@zereight/mcp-gitlab 2.2.5 → 2.3.0

package/build/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { getConfig, ENABLE_DYNAMIC_API_URL, ENABLE_DYNAMIC_PROJECT_SCOPE, ENABLE_STRICT_PROJECT_SCOPE, GITLAB_AUTH_COOKIE_PATH, GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_DISABLE_VERSION_CHECK, GITLAB_MASKING_ENABLED, GITLAB_MASKING_CONFIG, GITLAB_MASKING_POLICY_FILE, GITLAB_MASKING_WORKSPACE_DIR, GITLAB_PERMISSION_MODE, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, MCP_TRUST_PROXY, USE_GITLAB_WIKI, USE_MILESTONE, USE_OAUTH, USE_PIPELINE, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_OAUTH_ALLOWED_GROUPS, GITLAB_MCP_COMPACT_RESULTS, GITLAB_MCP_COMPACT_RESULT_CHARS, GITLAB_MCP_COMPACT_TOOL_NAMES, GITLAB_TOOL_PROFILE, buildDeprecatedEnvInput, } from "./config.js";
+import { getConfig, ENABLE_DYNAMIC_API_URL, ENABLE_DYNAMIC_PROJECT_SCOPE, ENABLE_STRICT_PROJECT_SCOPE, GITLAB_AUTH_COOKIE_PATH, GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_OAUTH_ALLOWED_REDIRECT_URIS_RAW, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_DISABLE_VERSION_CHECK, GITLAB_MASKING_ENABLED, GITLAB_MASKING_CONFIG, GITLAB_MASKING_POLICY_FILE, GITLAB_MASKING_WORKSPACE_DIR, GITLAB_PERMISSION_MODE, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, MCP_TRUST_PROXY, USE_GITLAB_WIKI, USE_MILESTONE, USE_OAUTH, USE_PIPELINE, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_OAUTH_ALLOWED_GROUPS, GITLAB_MCP_COMPACT_RESULTS, GITLAB_MCP_COMPACT_RESULT_CHARS, GITLAB_MCP_COMPACT_TOOL_NAMES, GITLAB_TOOL_PROFILE, GITLAB_DOWNLOAD_DIR, buildDeprecatedEnvInput, } from "./config.js";
 import { getDeprecatedEnvWarnings } from "./deprecated-env.js";
 /** True when the server is running in remote/network mode (SSE or StreamableHTTP transport). */
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
@@ -81,6 +81,7 @@ import { formatCliError, formatToolOutput } from "./cli/output.js";
 import { compactMcpToolResult, readOwnRecord } from "./cli/compact-mcp-result.js";
 import { compileDeniedToolsRegex } from "./tools/denied-regex.js";
 import { createGitLabOAuthProvider } from "./oauth-proxy.js";
+import { parseAllowedRedirectUris, RedirectUriPolicy } from "./oauth-consent.js";
 import { normalizeProxyClientIpForRateLimit } from "./utils/proxy-client-ip.js";
 import { getForwardedPublicBaseUrl, getForwardedRequestHost, } from "./utils/forwarded-public-base-url.js";
 import { registerDownloadProxy } from "./downloads/proxy.js";
@@ -92,7 +93,7 @@ import { SERVER_VERSION } from "./server/version.js";
 import { isInitializationRequestBody, isUnauthenticatedDiscoveryRequestBody, readAcceptHeader, readMcpSessionIdHeader, redactSessionIdForLog, } from "./server/request-helpers.js";
 export { readMcpSessionIdHeader } from "./server/request-helpers.js";
 import { encodeGitLabPath, encodeGitLabPathSegment, isCleartextRemoteUrl, normalizeGitLabApiUrl, } from "./utils/url.js";
-import { estimateMergeCommitCount, filterDiffsByPatterns, openSafeOutputWriteStream, readSafeExistingFile, summarizeWebhookEvents, } from "./utils/helpers.js";
+import { estimateMergeCommitCount, filterDiffsByPatterns, openSafeOutputWriteStream, resolveDownloadRoot, readSafeExistingFile, summarizeWebhookEvents, } from "./utils/helpers.js";
 import { graphqlQueryContainsWriteOperation, graphqlQueryContainsDeleteOperation, } from "./utils/graphql-query.js";
 import { resolveNestedWikiUpdateTitle } from "./utils/wiki-title.js";
 import { encodeRepoFilePayloadContent, fileOperationsIncludeDeleteOrMove, toGitLabCommitActions, } from "./utils/gitlab-commit-actions.js";
@@ -112,7 +113,7 @@ import { GitLabClientPool } from "./gitlab-client-pool.js";
 import { advertisesReadOnly, allTools, readOnlyTools, destructiveTools, deleteTools, parseEnabledToolsets, parseIndividualTools, buildFeatureFlagOverrides, isToolInEnabledToolset, findSmallestToolsetForTool, isExplicitOnlyToolsetId, isExplicitToolsetOnlyTool, isToolsetFullyActive, listDiscoverableCategories, TOOLSET_DEFINITIONS, DISCOVERABLE_TOOLSET_IDS, } from "./tools/registry.js";
 import { executeGitLabApiRequestAsync, GitLabApiRequestHttpError, GitLabApiRequestInputError, } from "./tools/gitlab-api-request.js";
 import { buildUnavailableToolMessage, isSkippedByDiscoverActivation, } from "./tools/discover-activation.js";
-import { selectExposedTools } from "./tools/exposed-tools.js";
+import { selectCallableHiddenToolNames, selectExposedTools } from "./tools/exposed-tools.js";
 import { createListedToolsCache, decorateToolsForList, } from "./tools/listed-tools.js";
 import { isExcludedBySlimProfile, shouldApplySlimToolProfile } from "./tools/tool-profile.js";
 import { shouldCompactToolResult } from "./utils/compact-tool-allowlist.js";
@@ -123,8 +124,8 @@ GitLabDiscussionNoteSchema, // Added
 GitLabDiscussionSchema, 
 // Draft Notes Schemas
 GitLabDraftNoteSchema, GitLabForkSchema, GitLabBranchSchema, GitLabProtectedBranchSchema, GitLabProtectedTagSchema, GitLabGroupSchema, GitLabIssueLinkSchema, GitLabIssueSchema, GitLabIssueWithLinkDetailsSchema, GitLabMarkdownUploadSchema, GitLabMergeRequestPipelineSchema, GitLabMergeRequestSchema, GitLabMilestonesSchema, GitLabGroupMilestonesSchema, GitLabNamespaceExistsResponseSchema, GitLabNamespaceSchema, GitLabPipelineJobSchema, GitLabDeploymentSchema, GitLabEnvironmentSchema, GitLabPipelineSchema, GitLabPipelineScheduleSchema, GitLabPipelineScheduleVariableSchema, GitLabPipelineSchedulePlayResultSchema, ListPipelineSchedulesSchema, GetPipelineScheduleSchema, ListPipelineSchedulePipelinesSchema, CreatePipelineScheduleSchema, UpdatePipelineScheduleSchema, DeletePipelineScheduleSchema, PlayPipelineScheduleSchema, TakeOwnershipPipelineScheduleSchema, GetPipelineScheduleVariableSchema, CreatePipelineScheduleVariableSchema, UpdatePipelineScheduleVariableSchema, DeletePipelineScheduleVariableSchema, GitLabPipelineTriggerJobSchema, GitLabProjectMemberSchema, GitLabProjectSchema, GitLabTodoSchema, GitLabReferenceSchema, GitLabRepositorySchema, GitLabSearchBlobResultSchema, GitLabSearchResponseSchema, GitLabTreeItemSchema, GitLabUserSchema, GitLabUsersResponseSchema, GitLabWikiPageSchema, GroupIteration, ListCommitStatusesSchema, ListBranchesSchema, ListCommitsSchema, ListDraftNotesSchema, ListGroupIterationsSchema, ListGroupProjectsSchema, GitLabCiVariableSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GitLabDependencyProxySchema, GitLabDependencyProxyBlobSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListProjectVulnerabilitiesSchema, GetVulnerabilitySchema, DismissVulnerabilitySchema, ConfirmVulnerabilitySchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListTodosSchema, ListLabelsSchema, ListMergeRequestDiffsSchema, // Added
-GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestsSchema, ListGroupMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListProjectRunnersSchema, GetRunnerSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListProjectMembersSchema, ListGroupMembersSchema, ListProjectMilestonesSchema, ListGroupMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, OrbitQuerySchema, OrbitSchemaSchema, OrbitStatusSchema, OrbitToolsSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, ListProtectedTagsSchema, GetProtectedTagSchema, ProtectTagSchema, UnprotectTagSchema, GitLabTagSchema, GitLabTagSignatureSchema, ListSnippetsSchema, GetSnippetSchema, CreateSnippetSchema, UpdateSnippetSchema, DeleteSnippetSchema, GitLabSnippetSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, GetMergeRequestDiscussionSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, CreateWebhookSchema, UpdateWebhookSchema, DeleteWebhookSchema, ListWebhookEventsSchema, GetWebhookEventSchema, HealthCheckSchema, } from "./schemas.js";
-import { randomUUID, timingSafeEqual, } from "node:crypto";
+GetMergeRequestFileDiffSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestsSchema, ListGroupMergeRequestsSchema, ListMergeRequestVersionsSchema, GetMergeRequestVersionSchema, GitLabMergeRequestVersionSchema, GitLabMergeRequestVersionDetailSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelinesSchema, ListDeploymentsSchema, ListEnvironmentsSchema, ListProjectRunnersSchema, GetRunnerSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListProjectMembersSchema, ListGroupMembersSchema, ListProjectMilestonesSchema, ListGroupMilestonesSchema, ListProjectsSchema, ListWikiPagesSchema, GetGroupWikiPageSchema, ListGroupWikiPagesSchema, UpdateGroupWikiPageSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, DownloadAttachmentSchema, DownloadJobArtifactsSchema, GetJobArtifactFileSchema, GitLabArtifactEntrySchema, ListJobArtifactsSchema, MergeMergeRequestSchema, ApproveMergeRequestSchema, UnapproveMergeRequestSchema, RebaseMergeRequestSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GitLabMergeRequestApprovalsResponseSchema, GitLabMergeRequestApprovalStateSchema, MyIssuesSchema, OrbitQuerySchema, OrbitSchemaSchema, OrbitStatusSchema, OrbitToolsSchema, MarkAllTodosDoneSchema, MarkTodoDoneSchema, PaginatedDiscussionsResponseSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PlayPipelineJobSchema, PushFilesSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, UpdateDraftNoteSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestSchema, UpdateWikiPageSchema, VerifyNamespaceSchema, GitLabEventSchema, ListEventsSchema, GetProjectEventsSchema, ExecuteGraphQLSchema, GitLabReleaseSchema, ListReleasesSchema, GetReleaseSchema, CreateReleaseSchema, UpdateReleaseSchema, DeleteReleaseSchema, CreateReleaseEvidenceSchema, DownloadReleaseAssetSchema, ListTagsSchema, GetTagSchema, CreateTagSchema, DeleteTagSchema, GetTagSignatureSchema, ListProtectedTagsSchema, GetProtectedTagSchema, ProtectTagSchema, UnprotectTagSchema, GitLabTagSchema, GitLabTagSignatureSchema, ListSnippetsSchema, GetSnippetSchema, CreateSnippetSchema, UpdateSnippetSchema, DeleteSnippetSchema, GitLabSnippetSchema, GetMergeRequestNotesSchema, GetMergeRequestNoteSchema, GetMergeRequestDiscussionSchema, DeleteMergeRequestDiscussionNoteSchema, ResolveMergeRequestThreadSchema, GetWorkItemSchema, ListWorkItemsSchema, CreateWorkItemSchema, UpdateWorkItemSchema, ConvertWorkItemTypeSchema, ListWorkItemStatusesSchema, ListWorkItemNotesSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, MoveWorkItemSchema, ListCustomFieldDefinitionsSchema, GetTimelineEventsSchema, CreateTimelineEventSchema, ListWebhooksSchema, CreateWebhookSchema, UpdateWebhookSchema, DeleteWebhookSchema, ListWebhookEventsSchema, GetWebhookEventSchema, HealthCheckSchema, } from "./schemas.js";
+import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { createLogger, flushBufferedLogs, flushStartupLogs } from "./utils/logger.js";
 const logger = createLogger();
 function exitAfterFlush(code) {
@@ -210,17 +211,20 @@ function buildToolUnavailableMessage(toolName) {
  */
 /** Builds an MCP server with the tool list filtered by toolsets, permission mode, and policy. */
 function createServer() {
-    const filteredTools = selectExposedTools({
+    const exposedToolSelection = {
         tools: allTools,
-        isInEnabledToolset: toolName => isToolInEnabledToolset(toolName, enabledToolsets),
+        isInEnabledToolset: (toolName) => isToolInEnabledToolset(toolName, enabledToolsets),
         individuallyEnabledTools,
         featureFlagOverrides,
         isAllowedByPermissionMode: isToolAllowedByPermissionMode,
         deniedToolsRegex: GITLAB_DENIED_TOOLS_REGEX,
         hiddenToolNames: hiddenToolSet,
         applySlimProfile,
-        isAdditiveEnablementAllowed: toolName => !isExplicitToolsetOnlyTool(toolName),
-    });
+        isAdditiveEnablementAllowed: (toolName) => !isExplicitToolsetOnlyTool(toolName),
+    };
+    const filteredTools = selectExposedTools(exposedToolSelection);
+    // Unlisted but callable; extended by discover_tools alongside filteredTools.
+    const callableHiddenToolNames = selectCallableHiddenToolNames(exposedToolSelection);
     const listedToolDecoration = {
         readOnlyToolNames: new Set([...readOnlyTools].filter(toolName => advertisesReadOnly(toolName))),
         destructiveToolNames: destructiveTools,
@@ -369,12 +373,11 @@ function createServer() {
                 return logCompletion({ content: [{ type: "text", text: jmespathSyntaxError }], isError: true }, { skipJmespath: true });
             }
             // Enforce list-time filtering on direct calls: clients can call names that tools/list omits.
-            // filteredTools is extended by discover_tools; hidden-policy tools stay callable by design,
-            // but GITLAB_DENIED_TOOLS_REGEX always wins over the hidden exemption.
+            // filteredTools is extended by discover_tools; hidden-policy tools stay callable only while
+            // the other list filters still expose them, so hiding a tool never enables it.
             // Permission-mode denials fall through so handleToolCall reports its mode-specific error.
-            const hiddenAndNotDenied = hiddenToolSet.has(toolName) && !GITLAB_DENIED_TOOLS_REGEX?.test(toolName);
             if (isToolAllowedByPermissionMode(toolName) &&
-                !hiddenAndNotDenied &&
+                !callableHiddenToolNames.has(toolName) &&
                 !filteredTools.some(t => t.name === toolName)) {
                 throw new Error(buildToolUnavailableMessage(toolName));
             }
@@ -382,12 +385,13 @@ function createServer() {
             if (toolName === "discover_tools") {
                 const category = request.params.arguments?.category?.trim()?.toLowerCase();
                 const currentToolNames = new Set(filteredTools.map(t => t.name));
-                const isNotActivatable = (name) => isSkippedByDiscoverActivation({
+                const isActivationSkipped = (name, hidden) => isSkippedByDiscoverActivation({
                     allowedByPermissionMode: isToolAllowedByPermissionMode(name),
                     deniedByRegex: GITLAB_DENIED_TOOLS_REGEX?.test(name) === true,
-                    hidden: hiddenToolSet.has(name),
+                    hidden,
                     excludedBySlimProfile: isExcludedFromToolsetListing(name),
                 });
+                const isNotActivatable = (name) => isActivationSkipped(name, hiddenToolSet.has(name));
                 if (!category) {
                     // Fully listed only. Partial overlap with `core` must stay inactive so
                     // clients still call discover_tools to add the missing tools. Tools this
@@ -441,6 +445,13 @@ function createServer() {
                         isError: true,
                     });
                 }
+                // Hidden tools in this toolset stay unlisted but become callable like the rest of it.
+                // Runs before the `active` check because hidden tools never keep a toolset inactive.
+                for (const name of toolsetDef.tools) {
+                    if (hiddenToolSet.has(name) && !isActivationSkipped(name, false)) {
+                        callableHiddenToolNames.add(name);
+                    }
+                }
                 // Same predicate as the category listing `active` flag.
                 const alreadyActive = isToolsetFullyActive(toolsetDef.tools, currentToolNames, isNotActivatable);
                 if (alreadyActive) {
@@ -550,20 +561,6 @@ function createServer() {
     });
     return mcpServer;
 }
-/**
- * Validate configuration at startup
- */
-function isLoopbackBindHost(host) {
-    const normalized = host
-        .trim()
-        .toLowerCase()
-        .replace(/^\[|\]$/g, "");
-    const isIpv4Loopback = /^127(?:\.\d{1,3}){3}$/.test(normalized);
-    return (normalized === "localhost" ||
-        isIpv4Loopback ||
-        normalized === "::1" ||
-        normalized === "0:0:0:0:0:0:0:1");
-}
 function formatHostWithPort(host, port) {
     const normalized = host
         .trim()
@@ -814,6 +811,14 @@ function validateConfiguration() {
             errors.push("GITLAB_OAUTH_APP_ID is required when GITLAB_MCP_OAUTH=true " +
                 "(create an OAuth application in GitLab Admin with the required scopes)");
         }
+        if (getConfig("oauth-callback-proxy", "GITLAB_OAUTH_CALLBACK_PROXY") === "true") {
+            try {
+                new RedirectUriPolicy(parseAllowedRedirectUris(getConfig("oauth-allowed-redirect-uris", "GITLAB_OAUTH_ALLOWED_REDIRECT_URIS")));
+            }
+            catch (error) {
+                errors.push(error instanceof Error ? error.message : String(error));
+            }
+        }
     }
     const enableDynamicApiUrl = getConfig("enable-dynamic-api-url", "ENABLE_DYNAMIC_API_URL") === "true";
     if (enableDynamicApiUrl && !remoteAuth) {
@@ -1111,7 +1116,7 @@ function buildAuthHeaders() {
     if (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH) {
         const ctx = sessionAuthStore.getStore();
         logger.debug({
-            sessionId: ctx?.sessionId,
+            sidPrefix: redactSessionIdForLog(ctx?.sessionId),
             header: ctx?.header,
             apiUrl: ctx?.apiUrl === undefined ? undefined : redactUrlSecretsInText(ctx.apiUrl),
         }, "buildAuthHeaders: session context");
@@ -1163,7 +1168,7 @@ function getEffectiveApiUrl() {
             return ctx.apiUrl;
         }
         logger.warn({
-            sessionId: ctx?.sessionId,
+            sidPrefix: redactSessionIdForLog(ctx?.sessionId),
             header: ctx?.header,
             apiUrl: ctx?.apiUrl === undefined ? undefined : redactUrlSecretsInText(ctx.apiUrl),
         }, "getEffectiveApiUrl: No context or apiUrl found, falling back to default");
@@ -1186,6 +1191,27 @@ function getEffectiveAllowedProjectIds() {
     }
     return GITLAB_ALLOWED_PROJECT_IDS;
 }
+/**
+ * Keep a dynamic project scope bound to its session
+ * A request that omits X-GitLab-Allowed-Project-Ids keeps the session scope, and a
+ * request naming a different scope is refused (null). An unscoped session may be
+ * narrowed. Re-initialize to change the scope.
+ */
+function bindSessionProjectScope(requested, sessionScope) {
+    if (!sessionScope || sessionScope.length === 0) {
+        return requested;
+    }
+    if (requested === undefined) {
+        return sessionScope;
+    }
+    const want = new Set(requested);
+    const have = new Set(sessionScope);
+    return want.size === have.size && [...want].every(id => have.has(id)) ? sessionScope : null;
+}
+const SESSION_PROJECT_SCOPE_MISMATCH = {
+    error: "Project scope mismatch",
+    message: "X-GitLab-Allowed-Project-Ids does not match the project scope of this session. Re-initialize to change it.",
+};
 /**
  * Reject tools that cannot be limited to allowed projects when
  * ENABLE_STRICT_PROJECT_SCOPE is set and an allowlist is in effect
@@ -2255,6 +2281,43 @@ async function createWorkItemNote(projectId, iid, body, options = {}) {
     return data.createNote.note;
 }
 // --- Emoji Reactions (GraphQL) ---
+const NOTE_GID_PATTERN = /^gid:\/\/gitlab\/\w*Note\/\d+$/;
+/**
+ * Check that a note's noteable is the given work item. Work item notes may report
+ * the noteable as an Issue, which shares the work item's numeric ID. GitLab.com
+ * returns noteableId as a bare number; a global ID string is accepted too.
+ */
+function isNoteOfWorkItem(note, workItemGID) {
+    const workItemId = workItemGID.match(/\/(\d+)$/)?.[1];
+    const noteable = String(note.noteableId ?? "").match(/^(?:gid:\/\/gitlab\/(\w+)\/)?(\d+)$/);
+    if (workItemId === undefined || noteable?.[2] !== workItemId) {
+        return false;
+    }
+    const types = [noteable[1], note.noteableType]
+        .filter((type) => Boolean(type))
+        .map(type => type.replace(/[^a-z]/gi, "").toLowerCase());
+    return types.length > 0 && types.every(type => type === "issue" || type === "workitem");
+}
+/**
+ * Resolve the work item and return the note GID only if the note belongs to it.
+ */
+async function resolveWorkItemNoteGID(projectId, iid, noteId) {
+    if (!NOTE_GID_PATTERN.test(noteId)) {
+        throw new ToolInputError(`note_id must be a note global ID such as gid://gitlab/Note/123 (got ${noteId})`);
+    }
+    const { workItemGID, projectPath } = await resolveWorkItemGID(projectId, iid);
+    const data = await executeGraphQL(`query($id: NoteID!) {
+      note(id: $id) {
+        id
+        noteableId
+        noteableType
+      }
+    }`, { id: noteId });
+    if (!data.note || !isNoteOfWorkItem(data.note, workItemGID)) {
+        throw new ProjectAccessDeniedError(`Access denied: Note ${noteId} was not found on work item #${iid} in ${projectPath}`);
+    }
+    return data.note.id;
+}
 async function addGraphQLAwardEmoji(awardableId, name) {
     const data = await executeGraphQL(`mutation($awardableId: AwardableID!, $name: String!) {
       awardEmojiAdd(input: { awardableId: $awardableId, name: $name }) {
@@ -3251,11 +3314,13 @@ async function createIssueLink(projectId, issueIid, targetProjectId, targetIssue
     projectId = decodeURIComponent(projectId); // Decode project ID
     targetProjectId = decodeURIComponent(targetProjectId); // Decode target project ID as well
     const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links`);
+    // The target project is subject to the same allowlist as the source project.
+    const effectiveTargetProjectId = getEffectiveProjectId(targetProjectId);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
         body: JSON.stringify({
-            target_project_id: targetProjectId,
+            target_project_id: effectiveTargetProjectId,
             target_issue_iid: targetIssueIid,
             link_type: linkType,
         }),
@@ -3293,6 +3358,10 @@ async function deleteIssueLink(projectId, issueIid, issueLinkId) {
 async function createMergeRequest(projectId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests`);
+    // A cross-project target is subject to the same allowlist as the source project.
+    const targetProjectId = options.target_project_id
+        ? getEffectiveProjectId(decodeURIComponent(options.target_project_id))
+        : undefined;
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -3301,7 +3370,7 @@ async function createMergeRequest(projectId, options) {
             description: options.description,
             source_branch: options.source_branch,
             target_branch: options.target_branch,
-            target_project_id: options.target_project_id,
+            target_project_id: targetProjectId,
             assignee_ids: options.assignee_ids,
             reviewer_ids: options.reviewer_ids,
             labels: options.labels?.join(","),
@@ -4408,6 +4477,51 @@ async function unapproveMergeRequest(projectId, mergeRequestIid) {
     await handleGitLabError(response);
     return parseApprovalsResponse(await response.json());
 }
+/**
+ * Enqueue a rebase of the merge request source branch onto its target branch
+ *
+ * @param {string} projectId - The ID or URL-encoded path of the project
+ * @param {string | number} mergeRequestIid - The internal ID of the merge request
+ * @param {boolean} skipCi - If true, GitLab does not create a pipeline for the rebased branch
+ * @returns {Promise<unknown>} GitLab's enqueue response, `{"rebase_in_progress": true}`
+ */
+async function rebaseMergeRequest(projectId, mergeRequestIid, skipCi) {
+    projectId = decodeURIComponent(projectId);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/rebase`);
+    const body = {};
+    if (skipCi !== undefined) {
+        body.skip_ci = skipCi;
+    }
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+        method: "PUT",
+        body: JSON.stringify(body),
+    });
+    await handleGitLabError(response);
+    return response.json();
+}
+/**
+ * Get a merge request with its rebase state, shaped for waitForStatus
+ *
+ * @param {string} projectId - The ID or URL-encoded path of the project
+ * @param {string | number} mergeRequestIid - The internal ID of the merge request
+ * @returns {Promise<{status: string, mergeRequest: GitLabMergeRequest}>} `in_progress` or `finished`
+ */
+async function getMergeRequestRebaseStatus(projectId, mergeRequestIid, signal) {
+    projectId = decodeURIComponent(projectId);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}`);
+    url.searchParams.append("include_rebase_in_progress", "true");
+    const response = await fetch(url.toString(), {
+        ...getFetchConfig(),
+        signal,
+    });
+    await handleGitLabError(response);
+    const mergeRequest = GitLabMergeRequestSchema.parse(await response.json());
+    return {
+        status: mergeRequest.rebase_in_progress === false ? "finished" : "in_progress",
+        mergeRequest,
+    };
+}
 /**
  * Get the approval state of a merge request
  *
@@ -5875,7 +5989,8 @@ async function downloadJobArtifacts(projectId, jobId, localPath) {
     if (!response.body) {
         throw new Error("No response body from GitLab");
     }
-    const { stream: saveStream, path: savePath } = openSafeOutputWriteStream(filename, localPath, "local_path");
+    // The archive name is fixed, but local_path still comes from the model.
+    const { stream: saveStream, path: savePath } = openSafeOutputWriteStream(filename, localPath, "local_path", undefined, { rejectDotNames: true });
     await streamPipeline(response.body, saveStream);
     return savePath;
 }
@@ -6246,6 +6361,7 @@ async function erasePipelineJob(projectId, jobId) {
 }
 const TERMINAL_PIPELINE_STATUSES = new Set(["success", "failed", "canceled", "skipped", "manual"]);
 const TERMINAL_JOB_STATUSES = new Set(["success", "failed", "canceled", "skipped", "manual"]);
+const TERMINAL_REBASE_STATUSES = new Set(["finished"]);
 async function waitForStatus(fetchStatus, terminalStatuses, timeoutSeconds = 300, pollIntervalSeconds = 5) {
     const deadline = Date.now() + timeoutSeconds * 1000;
     const fetchBeforeDeadline = async () => {
@@ -6743,7 +6859,7 @@ async function getCommit(projectId, sha, stats) {
 async function getCommitDiff(projectId, sha, full_diff) {
     projectId = decodeURIComponent(projectId);
     const baseUrl = `${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/commits/${encodeGitLabPathSegment(sha)}/diff`;
-    let allDiffs = [];
+    const allDiffs = [];
     let page = 1;
     while (true) {
         const url = new URL(baseUrl);
@@ -6887,7 +7003,7 @@ async function myIssues(options = {}) {
         }
     }
     // Use listIssues with assignee_username filter
-    let listIssuesOptions = {
+    const listIssuesOptions = {
         state: options.state || "opened", // Default to "opened" if not specified
         labels: options.labels,
         milestone: options.milestone,
@@ -7595,15 +7711,23 @@ async function downloadAttachment(projectId, secret, filename, localPath) {
         await handleGitLabError(response);
     }
     const mimeType = getImageMimeType(safeFilename);
-    // For non-image files, always save to disk.
-    // For image files, only save to disk if local_path is explicitly provided.
+    // Non-image files, and images with local_path, are saved as new files under the
+    // download directory. Upload names and local_path come from untrusted content, so
+    // dot names (.git, .vscode, .envrc) are refused and existing files are never replaced.
     if (!mimeType || localPath) {
         if (!response.body) {
             throw new Error("No response body from GitLab");
         }
-        const { stream: saveStream, path: savePath } = openSafeOutputWriteStream(safeFilename, localPath, "local_path");
+        const { stream: saveStream, path: savePath } = openSafeOutputWriteStream(safeFilename, localPath, "local_path", resolveDownloadRoot(GITLAB_DOWNLOAD_DIR), { exclusive: true, rejectDotNames: true });
         // Stream directly to disk instead of buffering in memory
-        await streamPipeline(response.body, saveStream);
+        try {
+            await streamPipeline(response.body, saveStream);
+        }
+        catch (error) {
+            // The file was created by this call; drop the partial copy so a retry can succeed.
+            fs.rmSync(savePath, { force: true });
+            throw error;
+        }
         return { buffer: Buffer.alloc(0), filename: safeFilename, mimeType, savedPath: savePath };
     }
     // Images returned inline — buffer into memory for base64 encoding
@@ -8638,6 +8762,15 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(approvalState) }],
                 };
             }
+            case "rebase_merge_request": {
+                const { project_id, merge_request_iid, skip_ci, wait, timeout_seconds, poll_interval_seconds, } = RebaseMergeRequestSchema.parse(params.arguments);
+                const enqueued = await rebaseMergeRequest(project_id, merge_request_iid, skip_ci);
+                if (!wait) {
+                    return { content: [{ type: "text", text: JSON.stringify(enqueued) }] };
+                }
+                const { mergeRequest } = await waitForStatus(signal => getMergeRequestRebaseStatus(project_id, merge_request_iid, signal), TERMINAL_REBASE_STATUSES, timeout_seconds, poll_interval_seconds);
+                return { content: [{ type: "text", text: JSON.stringify(mergeRequest) }] };
+            }
             case "get_merge_request_approval_state": {
                 const args = GetMergeRequestApprovalStateSchema.parse(params.arguments);
                 const approvalState = await getMergeRequestApprovalState(args.project_id, args.merge_request_iid);
@@ -8662,7 +8795,7 @@ async function handleToolCall(params) {
             }
             case "list_namespaces": {
                 const args = ListNamespacesSchema.parse(params.arguments);
-                const url = new URL(`${GITLAB_API_URL}/namespaces`);
+                const url = new URL(`${getEffectiveApiUrl()}/namespaces`);
                 if (args.search) {
                     url.searchParams.append("search", args.search);
                 }
@@ -8687,7 +8820,7 @@ async function handleToolCall(params) {
             }
             case "get_namespace": {
                 const args = GetNamespaceSchema.parse(params.arguments);
-                const url = new URL(`${GITLAB_API_URL}/namespaces/${encodeGitLabPathSegment(args.namespace_id)}`);
+                const url = new URL(`${getEffectiveApiUrl()}/namespaces/${encodeGitLabPathSegment(args.namespace_id)}`);
                 const response = await fetch(url.toString(), {
                     ...getFetchConfig(),
                 });
@@ -8700,7 +8833,7 @@ async function handleToolCall(params) {
             }
             case "verify_namespace": {
                 const args = VerifyNamespaceSchema.parse(params.arguments);
-                const url = new URL(`${GITLAB_API_URL}/namespaces/${encodeGitLabPathSegment(args.path)}/exists`);
+                const url = new URL(`${getEffectiveApiUrl()}/namespaces/${encodeGitLabPathSegment(args.path)}/exists`);
                 if (args.parent_id !== undefined)
                     url.searchParams.set("parent_id", String(args.parent_id));
                 const response = await fetch(url.toString(), {
@@ -9158,7 +9291,8 @@ async function handleToolCall(params) {
             }
             case "list_work_item_note_emoji_reactions": {
                 const args = ListWorkItemNoteEmojiReactionsSchema.parse(params.arguments);
-                const result = await listGraphQLAwardEmoji(args.note_id);
+                const noteGID = await resolveWorkItemNoteGID(args.project_id, args.iid, args.note_id);
+                const result = await listGraphQLAwardEmoji(noteGID);
                 return { content: [{ type: "text", text: JSON.stringify(result) }] };
             }
             case "create_work_item_emoji_reaction": {
@@ -9182,12 +9316,14 @@ async function handleToolCall(params) {
             }
             case "create_work_item_note_emoji_reaction": {
                 const args = CreateWorkItemNoteEmojiReactionSchema.parse(params.arguments);
-                const result = await addGraphQLAwardEmoji(args.note_id, args.name);
+                const noteGID = await resolveWorkItemNoteGID(args.project_id, args.iid, args.note_id);
+                const result = await addGraphQLAwardEmoji(noteGID, args.name);
                 return { content: [{ type: "text", text: JSON.stringify(result) }] };
             }
             case "delete_work_item_note_emoji_reaction": {
                 const args = DeleteWorkItemNoteEmojiReactionSchema.parse(params.arguments);
-                const result = await removeGraphQLAwardEmoji(args.note_id, args.name);
+                const noteGID = await resolveWorkItemNoteGID(args.project_id, args.iid, args.note_id);
+                const result = await removeGraphQLAwardEmoji(noteGID, args.name);
                 return {
                     content: [
                         {
@@ -10110,6 +10246,9 @@ async function handleToolCall(params) {
                         ],
                     };
                 }
+                if (GITLAB_PERMISSION_MODE === "readonly") {
+                    throw new Error("download_job_artifacts saves files to disk, which readonly mode does not allow. Use list_job_artifacts and get_job_artifact_file instead.");
+                }
                 const filePath = await downloadJobArtifacts(project_id, job_id, local_path);
                 return {
                     content: [
@@ -10618,6 +10757,10 @@ async function handleToolCall(params) {
                         ],
                     };
                 }
+                // Readonly mode never writes to disk: images still come back inline.
+                if (GITLAB_PERMISSION_MODE === "readonly" && (!mimeType || args.local_path)) {
+                    throw new Error("download_attachment saves this file to disk, which readonly mode does not allow. Only images without local_path can be downloaded in readonly mode.");
+                }
                 const result = await downloadAttachment(args.project_id, args.secret, args.filename, args.local_path);
                 if (result.mimeType && !args.local_path) {
                     // Return image inline as base64 so the AI can see it
@@ -11329,7 +11472,8 @@ async function startSSEServer() {
             const transport = transports[sessionId];
             delete transports[sessionId];
             sessionLastActivity.delete(sessionId);
-            logger.info({ sessionId, event: "sse_session_idle_closed" }, `SSE session ${sessionId} closed after ${SESSION_TIMEOUT_SECONDS}s of inactivity`);
+            const sidPrefix = redactSessionIdForLog(sessionId);
+            logger.info({ sidPrefix, event: "sse_session_idle_closed" }, `SSE session ${sidPrefix} closed after ${SESSION_TIMEOUT_SECONDS}s of inactivity`);
             if (transport) {
                 void transport.close().catch(error => {
                     logger.error({ err: error }, "Error closing idle SSE transport");
@@ -11365,7 +11509,7 @@ async function startSSEServer() {
             await serverInstance.connect(transport);
         }
         catch (error) {
-            logger.error({ err: error, sessionId }, "SSE connection error");
+            logger.error({ err: error, sidPrefix: redactSessionIdForLog(sessionId) }, "SSE connection error");
             // Release the capacity slot immediately instead of waiting for the
             // client to disconnect or the idle sweep to run.
             delete transports[sessionId];
@@ -11468,6 +11612,8 @@ async function startStreamableHTTPServer() {
     };
     // Rate limiting per session
     const sessionRequestCounts = {};
+    // MCP OAuth mode: the GitLab user each stateful session belongs to
+    const sessionOwners = Object.create(null);
     /**
      * Validate token format and length
      */
@@ -11575,7 +11721,18 @@ async function startStreamableHTTPServer() {
         }
         return null;
     };
-    const validateAuthDataUpstream = async (authData) => {
+    /**
+     * Identify the GitLab user behind a credential. When GitLab does not report a
+     * user id, fall back to a digest of the token so only that exact token matches.
+     */
+    const sessionOwnerKey = (apiUrl, userId, token) => typeof userId === "number" || typeof userId === "string"
+        ? `${apiUrl.replace(/\/$/, "")}#${userId}`
+        : `token:${createHash("sha256").update(token).digest("hex")}`;
+    /**
+     * Validate header auth against GitLab. Resolves to the session owner key of
+     * the token, or null when GitLab rejects it.
+     */
+    const resolveAuthOwnerUpstream = async (authData) => {
         const apiUrl = authData.apiUrl.replace(/\/$/, "");
         const paths = authData.header === "JOB-TOKEN" ? ["user", "job"] : ["user"];
         try {
@@ -11591,20 +11748,67 @@ async function startStreamableHTTPServer() {
                         },
                         signal: controller.signal,
                     });
-                    if (response.ok)
-                        return true;
+                    if (response.ok) {
+                        const body = (await response.json().catch(() => undefined));
+                        const userId = path === "job" ? body?.user?.id : body?.id;
+                        return sessionOwnerKey(apiUrl, userId, authData.token);
+                    }
                 }
                 finally {
                     clearTimeout(timeout);
                 }
             }
-            return false;
+            return null;
         }
         catch (error) {
             logger.warn({ err: error }, "Remote auth token validation failed");
-            return false;
+            return null;
         }
     };
+    const validateAuthDataUpstream = async (authData) => (await resolveAuthOwnerUpstream(authData)) !== null;
+    /**
+     * With GITLAB_OAUTH_ALLOWED_GROUPS set in MCP OAuth mode, credentials that do
+     * not pass through verifyAccessToken (Private-Token / JOB-TOKEN headers and
+     * sealed stateless session ids) get the same group check, using the OAuth
+     * provider's per-token membership cache. CI job tokens cannot list the
+     * user's groups, so they are refused. Returns null when access is allowed.
+     */
+    const checkAllowedGroups = async (header, token) => {
+        if (!GITLAB_MCP_OAUTH || !GITLAB_OAUTH_ALLOWED_GROUPS)
+            return null;
+        if (header === "JOB-TOKEN") {
+            return {
+                status: 403,
+                body: {
+                    error: "JOB-TOKEN header not accepted",
+                    message: "GITLAB_OAUTH_ALLOWED_GROUPS is set and CI job tokens cannot be checked for group " +
+                        "membership. Use OAuth or a Private-Token header instead.",
+                },
+            };
+        }
+        const provider = app._mcpOAuthProvider;
+        try {
+            if (await provider.isAllowedGroupMember(token))
+                return null;
+        }
+        catch (error) {
+            logger.warn({ err: error }, "Group membership lookup failed");
+            return {
+                status: 503,
+                body: {
+                    error: "Group membership check unavailable",
+                    message: "Could not verify group membership with GitLab. Please retry.",
+                },
+            };
+        }
+        return {
+            status: 403,
+            body: {
+                error: "Access denied",
+                message: "The token owner is not a member of an allowed group.",
+            },
+        };
+    };
     const sessionAuthTokensMatch = (left, right) => left.header === right.header && left.token === right.token && left.apiUrl === right.apiUrl;
     const storeValidatedSessionAuth = async (targetSessionId, authData, publicBaseUrl, existing, options) => {
         const current = authBySession[targetSessionId];
@@ -11635,15 +11839,15 @@ async function startStreamableHTTPServer() {
             const transport = streamableTransports[sessionId];
             if (authData || transport) {
                 logger.info(authData
-                    ? `Session ${sessionId}: auth token expired after ${SESSION_TIMEOUT_SECONDS}s of inactivity`
-                    : `Session ${sessionId}: unauthenticated discovery expired after ${SESSION_TIMEOUT_SECONDS}s`);
+                    ? `Session ${redactSessionIdForLog(sessionId)}: auth token expired after ${SESSION_TIMEOUT_SECONDS}s of inactivity`
+                    : `Session ${redactSessionIdForLog(sessionId)}: unauthenticated discovery expired after ${SESSION_TIMEOUT_SECONDS}s`);
                 delete authBySession[sessionId];
                 delete authTimeouts[sessionId];
                 metrics.expiredSessions++;
                 // Close the transport to free the slot; without this, stale sessions accumulate and exhaust MAX_SESSIONS.
                 if (transport) {
                     transport.close().catch(err => {
-                        logger.error(`Error closing transport for expired session ${sessionId}:`, err);
+                        logger.error(`Error closing transport for expired session ${redactSessionIdForLog(sessionId)}:`, err);
                     });
                 }
             }
@@ -11664,6 +11868,7 @@ async function startStreamableHTTPServer() {
      */
     const cleanupSessionAuth = (sessionId) => {
         delete authBySession[sessionId];
+        delete sessionOwners[sessionId];
         clearAuthTimeout(sessionId);
     };
     /**
@@ -11694,6 +11899,9 @@ async function startStreamableHTTPServer() {
         const incomingSid = readMcpSessionIdHeader(req);
         const isInit = isInitializationRequestBody(req.body);
         const headerAuth = parseAuthHeaders(req);
+        const opened = incomingSid && looksLikeStatelessSessionId(incomingSid)
+            ? openSessionId(material, incomingSid, sessionTtlSeconds)
+            : null;
         // In GITLAB_MCP_OAUTH mode, req.auth may be populated by requireBearerAuth.
         // Use it when headerAuth is null (no Private-Token / JOB-TOKEN / Authorization).
         let effective = null;
@@ -11701,7 +11909,6 @@ async function startStreamableHTTPServer() {
         if (headerAuth) {
             let needsUpstreamValidation = isInit || !incomingSid;
             if (!needsUpstreamValidation && incomingSid && looksLikeStatelessSessionId(incomingSid)) {
-                const opened = openSessionId(material, incomingSid, sessionTtlSeconds);
                 needsUpstreamValidation =
                     !opened ||
                         opened.h !== headerAuth.header ||
@@ -11748,7 +11955,6 @@ async function startStreamableHTTPServer() {
         let sidPresentedButInvalid = false;
         if (!effective && incomingSid) {
             if (looksLikeStatelessSessionId(incomingSid)) {
-                const opened = openSessionId(material, incomingSid, sessionTtlSeconds);
                 if (opened) {
                     effective = {
                         header: opened.h,
@@ -11791,6 +11997,27 @@ async function startStreamableHTTPServer() {
             });
             return;
         }
+        // Sid-only requests never reach verifyAccessToken or the header check in
+        // mcpBearerAuth, so the sealed credential is checked here (cached per token).
+        const groupDenial = await checkAllowedGroups(effective.header, effective.token);
+        if (groupDenial) {
+            metrics.authFailures++;
+            metrics.statelessAuthFailures++;
+            res.status(groupDenial.status).json(groupDenial.body);
+            return;
+        }
+        // The project scope sealed into the sid belongs to the session: live headers
+        // may refresh the token but cannot drop or replace the scope.
+        if (ENABLE_DYNAMIC_PROJECT_SCOPE && freshAuthPresent && !isInit && opened) {
+            const allowedProjectIds = bindSessionProjectScope(effective.allowedProjectIds, opened.p);
+            if (allowedProjectIds === null) {
+                metrics.authFailures++;
+                metrics.statelessAuthFailures++;
+                res.status(401).json(SESSION_PROJECT_SCOPE_MISMATCH);
+                return;
+            }
+            effective.allowedProjectIds = allowedProjectIds;
+        }
         // Always mint a fresh sid so the embedded iat advances on every request.
         // This makes OAUTH_STATELESS_SESSION_TTL_SECONDS behave as an inactivity
         // timeout rather than an absolute-age cap — matching the legacy
@@ -11908,7 +12135,7 @@ async function startStreamableHTTPServer() {
                 storedTtlSeconds: OAUTH_STATELESS_STORED_TTL_SECONDS,
             }
             : null;
-        const oauthProvider = createGitLabOAuthProvider(gitlabBaseUrl, GITLAB_OAUTH_APP_ID, "GitLab MCP Server", GITLAB_PERMISSION_MODE === "readonly", GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_ALLOWED_GROUPS, GITLAB_OAUTH_CALLBACK_PROXY, callbackUrl, statelessOptions);
+        const oauthProvider = createGitLabOAuthProvider(gitlabBaseUrl, GITLAB_OAUTH_APP_ID, "GitLab MCP Server", GITLAB_PERMISSION_MODE === "readonly", GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_ALLOWED_GROUPS, GITLAB_OAUTH_CALLBACK_PROXY, callbackUrl, statelessOptions, parseAllowedRedirectUris(GITLAB_OAUTH_ALLOWED_REDIRECT_URIS_RAW));
         const scopesSupported = GITLAB_OAUTH_SCOPES ?? ["api", "read_api", "read_user"];
         // When server URL has a path (e.g. behind Kong), the SDK's well-known metadata
         // advertises root-level endpoints. Override to use path-prefixed endpoints.
@@ -12038,18 +12265,25 @@ async function startStreamableHTTPServer() {
                 }
                 const sessionId = readMcpSessionIdHeader(req);
                 const cached = sessionId ? authBySession[sessionId] : undefined;
-                if (cached && sessionAuthTokensMatch(cached, authData)) {
-                    next();
+                const owner = sessionId && cached && sessionAuthTokensMatch(cached, authData)
+                    ? sessionOwners[sessionId]
+                    : await resolveAuthOwnerUpstream(authData);
+                if (owner === null) {
+                    res.status(401).json({
+                        error: "Invalid Private-Token or JOB-TOKEN header",
+                        message: "The provided token failed validation. Check the token value and format.",
+                    });
                     return;
                 }
-                if (await validateAuthDataUpstream(authData)) {
-                    next();
+                // Also runs for existing sessions so group removals take effect
+                // once the cached membership result expires.
+                const denial = await checkAllowedGroups(authData.header, authData.token);
+                if (denial) {
+                    res.status(denial.status).json(denial.body);
                     return;
                 }
-                res.status(401).json({
-                    error: "Invalid Private-Token or JOB-TOKEN header",
-                    message: "The provided token failed validation. Check the token value and format.",
-                });
+                res.locals.sessionOwner = owner;
+                next();
                 return;
             }
             // Stateless-mode sid bypass: when the client sends only an
@@ -12082,8 +12316,38 @@ async function startStreamableHTTPServer() {
         }
         next();
     };
+    // Owner key of the credential mcpBearerAuth accepted for this request
+    const readRequestOwner = (req, res) => {
+        if (hasHeaderAuth(req)) {
+            return res.locals.sessionOwner;
+        }
+        const authInfo = req.auth;
+        return authInfo?.token
+            ? sessionOwnerKey(GITLAB_API_URL, authInfo.extra?.resourceOwnerId, authInfo.token)
+            : undefined;
+    };
+    const bindSessionOwner = (sessionId, req, res) => {
+        const owner = readRequestOwner(req, res);
+        if (owner !== undefined) {
+            sessionOwners[sessionId] = owner;
+        }
+    };
+    // In MCP OAuth mode a stateful session belongs to the GitLab user who opened it.
+    // A credential for another user gets the same 404 as an unknown session, so it
+    // can neither use, stream from, nor close the session. A refreshed token for the
+    // same user still matches.
+    const rejectForeignSession = (req, res, next) => {
+        const sessionId = readMcpSessionIdHeader(req);
+        const owner = sessionId ? sessionOwners[sessionId] : undefined;
+        if (owner !== undefined && readRequestOwner(req, res) !== owner) {
+            metrics.authFailures++;
+            res.status(404).json({ error: "Session not found" });
+            return;
+        }
+        next();
+    };
     // Streamable HTTP endpoint - handles both session creation and message handling
-    app.post("/mcp", rejectUnknownStatefulSession, mcpRequestRateLimit, mcpBearerAuth, async (req, res) => {
+    app.post("/mcp", rejectUnknownStatefulSession, mcpRequestRateLimit, mcpBearerAuth, rejectForeignSession, async (req, res) => {
         const sessionId = readMcpSessionIdHeader(req);
         const publicBaseUrl = getForwardedPublicBaseUrl(req, MCP_TRUST_PROXY);
         // Track request
@@ -12171,7 +12435,7 @@ async function startStreamableHTTPServer() {
                     }
                     remoteAuthValidatedForInit = true;
                     if (result === "stored") {
-                        logger.info(`Session ${sessionId}: stored ${authData.header} header`);
+                        logger.info(`Session ${redactSessionIdForLog(sessionId)}: stored ${authData.header} header`);
                     }
                 }
                 else if (allowUnauthenticatedDiscovery) {
@@ -12180,7 +12444,13 @@ async function startStreamableHTTPServer() {
                 }
             }
             else if (sessionId && authData) {
-                const result = await storeValidatedSessionAuth(sessionId, authData, publicBaseUrl, authBySession[sessionId], { skipIfUnchanged: true });
+                const allowedProjectIds = bindSessionProjectScope(authData.allowedProjectIds, authBySession[sessionId].allowedProjectIds);
+                if (allowedProjectIds === null) {
+                    metrics.authFailures++;
+                    res.status(401).json(SESSION_PROJECT_SCOPE_MISMATCH);
+                    return;
+                }
+                const result = await storeValidatedSessionAuth(sessionId, { ...authData, allowedProjectIds }, publicBaseUrl, authBySession[sessionId], { skipIfUnchanged: true });
                 if (result === "invalid") {
                     metrics.authFailures++;
                     res.status(401).json({
@@ -12191,7 +12461,11 @@ async function startStreamableHTTPServer() {
                 }
                 remoteAuthValidatedForInit = true;
                 if (result === "stored") {
-                    logger.debug(`Session ${sessionId}: updated ${authData.header} header`);
+                    logger.debug(`Session ${redactSessionIdForLog(sessionId)}: updated ${authData.header} header`);
+                }
+                else {
+                    // Same token: keep the stored auth but let an unscoped session narrow.
+                    authBySession[sessionId].allowedProjectIds = allowedProjectIds;
                 }
             }
             else if (sessionId && authBySession[sessionId]) {
@@ -12214,11 +12488,18 @@ async function startStreamableHTTPServer() {
                 if (headerAuthData && sessionId) {
                     if (!authBySession[sessionId]) {
                         authBySession[sessionId] = withPublicBaseUrl(headerAuthData, publicBaseUrl);
-                        logger.info(`Session ${sessionId}: stored ${headerAuthData.header} header (header auth)`);
+                        bindSessionOwner(sessionId, req, res);
+                        logger.info(`Session ${redactSessionIdForLog(sessionId)}: stored ${headerAuthData.header} header (header auth)`);
                         setAuthTimeout(sessionId);
                     }
                     else {
-                        authBySession[sessionId] = withPublicBaseUrl(headerAuthData, publicBaseUrl, authBySession[sessionId]);
+                        const allowedProjectIds = bindSessionProjectScope(headerAuthData.allowedProjectIds, authBySession[sessionId].allowedProjectIds);
+                        if (allowedProjectIds === null) {
+                            metrics.authFailures++;
+                            res.status(401).json(SESSION_PROJECT_SCOPE_MISMATCH);
+                            return;
+                        }
+                        authBySession[sessionId] = withPublicBaseUrl({ ...headerAuthData, allowedProjectIds }, publicBaseUrl, authBySession[sessionId]);
                         setAuthTimeout(sessionId);
                     }
                 }
@@ -12234,7 +12515,8 @@ async function startStreamableHTTPServer() {
                             apiUrl: GITLAB_API_URL,
                             publicBaseUrl,
                         };
-                        logger.info(`Session ${sessionId}: stored OAuth token (client: ${authInfo.clientId})`);
+                        bindSessionOwner(sessionId, req, res);
+                        logger.info(`Session ${redactSessionIdForLog(sessionId)}: stored OAuth token (client: ${authInfo.clientId})`);
                         setAuthTimeout(sessionId);
                     }
                     else {
@@ -12264,13 +12546,13 @@ async function startStreamableHTTPServer() {
                             streamableTransports[newSessionId] = transport;
                             metrics.totalSessions++;
                             metrics.activeSessions++;
-                            logger.warn(`Streamable HTTP session initialized: ${newSessionId}`);
+                            logger.warn(`Streamable HTTP session initialized: ${redactSessionIdForLog(newSessionId)}`);
                             // Store auth for newly created session in remote mode
                             if (REMOTE_AUTHORIZATION && !authBySession[newSessionId]) {
                                 const authData = parseAuthHeaders(req);
                                 if (authData && remoteAuthValidatedForInit) {
                                     authBySession[newSessionId] = withPublicBaseUrl(authData, publicBaseUrl);
-                                    logger.info(`Session ${newSessionId}: stored ${authData.header} header`);
+                                    logger.info(`Session ${redactSessionIdForLog(newSessionId)}: stored ${authData.header} header`);
                                     setAuthTimeout(newSessionId);
                                 }
                                 else if (unauthenticatedDiscoveryRequested) {
@@ -12284,7 +12566,8 @@ async function startStreamableHTTPServer() {
                                     const authData = parseAuthHeaders(req);
                                     if (authData) {
                                         authBySession[newSessionId] = withPublicBaseUrl(authData, publicBaseUrl);
-                                        logger.info(`Session ${newSessionId}: stored ${authData.header} header (header auth)`);
+                                        bindSessionOwner(newSessionId, req, res);
+                                        logger.info(`Session ${redactSessionIdForLog(newSessionId)}: stored ${authData.header} header (header auth)`);
                                         setAuthTimeout(newSessionId);
                                     }
                                 }
@@ -12298,7 +12581,8 @@ async function startStreamableHTTPServer() {
                                             apiUrl: GITLAB_API_URL,
                                             publicBaseUrl,
                                         };
-                                        logger.info(`Session ${newSessionId}: stored OAuth token (client: ${authInfo.clientId})`);
+                                        bindSessionOwner(newSessionId, req, res);
+                                        logger.info(`Session ${redactSessionIdForLog(newSessionId)}: stored OAuth token (client: ${authInfo.clientId})`);
                                         setAuthTimeout(newSessionId);
                                     }
                                 }
@@ -12309,13 +12593,13 @@ async function startStreamableHTTPServer() {
                     transport.onclose = () => {
                         const sid = transport.sessionId;
                         if (sid && streamableTransports[sid]) {
-                            logger.warn(`Streamable HTTP transport closed for session ${sid}, cleaning up`);
+                            logger.warn(`Streamable HTTP transport closed for session ${redactSessionIdForLog(sid)}, cleaning up`);
                             delete streamableTransports[sid];
                             metrics.activeSessions--;
                             if (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH) {
                                 cleanupSessionAuth(sid);
                                 delete sessionRequestCounts[sid];
-                                logger.info(`Session ${sid}: cleaned up auth mapping`);
+                                logger.info(`Session ${redactSessionIdForLog(sid)}: cleaned up auth mapping`);
                             }
                         }
                     };
@@ -12356,7 +12640,7 @@ async function startStreamableHTTPServer() {
         }
     });
     // Streamable HTTP GET endpoint for listening to server-sent events (SSE)
-    app.get("/mcp", rejectUnknownStatefulSession, mcpRequestRateLimit, mcpBearerAuth, async (req, res) => {
+    app.get("/mcp", rejectUnknownStatefulSession, mcpRequestRateLimit, mcpBearerAuth, rejectForeignSession, async (req, res) => {
         const sessionId = readMcpSessionIdHeader(req);
         const acceptHeader = readAcceptHeader(req);
         if (!acceptHeader.includes("text/event-stream")) {
@@ -12480,7 +12764,7 @@ async function startStreamableHTTPServer() {
         });
     });
     // to delete a mcp server session explicitly
-    app.delete("/mcp", rejectUnknownStatefulSession, mcpRequestRateLimit, mcpBearerAuth, async (req, res) => {
+    app.delete("/mcp", rejectUnknownStatefulSession, mcpRequestRateLimit, mcpBearerAuth, rejectForeignSession, async (req, res) => {
         const sessionId = readMcpSessionIdHeader(req);
         if (!sessionId) {
             res.status(400).json({ error: "mcp-session-id header is required" });
@@ -12490,16 +12774,16 @@ async function startStreamableHTTPServer() {
         if (transport) {
             try {
                 await transport.close();
-                logger.info(`Explicitly closed session via DELETE request: ${sessionId}`);
+                logger.info(`Explicitly closed session via DELETE request: ${redactSessionIdForLog(sessionId)}`);
                 if (REMOTE_AUTHORIZATION || GITLAB_MCP_OAUTH) {
                     cleanupSessionAuth(sessionId);
                     delete sessionRequestCounts[sessionId];
-                    logger.info(`Session ${sessionId}: cleaned up auth mapping on DELETE`);
+                    logger.info(`Session ${redactSessionIdForLog(sessionId)}: cleaned up auth mapping on DELETE`);
                 }
                 res.status(204).send();
             }
             catch (error) {
-                logger.error({ err: error }, `Error closing session ${sessionId}`);
+                logger.error({ err: error }, `Error closing session ${redactSessionIdForLog(sessionId)}`);
                 res.status(500).json({ error: "Failed to close session" });
             }
         }
@@ -12542,7 +12826,7 @@ async function startStreamableHTTPServer() {
                 }
             }
             catch (error) {
-                logger.error({ err: error }, `Error closing session ${sessionId}`);
+                logger.error({ err: error }, `Error closing session ${redactSessionIdForLog(sessionId)}`);
             }
         });
         await Promise.allSettled(closePromises);