@zereight/mcp-gitlab 2.3.2 → 2.3.4

package/README.ko.md

@@ -138,7 +138,7 @@ command = lib.getExe inputs.gitlab-mcp.packages.${system}.default;
 
 예시는 기존 `mcp-gitlab`보다 충돌 가능성이 낮은 `zereight-mcp-gitlab` 별칭을 사용합니다. MCP 클라이언트가 찾지 못하면 `which zereight-mcp-gitlab`의 절대 경로를 사용하세요.
 
-전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.3.1`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
+전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.3.3`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
 
 #### Claude Desktop 원클릭 설치(MCP Bundle)
 

package/README.md

@@ -1,9 +1,9 @@
 # GitLab MCP Server
 
-[![GitHub stars](https://img.shields.io/github/stars/zereight/gitlab-mcp.svg?style=social&label=Star)](https://github.com/zereight/gitlab-mcp)
-[![npm downloads](https://img.shields.io/npm/dm/@zereight/mcp-gitlab.svg)](https://www.npmjs.com/package/@zereight/mcp-gitlab)
+[![GitHub stars](https://badgen.net/github/stars/zereight/gitlab-mcp?icon=github&label=Star)](https://github.com/zereight/gitlab-mcp)
+[![npm downloads](https://badgen.net/npm/dm/@zereight/mcp-gitlab)](https://www.npmjs.com/package/@zereight/mcp-gitlab)
 [![npm](https://img.shields.io/npm/v/@zereight/mcp-gitlab.svg)](https://www.npmjs.com/package/@zereight/mcp-gitlab)
-[![GitHub License](https://img.shields.io/github/license/zereight/gitlab-mcp.svg)](https://github.com/zereight/gitlab-mcp/blob/main/LICENSE)
+[![GitHub License](https://badgen.net/github/license/zereight/gitlab-mcp)](https://github.com/zereight/gitlab-mcp/blob/main/LICENSE)
 [![Install in VS Code](https://img.shields.io/badge/VS_Code-Install_GitLab_MCP-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://vscode.dev/redirect/mcp/install?name=zereight.gitlab-mcp&config=%7B%22type%22%3A%22stdio%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40zereight%2Fmcp-gitlab%40latest%22%5D%2C%22env%22%3A%7B%22GITLAB_PERSONAL_ACCESS_TOKEN%22%3A%22%24%7Binput%3Agitlab-token%7D%22%2C%22GITLAB_API_URL%22%3A%22https%3A%2F%2Fgitlab.com%2Fapi%2Fv4%22%2C%22GITLAB_PERMISSION_MODE%22%3A%22full%22%7D%7D)
 [![Install in Cursor](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=zereight.gitlab-mcp&config=eyJ0eXBlIjoic3RkaW8iLCJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkB6ZXJlaWdodC9tY3AtZ2l0bGFiQGxhdGVzdCJdLCJlbnYiOnsiR0lUTEFCX1BFUlNPTkFMX0FDQ0VTU19UT0tFTiI6IiR7ZW52OkdJVExBQl9QRVJTT05BTF9BQ0NFU1NfVE9LRU59IiwiR0lUTEFCX0FQSV9VUkwiOiJodHRwczovL2dpdGxhYi5jb20vYXBpL3Y0IiwiR0lUTEFCX1BFUk1JU1NJT05fTU9ERSI6ImZ1bGwifX0%3D)
 [![Ask DeepWiki](https://img.shields.io/badge/DeepWiki-Ask-blue)](https://deepwiki.com/zereight/gitlab-mcp)
@@ -143,7 +143,7 @@ The store path is pinned by your lock file; update it with `nix flake update git
 
 The examples use `zereight-mcp-gitlab`, a less collision-prone alias for the legacy `mcp-gitlab` binary. If your MCP client cannot find it, use the absolute path from `which zereight-mcp-gitlab`.
 
-No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.3.1`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
+No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.3.3`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
 
 #### Claude Desktop one-click install (MCP Bundle)
 

package/README.pt-BR.md

@@ -138,7 +138,7 @@ O caminho no store é fixado pelo seu lock file; atualize-o com `nix flake updat
 
 Os exemplos usam `zereight-mcp-gitlab`, um alias com menor chance de conflito que o binário legado `mcp-gitlab`. Se o seu cliente MCP não o encontrar, use o caminho absoluto retornado por `which zereight-mcp-gitlab`.
 
-Não quer instalar globalmente? Fixe o `npx` na versão estável anterior (a versão recomendada por esta documentação), por exemplo `npx -y @zereight/mcp-gitlab@2.3.1`. Se quiser sempre a versão mais recente, use `npx -y @zereight/mcp-gitlab@latest`. O servidor exibe um aviso no stderr durante a inicialização quando existe uma versão mais nova disponível (desative com `GITLAB_DISABLE_VERSION_CHECK=true`).
+Não quer instalar globalmente? Fixe o `npx` na versão estável anterior (a versão recomendada por esta documentação), por exemplo `npx -y @zereight/mcp-gitlab@2.3.3`. Se quiser sempre a versão mais recente, use `npx -y @zereight/mcp-gitlab@latest`. O servidor exibe um aviso no stderr durante a inicialização quando existe uma versão mais nova disponível (desative com `GITLAB_DISABLE_VERSION_CHECK=true`).
 
 #### Instalação com um clique no Claude Desktop (MCP Bundle)
 

package/README.zh-CN.md

@@ -138,7 +138,7 @@ command = lib.getExe inputs.gitlab-mcp.packages.${system}.default;
 
 示例使用 `zereight-mcp-gitlab`，这是比旧的 `mcp-gitlab` 更不容易冲突的别名。如果 MCP 客户端找不到它，请使用 `which zereight-mcp-gitlab` 输出的绝对路径。
 
-如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.3.1`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
+如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.3.3`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
 
 #### Claude Desktop 一键安装（MCP Bundle）
 

package/build/config.js

@@ -79,6 +79,7 @@ export const SSE = getConfig("sse", "SSE") === "true";
 export const STREAMABLE_HTTP = getConfig("streamable-http", "STREAMABLE_HTTP") === "true";
 export const REMOTE_AUTHORIZATION = getConfig("remote-auth", "REMOTE_AUTHORIZATION") === "true";
 export const GITLAB_MCP_OAUTH = getConfig("mcp-oauth", "GITLAB_MCP_OAUTH") === "true";
+export const GITLAB_MCP_REQUEST_BODY_LIMIT = process.env.GITLAB_MCP_REQUEST_BODY_LIMIT?.trim() || "10mb";
 export const GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY = getConfig("allow-unauthenticated-tool-discovery", "GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY") === "true";
 export const MCP_TRUST_PROXY = getConfig("mcp-trust-proxy", "MCP_TRUST_PROXY") === "true";
 // ---------------------------------------------------------------------------

package/build/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { getConfig, ENABLE_DYNAMIC_API_URL, ENABLE_DYNAMIC_PROJECT_SCOPE, ENABLE_STRICT_PROJECT_SCOPE, GITLAB_AUTH_COOKIE_PATH, GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_OAUTH_ALLOWED_REDIRECT_URIS_RAW, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_DISABLE_VERSION_CHECK, GITLAB_MASKING_ENABLED, GITLAB_MASKING_CONFIG, GITLAB_MASKING_POLICY_FILE, GITLAB_MASKING_WORKSPACE_DIR, GITLAB_PERMISSION_MODE, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, MCP_TRUST_PROXY, USE_GITLAB_WIKI, USE_MILESTONE, USE_OAUTH, USE_PIPELINE, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_OAUTH_ALLOWED_GROUPS, GITLAB_MCP_COMPACT_RESULTS, GITLAB_MCP_COMPACT_RESULT_CHARS, GITLAB_MCP_COMPACT_TOOL_NAMES, GITLAB_TOOL_PROFILE, GITLAB_DOWNLOAD_DIR, buildDeprecatedEnvInput, } from "./config.js";
+import { getConfig, ENABLE_DYNAMIC_API_URL, ENABLE_DYNAMIC_PROJECT_SCOPE, ENABLE_STRICT_PROJECT_SCOPE, GITLAB_AUTH_COOKIE_PATH, GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_MCP_REQUEST_BODY_LIMIT, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_OAUTH_ALLOWED_REDIRECT_URIS_RAW, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_DISABLE_VERSION_CHECK, GITLAB_MASKING_ENABLED, GITLAB_MASKING_CONFIG, GITLAB_MASKING_POLICY_FILE, GITLAB_MASKING_WORKSPACE_DIR, GITLAB_PERMISSION_MODE, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, MCP_TRUST_PROXY, USE_GITLAB_WIKI, USE_MILESTONE, USE_OAUTH, USE_PIPELINE, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_OAUTH_ALLOWED_GROUPS, GITLAB_MCP_COMPACT_RESULTS, GITLAB_MCP_COMPACT_RESULT_CHARS, GITLAB_MCP_COMPACT_TOOL_NAMES, GITLAB_TOOL_PROFILE, GITLAB_DOWNLOAD_DIR, buildDeprecatedEnvInput, } from "./config.js";
 import { getDeprecatedEnvWarnings } from "./deprecated-env.js";
 /** True when the server is running in remote/network mode (SSE or StreamableHTTP transport). */
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
@@ -62,7 +62,7 @@ function isConstantTimeSecretMatch(provided, expected) {
 import { loadKeyMaterialFromEnv, looksLikeStatelessSessionId, mintSessionId, openSessionId, } from "./stateless/index.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { CallToolRequestSchema, ListToolsRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ReadResourceRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import fetchCookie from "fetch-cookie";
 import fs from "node:fs";
@@ -90,6 +90,7 @@ import { loadRemoteHttpStack } from "./server/remote-http-stack.js";
 import { determineTransportMode, TransportMode } from "./server/transport-mode.js";
 import { formatPrometheusMetrics } from "./server/metrics.js";
 import { SERVER_VERSION } from "./server/version.js";
+import { listMcpResources, listMcpResourceTemplates, readMcpResource, } from "./server/mcp-resources.js";
 import { isInitializationRequestBody, isUnauthenticatedDiscoveryRequestBody, readAcceptHeader, readMcpSessionIdHeader, redactSessionIdForLog, } from "./server/request-helpers.js";
 export { readMcpSessionIdHeader } from "./server/request-helpers.js";
 import { encodeGitLabPath, encodeGitLabPathSegment, isCleartextRemoteUrl, normalizeGitLabApiUrl, } from "./utils/url.js";
@@ -98,12 +99,13 @@ import { graphqlQueryContainsWriteOperation, graphqlQueryContainsDeleteOperation
 import { resolveNestedWikiUpdateTitle } from "./utils/wiki-title.js";
 import { encodeRepoFilePayloadContent, fileOperationsIncludeDeleteOrMove, toGitLabCommitActions, } from "./utils/gitlab-commit-actions.js";
 import { redactSensitiveGitLabFields } from "./utils/redact-sensitive.js";
-import { classifyHealthCheckTransportError, redactGitLabUrlCredentials, } from "./utils/health-check-transport-error.js";
-import { redactUrlSecretsInText } from "./utils/redact-url.js";
+import { classifyHealthCheckTransportError, describeFetchTransportError, redactGitLabUrlCredentials, } from "./utils/health-check-transport-error.js";
+import { redactUrlSecretsInText, splitCommaSeparatedUrls } from "./utils/redact-url.js";
 import { createMaskingPolicyResolver, getManagedMaskingProjectIds, } from "./masking/index.js";
 import { checkForNewVersion } from "./utils/version-check.js";
 import { assertGitLabVersionAtLeast } from "./utils/gitlab-version-gate.js";
 import { fetchWithValidatedRedirects } from "./utils/safe-redirect-fetch.js";
+import { fetchStatusBeforeDeadline } from "./utils/poll-deadline.js";
 import { parseGitLabVersionApiResponse, } from "./utils/gitlab-instance-version.js";
 import { buildBulkPublishDraftNotesBody, needsGitLab19_2BulkPublish, } from "./utils/bulk-publish-options.js";
 import { appendFilterParam, appendFilterParams, cleanMutuallyExclusiveIdUsernameOptions, dropBlankArrayEntries, isBlankFilterValue, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS, sanitizeToolArguments, } from "./utils/tool-args.js";
@@ -142,6 +144,9 @@ const maskingPolicyResolver = createMaskingPolicyResolver({
     workspaceDir: GITLAB_MASKING_WORKSPACE_DIR,
 });
 const SERVER_NAME = process.env.MCP_SERVER_NAME?.trim() || "zereight-gitlab-mcp-server";
+// No `title`: clients would show it instead of `name`, hiding MCP_SERVER_NAME.
+const SERVER_DESCRIPTION = "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more.";
+const SERVER_WEBSITE_URL = "https://zereight.github.io/gitlab-mcp/";
 /**
  * Static MCP prompt catalog. These wrap the multi-step tool workflows documented in
  * skills/gitlab-mcp/ so MCP clients that surface prompts (e.g. slash commands) can
@@ -239,12 +244,15 @@ function createServer() {
     const mcpServer = new McpServer({
         name: SERVER_NAME,
         version: SERVER_VERSION,
+        description: SERVER_DESCRIPTION,
+        websiteUrl: SERVER_WEBSITE_URL,
     }, {
         capabilities: {
             tools: {
                 listChanged: true,
             },
             prompts: {},
+            resources: {},
         },
     });
     mcpServer.server.setRequestHandler(ListPromptsRequestSchema, async () => ({
@@ -273,6 +281,9 @@ function createServer() {
             ],
         };
     });
+    mcpServer.server.setRequestHandler(ListResourcesRequestSchema, async () => listMcpResources());
+    mcpServer.server.setRequestHandler(ListResourceTemplatesRequestSchema, async () => listMcpResourceTemplates());
+    mcpServer.server.setRequestHandler(ReadResourceRequestSchema, async (request) => readMcpResource(request.params.uri));
     mcpServer.server.setRequestHandler(ListToolsRequestSchema, async () => {
         return {
             tools: getListedTools(filteredTools, listedToolsCache.revision),
@@ -730,7 +741,8 @@ function validateConfiguration() {
         }
     }
     // Validate GITLAB_API_URL format
-    const apiUrls = getConfig("api-url", "GITLAB_API_URL")?.split(",") || [];
+    const configuredApiUrls = getConfig("api-url", "GITLAB_API_URL");
+    const apiUrls = configuredApiUrls === undefined ? [] : splitCommaSeparatedUrls(configuredApiUrls);
     if (apiUrls.length > 0) {
         for (const url of apiUrls) {
             try {
@@ -954,9 +966,7 @@ const hiddenToolSet = new Set((GITLAB_TOOL_POLICY_HIDDEN_RAW || "")
     }
 }
 const clientPool = new GitLabClientPool({
-    apiUrls: (getConfig("api-url", "GITLAB_API_URL") || "https://gitlab.com")
-        .split(",")
-        .map(normalizeGitLabApiUrl),
+    apiUrls: splitCommaSeparatedUrls(getConfig("api-url", "GITLAB_API_URL") || "https://gitlab.com").map(normalizeGitLabApiUrl),
     httpProxy: HTTP_PROXY,
     httpsProxy: HTTPS_PROXY,
     noProxy: NO_PROXY,
@@ -1330,9 +1340,7 @@ function resolveTrustedGitLabApiUrl(value) {
     return allowedApiUrl;
 }
 // Use the normalizeGitLabApiUrl function to handle various URL formats
-const GITLAB_API_URLS = (getConfig("api-url", "GITLAB_API_URL") || "https://gitlab.com")
-    .split(",")
-    .map(normalizeGitLabApiUrl);
+const GITLAB_API_URLS = splitCommaSeparatedUrls(getConfig("api-url", "GITLAB_API_URL") || "https://gitlab.com").map(normalizeGitLabApiUrl);
 const GITLAB_API_URL = GITLAB_API_URLS[0];
 const GITLAB_ALLOWED_API_URLS_BY_HOST = new Map();
 for (const { host, apiUrl } of [
@@ -6363,14 +6371,73 @@ async function erasePipelineJob(projectId, jobId) {
 const TERMINAL_PIPELINE_STATUSES = new Set(["success", "failed", "canceled", "skipped", "manual"]);
 const TERMINAL_JOB_STATUSES = new Set(["success", "failed", "canceled", "skipped", "manual"]);
 const TERMINAL_REBASE_STATUSES = new Set(["finished"]);
-async function waitForStatus(fetchStatus, terminalStatuses, timeoutSeconds = 300, pollIntervalSeconds = 5) {
+// GitLab accepts PUT .../rebase before Sidekiq starts the job. Until then, GET
+// with include_rebase_in_progress can still say rebase_in_progress=false and return
+// the pre-rebase sha (gitlab-org/gitlab-foss#57481). Recheck that snapshot a few
+// times, capped so the default 5s poll interval cannot stretch this into 15s.
+const REBASE_UNCHANGED_HEAD_RECHECK_LIMIT = 3;
+const REBASE_UNCHANGED_HEAD_RECHECK_INTERVAL_CAP_MS = 1000;
+function rebaseHeadMoved(previous, current) {
+    return current.sha !== previous.sha;
+}
+function rebaseFailureExplained(previous, current) {
+    const mergeError = current.merge_error;
+    if (typeof mergeError !== "string" || mergeError.length === 0) {
+        return false;
+    }
+    return mergeError !== previous.merge_error;
+}
+function delayForRebasePoll(delayMs) {
+    return new Promise(resolve => {
+        setTimeout(resolve, delayMs);
+    });
+}
+async function getMergeRequestRebaseStatusBeforeDeadline(projectId, mergeRequestIid, deadline) {
+    return fetchStatusBeforeDeadline(signal => getMergeRequestRebaseStatus(projectId, mergeRequestIid, signal), deadline);
+}
+/**
+ * Poll until a rebase finishes, without trusting a finished snapshot that still
+ * has the pre-rebase sha and no new merge_error. A later rebase_in_progress true
+ * means the job did start, so wait for that terminal status as usual. Rechecks
+ * share the caller's timeout and never add time beyond it.
+ */
+async function waitForMergeRequestRebase(projectId, mergeRequestIid, previous, timeoutSeconds = 300, pollIntervalSeconds = 5) {
     const deadline = Date.now() + timeoutSeconds * 1000;
-    const fetchBeforeDeadline = async () => {
+    let snapshot = await getMergeRequestRebaseStatusBeforeDeadline(projectId, mergeRequestIid, deadline);
+    let rechecksRemaining = REBASE_UNCHANGED_HEAD_RECHECK_LIMIT;
+    while (true) {
+        if (!TERMINAL_REBASE_STATUSES.has(snapshot.status)) {
+            rechecksRemaining = 0;
+            const remaining = deadline - Date.now();
+            if (remaining <= 0) {
+                break;
+            }
+            await delayForRebasePoll(Math.min(pollIntervalSeconds * 1000, remaining));
+            snapshot = await getMergeRequestRebaseStatusBeforeDeadline(projectId, mergeRequestIid, deadline);
+            continue;
+        }
+        const mergeRequest = snapshot.mergeRequest;
+        if (rebaseHeadMoved(previous, mergeRequest) || rebaseFailureExplained(previous, mergeRequest)) {
+            return mergeRequest;
+        }
+        if (rechecksRemaining <= 0) {
+            return mergeRequest;
+        }
         const remaining = deadline - Date.now();
-        if (remaining <= 0)
-            throw new Error("Timed out waiting for terminal status");
-        return fetchStatus(AbortSignal.timeout(remaining));
-    };
+        const delay = Math.min(pollIntervalSeconds * 1000, REBASE_UNCHANGED_HEAD_RECHECK_INTERVAL_CAP_MS, remaining);
+        // The next poll has to land inside the timeout. If one full backoff does not fit, stop.
+        if (remaining <= 0 || delay >= remaining) {
+            return mergeRequest;
+        }
+        rechecksRemaining -= 1;
+        await delayForRebasePoll(delay);
+        snapshot = await getMergeRequestRebaseStatusBeforeDeadline(projectId, mergeRequestIid, deadline);
+    }
+    throw new Error(`Timed out waiting for terminal status; last status: ${snapshot.status}`);
+}
+async function waitForStatus(fetchStatus, terminalStatuses, timeoutSeconds = 300, pollIntervalSeconds = 5) {
+    const deadline = Date.now() + timeoutSeconds * 1000;
+    const fetchBeforeDeadline = () => fetchStatusBeforeDeadline(fetchStatus, deadline);
     let value = await fetchBeforeDeadline();
     while (!terminalStatuses.has(value.status)) {
         const remaining = deadline - Date.now();
@@ -8233,7 +8300,7 @@ async function handleToolCall(params) {
                     };
                 }
                 catch (err) {
-                    const message = err instanceof Error ? err.message : String(err);
+                    const message = describeFetchTransportError(err) ?? (err instanceof Error ? err.message : String(err));
                     return {
                         content: [
                             {
@@ -8283,7 +8350,8 @@ async function handleToolCall(params) {
                     logger.error({ err: forkError }, "Error forking repository");
                     let forkErrorMessage = "Failed to fork repository";
                     if (forkError instanceof Error) {
-                        forkErrorMessage = `${forkErrorMessage}: ${forkError.message}`;
+                        const reason = describeFetchTransportError(forkError) ?? forkError.message;
+                        forkErrorMessage = `${forkErrorMessage}: ${reason}`;
                     }
                     return {
                         content: [
@@ -8651,7 +8719,7 @@ async function handleToolCall(params) {
                             text: JSON.stringify({
                                 status: "success",
                                 message: "All pending to-do items marked as done",
-                            }, null, 2),
+                            }),
                         },
                     ],
                 };
@@ -8771,11 +8839,11 @@ async function handleToolCall(params) {
                 }
                 const { mergeRequest: previous } = await getMergeRequestRebaseStatus(project_id, merge_request_iid);
                 await rebaseMergeRequest(project_id, merge_request_iid, skip_ci);
-                const { mergeRequest } = await waitForStatus(signal => getMergeRequestRebaseStatus(project_id, merge_request_iid, signal), TERMINAL_REBASE_STATUSES, timeout_seconds, poll_interval_seconds);
+                const mergeRequest = await waitForMergeRequestRebase(project_id, merge_request_iid, previous, timeout_seconds, poll_interval_seconds);
                 const rebaseResult = {
                     ...mergeRequest,
                     previous_sha: previous.sha,
-                    head_changed: mergeRequest.sha !== previous.sha,
+                    head_changed: rebaseHeadMoved(previous, mergeRequest),
                 };
                 return { content: [{ type: "text", text: JSON.stringify(rebaseResult) }] };
             }
@@ -8895,9 +8963,7 @@ async function handleToolCall(params) {
                 await handleGitLabError(response);
                 const data = await response.json();
                 return {
-                    content: [
-                        { type: "text", text: JSON.stringify(redactSensitiveGitLabFields(data), null, 2) },
-                    ],
+                    content: [{ type: "text", text: JSON.stringify(redactSensitiveGitLabFields(data)) }],
                 };
             }
             case "list_project_members": {
@@ -9118,7 +9184,7 @@ async function handleToolCall(params) {
                                     changes: result.changes,
                                     summary: result.summary,
                                     preview: result.preview,
-                                }, null, 2),
+                                }),
                             },
                         ],
                     };
@@ -9157,7 +9223,7 @@ async function handleToolCall(params) {
                                     web_url: updatedIssue.web_url,
                                     updated_at: updatedIssue.updated_at,
                                 },
-                            }, null, 2),
+                            }),
                         },
                     ],
                 };
@@ -9169,7 +9235,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify({ status: "success", message: "Issue deleted successfully" }, null, 2),
+                            text: JSON.stringify({ status: "success", message: "Issue deleted successfully" }),
                         },
                     ],
                 };
@@ -9213,7 +9279,7 @@ async function handleToolCall(params) {
                             text: JSON.stringify({
                                 status: "success",
                                 message: "Issue link deleted successfully",
-                            }, null, 2),
+                            }),
                         },
                     ],
                 };
@@ -9391,7 +9457,7 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify({ status: "success", message: "Label deleted successfully" }, null, 2),
+                            text: JSON.stringify({ status: "success", message: "Label deleted successfully" }),
                         },
                     ],
                 };
@@ -9446,7 +9512,7 @@ async function handleToolCall(params) {
                             text: JSON.stringify({
                                 status: "success",
                                 message: "Wiki page deleted successfully",
-                            }, null, 2),
+                            }),
                         },
                     ],
                 };
@@ -9499,7 +9565,7 @@ async function handleToolCall(params) {
                             text: JSON.stringify({
                                 status: "success",
                                 message: "Group wiki page deleted successfully",
-                            }, null, 2),
+                            }),
                         },
                     ],
                 };
@@ -9924,7 +9990,7 @@ async function handleToolCall(params) {
                     topics: args.topics,
                     verificationLevel: args.verification_level,
                 });
-                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
             }
             case "get_ci_catalog_resource": {
                 const args = GetCiCatalogResourceSchema.parse(params.arguments);
@@ -9996,7 +10062,7 @@ async function handleToolCall(params) {
                         }
                     }
                 }
-                return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+                return { content: [{ type: "text", text: JSON.stringify(result) }] };
             }
             case "create_pipeline": {
                 const { project_id, ref, variables, inputs } = CreatePipelineSchema.parse(params.arguments);
@@ -10039,14 +10105,14 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const schedules = await listPipelineSchedules(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(schedules, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(schedules) }],
                 };
             }
             case "get_pipeline_schedule": {
                 const { project_id, pipeline_schedule_id } = GetPipelineScheduleSchema.parse(params.arguments);
                 const schedule = await getPipelineSchedule(project_id, pipeline_schedule_id);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(schedule, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(schedule) }],
                 };
             }
             case "list_pipeline_schedule_pipelines": {
@@ -10054,7 +10120,7 @@ async function handleToolCall(params) {
                 const { project_id, pipeline_schedule_id, ...options } = args;
                 const pipelines = await listPipelineSchedulePipelines(project_id, pipeline_schedule_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(pipelines, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(pipelines) }],
                 };
             }
             case "create_pipeline_schedule": {
@@ -10123,7 +10189,7 @@ async function handleToolCall(params) {
                 const { project_id, pipeline_schedule_id, key } = GetPipelineScheduleVariableSchema.parse(params.arguments);
                 const variable = await getPipelineScheduleVariable(project_id, pipeline_schedule_id, key);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(variable, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(variable) }],
                 };
             }
             case "create_pipeline_schedule_variable": {
@@ -10354,7 +10420,7 @@ async function handleToolCall(params) {
                             text: JSON.stringify({
                                 status: "success",
                                 message: "Milestone deleted successfully",
-                            }, null, 2),
+                            }),
                         },
                     ],
                 };
@@ -10470,7 +10536,7 @@ async function handleToolCall(params) {
                             text: JSON.stringify({
                                 status: "success",
                                 message: "Group milestone deleted successfully",
-                            }, null, 2),
+                            }),
                         },
                     ],
                 };
@@ -10598,7 +10664,10 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify({ status: "success", message: `Variable '${args.key}' deleted from project` }, null, 2),
+                            text: JSON.stringify({
+                                status: "success",
+                                message: `Variable '${args.key}' deleted from project`,
+                            }),
                         },
                     ],
                 };
@@ -10638,7 +10707,10 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify({ status: "success", message: `Variable '${args.key}' deleted from group` }, null, 2),
+                            text: JSON.stringify({
+                                status: "success",
+                                message: `Variable '${args.key}' deleted from group`,
+                            }),
                         },
                     ],
                 };
@@ -10677,7 +10749,10 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify({ status: "success", message: "Dependency proxy cache purge scheduled" }, null, 2),
+                            text: JSON.stringify({
+                                status: "success",
+                                message: "Dependency proxy cache purge scheduled",
+                            }),
                         },
                     ],
                 };
@@ -10846,7 +10921,11 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify({ status: "success", message: "Release deleted successfully", release }, null, 2),
+                            text: JSON.stringify({
+                                status: "success",
+                                message: "Release deleted successfully",
+                                release,
+                            }),
                         },
                     ],
                 };
@@ -10858,7 +10937,10 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify({ status: "success", message: "Release evidence created successfully" }, null, 2),
+                            text: JSON.stringify({
+                                status: "success",
+                                message: "Release evidence created successfully",
+                            }),
                         },
                     ],
                 };
@@ -10918,7 +11000,10 @@ async function handleToolCall(params) {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify({ status: "success", message: `Tag '${args.tag_name}' deleted successfully` }, null, 2),
+                            text: JSON.stringify({
+                                status: "success",
+                                message: `Tag '${args.tag_name}' deleted successfully`,
+                            }),
                         },
                     ],
                 };
@@ -11006,7 +11091,7 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const snippets = await listSnippets(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(snippets, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(snippets) }],
                 };
             }
             case "get_snippet": {
@@ -11043,7 +11128,7 @@ async function handleToolCall(params) {
                     }
                 }
                 return {
-                    content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(result) }],
                 };
             }
             case "create_snippet": {
@@ -11051,7 +11136,7 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const snippet = await createSnippet(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(snippet, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(snippet) }],
                 };
             }
             case "update_snippet": {
@@ -11059,7 +11144,7 @@ async function handleToolCall(params) {
                 const { project_id, ...options } = args;
                 const snippet = await updateSnippet(project_id, options);
                 return {
-                    content: [{ type: "text", text: JSON.stringify(snippet, null, 2) }],
+                    content: [{ type: "text", text: JSON.stringify(snippet) }],
                 };
             }
             case "delete_snippet": {
@@ -11072,7 +11157,7 @@ async function handleToolCall(params) {
                             text: JSON.stringify({
                                 status: "success",
                                 message: `Snippet ${args.snippet_id} deleted successfully`,
-                            }, null, 2),
+                            }),
                         },
                     ],
                 };
@@ -11121,7 +11206,9 @@ async function handleToolCall(params) {
                         content: [
                             {
                                 type: "text",
-                                text: JSON.stringify({ error: `Webhook event ${args.event_id} not found ${searchScope}` }, null, 2),
+                                text: JSON.stringify({
+                                    error: `Webhook event ${args.event_id} not found ${searchScope}`,
+                                }),
                             },
                         ],
                     };
@@ -11348,6 +11435,11 @@ async function handleToolCall(params) {
             // ToolInputError is returned as an isError tool result, so the model can fix and retry.
             throw new ToolInputError(`Invalid arguments for ${params.name}: ${detail}`);
         }
+        // undici says only "fetch failed"; name the reason (TLS, DNS, refused, ...).
+        const transportMessage = describeFetchTransportError(error);
+        if (transportMessage !== null) {
+            throw new Error(transportMessage, { cause: error });
+        }
         throw error;
     }
 }
@@ -11389,6 +11481,7 @@ function buildDownloadProxyDeps() {
 async function startSSEServer() {
     const { express, rateLimit, ipKeyGenerator, SSEServerTransport } = await loadRemoteHttpStack();
     const app = express();
+    const sseJsonBodyParser = express.json({ limit: GITLAB_MCP_REQUEST_BODY_LIMIT });
     const sseAuthToken = getConfig("sse-auth-token", "SSE_AUTH_TOKEN");
     if (MCP_TRUST_PROXY) {
         app.set("trust proxy", 1);
@@ -11541,12 +11634,20 @@ async function startSSEServer() {
             }
         }
     });
-    app.post("/messages", rejectDnsRebinding, requireSseAuth, async (req, res) => {
+    const requireSseSession = (req, res, next) => {
+        const sessionId = req.query.sessionId;
+        if (typeof sessionId !== "string" || !transports[sessionId]) {
+            res.status(400).send("No transport found for sessionId");
+            return;
+        }
+        next();
+    };
+    app.post("/messages", rejectDnsRebinding, requireSseAuth, requireSseSession, sseJsonBodyParser, async (req, res) => {
         const sessionId = req.query.sessionId;
         const transport = transports[sessionId];
         if (transport) {
             sessionLastActivity.set(sessionId, Date.now());
-            await transport.handlePostMessage(req, res);
+            await transport.handlePostMessage(req, res, req.body);
         }
         else {
             res.status(400).send("No transport found for sessionId");
@@ -12119,7 +12220,7 @@ async function startStreamableHTTPServer() {
         app.set("trust proxy", 1);
     }
     app.use("/mcp", requireMcpHostAndOrigin);
-    app.use(express.json());
+    const mcpJsonBodyParser = express.json({ limit: GITLAB_MCP_REQUEST_BODY_LIMIT });
     registerDownloadProxy(app, buildDownloadProxyDeps());
     const mcpRateLimitKeyGenerator = (req) => ipKeyGenerator(normalizeProxyClientIpForRateLimit(req.ip ?? ""));
     const mcpRequestRateLimit = rateLimit({
@@ -12363,7 +12464,7 @@ async function startStreamableHTTPServer() {
         next();
     };
     // Streamable HTTP endpoint - handles both session creation and message handling
-    app.post("/mcp", rejectUnknownStatefulSession, mcpRequestRateLimit, mcpBearerAuth, rejectForeignSession, async (req, res) => {
+    app.post("/mcp", rejectUnknownStatefulSession, mcpRequestRateLimit, mcpBearerAuth, rejectForeignSession, mcpJsonBodyParser, async (req, res) => {
         const sessionId = readMcpSessionIdHeader(req);
         const publicBaseUrl = getForwardedPublicBaseUrl(req, MCP_TRUST_PROXY);
         // Track request

package/build/server/mcp-resources.js

@@ -0,0 +1,51 @@
+// npm ships build/ only, so the text is inlined.
+import { ErrorCode, McpError } from "@modelcontextprotocol/sdk/types.js";
+const TEXT_MARKDOWN = "text/markdown";
+const resources = [
+    {
+        uri: "gitlab-mcp://docs/auth-setup",
+        name: "auth-setup",
+        description: "Local token auth and browser OAuth.",
+        text: "A personal access token is the local default path. Set GITLAB_PERSONAL_ACCESS_TOKEN and GITLAB_API_URL. OAuth is the browser path. Enable it with GITLAB_USE_OAUTH and set GITLAB_OAUTH_CLIENT_ID. GITLAB_OAUTH_TOKEN_SCRIPT is a separate option: it runs a command that prints a token instead of opening a browser.",
+    },
+    {
+        uri: "gitlab-mcp://docs/toolsets",
+        name: "toolsets",
+        description: "How the enabled toolset list is chosen.",
+        text: "When GITLAB_TOOLSETS is unset, the server uses the lean core toolset. GITLAB_TOOLSETS or --toolsets sets an explicit list. An explicit list replaces core. It does not merge with core.",
+    },
+    {
+        uri: "gitlab-mcp://docs/permission-modes",
+        name: "permission-modes",
+        description: "How permission mode limits tool calls.",
+        text: "Set GITLAB_PERMISSION_MODE or pass --permission-mode. readonly blocks writes. modify blocks delete and teardown. full is the default.",
+    },
+];
+export function listMcpResources() {
+    return {
+        resources: resources.map(resource => ({
+            uri: resource.uri,
+            name: resource.name,
+            description: resource.description,
+            mimeType: TEXT_MARKDOWN,
+        })),
+    };
+}
+export function listMcpResourceTemplates() {
+    return { resourceTemplates: [] };
+}
+export function readMcpResource(uri) {
+    const resource = resources.find(entry => entry.uri === uri);
+    if (resource === undefined) {
+        throw new McpError(ErrorCode.InvalidParams, `Resource ${uri} not found`);
+    }
+    return {
+        contents: [
+            {
+                uri: resource.uri,
+                mimeType: TEXT_MARKDOWN,
+                text: resource.text,
+            },
+        ],
+    };
+}

package/build/utils/health-check-transport-error.js

@@ -3,6 +3,8 @@
  * health_check must report these as a normal tool result: the caller is
  * already asking whether the connection works, so a JSON-RPC -32603 hides the
  * only signal they came for.
+ * Other tools keep the JSON-RPC error, but describeFetchTransportError puts the
+ * reason in its message.
  *
  * node-fetch puts the OS code on `code` / `errno`. undici leaves `code` empty
  * on the TypeError and stores it on `cause.code` (errno there is numeric).
@@ -25,6 +27,14 @@ const TIMEOUT_ERROR_NAMES = new Set(["AbortError", "TimeoutError"]);
 const REQUEST_TIMEOUT_TYPE = "request-timeout";
 const TLS_CA_HINT = "Make sure NODE_EXTRA_CA_CERTS or GITLAB_CA_CERT_PATH contains the full certificate chain, including intermediate CAs.";
 const FALLBACK_MESSAGE = "GitLab request failed before an HTTP response";
+// undici rejects with exactly this TypeError message and keeps the reason on `cause`.
+const UNDICI_FETCH_FAILED_MESSAGE = "fetch failed";
+const TRANSPORT_HINTS = {
+    tls: TLS_CA_HINT,
+    dns: "Check the host in the GitLab API URL and the DNS or proxy settings.",
+    timeout: "Check that GitLab is reachable from this host and the proxy settings.",
+    network: "Check the GitLab API URL, that GitLab is reachable from this host, and the proxy settings.",
+};
 export function classifyHealthCheckTransportError(error) {
     const code = readTransportCode(error);
     const kind = classifyKind(error, code);
@@ -38,6 +48,20 @@ export function classifyHealthCheckTransportError(error) {
     }
     return failure;
 }
+/**
+ * Message for a tool call whose fetch never got an HTTP response, e.g.
+ * "GitLab request failed before an HTTP response (ENOTFOUND): fetch failed:
+ * getaddrinfo ENOTFOUND gitlab.example.com. Check the host ...".
+ * Returns null for anything that is not undici's "fetch failed" TypeError.
+ */
+export function describeFetchTransportError(error) {
+    if (!(error instanceof TypeError) || error.message !== UNDICI_FETCH_FAILED_MESSAGE) {
+        return null;
+    }
+    const failure = classifyHealthCheckTransportError(error);
+    const reason = failure.code ?? failure.kind;
+    return `${FALLBACK_MESSAGE} (${reason}): ${failure.message}. ${TRANSPORT_HINTS[failure.kind]}`;
+}
 function classifyKind(error, code) {
     if (code !== null) {
         return kindFromCode(code);

package/build/utils/jmespath-tool-result.js

@@ -33,6 +33,9 @@ export function applyJmespathFilter(data, expression) {
 function isContentBlock(value) {
     return Boolean(value && typeof value === "object");
 }
+function isJsonObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function prepareDataForJmespath(data, maskValue) {
     return maskValue ? maskValue(data) : data;
 }
@@ -68,9 +71,15 @@ export function applyJmespathToToolResult(result, expression, options) {
                 return parsed.ok ? { ...block, text: JSON.stringify(filter(parsed.value)) } : block;
             })
             : result.content;
-        return result.structuredContent === undefined
-            ? { ...result, content }
-            : { ...result, content, structuredContent: filter(result.structuredContent) };
+        if (result.structuredContent === undefined)
+            return { ...result, content };
+        // MCP structuredContent must be a JSON object, and the SDK rejects the whole tools/call
+        // result otherwise. "items[].title" or a missing path is not one, so drop it; the text keeps it.
+        const structuredContent = filter(result.structuredContent);
+        if (isJsonObject(structuredContent))
+            return { ...result, content, structuredContent };
+        const { structuredContent: _dropped, ...rest } = result;
+        return { ...rest, content };
     }
     catch {
         return result;

package/build/utils/poll-deadline.js

@@ -0,0 +1,27 @@
+export const POLL_TIMEOUT_MESSAGE = "Timed out waiting for terminal status";
+function isAbortError(error) {
+    return error instanceof Error && error.name === "AbortError";
+}
+/**
+ * Fetch one poll result inside the deadline. When the deadline signal aborts the
+ * request, the wait has timed out, so report that instead of the abort. Any other
+ * rejection passes through unchanged, even one that lands after the deadline.
+ */
+export async function fetchStatusBeforeDeadline(fetchStatus, deadline) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) {
+        throw new Error(POLL_TIMEOUT_MESSAGE);
+    }
+    const signal = AbortSignal.timeout(remaining);
+    try {
+        return await fetchStatus(signal);
+    }
+    catch (error) {
+        // fetch rejects with signal.reason itself when this signal aborts it. A body read
+        // that starts after the abort throws a new AbortError instead.
+        if (signal.aborted && (error === signal.reason || isAbortError(error))) {
+            throw new Error(POLL_TIMEOUT_MESSAGE, { cause: error });
+        }
+        throw error;
+    }
+}

package/build/utils/redact-url.js

@@ -34,7 +34,7 @@ export function redactUrlSecretsInText(text) {
     return redactSensitiveQuery(redactUrlUserinfoInText(redactParseableUrlUserinfo(text)));
 }
 function redactSensitiveQuery(url) {
-    return url.replace(/([?&])([^=&\s#]+)=[^&\s#]+/g, (match, separator, rawName) => {
+    return url.replace(/([?&#])([^=&\s#]+)=[^&\s#]+/g, (match, separator, rawName) => {
         if (!isSensitiveQueryName(rawName)) {
             return match;
         }
@@ -53,7 +53,7 @@ function decodeQueryName(rawName) {
     }
 }
 function redactUrlUserinfoInText(message) {
-    const withoutCompactUserinfo = message.replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s]+/gi, urlToken => redactCompactUserinfo(urlToken));
+    const withoutCompactUserinfo = message.replace(/\b[a-z][a-z0-9+.-]*:(?:\/\/|\/)?[^\s]+/gi, urlToken => redactCompactUserinfo(urlToken));
     return withoutCompactUserinfo.replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@.]+(?::[^\s/:@.]+)+(?:\s+[^\s/:@.]+)+)@/gi, (match, scheme, userinfo, offset, source) => {
         if (looksLikeHostPort(userinfo, source.slice(offset + match.length))) {
             return match;
@@ -84,13 +84,13 @@ function tryParseUrl(value) {
     }
 }
 function splitAuthorityUserinfo(url) {
-    // WHATWG special schemes still expose userinfo for "https:user:pass@host".
-    const schemeMatch = /^([a-z][a-z0-9+.-]*:)(\/\/)?/i.exec(url);
-    if (schemeMatch === null) {
+    // WHATWG special schemes still expose userinfo for "https:user:pass@host"
+    // and for one slash, "https:/user:pass@host".
+    const prefix = readSchemePrefix(url);
+    if (prefix === null) {
         return null;
     }
-    const schemeEnd = schemeMatch[0].length;
-    const rest = url.slice(schemeEnd);
+    const rest = prefix.rest;
     const slash = rest.indexOf("/");
     const query = rest.indexOf("?");
     const hash = rest.indexOf("#");
@@ -102,18 +102,78 @@ function splitAuthorityUserinfo(url) {
         return null;
     }
     return {
-        scheme: url.slice(0, schemeEnd),
+        scheme: prefix.scheme,
         afterAt: `${authority.slice(atIndex + 1)}${rest.slice(authorityEnd)}`,
     };
 }
 function redactCompactUserinfo(urlToken) {
-    const schemeIndex = urlToken.indexOf("://");
-    const rest = urlToken.slice(schemeIndex + 3);
-    const atIndex = rest.lastIndexOf("@");
+    const prefix = readSchemePrefix(urlToken);
+    if (prefix === null) {
+        return urlToken;
+    }
+    const atIndex = prefix.rest.lastIndexOf("@");
     if (atIndex <= 0) {
         return urlToken;
     }
-    return `${urlToken.slice(0, schemeIndex + 3)}[REDACTED]@${rest.slice(atIndex + 1)}`;
+    return `${prefix.scheme}[REDACTED]@${prefix.rest.slice(atIndex + 1)}`;
+}
+const SCHEME_PREFIX_PATTERN = /^([a-z][a-z0-9+.-]*:)(\/\/|\/)?/i;
+function readSchemePrefix(value) {
+    const schemeMatch = SCHEME_PREFIX_PATTERN.exec(value);
+    if (schemeMatch === null) {
+        return null;
+    }
+    const scheme = schemeMatch[0];
+    return {
+        scheme,
+        rest: value.slice(scheme.length),
+    };
+}
+export function splitCommaSeparatedUrls(value) {
+    const parts = [];
+    let start = 0;
+    for (let index = 0; index < value.length; index += 1) {
+        if (value[index] !== ",") {
+            continue;
+        }
+        if (commaIsInsideUserinfo(value, start, index)) {
+            continue;
+        }
+        parts.push(value.slice(start, index).trim());
+        start = index + 1;
+    }
+    parts.push(value.slice(start).trim());
+    return parts;
+}
+// "https://a.example,https:user:pass@b.example" is two URLs; the "@" after the
+// comma belongs to the next one. The text before the comma must parse as a URL
+// by itself, so "https://alice:secret,https:word@host" stays one entry.
+// Only http(s) counts, so "pass,abc:def@host" stays.
+const NEXT_HTTP_URL_PATTERN = /^https?:/i;
+function commaIsInsideUserinfo(value, start, commaIndex) {
+    const entry = value.slice(start, commaIndex).trim();
+    const prefix = readSchemePrefix(entry);
+    if (prefix === null || authorityAlreadyClosed(prefix.rest)) {
+        return false;
+    }
+    const afterComma = value.slice(commaIndex + 1);
+    const startsNextUrl = NEXT_HTTP_URL_PATTERN.test(afterComma) && tryParseUrl(entry) !== null;
+    return !startsNextUrl && userinfoAtFollows(afterComma);
+}
+function authorityAlreadyClosed(rest) {
+    return rest.includes("@") || rest.includes("/") || rest.includes("?") || rest.includes("#");
+}
+function userinfoAtFollows(afterComma) {
+    for (let index = 0; index < afterComma.length; index += 1) {
+        const char = afterComma[index];
+        if (char === "@") {
+            return true;
+        }
+        if (char === "/" || char === "?" || char === "#" || char === " " || char === "\t") {
+            return false;
+        }
+    }
+    return false;
 }
 // "user:pa ss@host" is a password. "localhost:3000 a@b.com" is a host, then an email.
 // A numeric port counts only when one token follows it and the text after "@" is an email domain.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.3.2",
+  "version": "2.3.4",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
@@ -32,6 +32,7 @@
   "files": [
     "build"
   ],
+  "homepage": "https://zereight.github.io/gitlab-mcp/",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/zereight/gitlab-mcp.git"