment",
+        inputSchema: toJSONSchema(StopEnvironmentSchema),
+    },
+    {
+        name: "stop_stale_environments",
+        description: "Stop eligible stale environments; protected environments are excluded and environments are stopped, not deleted",
+        inputSchema: toJSONSchema(StopStaleEnvironmentsSchema),
+    },
+    {
+        name: "delete_review_app_environments",
+        description: "Schedule deletion of stopped review-app environments one week later; dry_run defaults to true and actual scheduling requires dry_run=false",
+        inputSchema: toJSONSchema(DeleteReviewAppEnvironmentsSchema),
+    },
+    {
+        name: "list_pipeline_triggers",
+        description: "List project pipeline trigger tokens",
+        inputSchema: toJSONSchema(ListPipelineTriggersSchema),
+    },
+    {
+        name: "get_pipeline_trigger",
+        description: "Get a project pipeline trigger",
+        inputSchema: toJSONSchema(PipelineTriggerIdSchema),
+    },
+    {
+        name: "create_pipeline_trigger",
+        description: "Create a project pipeline trigger",
+        inputSchema: toJSONSchema(CreatePipelineTriggerSchema),
+    },
+    {
+        name: "update_pipeline_trigger",
+        description: "Update a project pipeline trigger",
+        inputSchema: toJSONSchema(UpdatePipelineTriggerSchema),
+    },
+    {
+        name: "delete_pipeline_trigger",
+        description: "Delete a project pipeline trigger",
+        inputSchema: toJSONSchema(PipelineTriggerIdSchema),
+    },
+    {
+        name: "trigger_pipeline",
+        description: "Trigger a pipeline with a pipeline trigger token",
+        inputSchema: toJSONSchema(TriggerPipelineSchema),
+    },
     {
         name: "list_pipeline_jobs",
         description: "List all jobs in a specific pipeline",
@@ -734,9 +814,21 @@ export const allTools = [
         description: "Cancel a running pipeline job",
         inputSchema: toJSONSchema(CancelPipelineJobSchema),
     },
-    { name: "erase_pipeline_job", description: "Erase a pipeline job log and artifacts", inputSchema: toJSONSchema(ErasePipelineJobSchema) },
-    { name: "wait_for_pipeline", description: "Wait for a pipeline to reach a terminal status", inputSchema: toJSONSchema(WaitForPipelineSchema) },
-    { name: "wait_for_job", description: "Wait for a job to reach a terminal status", inputSchema: toJSONSchema(WaitForPipelineJobSchema) },
+    {
+        name: "erase_pipeline_job",
+        description: "Erase a pipeline job log and artifacts",
+        inputSchema: toJSONSchema(ErasePipelineJobSchema),
+    },
+    {
+        name: "wait_for_pipeline",
+        description: "Wait for a pipeline to reach a terminal status",
+        inputSchema: toJSONSchema(WaitForPipelineSchema),
+    },
+    {
+        name: "wait_for_job",
+        description: "Wait for a job to reach a terminal status",
+        inputSchema: toJSONSchema(WaitForPipelineJobSchema),
+    },
     {
         name: "list_job_artifacts",
         description: "List artifact files in a job's archive",
@@ -1432,6 +1524,12 @@ export const readOnlyTools = new Set([
     "orbit_get_status",
     "orbit_list_tools",
 ]);
+// Stays in readOnlyTools so readonly mode can still run queries, but mutations
+// are allowed in other permission modes and rejected only at call time.
+const MIXED_ACCESS_TOOLS = new Set(["execute_graphql"]);
+export function advertisesReadOnly(toolName) {
+    return readOnlyTools.has(toolName) && !MIXED_ACCESS_TOOLS.has(toolName);
+}
 // Define which tools are destructive (data loss potential)
 export const destructiveTools = new Set([
     "delete_pipeline",
@@ -1620,8 +1718,52 @@ export const pipelineToolNames = new Set([
 ]);
 export const TOOLSET_DEFINITIONS = [
     {
-        id: "merge_requests",
+        id: "core",
         isDefault: true,
+        tools: new Set([
+            "list_merge_requests",
+            "get_merge_request",
+            "get_merge_request_approval_state",
+            "list_merge_request_changed_files",
+            "get_merge_request_file_diff",
+            "list_merge_request_diffs",
+            "get_merge_request_diffs",
+            "mr_discussions",
+            "get_merge_request_discussion",
+            "get_merge_request_note",
+            "get_merge_request_notes",
+            "create_merge_request",
+            "create_merge_request_thread",
+            "resolve_merge_request_thread",
+            "update_merge_request",
+            "list_issues",
+            "my_issues",
+            "get_issue",
+            "create_issue",
+            "update_issue",
+            "create_issue_note",
+            "list_issue_discussions",
+            "update_issue_description_patch",
+            "get_file_contents",
+            "get_repository_tree",
+            "search_repositories",
+            "get_branch",
+            "list_branches",
+            "list_commits",
+            "get_commit",
+            "get_commit_diff",
+            "get_file_blame",
+            "get_project",
+            "list_projects",
+            "list_project_members",
+            "list_labels",
+            "whoami",
+            "health_check",
+        ]),
+    },
+    {
+        id: "merge_requests",
+        isDefault: false,
         tools: new Set([
             "merge_merge_request",
             "approve_merge_request",
@@ -1672,7 +1814,7 @@ export const TOOLSET_DEFINITIONS = [
     },
     {
         id: "issues",
-        isDefault: true,
+        isDefault: false,
         tools: new Set([
             "create_issue",
             "list_issues",
@@ -1702,7 +1844,7 @@ export const TOOLSET_DEFINITIONS = [
     },
     {
         id: "repositories",
-        isDefault: true,
+        isDefault: false,
         tools: new Set([
             "search_repositories",
             "create_repository",
@@ -1715,7 +1857,7 @@ export const TOOLSET_DEFINITIONS = [
     },
     {
         id: "branches",
-        isDefault: true,
+        isDefault: false,
         tools: new Set([
             "create_branch",
             "get_branch",
@@ -1736,7 +1878,7 @@ export const TOOLSET_DEFINITIONS = [
     },
     {
         id: "projects",
-        isDefault: true,
+        isDefault: false,
         tools: new Set([
             "get_project",
             "list_projects",
@@ -1753,18 +1895,12 @@ export const TOOLSET_DEFINITIONS = [
     },
     {
         id: "labels",
-        isDefault: true,
-        tools: new Set([
-            "list_labels",
-            "get_label",
-            "create_label",
-            "update_label",
-            "delete_label",
-        ]),
+        isDefault: false,
+        tools: new Set(["list_labels", "get_label", "create_label", "update_label", "delete_label"]),
     },
     {
         id: "ci",
-        isDefault: true,
+        isDefault: false,
         tools: new Set([
             "validate_ci_lint",
             "validate_project_ci_lint",
@@ -1774,7 +1910,7 @@ export const TOOLSET_DEFINITIONS = [
     },
     {
         id: "groups",
-        isDefault: true,
+        isDefault: false,
         tools: new Set(["create_group"]),
     },
     {
@@ -1894,13 +2030,7 @@ export const TOOLSET_DEFINITIONS = [
     {
         id: "tags",
         isDefault: false,
-        tools: new Set([
-            "list_tags",
-            "get_tag",
-            "create_tag",
-            "delete_tag",
-            "get_tag_signature",
-        ]),
+        tools: new Set(["list_tags", "get_tag", "create_tag", "delete_tag", "get_tag_signature"]),
     },
     {
         id: "snippets",
@@ -1915,7 +2045,7 @@ export const TOOLSET_DEFINITIONS = [
     },
     {
         id: "users",
-        isDefault: true,
+        isDefault: false,
         tools: new Set([
             "get_users",
             "get_user",
@@ -2009,18 +2139,29 @@ export const TOOLSET_DEFINITIONS = [
         tools: new Set(["orbit_query", "orbit_get_schema", "orbit_get_status", "orbit_list_tools"]),
     },
 ];
-// Derived lookup: tool name → toolset ID
-export const TOOLSET_BY_TOOL_NAME = new Map();
+// Derived lookup: tool name → toolset IDs. Most tools belong to one category.
+// The default `core` toolset intentionally overlaps with the full opt-in
+// categories so users get a small starter surface without losing the ability
+// to enable complete categories later.
+export const TOOLSETS_BY_TOOL_NAME = new Map();
 for (const def of TOOLSET_DEFINITIONS) {
     for (const tool of def.tools) {
-        if (TOOLSET_BY_TOOL_NAME.has(tool)) {
-            console.warn(`Tool "${tool}" is defined in multiple toolsets: "${TOOLSET_BY_TOOL_NAME.get(tool)}" and "${def.id}"`);
-        }
-        TOOLSET_BY_TOOL_NAME.set(tool, def.id);
+        const toolsets = TOOLSETS_BY_TOOL_NAME.get(tool) ?? new Set();
+        toolsets.add(def.id);
+        TOOLSETS_BY_TOOL_NAME.set(tool, toolsets);
     }
 }
 export const DEFAULT_TOOLSET_IDS = new Set(TOOLSET_DEFINITIONS.filter(d => d.isDefault).map(d => d.id));
 export const ALL_TOOLSET_IDS = new Set(TOOLSET_DEFINITIONS.map(d => d.id));
+/**
+ * Smallest toolset containing the tool, i.e. the cheapest category to activate for it.
+ * Returns undefined for tools outside every toolset (e.g. `execute_graphql`) and unknown names.
+ */
+export function findSmallestToolsetForTool(toolName) {
+    const candidates = TOOLSET_DEFINITIONS.filter(d => d.tools.has(toolName));
+    const smallest = candidates.reduce((best, d) => (best === undefined || d.tools.size < best.tools.size ? d : best), undefined);
+    return smallest?.id;
+}
 // Update discover_tools description with all known categories (must be after TOOLSET_DEFINITIONS)
 const discoverTool = allTools.find(t => t.name === "discover_tools");
 if (discoverTool) {
@@ -2080,9 +2221,37 @@ export function buildFeatureFlagOverrides() {
     return overrides;
 }
 export function isToolInEnabledToolset(toolName, enabledToolsets) {
-    const toolsetId = TOOLSET_BY_TOOL_NAME.get(toolName);
+    const toolsetIds = TOOLSETS_BY_TOOL_NAME.get(toolName);
     // Tools not in any toolset (e.g. execute_graphql) are excluded by default
-    if (toolsetId === undefined)
+    if (toolsetIds === undefined)
         return false;
-    return enabledToolsets.has(toolsetId);
+    for (const toolsetId of toolsetIds) {
+        if (enabledToolsets.has(toolsetId))
+            return true;
+    }
+    return false;
+}
+/**
+ * True only when every tool in the set is already exposed.
+ * Partial overlap (for example `core` sharing names with `merge_requests`) is not active.
+ * `isExcluded` covers tools the caller will not list; those do not keep the toolset inactive.
+ * An empty set is fully active, matching `Array.prototype.every`.
+ */
+export function isToolsetFullyActive(tools, currentToolNames, isExcluded) {
+    for (const toolName of tools) {
+        if (currentToolNames.has(toolName) || isExcluded?.(toolName)) {
+            continue;
+        }
+        return false;
+    }
+    return true;
+}
+/** Category listing returned by `discover_tools` when no category argument is given. */
+export function listDiscoverableCategories(currentToolNames, isExcluded) {
+    return TOOLSET_DEFINITIONS.map(def => ({
+        id: def.id,
+        toolCount: def.tools.size,
+        active: isToolsetFullyActive(def.tools, currentToolNames, isExcluded),
+        isDefault: def.isDefault,
+    }));
 }

package/build/tools/tool-descriptions.js

@@ -9,7 +9,7 @@ const TOOL_GUIDANCE = {
     push_files: "Use this to commit several file changes atomically; use `create_or_update_file` when only one path is involved. Each file defaults to action `create`; optional per-file `action` (create/update/delete/move) and `encoding` (text/base64) are additive. `GITLAB_PERMISSION_MODE=modify` rejects `delete` and `move`. The operation writes repository history on the selected branch, requires repository write permission, and returns the commit result or a validation, conflict, or protected-branch error.",
     create_issue: "Use this to open a new issue; use `update_issue` for an existing issue and `create_issue_note` to add discussion without changing issue fields. The operation creates remote project data, requires issue creation permission, and returns the new issue or a validation, permission, or duplicate-related error.",
     list_issues: "Use this for issue management: list GitLab issues, optionally scoped with `project_id`. Use `get_issue` when the issue iid is already known and `my_issues` for issues assigned to the current user. It is read-only and paginated, requires issue read permission, and returns issue records or GitLab errors for invalid identifiers, missing resources, or rate limits.",
-    my_issues: "Use this for issue management: list issues assigned to the authenticated user. Use `list_issues` for project-wide or author-scoped listing and `get_issue` for one issue. It is read-only and paginated, requires authentication, and returns assigned issue records or permission/rate-limit errors.",
+    my_issues: "Use this for issue management: list issues assigned to the authenticated user. Use `list_issues` for project-wide or author-scoped listing and `get_issue` for one issue. Resolving the current user requires classic read_user or fine-grained User:Read. It is read-only and paginated, requires authentication, and returns assigned issue records or permission/rate-limit errors.",
     get_issue: "Use this for issue management: inspect one issue's fields; use `list_issues` or `my_issues` to discover issues first. It is read-only, requires issue read permission, and returns the issue or an error when the identifier is invalid, the issue is missing, or access is denied.",
     create_merge_request: "Use this to open a new merge request from an existing source branch to a target branch; use `update_merge_request` after it exists. The operation creates remote review state, requires project access, and returns the new merge request or a validation, permission, branch, or duplicate-related error.",
     fork_repository: "Use this to create a copy of an existing project in the current user's namespace or a permitted namespace; use `search_repositories` or `get_project` to inspect projects without copying them. The operation creates a new project, requires fork permission, and returns the forked project or a namespace/permission error.",
@@ -36,8 +36,8 @@ const TOOL_GUIDANCE = {
     download_attachment: "Use this to retrieve a previously uploaded project attachment; remote mode returns inline base64 for images or a download URL, while local mode can save to a path. It is read-only with respect to GitLab, requires project access, and returns the file content or an attachment/permission error.",
     execute_graphql: "Use this only when a supported GitLab REST tool does not cover the requested operation; prefer a typed tool when one exists. The query is sent directly to GitLab and can include mutations when permission allows, so callers must treat it as potentially state-changing and handle GraphQL errors in the returned response.",
     discover_tools: "Use this when a needed opt-in category is not currently exposed; omit `category` to inspect available categories, then call it with a category to activate that group for the current session. It changes only the session's tool registry, returns the active-tool summary, and does not change GitLab data.",
-    health_check: "Use this to verify server connectivity and authentication before making GitLab requests; use `whoami` when the authenticated user's identity is the goal. It does not mutate GitLab state and returns server/authentication status plus GitLab version details when available.",
-    whoami: "Use this to identify the authenticated GitLab user; use `get_user` or `get_users` when looking up another user. It is read-only and returns the current user profile, while missing credentials or GitLab permission failures are reported as errors.",
+    health_check: "Use this to verify server connectivity and authentication before making GitLab requests; use `whoami` when the authenticated user's identity is the goal. A 403 from GET /user with an insufficient_scope error means the token is accepted but User API scope is missing (read_user or fine-grained User:Read); the check stays ok, sets user_api_warning, and omits version metadata. Rate-limit and authentication-ban 403 responses stay unauthenticated. It does not mutate GitLab state and returns server/authentication status plus GitLab version details when available.",
+    whoami: "Use this to identify the authenticated GitLab user; use `get_user` or `get_users` when looking up another user. It requires classic read_user or fine-grained User:Read. It is read-only and returns the current user profile, while missing credentials or GitLab permission failures are reported as errors.",
     list_pipeline_schedules: "Use this to survey a project's scheduled pipelines and their `cron`, `next_run_at`, and `active` state, optionally narrowed with `scope` to `active` or `inactive`; use `list_pipelines` for pipelines that already ran and `get_pipeline_schedule` when the schedule ID is known. The list response carries no `variables` — call `get_pipeline_schedule` for those — and includes `inputs` only for Maintainers, Owners, or the schedule owner. It is read-only and paginated, requires project access, and returns schedule records or an error when the project is missing or access is denied.",
     get_pipeline_schedule: "Use this to inspect one schedule's cron, owner, last pipeline, variables, and inputs; use `list_pipeline_schedules` to discover schedule IDs and `list_pipeline_schedule_pipelines` for the pipelines it produced. It is read-only, returns `variables` and `inputs` only to Maintainers, Owners, or the schedule owner, and returns the schedule or an error when the schedule is missing or access is denied.",
     list_pipeline_schedule_pipelines: "Use this to review the pipelines a schedule has actually triggered, for example to see whether the nightly run succeeded; use `get_pipeline` for one pipeline's full detail and `list_pipelines` for project-wide filtering. Narrow the result with `scope`, `status`, `sort`, and the `created_*` / `updated_*` date bounds. It is read-only and paginated, requires project access, and returns pipeline records or an error when the schedule is missing or access is denied.",

package/build/tools/tool-profile.js

@@ -0,0 +1,66 @@
+export const TOOL_PROFILES = ["full", "slim"];
+/**
+ * Tools omitted from the initial list when `GITLAB_TOOL_PROFILE=slim` and
+ * `GITLAB_TOOLSETS` is unset. `discover_tools` does not add them back.
+ * `GITLAB_TOOLS` can still name one explicitly.
+ */
+export const SLIM_PROFILE_EXCLUDED_TOOLS = new Set([
+    "get_draft_note",
+    "list_draft_notes",
+    "create_draft_note",
+    "update_draft_note",
+    "delete_draft_note",
+    "publish_draft_note",
+    "bulk_publish_draft_notes",
+    "list_merge_request_emoji_reactions",
+    "list_merge_request_note_emoji_reactions",
+    "create_merge_request_emoji_reaction",
+    "delete_merge_request_emoji_reaction",
+    "create_merge_request_note_emoji_reaction",
+    "delete_merge_request_note_emoji_reaction",
+    "list_issue_emoji_reactions",
+    "list_issue_note_emoji_reactions",
+    "create_issue_emoji_reaction",
+    "delete_issue_emoji_reaction",
+    "create_issue_note_emoji_reaction",
+    "delete_issue_note_emoji_reaction",
+    "list_labels",
+    "get_label",
+    "create_label",
+    "update_label",
+    "delete_label",
+    "validate_ci_lint",
+    "validate_project_ci_lint",
+    "list_ci_catalog_resources",
+    "get_ci_catalog_resource",
+    "create_group",
+]);
+export function parseToolProfile(raw) {
+    if (raw === undefined) {
+        return "full";
+    }
+    const normalized = raw.trim().toLowerCase();
+    if (normalized === "" || normalized === "full") {
+        return "full";
+    }
+    if (normalized === "slim") {
+        return "slim";
+    }
+    throw new Error(`Invalid GITLAB_TOOL_PROFILE: "${raw}". Expected one of: ${TOOL_PROFILES.join(", ")}`);
+}
+/** Slim applies only when the caller did not pin an explicit toolset list. */
+export function shouldApplySlimToolProfile(profile, toolsetsRaw) {
+    if (profile !== "slim") {
+        return false;
+    }
+    return toolsetsRaw === undefined || toolsetsRaw.trim() === "";
+}
+export function isExcludedBySlimProfile(toolName, applySlimProfile, explicitlyEnabledTools) {
+    if (!applySlimProfile) {
+        return false;
+    }
+    if (explicitlyEnabledTools.has(toolName)) {
+        return false;
+    }
+    return SLIM_PROFILE_EXCLUDED_TOOLS.has(toolName);
+}

package/build/utils/compact-tool-allowlist.js

@@ -0,0 +1,14 @@
+/** Tool names that compact oversized replies even when global compact mode is off. */
+export function parseCompactToolAllowlist(raw) {
+    if (raw === undefined || raw.trim() === "") {
+        return new Set();
+    }
+    const names = raw
+        .split(",")
+        .map(name => name.trim())
+        .filter(name => name.length > 0);
+    return new Set(names);
+}
+export function shouldCompactToolResult(toolName, globalEnabled, allowlist) {
+    return globalEnabled || allowlist.has(toolName);
+}

package/build/utils/logger.js

@@ -1,4 +1,6 @@
+import { createRequire } from "node:module";
 import { pino } from "pino";
+const require = createRequire(import.meta.url);
 const REDACT_PATHS = [
     "token",
     "*.token",
@@ -23,6 +25,31 @@ const REDACT_PATHS = [
     "arguments.approval_password",
     "params.arguments.approval_password",
 ];
+function isPrettyFactory(value) {
+    return typeof value === "function";
+}
+function isPrettyModule(value) {
+    if (typeof value !== "object" || value === null || !("default" in value)) {
+        return false;
+    }
+    return isPrettyFactory(value.default);
+}
+/**
+ * Pretty-print in process. The worker transport has the same text format, but
+ * it spawns a thread on every logger, including stdio MCP startup.
+ * LOG_FORMAT=json still skips pino-pretty entirely.
+ */
+function createPrettyStream() {
+    const loaded = require("pino-pretty");
+    const options = { colorize: true, levelFirst: true, destination: 2 };
+    if (isPrettyFactory(loaded)) {
+        return loaded(options);
+    }
+    if (isPrettyModule(loaded)) {
+        return loaded.default(options);
+    }
+    throw new Error("pino-pretty did not export a stream factory");
+}
 /**
  * Create a pino logger with consistent redaction, level, format, and
  * destination across the entire codebase.
@@ -30,26 +57,21 @@ const REDACT_PATHS = [
  * - LOG_LEVEL (default "info") controls the minimum severity.
  * - LOG_FORMAT=json disables pino-pretty and outputs newline-delimited JSON
  *   to stderr.
+ * - Any other value, including unset, keeps human-readable pino-pretty output.
  * - All loggers redact the same set of sensitive fields.
  */
 export function createLogger(name) {
     const isJson = process.env.LOG_FORMAT === "json";
-    return pino({
+    const options = {
         ...(name && { name }),
         level: process.env.LOG_LEVEL || "info",
         redact: {
             paths: REDACT_PATHS,
             censor: "[REDACTED]",
         },
-        ...(!isJson && {
-            transport: {
-                target: "pino-pretty",
-                options: {
-                    colorize: true,
-                    levelFirst: true,
-                    destination: 2,
-                },
-            },
-        }),
-    }, ...(isJson ? [pino.destination(2)] : []));
+    };
+    if (isJson) {
+        return pino(options, pino.destination(2));
+    }
+    return pino(options, createPrettyStream());
 }