@zereight/mcp-gitlab 2.1.8 → 2.1.10

package/README.md

@@ -129,7 +129,7 @@ docker run -i --rm \
 ```shell
 docker run -i --rm \
   -e HOST=0.0.0.0 \
-  -e GITLAB_PERSONAL_ACCESS_TOKEN=your_gitlab_token \
+  -e REMOTE_AUTHORIZATION=true \
   -e GITLAB_API_URL="https://gitlab.com/api/v4" \
   -e GITLAB_READ_ONLY_MODE=true \
   -e USE_GITLAB_WIKI=true \
@@ -145,7 +145,10 @@ docker run -i --rm \
   "mcpServers": {
     "gitlab": {
       "type": "streamable-http",
-      "url": "http://localhost:3333/mcp"
+      "url": "http://localhost:3333/mcp",
+      "headers": {
+        "Authorization": "Bearer glpat-..."
+      }
     }
   }
 }
@@ -206,6 +209,8 @@ exchanging credentials with GitLab on behalf of the client.
 | `GITLAB_OAUTH_CALLBACK_PROXY` | optional | Set to `true` to use the MCP server's fixed `/callback` URL |
 | `GITLAB_OAUTH_SCOPES` | optional | Comma-separated scopes (default: `api,read_api,read_user`) |
 
+When `STREAMABLE_HTTP=true`, server-side `GITLAB_PERSONAL_ACCESS_TOKEN` or `GITLAB_JOB_TOKEN` require `REMOTE_AUTHORIZATION=true` or `GITLAB_MCP_OAUTH=true`.
+
 > **Troubleshooting `Unregistered redirect_uri`**
 >
 > Check the `redirect_uri` in the browser URL. If it points to a client callback
@@ -601,42 +606,44 @@ Register the skill directory in your AI client to get optimal tool usage guidanc
 113. `list_commits` - List repository commits with filtering options
 114. `get_commit` - Get details of a specific commit
 115. `get_commit_diff` - Get changes/diffs of a specific commit
-116. `list_releases` - List all releases for a project
-117. `get_release` - Get a release by tag name
-118. `create_release` - Create a new release in a GitLab project
-119. `update_release` - Update an existing release in a GitLab project
-120. `delete_release` - Delete a release from a GitLab project (does not delete the associated tag)
-121. `create_release_evidence` - Create release evidence for an existing release (GitLab Premium/Ultimate only)
-122. `download_release_asset` - Download a release asset file by direct asset path
-123. `list_tags` - List repository tags with filtering and pagination support
-124. `get_tag` - Get details of a specific repository tag
-125. `create_tag` - Create a new tag in the repository
-126. `delete_tag` - Delete a tag from the repository
-127. `get_tag_signature` - Get the signature of a signed tag
-128. `get_users` - Get GitLab user details by usernames
-129. `list_events` - List all events for the currently authenticated user
-130. `get_project_events` - List all visible events for a specified project
-131. `upload_markdown` - Upload a file to a GitLab project for use in markdown content
-132. `download_attachment` - Download an uploaded file from a GitLab project by secret and filename
-133. `get_work_item` - Get a single work item with full details including status, hierarchy (parent/children), type, labels, assignees, and all widgets
-134. `list_work_items` - List work items in a project with filters (type, state, search, assignees, labels). Returns items with status and hierarchy info
-135. `create_work_item` - Create a new work item (issue, task, incident, test_case, epic, key_result, objective, requirement, ticket). Supports setting title, description, labels, assignees, weight, parent, health status, start/due dates, milestone, and confidentiality
-136. `update_work_item` - Update a work item. Can modify title, description, labels, assignees, weight, state, status, parent hierarchy, children, health status, start/due dates, milestone, confidentiality, linked items, and custom fields
-137. `convert_work_item_type` - Convert a work item to a different type (e.g. issue to task, task to incident)
-138. `list_work_item_statuses` - List available statuses for a work item type in a project. Requires GitLab Premium/Ultimate with configurable statuses
-139. `list_custom_field_definitions` - List available custom field definitions for a work item type in a project. Returns field names, types, and IDs needed for setting custom fields via update_work_item
-140. `move_work_item` - Move a work item (issue, task, etc.) to a different project. Uses GitLab GraphQL issueMove mutation
-141. `list_work_item_notes` - List notes and discussions on a work item. Returns threaded discussions with author, body, timestamps, and system/internal flags
-142. `create_work_item_note` - Add a note/comment to a work item. Supports Markdown, internal notes, and threaded replies
-143. `get_timeline_events` - List timeline events for an incident. Returns chronological events with notes, timestamps, and tags
-144. `create_timeline_event` - Create a timeline event on an incident. Supports tags: 'Start time', 'End time', 'Impact detected', 'Response initiated', 'Impact mitigated', 'Cause identified'
-145. `list_webhooks` - List all configured webhooks for a GitLab project or group. Provide either project_id or group_id
-146. `list_webhook_events` - List recent webhook events (past 7 days) for a project or group webhook. Use summary mode for overview, then get_webhook_event for full details
-147. `get_webhook_event` - Get full details of a specific webhook event by ID, including request/response payloads
-148. `search_code` - Search for code across all projects on the GitLab instance (requires advanced search or exact code search to be enabled)
-149. `search_project_code` - Search for code within a specific GitLab project (requires advanced search or exact code search to be enabled)
-150. `search_group_code` - Search for code within a specific GitLab group (requires advanced search or exact code search to be enabled)
-151. `execute_graphql` - Execute a GitLab GraphQL query
+116. `list_commit_statuses` - List statuses for a specific commit
+117. `create_commit_status` - Create or update the status of a specific commit
+118. `list_releases` - List all releases for a project
+119. `get_release` - Get a release by tag name
+120. `create_release` - Create a new release in a GitLab project
+121. `update_release` - Update an existing release in a GitLab project
+122. `delete_release` - Delete a release from a GitLab project (does not delete the associated tag)
+123. `create_release_evidence` - Create release evidence for an existing release (GitLab Premium/Ultimate only)
+124. `download_release_asset` - Download a release asset file by direct asset path
+125. `list_tags` - List repository tags with filtering and pagination support
+126. `get_tag` - Get details of a specific repository tag
+127. `create_tag` - Create a new tag in the repository
+128. `delete_tag` - Delete a tag from the repository
+129. `get_tag_signature` - Get the signature of a signed tag
+130. `get_users` - Get GitLab user details by usernames
+131. `list_events` - List all events for the currently authenticated user
+132. `get_project_events` - List all visible events for a specified project
+133. `upload_markdown` - Upload a file to a GitLab project for use in markdown content
+134. `download_attachment` - Download an uploaded file from a GitLab project by secret and filename
+135. `get_work_item` - Get a single work item with full details including status, hierarchy (parent/children), type, labels, assignees, and all widgets
+136. `list_work_items` - List work items in a project with filters (type, state, search, assignees, labels). Returns items with status and hierarchy info
+137. `create_work_item` - Create a new work item (issue, task, incident, test_case, epic, key_result, objective, requirement, ticket). Supports setting title, description, labels, assignees, weight, parent, health status, start/due dates, milestone, and confidentiality
+138. `update_work_item` - Update a work item. Can modify title, description, labels, assignees, weight, state, status, parent hierarchy, children, health status, start/due dates, milestone, confidentiality, linked items, and custom fields
+139. `convert_work_item_type` - Convert a work item to a different type (e.g. issue to task, task to incident)
+140. `list_work_item_statuses` - List available statuses for a work item type in a project. Requires GitLab Premium/Ultimate with configurable statuses
+141. `list_custom_field_definitions` - List available custom field definitions for a work item type in a project. Returns field names, types, and IDs needed for setting custom fields via update_work_item
+142. `move_work_item` - Move a work item (issue, task, etc.) to a different project. Uses GitLab GraphQL issueMove mutation
+143. `list_work_item_notes` - List notes and discussions on a work item. Returns threaded discussions with author, body, timestamps, and system/internal flags
+144. `create_work_item_note` - Add a note/comment to a work item. Supports Markdown, internal notes, and threaded replies
+145. `get_timeline_events` - List timeline events for an incident. Returns chronological events with notes, timestamps, and tags
+146. `create_timeline_event` - Create a timeline event on an incident. Supports tags: 'Start time', 'End time', 'Impact detected', 'Response initiated', 'Impact mitigated', 'Cause identified'
+147. `list_webhooks` - List all configured webhooks for a GitLab project or group. Provide either project_id or group_id
+148. `list_webhook_events` - List recent webhook events (past 7 days) for a project or group webhook. Use summary mode for overview, then get_webhook_event for full details
+149. `get_webhook_event` - Get full details of a specific webhook event by ID, including request/response payloads
+150. `search_code` - Search for code across all projects on the GitLab instance (requires advanced search or exact code search to be enabled)
+151. `search_project_code` - Search for code within a specific GitLab project (requires advanced search or exact code search to be enabled)
+152. `search_group_code` - Search for code within a specific GitLab group (requires advanced search or exact code search to be enabled)
+153. `execute_graphql` - Execute a GitLab GraphQL query
 
 <!-- TOOLS-END -->
 

package/build/index.js

@@ -25,12 +25,12 @@ import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middlew
 import { GitLabClientPool } from "./gitlab-client-pool.js";
 import { allTools, readOnlyTools, destructiveTools, parseEnabledToolsets, parseIndividualTools, buildFeatureFlagOverrides, isToolInEnabledToolset, TOOLSET_DEFINITIONS, ALL_TOOLSET_IDS, } from "./tools/registry.js";
 import { BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, // Added
-CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateMergeRequestNoteEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateRepositorySchema, CreateWikiPageSchema, CreateGroupWikiPageSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteProjectMilestoneSchema, DeleteWikiPageSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, EditProjectMilestoneSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetDraftNoteSchema, GetFileContentsSchema, GetIssueLinkSchema, GetIssueSchema, GetLabelSchema, GetMergeRequestDiffsSchema, GetMergeRequestSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetDeploymentSchema, GetEnvironmentSchema, GetNamespaceSchema, GitLabCiLintResultSchema, GetPipelineJobOutputSchema, GetPipelineSchema, GetProjectMilestoneSchema, GetProjectSchema, GetRepositoryTreeSchema, GetUsersSchema, GetWikiPageSchema, GitLabCommitSchema, GitLabCompareResultSchema, GitLabContentSchema, GitLabCreateUpdateFileResponseSchema, GitLabDiffSchema, 
+CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateMergeRequestNoteEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateRepositorySchema, CreateWikiPageSchema, CreateGroupWikiPageSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteProjectMilestoneSchema, DeleteWikiPageSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, EditProjectMilestoneSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetDraftNoteSchema, GetFileContentsSchema, GetIssueLinkSchema, GetIssueSchema, GetLabelSchema, GetMergeRequestDiffsSchema, GetMergeRequestSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetDeploymentSchema, GetEnvironmentSchema, GetNamespaceSchema, GitLabCiLintResultSchema, GetPipelineJobOutputSchema, GetPipelineSchema, GetProjectMilestoneSchema, GetProjectSchema, GetRepositoryTreeSchema, GetUsersSchema, GetWikiPageSchema, GitLabCommitSchema, GitLabCommitStatusSchema, GitLabCompareResultSchema, GitLabContentSchema, GitLabCreateUpdateFileResponseSchema, GitLabDiffSchema, 
 // Discussion Schemas
 GitLabDiscussionNoteSchema, // Added
 GitLabDiscussionSchema, 
 // Draft Notes Schemas
-GitLabDraftNoteSchema, GitLabForkSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
+GitLabDraftNoteSchema, GitLabForkSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
 GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateLabelSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, GitLabTagSchema, GitLabTagSignatureSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, ListWebhookEventsSchema, GetWebhookEventSchema, } from "./schemas.js";
 import { randomUUID } from "node:crypto";
 import { pino } from "pino";
@@ -394,9 +394,13 @@ function validateConfiguration() {
     const hasCookie = !!getConfig("cookie-path", "GITLAB_AUTH_COOKIE_PATH");
     const mcpOAuth = getConfig("mcp-oauth", "GITLAB_MCP_OAUTH") === "true";
     const mcpServerUrl = getConfig("mcp-server-url", "MCP_SERVER_URL");
+    const streamableHttp = getConfig("streamable-http", "STREAMABLE_HTTP") === "true";
     if (!remoteAuth && !useOAuth && !hasToken && !hasJobToken && !hasCookie && !mcpOAuth) {
         errors.push("Either --token, --job-token, --cookie-path, --use-oauth=true, --remote-auth=true, or --mcp-oauth=true must be set (or use environment variables)");
     }
+    if (streamableHttp && (hasToken || hasJobToken) && !remoteAuth && !mcpOAuth) {
+        errors.push("STREAMABLE_HTTP=true/--streamable-http with GITLAB_PERSONAL_ACCESS_TOKEN/--token or GITLAB_JOB_TOKEN/--job-token requires REMOTE_AUTHORIZATION=true/--remote-auth=true or GITLAB_MCP_OAUTH=true/--mcp-oauth=true");
+    }
     if (mcpOAuth) {
         if (!mcpServerUrl) {
             errors.push("MCP_SERVER_URL is required when GITLAB_MCP_OAUTH=true (e.g. https://mcp.example.com)");
@@ -5387,6 +5391,56 @@ async function getCommitDiff(projectId, sha, full_diff) {
     }
     return allDiffs;
 }
+/**
+ * List statuses for a commit.
+ *
+ * @param {string} projectId - Project ID or URL-encoded path
+ * @param {string} sha - The commit hash or name of a repository branch or tag
+ * @param {ListCommitStatusesOptions} options - List commit statuses options
+ * @returns {Promise<GitLabCommitStatus[]>} List of commit statuses
+ */
+async function listCommitStatuses(projectId, sha, options = {}) {
+    projectId = decodeURIComponent(projectId);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/commits/${encodeURIComponent(sha)}/statuses`);
+    Object.entries(options).forEach(([key, value]) => {
+        if (value !== undefined) {
+            url.searchParams.append(key, value.toString());
+        }
+    });
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return z.array(GitLabCommitStatusSchema).parse(data);
+}
+/**
+ * Create or update a commit status.
+ *
+ * @param {string} projectId - Project ID or URL-encoded path
+ * @param {string} sha - The commit hash
+ * @param {CreateCommitStatusOptions} options - Commit status fields
+ * @returns {Promise<GitLabCommitStatus>} The created commit status
+ */
+async function createCommitStatus(projectId, sha, options) {
+    if (options.name && options.context) {
+        throw new Error("Use either name or context when creating a commit status, not both.");
+    }
+    projectId = decodeURIComponent(projectId);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/statuses/${encodeURIComponent(sha)}`);
+    Object.entries(options).forEach(([key, value]) => {
+        if (value !== undefined) {
+            url.searchParams.append(key, value.toString());
+        }
+    });
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+        method: "POST",
+    });
+    await handleGitLabError(response);
+    const data = await response.json();
+    return GitLabCommitStatusSchema.parse(data);
+}
 /**
  * Get the current authenticated user
  * 현재 인증된 사용자 가져오기
@@ -7266,6 +7320,22 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(diff, null, 2) }],
                 };
             }
+            case "list_commit_statuses": {
+                const args = ListCommitStatusesSchema.parse(params.arguments);
+                const { project_id, sha, ...options } = args;
+                const statuses = await listCommitStatuses(project_id, sha, options);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(statuses, null, 2) }],
+                };
+            }
+            case "create_commit_status": {
+                const args = CreateCommitStatusSchema.parse(params.arguments);
+                const { project_id, sha, ...options } = args;
+                const status = await createCommitStatus(project_id, sha, options);
+                return {
+                    content: [{ type: "text", text: JSON.stringify(status, null, 2) }],
+                };
+            }
             case "list_group_iterations": {
                 const args = ListGroupIterationsSchema.parse(params.arguments);
                 const iterations = await listGroupIterations(args.group_id, args);
@@ -7977,11 +8047,10 @@ async function startStreamableHTTPServer() {
         app._mcpOAuthProvider = oauthProvider;
         // Mount /callback route for callback proxy mode
         if (GITLAB_OAUTH_CALLBACK_PROXY) {
-            const callbackPath = `${issuerUrl.pathname.replace(/\/$/, "")}/callback`;
-            app.get(callbackPath, (req, res, next) => {
+            app.get("/callback", (req, res, next) => {
                 oauthProvider.handleCallback(req, res).catch(next);
             });
-            logger.info(`Callback proxy mode enabled — ${callbackPath} route mounted`);
+            logger.info(`Callback proxy mode enabled — /callback route mounted`);
         }
     }
     // Build bearer-auth middleware — no-op unless GITLAB_MCP_OAUTH is enabled.

package/build/schemas.js

@@ -12,6 +12,16 @@ const coerceStringArray = z.preprocess((val) => {
     }
     return val;
 }, z.array(z.string()));
+const coerceBooleanString = z.preprocess((val) => {
+    if (typeof val === "string") {
+        const normalized = val.trim().toLowerCase();
+        if (normalized === "true")
+            return true;
+        if (normalized === "false")
+            return false;
+    }
+    return val;
+}, z.boolean());
 // Base schemas for common types
 export const GitLabAuthorSchema = z.object({
     name: z.string(),
@@ -699,6 +709,35 @@ export const GitLabCommitSchema = z.object({
     trailers: z.record(z.string()).optional().default({}), // Git trailers, may be empty object
     extended_trailers: z.record(z.array(z.string())).optional().default({}), // Extended trailers, may be empty object
 });
+export const GitLabCommitStatusSchema = z
+    .object({
+    id: z.coerce.number().optional(),
+    sha: z.string(),
+    ref: z.string().nullable().optional(),
+    status: z.string(),
+    name: z.string().optional(),
+    context: z.string().optional(),
+    target_url: z.string().nullable().optional(),
+    description: z.string().nullable().optional(),
+    coverage: z.coerce.number().nullable().optional(),
+    allow_failure: z.coerce.boolean().optional(),
+    created_at: z.string().optional(),
+    started_at: z.string().nullable().optional(),
+    finished_at: z.string().nullable().optional(),
+    author: z
+        .object({
+        id: z.coerce.number().optional(),
+        name: z.string().optional(),
+        username: z.string().optional(),
+        state: z.string().optional(),
+        avatar_url: z.string().nullable().optional(),
+        web_url: z.string().optional(),
+    })
+        .passthrough()
+        .nullable()
+        .optional(),
+})
+    .passthrough();
 // Reference schema
 export const GitLabReferenceSchema = z.object({
     name: z.string(), // Changed from ref to match GitLab API
@@ -926,6 +965,7 @@ export const GitLabMergeRequestSchema = z.object({
     author: GitLabUserSchema,
     assignees: z.array(GitLabUserSchema).optional(),
     reviewers: z.array(GitLabUserSchema).optional(),
+    milestone: GitLabMilestoneSchema.nullable().optional(),
     source_branch: z.string(),
     target_branch: z.string(),
     diff_refs: GitLabMergeRequestDiffRefSchema.nullable().optional(),
@@ -1364,6 +1404,15 @@ export const GetBranchDiffsSchema = ProjectParamsSchema.extend({
         .describe('Array of regex patterns to exclude files from the diff results. Each pattern is a JavaScript-compatible regular expression that matches file paths to ignore. Examples: ["^vendor/", "^test/mocks/", "\\.spec\\.ts$", "package-lock\\.json"]'),
 });
 export const GetMergeRequestSchema = ProjectParamsSchema.extend({
+    project_id: z
+        .preprocess(value => (value === undefined || value === null ? value : String(value)), z
+        .string({
+        required_error: "project_id is required",
+        invalid_type_error: "project_id is required",
+    })
+        .refine(value => value === "" || value.trim().length > 0, "project_id is required")
+        .transform(value => (value === "" ? value : value.trim())))
+        .describe("Project ID or complete URL-encoded path to project"),
     merge_request_iid: z.coerce.string().optional().describe("The IID of a merge request"),
     source_branch: z.string().optional().describe("Source branch name"),
 });
@@ -1781,7 +1830,8 @@ export const ListProjectsSchema = z
 })
     .merge(PaginationOptionsSchema);
 // Label operation schemas
-export const ListLabelsSchema = z.object({
+export const ListLabelsSchema = z
+    .object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     with_counts: z
         .coerce.boolean()
@@ -1789,7 +1839,8 @@ export const ListLabelsSchema = z.object({
         .describe("Whether or not to include issue and merge request counts"),
     include_ancestor_groups: z.coerce.boolean().optional().describe("Include ancestor groups"),
     search: z.string().optional().describe("Keyword to filter labels by"),
-});
+})
+    .merge(PaginationOptionsSchema);
 export const GetLabelSchema = z.object({
     project_id: z.coerce.string().describe("Project ID or URL-encoded path"),
     label_id: z.coerce.string().describe("The ID or title of a project's label"),
@@ -2214,6 +2265,44 @@ export const GetCommitDiffSchema = z.object({
         .optional()
         .describe("Whether to return the full diff or only first page (default: false)"),
 });
+export const ListCommitStatusesSchema = z
+    .object({
+    project_id: z.coerce.string().describe("Project ID or complete URL-encoded path to project"),
+    sha: z.string().describe("The commit hash or name of a repository branch or tag"),
+    ref: z.string().optional().describe("Filter statuses by Git ref"),
+    stage: z.string().optional().describe("Filter statuses by build stage"),
+    name: z.string().optional().describe("Filter statuses by status name or context"),
+    pipeline_id: z.coerce.number().optional().describe("Filter statuses by pipeline ID"),
+    order_by: z
+        .enum(["id", "pipeline_id"])
+        .optional()
+        .describe("Field to order statuses by"),
+    sort: z.enum(["asc", "desc"]).optional().describe("Sort direction"),
+    all: coerceBooleanString.optional().describe("Return all statuses, not only latest ones"),
+})
+    .merge(PaginationOptionsSchema);
+export const CreateCommitStatusSchema = z.object({
+    project_id: z.coerce.string().describe("Project ID or complete URL-encoded path to project"),
+    sha: z.string().describe("The commit hash to set the status on"),
+    state: z
+        .enum(["pending", "running", "success", "failed", "canceled", "skipped"])
+        .describe("Commit status state"),
+    ref: z.string().max(255).optional().describe("The branch or tag ref"),
+    name: z
+        .string()
+        .max(255)
+        .optional()
+        .describe("Status name. GitLab defaults to 'default' when omitted."),
+    context: z
+        .string()
+        .max(255)
+        .optional()
+        .describe("Alias for name. Provide either name or context, not both."),
+    target_url: z.string().max(255).optional().describe("Target URL associated with this status"),
+    description: z.string().max(255).optional().describe("Short status description"),
+    coverage: z.coerce.number().optional().describe("Total code coverage for this status"),
+    pipeline_id: z.coerce.number().optional().describe("Pipeline ID to attach the status to"),
+});
 // Schema for listing issues assigned to the current user
 export const MyIssuesSchema = z.object({
     project_id: z

package/build/test/dynamic-routing-tests.js

@@ -417,7 +417,7 @@ async function validateToolCalls(client, mockServer, expectedToken) {
         { name: 'get_merge_request', params: { project_id: '1', merge_request_iid: '1' } },
         { name: 'list_merge_requests', params: { project_id: '1' } },
         { name: 'get_repository_tree', params: { project_id: '1' } },
-        { name: 'list_labels', params: { project_id: '1' } },
+        { name: 'list_labels', params: { project_id: '1', page: 2, per_page: 50 } },
         { name: 'list_pipelines', params: { project_id: '1' } },
         { name: 'list_commits', params: { project_id: '1' } },
     ];
@@ -468,6 +468,10 @@ async function validateToolCalls(client, mockServer, expectedToken) {
             else {
                 assert.strictEqual(req.headers['private-token'], expectedToken);
             }
+            if (tool.name === 'list_labels') {
+                assert.strictEqual(req.query.page, '2');
+                assert.strictEqual(req.query.per_page, '50');
+            }
             res.json(mockResponse);
         });
         const result = await client.callTool(tool.name, tool.params);

package/build/test/schema-tests.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env ts-node
-import { GetFileContentsSchema, GitLabFileContentSchema, GitLabRepositorySchema, CreatePipelineSchema, CreateIssueNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateIssueEmojiReactionSchema, DeleteMergeRequestEmojiReactionSchema, DeleteIssueEmojiReactionSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, CreateIssueSchema, ListIssuesSchema, ListMergeRequestsSchema, GitLabTreeItemSchema, GetMergeRequestSchema, GetRepositoryTreeSchema } from '../schemas.js';
+import { GetFileContentsSchema, GitLabFileContentSchema, GitLabRepositorySchema, CreatePipelineSchema, CreateCommitStatusSchema, ListCommitStatusesSchema, CreateIssueNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateIssueEmojiReactionSchema, DeleteMergeRequestEmojiReactionSchema, DeleteIssueEmojiReactionSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, CreateIssueSchema, ListIssuesSchema, ListMergeRequestsSchema, ListLabelsSchema, GitLabMergeRequestSchema, GitLabTreeItemSchema, GetMergeRequestSchema, GetRepositoryTreeSchema } from '../schemas.js';
 function runGetFileContentsSchemaTests() {
     console.log('🧪 Testing GetFileContentsSchema...');
     const cases = [
@@ -298,6 +298,142 @@ function runCreatePipelineSchemaTests() {
     console.log(`\nResults: ${passed} passed, ${failed} failed`);
     return { passed, failed };
 }
+function runCommitStatusSchemaTests() {
+    console.log('\n🧪 Testing Commit Status Schemas...');
+    const cases = [
+        {
+            name: 'schema:create_commit_status:minimal-required-fields',
+            schema: CreateCommitStatusSchema,
+            input: { project_id: 'my/project', sha: 'abc123', state: 'success' },
+            expected: { project_id: 'my/project', sha: 'abc123', state: 'success' }
+        },
+        {
+            name: 'schema:create_commit_status:with-optional-fields',
+            schema: CreateCommitStatusSchema,
+            input: {
+                project_id: 'my/project',
+                sha: 'abc123',
+                state: 'failed',
+                name: 'external/check',
+                target_url: 'https://ci.example.com/build/1',
+                description: 'External check failed',
+                coverage: '87.5',
+                pipeline_id: '42'
+            },
+            expected: {
+                project_id: 'my/project',
+                sha: 'abc123',
+                state: 'failed',
+                name: 'external/check',
+                target_url: 'https://ci.example.com/build/1',
+                description: 'External check failed',
+                coverage: 87.5,
+                pipeline_id: 42
+            }
+        },
+        {
+            name: 'schema:create_commit_status:context-alias',
+            schema: CreateCommitStatusSchema,
+            input: { project_id: 123, sha: 'abc123', state: 'pending', context: 'external/check' },
+            expected: { project_id: '123', sha: 'abc123', state: 'pending', context: 'external/check' }
+        },
+        {
+            name: 'schema:create_commit_status:reject-invalid-state',
+            schema: CreateCommitStatusSchema,
+            input: { project_id: 'my/project', sha: 'abc123', state: 'passing' },
+            shouldFail: true
+        },
+        {
+            name: 'schema:create_commit_status:reject-missing-state',
+            schema: CreateCommitStatusSchema,
+            input: { project_id: 'my/project', sha: 'abc123' },
+            shouldFail: true
+        },
+        {
+            name: 'schema:list_commit_statuses:filters',
+            schema: ListCommitStatusesSchema,
+            input: {
+                project_id: 'my/project',
+                sha: 'abc123',
+                ref: 'main',
+                name: 'external/check',
+                pipeline_id: '42',
+                order_by: 'pipeline_id',
+                sort: 'desc',
+                all: 'true',
+                page: '2',
+                per_page: '50'
+            },
+            expected: {
+                project_id: 'my/project',
+                sha: 'abc123',
+                ref: 'main',
+                name: 'external/check',
+                pipeline_id: 42,
+                order_by: 'pipeline_id',
+                sort: 'desc',
+                all: true,
+                page: 2,
+                per_page: 50
+            }
+        },
+        {
+            name: 'schema:list_commit_statuses:all-false-string',
+            schema: ListCommitStatusesSchema,
+            input: { project_id: 'my/project', sha: 'abc123', all: 'false' },
+            expected: { project_id: 'my/project', sha: 'abc123', all: false }
+        },
+        {
+            name: 'schema:list_commit_statuses:reject-invalid-all-string',
+            schema: ListCommitStatusesSchema,
+            input: { project_id: 'my/project', sha: 'abc123', all: 'yes' },
+            shouldFail: true
+        }
+    ];
+    let passed = 0;
+    let failed = 0;
+    cases.forEach(testCase => {
+        const result = {
+            name: testCase.name,
+            status: 'failed'
+        };
+        const parsed = testCase.schema.safeParse(testCase.input);
+        if (testCase.shouldFail) {
+            if (parsed.success) {
+                result.error = 'Expected schema validation to fail';
+            }
+            else {
+                result.status = 'passed';
+            }
+        }
+        else if (parsed.success) {
+            const expected = testCase.expected || {};
+            const matches = Object.entries(expected).every(([key, value]) => {
+                const actual = parsed.data[key];
+                return JSON.stringify(actual) === JSON.stringify(value);
+            });
+            if (matches) {
+                result.status = 'passed';
+            }
+            else {
+                result.error = `Unexpected parsed result: ${JSON.stringify(parsed.data)}`;
+            }
+        }
+        else {
+            result.error = parsed.error?.message || 'Schema validation failed';
+        }
+        if (result.status === 'passed') {
+            passed++;
+            console.log(`✅ ${result.name}`);
+        }
+        else {
+            failed++;
+            console.log(`❌ ${result.name}: ${result.error}`);
+        }
+    });
+    console.log(`\nResults: ${passed} passed, ${failed} failed`);
+    return { passed, failed };
+}
 function runCreateIssueNoteSchemaTests() {
     console.log('\n🧪 Testing CreateIssueNoteSchema...');
     const cases = [
@@ -398,11 +534,36 @@ function runGetMergeRequestSchemaTests() {
             input: { project_id: 'my/project', merge_request_iid: 24 },
             expected: { project_id: 'my/project', merge_request_iid: '24' },
         },
+        {
+            name: 'schema:get_merge_request:coerced-project-id',
+            input: { project_id: 123, merge_request_iid: '42' },
+            expected: { project_id: '123', merge_request_iid: '42' },
+        },
         {
             name: 'schema:get_merge_request:coerced-source-branch',
             input: { project_id: 'my/project', source_branch: 'feature' },
             expected: { project_id: 'my/project', source_branch: 'feature' },
         },
+        {
+            name: 'schema:get_merge_request:reject-missing-project-id-with-merge-request-iid',
+            input: { merge_request_iid: '42' },
+            shouldFail: true,
+        },
+        {
+            name: 'schema:get_merge_request:reject-missing-project-id-with-source-branch',
+            input: { source_branch: 'feature' },
+            shouldFail: true,
+        },
+        {
+            name: 'schema:get_merge_request:allow-empty-project-id-for-default-project',
+            input: { project_id: '', merge_request_iid: '42' },
+            expected: { project_id: '', merge_request_iid: '42' },
+        },
+        {
+            name: 'schema:get_merge_request:reject-whitespace-project-id',
+            input: { project_id: '   ', merge_request_iid: '42' },
+            shouldFail: true,
+        },
     ];
     let passed = 0;
     let failed = 0;
@@ -448,6 +609,93 @@ function runGetMergeRequestSchemaTests() {
     console.log(`\nResults: ${passed} passed, ${failed} failed`);
     return { passed, failed };
 }
+function runGitLabMergeRequestSchemaTests() {
+    console.log('\n🧪 Testing GitLabMergeRequestSchema...');
+    const baseMergeRequest = {
+        id: '1001',
+        iid: '42',
+        project_id: '123',
+        title: 'Add milestone exposure',
+        description: 'Expose MR milestone',
+        state: 'opened',
+        author: {
+            id: '1',
+            username: 'octocat',
+            name: 'Octo Cat',
+            avatar_url: null,
+            web_url: 'https://gitlab.example.com/octocat',
+        },
+        assignees: [],
+        reviewers: [],
+        source_branch: 'feature/milestone',
+        target_branch: 'main',
+        web_url: 'https://gitlab.example.com/group/project/-/merge_requests/42',
+        created_at: '2026-05-07T00:00:00.000Z',
+        updated_at: '2026-05-07T00:00:00.000Z',
+        merged_at: null,
+        closed_at: null,
+        merge_commit_sha: null,
+    };
+    const cases = [
+        {
+            name: 'schema:gitlab_merge_request:preserves-milestone',
+            input: {
+                ...baseMergeRequest,
+                milestone: {
+                    id: '5',
+                    iid: '2',
+                    title: 'v1.0',
+                    description: 'Version 1.0',
+                    state: 'active',
+                    web_url: 'https://gitlab.example.com/group/project/-/milestones/2',
+                },
+            },
+            validate: (data) => data.milestone?.title === 'v1.0' &&
+                data.milestone?.id === '5' &&
+                data.milestone?.iid === '2',
+        },
+        {
+            name: 'schema:gitlab_merge_request:allows-null-milestone',
+            input: {
+                ...baseMergeRequest,
+                milestone: null,
+            },
+            validate: (data) => data.milestone === null,
+        },
+        {
+            name: 'schema:gitlab_merge_request:allows-omitted-milestone',
+            input: {
+                ...baseMergeRequest,
+            },
+            validate: (data) => data.milestone === undefined,
+        },
+    ];
+    let passed = 0;
+    let failed = 0;
+    cases.forEach(testCase => {
+        const result = { name: testCase.name, status: 'failed' };
+        const parsed = GitLabMergeRequestSchema.safeParse(testCase.input);
+        if (parsed.success && testCase.validate(parsed.data)) {
+            result.status = 'passed';
+        }
+        else if (parsed.success) {
+            result.error = `Unexpected parsed result: ${JSON.stringify(parsed.data)}`;
+        }
+        else {
+            result.error = parsed.error?.message || 'Schema validation failed';
+        }
+        if (result.status === 'passed') {
+            passed++;
+            console.log(`✅ ${result.name}`);
+        }
+        else {
+            failed++;
+            console.log(`❌ ${result.name}: ${result.error}`);
+        }
+    });
+    console.log(`\nResults: ${passed} passed, ${failed} failed`);
+    return { passed, failed };
+}
 function runEmojiReactionSchemaTests() {
     console.log('\n🧪 Testing Emoji Reaction Schemas...');
     const cases = [
@@ -653,6 +901,52 @@ function runLabelsCoercionSchemaTests() {
     console.log(`\nResults: ${passed} passed, ${failed} failed`);
     return { passed, failed };
 }
+function runListLabelsSchemaTests() {
+    console.log('\n=== List Labels Schema Tests ===');
+    const cases = [
+        {
+            name: 'schema:list_labels:pagination-coercion',
+            input: { project_id: 'my/project', page: '2', per_page: '100' },
+            expected: { project_id: 'my/project', page: 2, per_page: 100 },
+        },
+        {
+            name: 'schema:list_labels:filters-with-pagination',
+            input: { project_id: 'my/project', search: 'backend', with_counts: 'true', page: 3, per_page: 50 },
+            expected: { project_id: 'my/project', search: 'backend', with_counts: true, page: 3, per_page: 50 },
+        },
+    ];
+    let passed = 0;
+    let failed = 0;
+    cases.forEach(testCase => {
+        const result = { name: testCase.name, status: 'failed' };
+        const parsed = ListLabelsSchema.safeParse(testCase.input);
+        if (!parsed.success) {
+            result.error = parsed.error?.message || 'Schema validation failed';
+        }
+        else {
+            const matches = Object.entries(testCase.expected).every(([key, value]) => {
+                const actual = parsed.data[key];
+                return actual === value;
+            });
+            if (matches) {
+                result.status = 'passed';
+            }
+            else {
+                result.error = `Unexpected parsed result: ${JSON.stringify(parsed.data)}`;
+            }
+        }
+        if (result.status === 'passed') {
+            passed++;
+            console.log(`✅ ${result.name}`);
+        }
+        else {
+            failed++;
+            console.log(`❌ ${result.name}: ${result.error}`);
+        }
+    });
+    console.log(`\nResults: ${passed} passed, ${failed} failed`);
+    return { passed, failed };
+}
 function runGitLabTreeItemSchemaTests() {
     console.log('\n=== GitLabTreeItem Schema Tests ===');
     const cases = [
@@ -778,15 +1072,18 @@ if (import.meta.url === `file://${process.argv[1]}`) {
     const getFileContentsResult = runGetFileContentsSchemaTests();
     const fileContentResult = runGitLabFileContentSchemaTests();
     const createPipelineResult = runCreatePipelineSchemaTests();
+    const commitStatusResult = runCommitStatusSchemaTests();
     const createIssueNoteResult = runCreateIssueNoteSchemaTests();
     const getMergeRequestResult = runGetMergeRequestSchemaTests();
+    const gitLabMergeRequestResult = runGitLabMergeRequestSchemaTests();
     const emojiReactionResult = runEmojiReactionSchemaTests();
     const repositorySchemaResult = runGitLabRepositorySchemaTests();
     const labelsCoercionResult = runLabelsCoercionSchemaTests();
+    const listLabelsResult = runListLabelsSchemaTests();
     const treeItemResult = runGitLabTreeItemSchemaTests();
     const repositoryTreeResult = runGetRepositoryTreeSchemaTests();
-    const totalPassed = getFileContentsResult.passed + fileContentResult.passed + createPipelineResult.passed + createIssueNoteResult.passed + getMergeRequestResult.passed + emojiReactionResult.passed + repositorySchemaResult.passed + labelsCoercionResult.passed + treeItemResult.passed + repositoryTreeResult.passed;
-    const totalFailed = getFileContentsResult.failed + fileContentResult.failed + createPipelineResult.failed + createIssueNoteResult.failed + getMergeRequestResult.failed + emojiReactionResult.failed + repositorySchemaResult.failed + labelsCoercionResult.failed + treeItemResult.failed + repositoryTreeResult.failed;
+    const totalPassed = getFileContentsResult.passed + fileContentResult.passed + createPipelineResult.passed + commitStatusResult.passed + createIssueNoteResult.passed + getMergeRequestResult.passed + gitLabMergeRequestResult.passed + emojiReactionResult.passed + repositorySchemaResult.passed + labelsCoercionResult.passed + listLabelsResult.passed + treeItemResult.passed + repositoryTreeResult.passed;
+    const totalFailed = getFileContentsResult.failed + fileContentResult.failed + createPipelineResult.failed + commitStatusResult.failed + createIssueNoteResult.failed + getMergeRequestResult.failed + gitLabMergeRequestResult.failed + emojiReactionResult.failed + repositorySchemaResult.failed + labelsCoercionResult.failed + listLabelsResult.failed + treeItemResult.failed + repositoryTreeResult.failed;
     console.log(`\nTotal Results: ${totalPassed} passed, ${totalFailed} failed`);
     if (totalFailed > 0) {
         process.exit(1);

package/build/test/streamable-http-static-token-auth.test.js

@@ -0,0 +1,154 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { once } from "node:events";
+import { afterEach, describe, test } from "node:test";
+import * as path from "node:path";
+import { findAvailablePort } from "./utils/server-launcher.js";
+const ERROR_MESSAGE = "STREAMABLE_HTTP=true/--streamable-http with GITLAB_PERSONAL_ACCESS_TOKEN/--token or GITLAB_JOB_TOKEN/--job-token requires REMOTE_AUTHORIZATION=true/--remote-auth=true or GITLAB_MCP_OAUTH=true/--mcp-oauth=true";
+const HOST = process.env.HOST || "127.0.0.1";
+const SERVER_PATH = path.resolve(process.cwd(), "build/index.js");
+const running = new Set();
+function startServer(env, port) {
+    const child = spawn("node", [SERVER_PATH], {
+        env: {
+            ...process.env,
+            GITLAB_API_URL: "https://gitlab.example.com",
+            HOST,
+            PORT: String(port),
+            STREAMABLE_HTTP: "true",
+            REMOTE_AUTHORIZATION: "false",
+            GITLAB_MCP_OAUTH: "false",
+            GITLAB_USE_OAUTH: "false",
+            GITLAB_PERSONAL_ACCESS_TOKEN: "",
+            GITLAB_JOB_TOKEN: "",
+            GITLAB_AUTH_COOKIE_PATH: "",
+            MCP_SERVER_URL: "",
+            GITLAB_OAUTH_APP_ID: "",
+            ...env,
+        },
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    running.add(child);
+    child.once("exit", () => running.delete(child));
+    return child;
+}
+async function waitForExit(child, timeoutMs = 5000) {
+    let output = "";
+    child.stdout?.on("data", chunk => {
+        output += chunk.toString();
+    });
+    child.stderr?.on("data", chunk => {
+        output += chunk.toString();
+    });
+    let timeoutHandle;
+    const timeout = new Promise((_, reject) => {
+        timeoutHandle = setTimeout(() => reject(new Error(`server did not exit within ${timeoutMs}ms`)), timeoutMs);
+    });
+    try {
+        const [code] = (await Promise.race([once(child, "exit"), timeout]));
+        return { code, output };
+    }
+    finally {
+        clearTimeout(timeoutHandle);
+    }
+}
+async function waitForHealth(port, timeoutMs = 5000) {
+    const deadline = Date.now() + timeoutMs;
+    let lastError;
+    while (Date.now() < deadline) {
+        try {
+            const response = await fetch(`http://${HOST}:${port}/health`);
+            if (response.ok)
+                return;
+        }
+        catch (error) {
+            lastError = error;
+        }
+        await new Promise(resolve => setTimeout(resolve, 100));
+    }
+    throw new Error(`server did not become healthy: ${String(lastError)}`);
+}
+async function postMcpWithoutAuth(port) {
+    return fetch(`http://${HOST}:${port}/mcp`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json, text/event-stream",
+        },
+        body: JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "initialize",
+            params: {
+                protocolVersion: "2025-03-26",
+                capabilities: {},
+                clientInfo: { name: "static-token-auth-test", version: "1.0.0" },
+            },
+        }),
+    });
+}
+async function postMcpWithSessionWithoutAuth(port, sessionId) {
+    return fetch(`http://${HOST}:${port}/mcp`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json, text/event-stream",
+            "Mcp-Session-Id": sessionId,
+        },
+        body: JSON.stringify({
+            jsonrpc: "2.0",
+            id: 2,
+            method: "tools/list",
+            params: {},
+        }),
+    });
+}
+afterEach(() => {
+    for (const child of running) {
+        if (!child.killed)
+            child.kill("SIGTERM");
+    }
+    running.clear();
+});
+describe("Streamable HTTP static server token auth", () => {
+    test("refuses startup with PAT and no MCP-layer auth", async () => {
+        const port = await findAvailablePort(4300);
+        const child = startServer({ GITLAB_PERSONAL_ACCESS_TOKEN: "glpat_test" }, port);
+        const { code, output } = await waitForExit(child);
+        assert.notEqual(code, 0);
+        assert.match(output, new RegExp(ERROR_MESSAGE.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")));
+    });
+    test("refuses startup with JOB-TOKEN and no MCP-layer auth", async () => {
+        const port = await findAvailablePort(4310);
+        const child = startServer({ GITLAB_JOB_TOKEN: "job_test" }, port);
+        const { code, output } = await waitForExit(child);
+        assert.notEqual(code, 0);
+        assert.match(output, new RegExp(ERROR_MESSAGE.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")));
+    });
+    test("allows startup with PAT when REMOTE_AUTHORIZATION is enabled", async () => {
+        const port = await findAvailablePort(4320);
+        startServer({
+            GITLAB_PERSONAL_ACCESS_TOKEN: "glpat_test",
+            REMOTE_AUTHORIZATION: "true",
+        }, port);
+        await waitForHealth(port);
+        const initResponse = await postMcpWithoutAuth(port);
+        assert.equal(initResponse.status, 200);
+        const sessionId = initResponse.headers.get("mcp-session-id");
+        assert.ok(sessionId);
+        const followUpResponse = await postMcpWithSessionWithoutAuth(port, sessionId);
+        assert.equal(followUpResponse.status, 401);
+    });
+    test("allows startup with PAT when GITLAB_MCP_OAUTH is enabled", async () => {
+        const port = await findAvailablePort(4330);
+        startServer({
+            GITLAB_PERSONAL_ACCESS_TOKEN: "glpat_test",
+            GITLAB_MCP_OAUTH: "true",
+            MCP_SERVER_URL: `http://${HOST}:${port}`,
+            GITLAB_OAUTH_APP_ID: "oauth-app-id",
+        }, port);
+        await waitForHealth(port);
+        const response = await postMcpWithoutAuth(port);
+        assert.equal(response.status, 401);
+    });
+});

package/build/test/test-json-schema.js

@@ -124,6 +124,24 @@ function runTests() {
             error: error.message,
         });
     }
+    // Test 7: Effects fields
+    try {
+        const schema = z.object({
+            effectRequired: z.preprocess(value => value, z.string()),
+            effectOptional: z.preprocess(value => value, z.string().optional()),
+        });
+        const result = toJSONSchema(schema);
+        assert(result.required?.includes("effectRequired"), "effectRequired should be in required array");
+        assert(!result.required?.includes("effectOptional"), "effectOptional should NOT be in required array");
+        results.push({ name: "effects fields", status: "passed" });
+    }
+    catch (error) {
+        results.push({
+            name: "effects fields",
+            status: "failed",
+            error: error.message,
+        });
+    }
     // Print results
     const passed = results.filter((r) => r.status === "passed").length;
     const failed = results.filter((r) => r.status === "failed").length;

package/build/test/test-toolset-filtering.js

@@ -19,7 +19,7 @@ const TOOLSET_TOOL_COUNTS = {
     merge_requests: 40,
     issues: 23,
     repositories: 7,
-    branches: 4,
+    branches: 6,
     projects: 8,
     labels: 5,
     ci: 2,
@@ -63,7 +63,7 @@ const TOOLSET_SAMPLE_TOOLS = {
     merge_requests: ["merge_merge_request", "create_merge_request_thread", "list_draft_notes"],
     issues: ["create_issue", "list_issues", "create_note", "list_todos"],
     repositories: ["search_repositories", "get_file_contents", "push_files"],
-    branches: ["create_branch", "list_commits"],
+    branches: ["create_branch", "list_commits", "list_commit_statuses", "create_commit_status"],
     projects: ["get_project", "list_namespaces", "list_group_iterations"],
     labels: ["list_labels", "create_label"],
     ci: ["validate_ci_lint", "validate_project_ci_lint"],

package/build/tools/registry.js

@@ -1,7 +1,7 @@
 import { zodToJsonSchema } from "zod-to-json-schema";
 import { toJSONSchema } from "../utils/schema.js";
 import { USE_GITLAB_WIKI, USE_MILESTONE, USE_PIPELINE, } from "../config.js";
-import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetDeploymentSchema, GetDraftNoteSchema, GetEnvironmentSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, GetPipelineSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetTimelineEventsSchema, GetUsersSchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListCommitsSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListPipelinesSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateLabelSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, } from "../schemas.js";
+import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteDraftNoteSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetDeploymentSchema, GetDraftNoteSchema, GetEnvironmentSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, GetPipelineSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetTimelineEventsSchema, GetUsersSchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListPipelinesSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListReleasesSchema, ListTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UnapproveMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateLabelSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, } from "../schemas.js";
 // Define all available tools
 export const allTools = [
     {
@@ -646,6 +646,16 @@ export const allTools = [
         description: "Get changes/diffs of a specific commit",
         inputSchema: toJSONSchema(GetCommitDiffSchema),
     },
+    {
+        name: "list_commit_statuses",
+        description: "List statuses for a commit",
+        inputSchema: toJSONSchema(ListCommitStatusesSchema),
+    },
+    {
+        name: "create_commit_status",
+        description: "Create or update the status of a commit",
+        inputSchema: toJSONSchema(CreateCommitStatusSchema),
+    },
     {
         name: "list_group_iterations",
         description: "List group iterations with filtering options",
@@ -937,6 +947,7 @@ export const readOnlyTools = new Set([
     "list_commits",
     "get_commit",
     "get_commit_diff",
+    "list_commit_statuses",
     "list_group_iterations",
     "get_group_iteration",
     "download_attachment",
@@ -1135,6 +1146,8 @@ export const TOOLSET_DEFINITIONS = [
             "list_commits",
             "get_commit",
             "get_commit_diff",
+            "list_commit_statuses",
+            "create_commit_status",
         ]),
     },
     {

package/build/utils/schema.js

@@ -6,6 +6,23 @@ import { zodToJsonSchema } from "zod-to-json-schema";
  */
 export const toJSONSchema = (schema) => {
     const jsonSchema = zodToJsonSchema(schema, { $refStrategy: "none" });
+    const isOptionalLikeField = (zodType) => {
+        const def = zodType._def;
+        const typeName = def?.typeName;
+        if (["ZodOptional", "ZodNullable", "ZodDefault", "ZodCatch"].includes(typeName)) {
+            return true;
+        }
+        if (typeName === "ZodEffects") {
+            return isOptionalLikeField(def.schema);
+        }
+        if (typeName === "ZodBranded") {
+            return isOptionalLikeField(def.type);
+        }
+        if (typeName === "ZodPipeline") {
+            return isOptionalLikeField(def.in);
+        }
+        return false;
+    };
     // Extract required fields from Zod schema
     const zodRequiredFields = (() => {
         if (schema instanceof z.ZodObject) {
@@ -13,17 +30,7 @@ export const toJSONSchema = (schema) => {
             const requiredFields = [];
             Object.entries(shape).forEach(([key, fieldDef]) => {
                 const zodType = fieldDef;
-                const typeName = zodType._def?.typeName;
-                // Check if field is wrapped in zod required types
-                const isRequired = [
-                    "ZodOptional",
-                    "ZodNullable",
-                    "ZodDefault",
-                    "ZodEffects",
-                    "ZodCatch",
-                    "ZodBranded",
-                ].includes(typeName);
-                if (!isRequired) {
+                if (!isOptionalLikeField(zodType)) {
                     requiredFields.push(key);
                 }
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.8",
+  "version": "2.1.10",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
@@ -51,7 +51,7 @@
     "changelog": "auto-changelog -p",
     "test": "npm run test:all",
     "test:all": "npm run build && npm run test:mock && npm run test:live",
-    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts",
+    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts",
     "test:stateless": "npm run build && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts",
     "test:mcp-oauth": "npm run build && node --import tsx/esm --test test/mcp-oauth-tests.ts",
     "test:live": "node test/validate-api.js",