@zereight/mcp-gitlab 2.3.4 → 2.3.5-next.125

package/README.ko.md

@@ -138,7 +138,7 @@ command = lib.getExe inputs.gitlab-mcp.packages.${system}.default;
 
 예시는 기존 `mcp-gitlab`보다 충돌 가능성이 낮은 `zereight-mcp-gitlab` 별칭을 사용합니다. MCP 클라이언트가 찾지 못하면 `which zereight-mcp-gitlab`의 절대 경로를 사용하세요.
 
-전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.3.3`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
+전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.3.3`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. `main`에 머지된 수정을 다음 안정 버전 전에 확인하려면 프리릴리스 빌드인 `npx -y @zereight/mcp-gitlab@next`를 사용하세요(운영 환경용이 아닙니다). 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
 
 #### Claude Desktop 원클릭 설치(MCP Bundle)
 
@@ -304,7 +304,7 @@ MCP 서버가 직접 로컬 브라우저 callback을 받을 때만 `GITLAB_OAUTH
 | 환경 변수                     | 필수 | 설명                                                                                                                            |
 | ----------------------------- | ---- | ------------------------------------------------------------------------------------------------------------------------------- |
 | `GITLAB_MCP_OAUTH`            | 예   | 활성화하려면 `true`                                                                                                             |
-| `GITLAB_API_URL`              | 예   | GitLab API base URL                                                                                                             |
+| `GITLAB_API_URL`              | 예   | GitLab API base URL. URL에 자격 증명(`user:pass@`)을 넣지 마세요. 넣어도 무시됩니다.                                            |
 | `GITLAB_OAUTH_APP_ID`         | 예   | GitLab OAuth Application ID                                                                                                     |
 | `MCP_SERVER_URL`              | 예   | 이 MCP 서버의 공개 HTTPS URL                                                                                                    |
 | `STREAMABLE_HTTP`             | 예   | 반드시 `true`                                                                                                                   |
@@ -572,7 +572,7 @@ node build/index.js
 | `GITLAB_MCP_OAUTH`                          | 예     | 활성화하려면 `true`                                                                                                                                                        |
 | `GITLAB_OAUTH_APP_ID`                       | 예     | 사전 등록 GitLab OAuth 애플리케이션의 client ID                                                                                                                            |
 | `MCP_SERVER_URL`                            | 예     | MCP 서버의 공개 HTTPS URL                                                                                                                                                  |
-| `GITLAB_API_URL`                            | 예     | GitLab 인스턴스 API URL(예: `https://gitlab.com/api/v4`)                                                                                                                   |
+| `GITLAB_API_URL`                            | 예     | GitLab 인스턴스 API URL(예: `https://gitlab.com/api/v4`). URL에 자격 증명(`user:pass@`)을 넣지 마세요. 넣어도 무시됩니다.                                                  |
 | `STREAMABLE_HTTP`                           | 예     | 반드시 `true`(SSE 미지원)                                                                                                                                                  |
 | `GITLAB_OAUTH_SCOPES`                       | 아니오 | 요청할 GitLab scope 목록(쉼표 구분). 기본값은 `api`이며, 유효 permission mode가 `readonly`일 때 `read_api`입니다. 사전 등록 애플리케이션에 해당 scope가 설정되어 있어야 합니다. |
 | `OAUTH_REGISTER_RATE_LIMIT_PER_HOUR`        | 아니오 | Dynamic Client Registration(`POST /register`)의 클라이언트 IP당 rolling 한도. 기본 `20`/시간, 범위 `1`–`1000`. IDE 창 여러 개 등으로 등록이 막히면 올리세요. GitLab API 한도와 무관합니다. |

package/README.md

@@ -143,7 +143,7 @@ The store path is pinned by your lock file; update it with `nix flake update git
 
 The examples use `zereight-mcp-gitlab`, a less collision-prone alias for the legacy `mcp-gitlab` binary. If your MCP client cannot find it, use the absolute path from `which zereight-mcp-gitlab`.
 
-No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.3.3`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
+No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.3.3`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. To try a fix merged to `main` before the next stable release, use `npx -y @zereight/mcp-gitlab@next`, a pre-release build that is not meant for production. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
 
 #### Claude Desktop one-click install (MCP Bundle)
 
@@ -326,7 +326,7 @@ exchanging credentials with GitLab on behalf of the client.
 | Environment Variable          | Required | Description                                                                                                                             |
 | ----------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------- |
 | `GITLAB_MCP_OAUTH`            | ✅       | Set to `true` to enable                                                                                                                 |
-| `GITLAB_API_URL`              | ✅       | GitLab API base URL                                                                                                                     |
+| `GITLAB_API_URL`              | ✅       | GitLab API base URL. Do not embed credentials (`user:pass@`) in the URL; they are ignored.                                              |
 | `GITLAB_OAUTH_APP_ID`         | ✅       | GitLab OAuth Application ID                                                                                                             |
 | `MCP_SERVER_URL`              | ✅       | Public HTTPS URL of this MCP server                                                                                                     |
 | `STREAMABLE_HTTP`             | ✅       | Must be `true`                                                                                                                          |
@@ -614,7 +614,7 @@ No `headers` field is needed — Claude.ai obtains the token via OAuth automatic
 | `GITLAB_MCP_OAUTH`                          | Yes      | Set to `true` to enable                                                                                                                                                                                             |
 | `GITLAB_OAUTH_APP_ID`                       | Yes      | Client ID of the pre-registered GitLab OAuth application                                                                                                                                                            |
 | `MCP_SERVER_URL`                            | Yes      | Public HTTPS URL of your MCP server; also allowed for `/mcp` Host/Origin checks                                                                                                                                     |
-| `GITLAB_API_URL`                            | Yes      | Your GitLab instance API URL (e.g. `https://gitlab.com/api/v4`)                                                                                                                                                     |
+| `GITLAB_API_URL`                            | Yes      | Your GitLab instance API URL (e.g. `https://gitlab.com/api/v4`). Do not embed credentials (`user:pass@`) in the URL; they are ignored.                                                                              |
 | `STREAMABLE_HTTP`                           | Yes      | Must be `true` (SSE is not supported)                                                                                                                                                                               |
 | `GITLAB_OAUTH_SCOPES`                       | No       | Comma-separated GitLab scopes to request (e.g. `api,read_user`). Defaults to `api` (or `read_api` when the effective permission mode is `readonly`). The pre-registered application must be configured with at least these scopes. |
 | `OAUTH_REGISTER_RATE_LIMIT_PER_HOUR`        | No       | Per-IP rolling limit for Dynamic Client Registration (`POST /register`). Default `20`/hour; range `1`–`1000`. Raise when clients (e.g. multiple IDE windows) hit registration throttling. Not a GitLab API limit. |

package/README.pt-BR.md

@@ -138,7 +138,7 @@ O caminho no store é fixado pelo seu lock file; atualize-o com `nix flake updat
 
 Os exemplos usam `zereight-mcp-gitlab`, um alias com menor chance de conflito que o binário legado `mcp-gitlab`. Se o seu cliente MCP não o encontrar, use o caminho absoluto retornado por `which zereight-mcp-gitlab`.
 
-Não quer instalar globalmente? Fixe o `npx` na versão estável anterior (a versão recomendada por esta documentação), por exemplo `npx -y @zereight/mcp-gitlab@2.3.3`. Se quiser sempre a versão mais recente, use `npx -y @zereight/mcp-gitlab@latest`. O servidor exibe um aviso no stderr durante a inicialização quando existe uma versão mais nova disponível (desative com `GITLAB_DISABLE_VERSION_CHECK=true`).
+Não quer instalar globalmente? Fixe o `npx` na versão estável anterior (a versão recomendada por esta documentação), por exemplo `npx -y @zereight/mcp-gitlab@2.3.3`. Se quiser sempre a versão mais recente, use `npx -y @zereight/mcp-gitlab@latest`. Para testar uma correção já mesclada na `main` antes da próxima versão estável, use `npx -y @zereight/mcp-gitlab@next`, um build de pré-lançamento que não é indicado para produção. O servidor exibe um aviso no stderr durante a inicialização quando existe uma versão mais nova disponível (desative com `GITLAB_DISABLE_VERSION_CHECK=true`).
 
 #### Instalação com um clique no Claude Desktop (MCP Bundle)
 
@@ -304,7 +304,7 @@ Use `GITLAB_OAUTH_REDIRECT_URI` somente quando o próprio servidor MCP receber o
 | Variável de ambiente          | Obrigatória | Descrição                                                                                                                                                                |
 | ----------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | `GITLAB_MCP_OAUTH`            | sim         | Defina como `true` para habilitar                                                                                                                                        |
-| `GITLAB_API_URL`              | sim         | URL base da API do GitLab                                                                                                                                                |
+| `GITLAB_API_URL`              | sim         | URL base da API do GitLab. Não inclua credenciais (`user:pass@`) na URL; elas são ignoradas.                                                                             |
 | `GITLAB_OAUTH_APP_ID`         | sim         | Application ID do OAuth do GitLab                                                                                                                                        |
 | `MCP_SERVER_URL`              | sim         | URL HTTPS pública deste servidor MCP                                                                                                                                     |
 | `STREAMABLE_HTTP`             | sim         | Deve ser `true`                                                                                                                                                          |
@@ -572,7 +572,7 @@ Não é necessário definir `headers`. O Claude.ai obtém o token via OAuth.
 | `GITLAB_MCP_OAUTH`                          | sim         | Defina como `true` para habilitar                                                                                                                                                                                                                |
 | `GITLAB_OAUTH_APP_ID`                       | sim         | Client ID do aplicativo OAuth do GitLab previamente registrado                                                                                                                                                                                   |
 | `MCP_SERVER_URL`                            | sim         | URL HTTPS pública do servidor MCP                                                                                                                                                                                                                |
-| `GITLAB_API_URL`                            | sim         | URL da API da instância GitLab (por exemplo, `https://gitlab.com/api/v4`)                                                                                                                                                                        |
+| `GITLAB_API_URL`                            | sim         | URL da API da instância GitLab (por exemplo, `https://gitlab.com/api/v4`). Não inclua credenciais (`user:pass@`) na URL; elas são ignoradas.                                                                                                     |
 | `STREAMABLE_HTTP`                           | sim         | Deve ser `true` (SSE não é suportado)                                                                                                                                                                                                            |
 | `GITLAB_OAUTH_SCOPES`                       | não         | Scopes do GitLab a solicitar, separados por vírgula. O padrão é `api`, ou `read_api` quando o permission mode efetivo é `readonly`. O aplicativo previamente registrado deve ter pelo menos esses scopes configurados.                                     |
 | `OAUTH_REGISTER_RATE_LIMIT_PER_HOUR`        | não         | Limite rolling de Dynamic Client Registration (`POST /register`) por IP do cliente. Padrão `20`/hora, intervalo `1`–`1000`. Aumente se múltiplas janelas de IDE estiverem atingindo o limite. Não está relacionado aos limites da API do GitLab. |

package/README.zh-CN.md

@@ -138,7 +138,7 @@ command = lib.getExe inputs.gitlab-mcp.packages.${system}.default;
 
 示例使用 `zereight-mcp-gitlab`，这是比旧的 `mcp-gitlab` 更不容易冲突的别名。如果 MCP 客户端找不到它，请使用 `which zereight-mcp-gitlab` 输出的绝对路径。
 
-如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.3.3`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
+如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.3.3`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。如需在下一个稳定版本发布前试用已合并到 `main` 的修复，请使用 `npx -y @zereight/mcp-gitlab@next`（预发布版本，不适用于生产环境）。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
 
 #### Claude Desktop 一键安装（MCP Bundle）
 
@@ -303,7 +303,7 @@ OpenCode、MCPJam、Claude.ai 等远程 MCP 客户端可能会在授权时发送
 | 环境变量                      | 必需 | 说明                                                                                                        |
 | ----------------------------- | ---- | ----------------------------------------------------------------------------------------------------------- |
 | `GITLAB_MCP_OAUTH`            | 是   | 设置为 `true` 以启用                                                                                        |
-| `GITLAB_API_URL`              | 是   | GitLab API base URL                                                                                         |
+| `GITLAB_API_URL`              | 是   | GitLab API base URL。不要在 URL 中嵌入凭据（`user:pass@`），嵌入的凭据会被忽略。                            |
 | `GITLAB_OAUTH_APP_ID`         | 是   | GitLab OAuth Application ID                                                                                 |
 | `MCP_SERVER_URL`              | 是   | 此 MCP 服务器的公开 HTTPS URL                                                                               |
 | `STREAMABLE_HTTP`             | 是   | 必须为 `true`                                                                                               |
@@ -571,7 +571,7 @@ node build/index.js
 | `GITLAB_MCP_OAUTH`                          | 是   | 设置为 `true` 以启用                                                                                                                     |
 | `GITLAB_OAUTH_APP_ID`                       | 是   | 预先注册的 GitLab OAuth 应用 client ID                                                                                                   |
 | `MCP_SERVER_URL`                            | 是   | MCP 服务器的公开 HTTPS URL                                                                                                               |
-| `GITLAB_API_URL`                            | 是   | GitLab 实例 API URL（例如 `https://gitlab.com/api/v4`）                                                                                  |
+| `GITLAB_API_URL`                            | 是   | GitLab 实例 API URL（例如 `https://gitlab.com/api/v4`）。不要在 URL 中嵌入凭据（`user:pass@`），嵌入的凭据会被忽略。                     |
 | `STREAMABLE_HTTP`                           | 是   | 必须为 `true`（不支持 SSE）                                                                                                              |
 | `GITLAB_OAUTH_SCOPES`                       | 否   | 要请求的 GitLab scopes，以逗号分隔。默认值为 `api`；有效 permission mode 为 `readonly` 时为 `read_api`。预注册应用必须配置至少这些 scopes。 |
 | `OAUTH_REGISTER_RATE_LIMIT_PER_HOUR`        | 否   | Dynamic Client Registration（`POST /register`）的每客户端 IP rolling 限制。默认 `20`/小时，范围 `1`–`1000`。多个 IDE 窗口等导致注册被限流时可调高。与 GitLab API 限额无关。 |

package/build/auth-cli.js

@@ -4,6 +4,8 @@ import { parseCliArgs } from "./cli-boolean-flags.js";
 import { deprecatedEnvInputFromSources, getDeprecatedEnvWarnings } from "./deprecated-env.js";
 import { GitLabOAuth } from "./oauth.js";
 import { createLogger, flushStartupLogs } from "./utils/logger.js";
+import { stripUrlUserinfo } from "./utils/redact-url.js";
+import { apiUrlUserinfoWarning } from "./utils/url.js";
 const logger = createLogger("gitlab-mcp-auth");
 const DEFAULT_API_URL = "https://gitlab.com";
 const DEFAULT_REDIRECT_URI = "http://127.0.0.1:8888/callback";
@@ -74,7 +76,13 @@ export async function runAuthCommandAsync(input = {}) {
     if (!clientId) {
         throw new Error("Missing OAuth client ID. Pass --client-id or set GITLAB_OAUTH_CLIENT_ID.");
     }
-    const apiUrl = readFlag(argv, "api-url") ?? env.GITLAB_API_URL ?? DEFAULT_API_URL;
+    const apiUrlFlag = readFlag(argv, "api-url");
+    const configuredApiUrl = stripUrlUserinfo(apiUrlFlag ?? env.GITLAB_API_URL ?? DEFAULT_API_URL);
+    if (configuredApiUrl.hadUserinfo) {
+        logger.warn(apiUrlUserinfoWarning(apiUrlFlag !== undefined ? "--api-url" : "GITLAB_API_URL"));
+        flushStartupLogs(logger);
+    }
+    const apiUrl = configuredApiUrl.url;
     const tokenPath = readFlag(argv, "token-path") ??
         env.GITLAB_OAUTH_TOKEN_PATH ??
         path.join(os.homedir(), ".gitlab-mcp-token.json");

package/build/cli/output.js

@@ -1,4 +1,5 @@
 import { renderTable } from "./tables.js";
+import { redactUrlSecretsInText } from "../utils/redact-url.js";
 export function formatToolOutput(input) {
     const isError = resultIsError(input.result);
     const text = unwrapToolText(input.result);
@@ -58,7 +59,7 @@ function ensureTrailingNewline(text) {
     return text.endsWith("\n") ? text : `${text}\n`;
 }
 function redactSecrets(message) {
-    return message.replace(/glpat-[A-Za-z0-9_-]+/g, "[REDACTED]");
+    return redactUrlSecretsInText(message).replace(/glpat-[A-Za-z0-9_-]+/g, "[REDACTED]");
 }
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);

package/build/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { getConfig, ENABLE_DYNAMIC_API_URL, ENABLE_DYNAMIC_PROJECT_SCOPE, ENABLE_STRICT_PROJECT_SCOPE, GITLAB_AUTH_COOKIE_PATH, GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_MCP_REQUEST_BODY_LIMIT, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_OAUTH_ALLOWED_REDIRECT_URIS_RAW, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_DISABLE_VERSION_CHECK, GITLAB_MASKING_ENABLED, GITLAB_MASKING_CONFIG, GITLAB_MASKING_POLICY_FILE, GITLAB_MASKING_WORKSPACE_DIR, GITLAB_PERMISSION_MODE, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, MCP_TRUST_PROXY, USE_GITLAB_WIKI, USE_MILESTONE, USE_OAUTH, USE_PIPELINE, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_OAUTH_ALLOWED_GROUPS, GITLAB_MCP_COMPACT_RESULTS, GITLAB_MCP_COMPACT_RESULT_CHARS, GITLAB_MCP_COMPACT_TOOL_NAMES, GITLAB_TOOL_PROFILE, GITLAB_DOWNLOAD_DIR, buildDeprecatedEnvInput, } from "./config.js";
+import { cliArgs, getConfig, ENABLE_DYNAMIC_API_URL, ENABLE_DYNAMIC_PROJECT_SCOPE, ENABLE_STRICT_PROJECT_SCOPE, GITLAB_AUTH_COOKIE_PATH, GITLAB_ALLOW_UNAUTHENTICATED_TOOL_DISCOVERY, GITLAB_CA_CERT_PATH, GITLAB_JOB_TOKEN, GITLAB_MCP_OAUTH, GITLAB_MCP_REQUEST_BODY_LIMIT, GITLAB_OAUTH_APP_ID, GITLAB_OAUTH_SCOPES, GITLAB_OAUTH_CALLBACK_PROXY, GITLAB_OAUTH_ALLOWED_REDIRECT_URIS_RAW, GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_POOL_MAX_SIZE, GITLAB_DISABLE_VERSION_CHECK, GITLAB_MASKING_ENABLED, GITLAB_MASKING_CONFIG, GITLAB_MASKING_POLICY_FILE, GITLAB_MASKING_WORKSPACE_DIR, GITLAB_PERMISSION_MODE, GITLAB_TOOLSETS_RAW, GITLAB_TOOLS_RAW, HOST, HTTP_PROXY, HTTPS_PROXY, IS_OLD, MCP_SERVER_URL, NODE_TLS_REJECT_UNAUTHORIZED, NO_PROXY, OAUTH_STATELESS_CLIENT_TTL_SECONDS, OAUTH_STATELESS_MODE, OAUTH_STATELESS_PENDING_TTL_SECONDS, OAUTH_STATELESS_SESSION_TTL_SECONDS, OAUTH_STATELESS_STORED_TTL_SECONDS, PORT, REMOTE_AUTHORIZATION, SESSION_TIMEOUT_SECONDS, SSE, STREAMABLE_HTTP, MCP_TRUST_PROXY, USE_GITLAB_WIKI, USE_MILESTONE, USE_OAUTH, USE_PIPELINE, GITLAB_TOOL_POLICY_APPROVE_RAW, GITLAB_TOOL_POLICY_HIDDEN_RAW, GITLAB_OAUTH_ALLOWED_GROUPS, GITLAB_MCP_COMPACT_RESULTS, GITLAB_MCP_COMPACT_RESULT_CHARS, GITLAB_MCP_COMPACT_TOOL_NAMES, GITLAB_TOOL_PROFILE, GITLAB_DOWNLOAD_DIR, buildDeprecatedEnvInput, } from "./config.js";
 import { getDeprecatedEnvWarnings } from "./deprecated-env.js";
 /** True when the server is running in remote/network mode (SSE or StreamableHTTP transport). */
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
@@ -93,14 +93,14 @@ import { SERVER_VERSION } from "./server/version.js";
 import { listMcpResources, listMcpResourceTemplates, readMcpResource, } from "./server/mcp-resources.js";
 import { isInitializationRequestBody, isUnauthenticatedDiscoveryRequestBody, readAcceptHeader, readMcpSessionIdHeader, redactSessionIdForLog, } from "./server/request-helpers.js";
 export { readMcpSessionIdHeader } from "./server/request-helpers.js";
-import { encodeGitLabPath, encodeGitLabPathSegment, isCleartextRemoteUrl, normalizeGitLabApiUrl, } from "./utils/url.js";
+import { apiUrlUserinfoWarning, encodeGitLabPath, encodeGitLabPathSegment, isCleartextRemoteUrl, normalizeGitLabApiUrl, parseConfiguredGitLabApiUrls, } from "./utils/url.js";
 import { estimateMergeCommitCount, filterDiffsByPatterns, openSafeOutputWriteStream, resolveDownloadRoot, readSafeExistingFile, summarizeWebhookEvents, } from "./utils/helpers.js";
 import { graphqlQueryContainsWriteOperation, graphqlQueryContainsDeleteOperation, } from "./utils/graphql-query.js";
 import { resolveNestedWikiUpdateTitle } from "./utils/wiki-title.js";
 import { encodeRepoFilePayloadContent, fileOperationsIncludeDeleteOrMove, toGitLabCommitActions, } from "./utils/gitlab-commit-actions.js";
 import { redactSensitiveGitLabFields } from "./utils/redact-sensitive.js";
 import { classifyHealthCheckTransportError, describeFetchTransportError, redactGitLabUrlCredentials, } from "./utils/health-check-transport-error.js";
-import { redactUrlSecretsInText, splitCommaSeparatedUrls } from "./utils/redact-url.js";
+import { redactUrlSecretsInError, redactUrlSecretsInErrorMessage, redactUrlSecretsInText, splitCommaSeparatedUrls, } from "./utils/redact-url.js";
 import { createMaskingPolicyResolver, getManagedMaskingProjectIds, } from "./masking/index.js";
 import { checkForNewVersion } from "./utils/version-check.js";
 import { assertGitLabVersionAtLeast } from "./utils/gitlab-version-gate.js";
@@ -303,9 +303,11 @@ function createServer() {
             const isPlainTextResult = toolName === "get_pipeline_job_output" ||
                 toolName === "get_job_artifact_file" ||
                 (toolName === "download_release_asset" && !IS_REMOTE);
-            const filtered = applyJmespathToToolResult(result, jmespathExpression, {
+            const filtered = applyJmespathToToolResult(redactErrorResultUrls(result), jmespathExpression, {
                 ...completionOptions,
-                maskValue: maskingEngine ? (value) => maskingEngine.maskValue(value) : undefined,
+                maskValue: maskingEngine
+                    ? (value) => maskingEngine.maskValue(value)
+                    : undefined,
             });
             const masked = maskingEngine
                 ? maskingEngine.maskToolResult(filtered, {
@@ -322,7 +324,10 @@ function createServer() {
         };
         const logError = (error) => {
             const durationMs = Date.now() - start;
-            const safeError = maskingEngine ? maskingEngine.maskError(error) : error;
+            // fetch() and new URL() quote the URL they rejected, userinfo included. The
+            // redacted error is what gets logged, returned, or rethrown to the client.
+            const redactedError = redactUrlSecretsInError(error);
+            const safeError = maskingEngine ? maskingEngine.maskError(redactedError) : redactedError;
             logger.error({
                 tool: toolName,
                 event: "tool_call_error",
@@ -573,6 +578,23 @@ function createServer() {
     });
     return mcpServer;
 }
+/**
+ * An isError tool result can quote fetch/URL error text too; see redactUrlSecretsInError.
+ * Other results carry GitLab data, which is returned as is; a handler that puts
+ * a caught error into its data redacts it there (redactUrlSecretsInErrorMessage).
+ */
+function redactErrorResultUrls(result) {
+    if (!isRecord(result) || result.isError !== true || !Array.isArray(result.content)) {
+        return result;
+    }
+    // Same shape as the input; only text values change.
+    return {
+        ...result,
+        content: result.content.map((item) => isRecord(item) && typeof item.text === "string"
+            ? { ...item, text: redactUrlSecretsInText(item.text) }
+            : item),
+    };
+}
 function formatHostWithPort(host, port) {
     const normalized = host
         .trim()
@@ -856,13 +878,21 @@ let oauthClient = null;
  * switch to signed/sealed opaque values instead of per-pod in-memory caches.
  */
 let STATELESS_MATERIAL = null;
+// Userinfo is dropped here, before the client pool or any request URL is built.
+// Defined before the first emitDeprecatedEnvWarnings() call, which reports it.
+const CONFIGURED_GITLAB_API_URLS = parseConfiguredGitLabApiUrls(getConfig("api-url", "GITLAB_API_URL") || "https://gitlab.com");
 let hasEmittedDeprecatedEnvWarnings = false;
 function emitDeprecatedEnvWarnings() {
     if (hasEmittedDeprecatedEnvWarnings) {
         return;
     }
     hasEmittedDeprecatedEnvWarnings = true;
-    const warnings = getDeprecatedEnvWarnings(buildDeprecatedEnvInput());
+    const warnings = [
+        ...getDeprecatedEnvWarnings(buildDeprecatedEnvInput()),
+        ...(CONFIGURED_GITLAB_API_URLS.hadUserinfo
+            ? [apiUrlUserinfoWarning(cliArgs["api-url"] ? "--api-url" : "GITLAB_API_URL")]
+            : []),
+    ];
     for (const warning of warnings) {
         logger.warn(warning);
     }
@@ -966,7 +996,7 @@ const hiddenToolSet = new Set((GITLAB_TOOL_POLICY_HIDDEN_RAW || "")
     }
 }
 const clientPool = new GitLabClientPool({
-    apiUrls: splitCommaSeparatedUrls(getConfig("api-url", "GITLAB_API_URL") || "https://gitlab.com").map(normalizeGitLabApiUrl),
+    apiUrls: CONFIGURED_GITLAB_API_URLS.urls,
     httpProxy: HTTP_PROXY,
     httpsProxy: HTTPS_PROXY,
     noProxy: NO_PROXY,
@@ -1315,6 +1345,9 @@ function toAllowedGitLabApiUrl(value) {
         const url = new URL(trimmed.includes("://") ? trimmed : `https://${trimmed}`);
         if (url.protocol !== "http:" && url.protocol !== "https:")
             return null;
+        // Same rule as GITLAB_API_URL: fetch() rejects a URL that carries userinfo.
+        url.username = "";
+        url.password = "";
         return { host: url.host, apiUrl: normalizeGitLabApiUrl(url.toString()) };
     }
     catch {
@@ -1339,8 +1372,7 @@ function resolveTrustedGitLabApiUrl(value) {
     }
     return allowedApiUrl;
 }
-// Use the normalizeGitLabApiUrl function to handle various URL formats
-const GITLAB_API_URLS = splitCommaSeparatedUrls(getConfig("api-url", "GITLAB_API_URL") || "https://gitlab.com").map(normalizeGitLabApiUrl);
+const GITLAB_API_URLS = CONFIGURED_GITLAB_API_URLS.urls;
 const GITLAB_API_URL = GITLAB_API_URLS[0];
 const GITLAB_ALLOWED_API_URLS_BY_HOST = new Map();
 for (const { host, apiUrl } of [
@@ -4070,7 +4102,7 @@ async function buildMergeRequestCommitAdditionSummary(projectId, mergeRequest) {
         };
     }
     catch (error) {
-        const unavailableReason = error instanceof Error ? error.message : String(error);
+        const unavailableReason = redactUrlSecretsInErrorMessage(error);
         return {
             target_branch: mergeRequest.target_branch,
             source_commits_count: null,
@@ -4098,7 +4130,7 @@ async function buildMergeRequestApprovalSummary(projectId, mergeRequestIid) {
         };
     }
     catch (error) {
-        const unavailableReason = error instanceof Error ? error.message : String(error);
+        const unavailableReason = redactUrlSecretsInErrorMessage(error);
         return {
             approved: null,
             user_has_approved: null,
@@ -4196,7 +4228,7 @@ async function buildMergeRequestDeploymentSummary(projectId, mergeRequest) {
         };
     }
     catch (error) {
-        const unavailableReason = error instanceof Error ? error.message : String(error);
+        const unavailableReason = redactUrlSecretsInErrorMessage(error);
         return {
             lookup_sha: lookupSha,
             sort: "created_at_desc",
@@ -8300,7 +8332,8 @@ async function handleToolCall(params) {
                     };
                 }
                 catch (err) {
-                    const message = describeFetchTransportError(err) ?? (err instanceof Error ? err.message : String(err));
+                    // Returned as data, not isError, so the central error redaction does not see it.
+                    const message = describeFetchTransportError(err) ?? redactUrlSecretsInErrorMessage(err);
                     return {
                         content: [
                             {
@@ -8350,7 +8383,7 @@ async function handleToolCall(params) {
                     logger.error({ err: forkError }, "Error forking repository");
                     let forkErrorMessage = "Failed to fork repository";
                     if (forkError instanceof Error) {
-                        const reason = describeFetchTransportError(forkError) ?? forkError.message;
+                        const reason = describeFetchTransportError(forkError) ?? redactUrlSecretsInErrorMessage(forkError);
                         forkErrorMessage = `${forkErrorMessage}: ${reason}`;
                     }
                     return {
@@ -9204,7 +9237,7 @@ async function handleToolCall(params) {
                     catch (noteError) {
                         noteResult = {
                             status: "failed",
-                            message: `Note creation failed: ${noteError.message ?? noteError}`,
+                            message: redactUrlSecretsInText(`Note creation failed: ${noteError.message ?? noteError}`),
                         };
                     }
                 }
@@ -13066,7 +13099,7 @@ async function main() {
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            process.stderr.write(`${message}\n`);
+            process.stderr.write(`${redactUrlSecretsInText(message)}\n`);
             logger.error({ err: error }, "auth command failed");
             exitAfterFlush(1);
         }
@@ -13080,7 +13113,7 @@ async function main() {
         try {
             initOAuthClient();
             const result = await handleToolCall({ name: cli.toolName, arguments: cli.args });
-            const masked = maskCliToolResult(cli.toolName, result);
+            const masked = maskCliToolResult(cli.toolName, redactErrorResultUrls(result));
             const formatted = formatToolOutput({
                 result: masked,
                 mode: cli.output,
@@ -13107,9 +13140,8 @@ function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function maskCliToolResult(toolName, result) {
-    const gitlabInstance = getConfig("api-url", "GITLAB_API_URL") || "https://gitlab.com";
     const engine = maskingPolicyResolver?.select({
-        gitlabInstance,
+        gitlabInstance: GITLAB_API_URL,
         allowBuiltinForUnscoped: true,
     });
     if (!engine || !isRecord(result)) {

package/build/utils/logger.js

@@ -1,5 +1,6 @@
 import { createRequire } from "node:module";
 import { pino } from "pino";
+import { redactUrlSecretsInLogLine } from "./redact-url.js";
 const require = createRequire(import.meta.url);
 const REDACT_PATHS = [
     "token",
@@ -125,6 +126,8 @@ export function flushBufferedLogs(logger) {
  *   to stderr.
  * - Any other value, including unset, keeps human-readable pino-pretty output.
  * - All loggers redact the same set of sensitive fields.
+ * - Every line, in either format, has URL userinfo and token query values
+ *   redacted, including text from thrown fetch/URL errors and their causes.
  */
 export function createLogger(name) {
     const isJson = process.env.LOG_FORMAT === "json";
@@ -135,6 +138,9 @@ export function createLogger(name) {
             paths: REDACT_PATHS,
             censor: "[REDACTED]",
         },
+        hooks: {
+            streamWrite: redactUrlSecretsInLogLine,
+        },
     };
     if (isJson) {
         const destination = createAsyncStderr();

package/build/utils/redact-url.js

@@ -1,3 +1,4 @@
+import { isIP } from "node:net";
 const SENSITIVE_QUERY_NAMES = new Set([
     "access_token",
     "private_token",
@@ -7,8 +8,9 @@ const SENSITIVE_QUERY_NAMES = new Set([
 ]);
 /**
  * Removes userinfo from a GitLab API URL before it is returned to the client.
- * A password with an unencoded slash is not a valid WHATWG URL, so that form
- * uses the same text redaction as transport error messages.
+ * A password with an unencoded slash is not a valid WHATWG URL, or parses as a
+ * host and port ("https://u:12/ab@host" has host "u"), so those forms use the
+ * same text redaction as transport error messages.
  */
 export function redactGitLabUrlCredentials(url) {
     try {
@@ -18,7 +20,7 @@ export function redactGitLabUrlCredentials(url) {
             parsed.username = "";
             parsed.password = "";
         }
-        const serialized = hadUserinfo ? parsed.toString() : url;
+        const serialized = hadUserinfo ? parsed.toString() : redactUrlUserinfoInText(url);
         return redactSensitiveQuery(serialized);
     }
     catch {
@@ -33,8 +35,125 @@ export function redactGitLabUrlCredentials(url) {
 export function redactUrlSecretsInText(text) {
     return redactSensitiveQuery(redactUrlUserinfoInText(redactParseableUrlUserinfo(text)));
 }
+/**
+ * Redacts an error in place: `message`, `stack`, and every `cause` below it.
+ * undici and `new URL()` put the URL they rejected into the message, so a
+ * credentialed URL would otherwise reach the MCP client and the log verbatim.
+ * A thrown string is returned redacted; other values are returned unchanged.
+ */
+export function redactUrlSecretsInError(error) {
+    if (typeof error === "string") {
+        return redactUrlSecretsInText(error);
+    }
+    redactErrorChain(error, new Set());
+    return error;
+}
+/**
+ * The redacted message of a caught error, for a tool result that reports the
+ * failure in its data (`{ "error": "GraphQL request failed: ..." }`) instead of
+ * as an isError result.
+ */
+export function redactUrlSecretsInErrorMessage(error) {
+    return redactUrlSecretsInText(error instanceof Error ? error.message : String(error));
+}
+function redactErrorChain(error, seen) {
+    if (!(error instanceof Error) || seen.has(error)) {
+        return;
+    }
+    seen.add(error);
+    redactErrorField(error, "message");
+    redactErrorField(error, "stack");
+    if (typeof error.cause === "string") {
+        redactErrorField(error, "cause");
+    }
+    else {
+        redactErrorChain(error.cause, seen);
+    }
+    if (error instanceof AggregateError && Array.isArray(error.errors)) {
+        for (const inner of error.errors) {
+            redactErrorChain(inner, seen);
+        }
+    }
+}
+function redactErrorField(error, field) {
+    const value = error[field];
+    if (typeof value !== "string") {
+        return;
+    }
+    const redacted = redactUrlSecretsInText(value);
+    if (redacted === value) {
+        return;
+    }
+    try {
+        error[field] = redacted;
+    }
+    catch {
+        // A frozen error keeps its text; the logger still redacts its own copy.
+    }
+}
+/**
+ * Redacts one serialized pino line. Each JSON string is redacted after
+ * JSON.parse, so a URL next to a quote cannot pull the rest of the line into
+ * the userinfo match. A line that is not JSON is redacted as text.
+ */
+export function redactUrlSecretsInLogLine(line) {
+    if (!line.includes("@") && !line.includes("=")) {
+        return line;
+    }
+    const newline = line.endsWith("\n") ? "\n" : "";
+    const body = newline ? line.slice(0, -1) : line;
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return redactUrlSecretsInText(line);
+    }
+    let changed = false;
+    const redacted = mapJsonStrings(parsed, value => {
+        const next = redactUrlSecretsInText(value);
+        changed ||= next !== value;
+        return next;
+    });
+    return changed ? `${JSON.stringify(redacted)}${newline}` : line;
+}
+function mapJsonStrings(value, map) {
+    if (typeof value === "string") {
+        return map(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map(item => mapJsonStrings(item, map));
+    }
+    if (typeof value === "object" && value !== null) {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, mapJsonStrings(item, map)]));
+    }
+    return value;
+}
+/**
+ * Drops userinfo from a configured GitLab API URL. fetch() refuses a URL with
+ * credentials, and GitLab API authentication goes in request headers, so the
+ * userinfo is removed before any request is built. A value that does not parse
+ * is returned unchanged for the config validation to report.
+ */
+export function stripUrlUserinfo(url) {
+    const trimmed = url.trim();
+    const parsed = tryParseUrl(trimmed);
+    if (parsed === null || (parsed.username.length === 0 && parsed.password.length === 0)) {
+        return { url, hadUserinfo: false };
+    }
+    parsed.username = "";
+    parsed.password = "";
+    const serialized = parsed.toString();
+    // "https://user:pass@host" serializes as "https://host/"; keep the input's form.
+    const addedRootSlash = parsed.pathname === "/" &&
+        parsed.search.length === 0 &&
+        parsed.hash.length === 0 &&
+        !trimmed.endsWith("/");
+    return { url: addedRootSlash ? serialized.slice(0, -1) : serialized, hadUserinfo: true };
+}
 function redactSensitiveQuery(url) {
-    return url.replace(/([?&#])([^=&\s#]+)=[^&\s#]+/g, (match, separator, rawName) => {
+    // The name cannot hold a separator, so a run of "?" is not rescanned from each one.
+    return url.replace(/([?&#])([^=&\s#?]+)=[^&\s#]+/g, (match, separator, rawName) => {
         if (!isSensitiveQueryName(rawName)) {
             return match;
         }
@@ -52,14 +171,116 @@ function decodeQueryName(rawName) {
         return rawName;
     }
 }
+// Every scan below runs in time linear in the text: log lines can carry
+// client-chosen strings such as an unknown tool name.
 function redactUrlUserinfoInText(message) {
-    const withoutCompactUserinfo = message.replace(/\b[a-z][a-z0-9+.-]*:(?:\/\/|\/)?[^\s]+/gi, urlToken => redactCompactUserinfo(urlToken));
-    return withoutCompactUserinfo.replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@.]+(?::[^\s/:@.]+)+(?:\s+[^\s/:@.]+)+)@/gi, (match, scheme, userinfo, offset, source) => {
-        if (looksLikeHostPort(userinfo, source.slice(offset + match.length))) {
-            return match;
+    // A token can hold a comma-separated GITLAB_API_URL list; each entry has its own userinfo.
+    const withoutCompactUserinfo = replaceUrlTokens(message, urlToken => splitCommaSeparatedUrls(urlToken).map(redactCompactUserinfo).join(","));
+    return redactSpacedUserinfo(withoutCompactUserinfo);
+}
+const WORD_CHAR_PATTERN = /\w/;
+const WHITESPACE_PATTERN = /\s/;
+const NEXT_WHITESPACE_PATTERN = /\s/g;
+// The tokens /\b[a-z][a-z0-9+.-]*:\S+/gi matches: a scheme, then the text up
+// to the next whitespace.
+function replaceUrlTokens(text, replace) {
+    const parts = [];
+    let copied = 0;
+    let colon = text.indexOf(":");
+    while (colon !== -1) {
+        const followedByText = colon + 1 < text.length && !WHITESPACE_PATTERN.test(text[colon + 1]);
+        const start = followedByText ? findSchemeStart(text, colon) : -1;
+        if (start === -1) {
+            colon = text.indexOf(":", colon + 1);
+            continue;
         }
-        return `${scheme}[REDACTED]@`;
-    });
+        const end = indexOfPattern(text, NEXT_WHITESPACE_PATTERN, colon + 1);
+        parts.push(text.slice(copied, start), replace(text.slice(start, end)));
+        copied = end;
+        colon = text.indexOf(":", end);
+    }
+    parts.push(text.slice(copied));
+    return parts.join("");
+}
+// "scheme://user:pa ss@host": a password with whitespace splits the token above.
+function redactSpacedUserinfo(text) {
+    const parts = [];
+    let copied = 0;
+    let colon = text.indexOf("://");
+    while (colon !== -1) {
+        const start = findSchemeStart(text, colon);
+        const authorityStart = colon + 3;
+        const atIndex = start === -1 ? -1 : findSpacedUserinfoEnd(text, authorityStart);
+        if (atIndex === -1) {
+            colon = text.indexOf("://", colon + 1);
+            continue;
+        }
+        const end = atIndex + 1;
+        if (!looksLikeHostPort(text.slice(authorityStart, atIndex), text.slice(end))) {
+            parts.push(text.slice(copied, start), `${text.slice(start, authorityStart)}[REDACTED]@`);
+            copied = end;
+        }
+        colon = text.indexOf("://", end);
+    }
+    parts.push(text.slice(copied));
+    return parts.join("");
+}
+const SPACED_USERINFO_STOP_PATTERN = /[\s/:@.]/;
+// Index of the "@" that ends /[^\s/:@.]+(?::[^\s/:@.]+)+(?:\s+[^\s/:@.]+)+@/ at
+// `start`, or -1. Its parts cannot overlap, so one pass decides the match, and
+// the scan stops at the next "://".
+function findSpacedUserinfoEnd(text, start) {
+    let index = skipUserinfoRun(text, start);
+    if (index === start || text[index] !== ":") {
+        return -1;
+    }
+    while (text[index] === ":") {
+        const runEnd = skipUserinfoRun(text, index + 1);
+        if (runEnd === index + 1) {
+            return -1;
+        }
+        index = runEnd;
+    }
+    let spacedRuns = 0;
+    while (index < text.length && WHITESPACE_PATTERN.test(text[index])) {
+        let runStart = index + 1;
+        while (runStart < text.length && WHITESPACE_PATTERN.test(text[runStart])) {
+            runStart += 1;
+        }
+        const runEnd = skipUserinfoRun(text, runStart);
+        if (runEnd === runStart) {
+            return -1;
+        }
+        index = runEnd;
+        spacedRuns += 1;
+    }
+    return spacedRuns > 0 && text[index] === "@" ? index : -1;
+}
+function skipUserinfoRun(text, from) {
+    let index = from;
+    while (index < text.length && !SPACED_USERINFO_STOP_PATTERN.test(text[index])) {
+        index += 1;
+    }
+    return index;
+}
+// Start of the scheme that ends at `colon`, where /\b[a-z][a-z0-9+.-]*:/i
+// would match it, or -1. Walking back from the ":" reads a run like "a.a.a.a"
+// once; the regex would rescan it from every letter.
+function findSchemeStart(text, colon) {
+    let start = -1;
+    for (let index = colon - 1; index >= 0 && SCHEME_CHAR_PATTERN.test(text[index]); index -= 1) {
+        const atWordBoundary = index === 0 || !WORD_CHAR_PATTERN.test(text[index - 1]);
+        if (atWordBoundary && SCHEME_START_PATTERN.test(text[index])) {
+            start = index;
+        }
+    }
+    return start;
+}
+// Index of the first match of a global `pattern` at or after `from`, or the text length.
+function indexOfPattern(text, pattern, from) {
+    pattern.lastIndex = from;
+    const match = pattern.exec(text);
+    return match === null ? text.length : match.index;
 }
 function redactParseableUrlUserinfo(text) {
     const trimmed = text.trim();
@@ -106,16 +327,176 @@ function splitAuthorityUserinfo(url) {
         afterAt: `${authority.slice(atIndex + 1)}${rest.slice(authorityEnd)}`,
     };
 }
+// A URL inside another URL's path or query ("...?next=https://user:pass@host")
+// has its own authority. The text regex sees both as one token.
+// One pass per URL in the token, outer first, so a long token of nested URLs
+// does not grow the call stack. URLs nested in one authority share its end, and
+// the authority reader reads that text once for all of them.
 function redactCompactUserinfo(urlToken) {
-    const prefix = readSchemePrefix(urlToken);
-    if (prefix === null) {
-        return urlToken;
+    // Without an "@" after a URL's scheme there is no userinfo to find, so
+    // segments past the last "@" skip the authority scan.
+    const lastAt = urlToken.lastIndexOf("@");
+    const lastUserinfoAt = lastAtOutsidePathSegmentStart(urlToken);
+    const authorities = createAuthorityReader(urlToken);
+    const parts = [];
+    let offset = 0;
+    for (;;) {
+        const prefix = readSchemePrefix(urlToken.slice(offset));
+        if (prefix === null) {
+            parts.push(urlToken.slice(offset));
+            break;
+        }
+        const restStart = offset + prefix.scheme.length;
+        const hasAuthority = prefix.hasAuthoritySlashes || SPECIAL_SCHEMES.has(prefix.name);
+        const atIndex = hasAuthority && lastAt >= restStart
+            ? findUserinfoEnd(urlToken, restStart, authorities, lastAt, lastUserinfoAt)
+            : -1;
+        const nestedFrom = atIndex > 0 ? atIndex + 1 : 0;
+        parts.push(atIndex > 0 ? `${prefix.scheme}[REDACTED]@` : prefix.scheme);
+        const rest = prefix.rest.slice(nestedFrom);
+        const nestedStart = findNestedUrlStart(rest);
+        if (nestedStart === -1) {
+            parts.push(rest);
+            break;
+        }
+        parts.push(rest.slice(0, nestedStart));
+        offset = restStart + nestedFrom + nestedStart;
     }
-    const atIndex = prefix.rest.lastIndexOf("@");
-    if (atIndex <= 0) {
-        return urlToken;
+    return parts.join("");
+}
+const SCHEME_CHAR_PATTERN = /[a-z0-9+.-]/i;
+const SCHEME_START_PATTERN = /[a-z]/i;
+// Index of the first match of /[a-z][a-z0-9+.-]*:\S/i, or -1. It walks back
+// from each ":" instead of trying every start position, so a long run of
+// letters in a path is read once rather than once per letter.
+function findNestedUrlStart(text) {
+    for (let colon = text.indexOf(":"); colon !== -1; colon = text.indexOf(":", colon + 1)) {
+        if (colon + 1 >= text.length || /\s/.test(text[colon + 1])) {
+            continue;
+        }
+        let start = -1;
+        for (let index = colon - 1; index >= 0 && SCHEME_CHAR_PATTERN.test(text[index]); index -= 1) {
+            if (SCHEME_START_PATTERN.test(text[index])) {
+                start = index;
+            }
+        }
+        if (start !== -1) {
+            return start;
+        }
     }
-    return `${prefix.scheme}[REDACTED]@${prefix.rest.slice(atIndex + 1)}`;
+    return -1;
+}
+// WHATWG special schemes read userinfo without "//" ("https:user:pass@host").
+// Other schemes have an authority only after "//", so "mailto:a@b.com" has none.
+const SPECIAL_SCHEMES = new Set(["http:", "https:", "ws:", "wss:", "ftp:"]);
+// Path, query, fragment, and the quote or bracket that closes a URL in prose or JSON.
+const AUTHORITY_END_PATTERN = /[/\\?#"'<>`]/g;
+const DIGITS_PATTERN = /^\d*$/;
+const DOTTED_HOST_NAME_PATTERN = /^[a-z0-9_.-]+$/i;
+const LOCALHOST_PATTERN = /^localhost$/i;
+// Starts only move forward, and so do both positions here, as in
+// splitCommaSeparatedUrls: the authorities of a token are read once in total.
+function createAuthorityReader(token) {
+    let text;
+    let closeBracket = -1;
+    return {
+        read(start) {
+            if (text === undefined || text.end < start) {
+                text = readAuthorityText(token, start);
+            }
+            return text;
+        },
+        closeBracket(start) {
+            if (closeBracket < start) {
+                const index = token.indexOf("]", start);
+                closeBracket = index === -1 ? token.length : index;
+            }
+            return closeBracket;
+        },
+    };
+}
+function readAuthorityText(token, from) {
+    const end = indexOfPattern(token, AUTHORITY_END_PATTERN, from);
+    let lastAt = -1;
+    let lastColon = -1;
+    let colonBeforeLast = -1;
+    for (let index = from; index < end; index += 1) {
+        if (token[index] === "@") {
+            lastAt = index;
+        }
+        else if (token[index] === ":") {
+            colonBeforeLast = lastColon;
+            lastColon = index;
+        }
+    }
+    const port = lastColon === -1 ? "" : token.slice(lastColon + 1, end);
+    const digitsAfterLastColon = DIGITS_PATTERN.test(port);
+    return {
+        end,
+        closed: end < token.length,
+        lastAt,
+        lastColon,
+        colonBeforeLast,
+        digitsAfterLastColon,
+        // WHATWG reads ":0000080" as port 80.
+        portTooLarge: digitsAfterLastColon && Number(port) > 65535,
+    };
+}
+// The userinfo ends at the last "@" before the path, so "https://host/a?x=1@2"
+// and ".../npm/@scope/pkg" keep their "@". A password with an unencoded "/"
+// ("user:p/ss@host") moves that "@" past the first "/"; it is told apart from
+// a URL by the "user:p" before the "/", which is not a host[:port].
+// A password of digits first ("u:12/ab@host", "u:123?x@host") reads as a port.
+// So when the name before the port cannot be a host (a dotted name of letters,
+// digits, "-" and "_", localhost, or an IPv6 literal), or the digits are above
+// 65535, the last "@" counts unless it starts a path segment ("/@scope"), and
+// "gitlab.example:8443/users?search=a@b.com" keeps its "@".
+// Two shapes stay ambiguous. A username that is also a dotted host name
+// ("first.last:12/ab@host") is left unchanged. A single-label host on a port
+// ("gitlab:8080/users?search=a@b.com") is redacted up to that "@".
+// `start` is the authority start in `token`; the result is an index from it.
+function findUserinfoEnd(token, start, authorities, lastAt, lastUserinfoAt) {
+    const text = authorities.read(start);
+    if (text.lastAt >= start || !text.closed) {
+        return Math.max(text.lastAt - start, -1);
+    }
+    const { end, lastColon } = text;
+    const hasColon = lastColon >= start;
+    const oneColon = hasColon && text.colonBeforeLast < start;
+    // ":" and then only digits, maybe none.
+    const portDigits = hasColon && text.digitsAfterLastColon;
+    const bracketEnd = token[start] === "[" ? authorities.closeBracket(start) : -1;
+    // /^(?:\[[^\]]*\]|[^:]*):\d+$/: "host:port" or "[...]:port".
+    if (portDigits && lastColon + 1 < end && (oneColon || bracketEnd === lastColon - 1)) {
+        const host = token.slice(start, lastColon);
+        return !text.portTooLarge && couldBeHostName(host) ? -1 : Math.max(lastUserinfoAt - start, -1);
+    }
+    // The rest of /^(?:\[[^\]]*\]|[^:]*)(?::\d*)?$/: "host", "host:", "[...]", or "[...]:".
+    const hostWithoutPort = !hasColon ||
+        (oneColon && portDigits) ||
+        bracketEnd === end - 1 ||
+        (portDigits && bracketEnd === lastColon - 1);
+    return hostWithoutPort ? -1 : lastAt - start;
+}
+// "%" (an encoded "@" in an email username) or "+" cannot appear in a host name.
+// The character test comes first and stops at the first other character.
+function couldBeHostName(host) {
+    if (host.startsWith("[")) {
+        return host.endsWith("]") && isIP(host.slice(1, -1)) === 6;
+    }
+    return (LOCALHOST_PATTERN.test(host) ||
+        (DOTTED_HOST_NAME_PATTERN.test(host) &&
+            host.includes(".") &&
+            !host.startsWith(".") &&
+            !host.includes("..")));
+}
+// Found once per token, so each nested URL reads it in constant time.
+function lastAtOutsidePathSegmentStart(urlToken) {
+    let index = urlToken.lastIndexOf("@");
+    while (index > 0 && urlToken[index - 1] === "/") {
+        index = urlToken.lastIndexOf("@", index - 1);
+    }
+    return index;
 }
 const SCHEME_PREFIX_PATTERN = /^([a-z][a-z0-9+.-]*:)(\/\/|\/)?/i;
 function readSchemePrefix(value) {
@@ -126,54 +507,69 @@ function readSchemePrefix(value) {
     const scheme = schemeMatch[0];
     return {
         scheme,
+        name: schemeMatch[1].toLowerCase(),
+        hasAuthoritySlashes: schemeMatch[2] === "//",
         rest: value.slice(scheme.length),
     };
 }
+// A comma is inside a password when the entry's authority is still open (no
+// "@", "/", "?", or "#" after the scheme yet) and the next of those after the
+// comma, or whitespace, is an "@".
+const AUTHORITY_CLOSE_PATTERN = /[@/?#]/g;
+const USERINFO_STOP_PATTERN = /[@/?# \t]/g;
 export function splitCommaSeparatedUrls(value) {
     const parts = [];
     let start = 0;
-    for (let index = 0; index < value.length; index += 1) {
-        if (value[index] !== ",") {
-            continue;
+    // Where the current entry's authority starts, -1 without a scheme; read at its first comma.
+    let restStart;
+    let inUserinfo = false;
+    // Both positions only move forward, so a value with many commas is read once.
+    let closeIndex = -1;
+    let stopIndex = -1;
+    for (let comma = value.indexOf(","); comma !== -1; comma = value.indexOf(",", comma + 1)) {
+        if (restStart === undefined) {
+            restStart = readRestStart(value, start, comma);
         }
-        if (commaIsInsideUserinfo(value, start, index)) {
-            continue;
+        if (restStart !== -1) {
+            if (closeIndex < restStart) {
+                closeIndex = indexOfPattern(value, AUTHORITY_CLOSE_PATTERN, restStart);
+            }
+            if (stopIndex < comma) {
+                stopIndex = indexOfPattern(value, USERINFO_STOP_PATTERN, comma + 1);
+            }
+            const commaInUserinfo = closeIndex > comma &&
+                value[stopIndex] === "@" &&
+                (inUserinfo || !startsNextUrl(value, start, comma));
+            if (commaInUserinfo) {
+                inUserinfo = true;
+                continue;
+            }
         }
-        parts.push(value.slice(start, index).trim());
-        start = index + 1;
+        parts.push(value.slice(start, comma).trim());
+        start = comma + 1;
+        restStart = undefined;
+        inUserinfo = false;
     }
     parts.push(value.slice(start).trim());
     return parts;
 }
+function readRestStart(value, start, comma) {
+    const raw = value.slice(start, comma);
+    const prefix = readSchemePrefix(raw.trim());
+    if (prefix === null) {
+        return -1;
+    }
+    return start + raw.length - raw.trimStart().length + prefix.scheme.length;
+}
 // "https://a.example,https:user:pass@b.example" is two URLs; the "@" after the
 // comma belongs to the next one. The text before the comma must parse as a URL
 // by itself, so "https://alice:secret,https:word@host" stays one entry.
-// Only http(s) counts, so "pass,abc:def@host" stays.
-const NEXT_HTTP_URL_PATTERN = /^https?:/i;
-function commaIsInsideUserinfo(value, start, commaIndex) {
-    const entry = value.slice(start, commaIndex).trim();
-    const prefix = readSchemePrefix(entry);
-    if (prefix === null || authorityAlreadyClosed(prefix.rest)) {
-        return false;
-    }
-    const afterComma = value.slice(commaIndex + 1);
-    const startsNextUrl = NEXT_HTTP_URL_PATTERN.test(afterComma) && tryParseUrl(entry) !== null;
-    return !startsNextUrl && userinfoAtFollows(afterComma);
-}
-function authorityAlreadyClosed(rest) {
-    return rest.includes("@") || rest.includes("/") || rest.includes("?") || rest.includes("#");
-}
-function userinfoAtFollows(afterComma) {
-    for (let index = 0; index < afterComma.length; index += 1) {
-        const char = afterComma[index];
-        if (char === "@") {
-            return true;
-        }
-        if (char === "/" || char === "?" || char === "#" || char === " " || char === "\t") {
-            return false;
-        }
-    }
-    return false;
+// Only http(s) counts, so "pass,abc:def@host" stays. Checked at an entry's
+// first comma only: once a comma is in the password, so is every comma up to its "@".
+const NEXT_HTTP_URL_PATTERN = /https?:/iy;
+function startsNextUrl(value, start, comma) {
+    NEXT_HTTP_URL_PATTERN.lastIndex = comma + 1;
+    return (NEXT_HTTP_URL_PATTERN.test(value) && tryParseUrl(value.slice(start, comma).trim()) !== null);
 }
 // "user:pa ss@host" is a password. "localhost:3000 a@b.com" is a host, then an email.
 // A numeric port counts only when one token follows it and the text after "@" is an email domain.

package/build/utils/safe-redirect-fetch.js

@@ -1,6 +1,7 @@
 import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
 import { fetch as undiciFetch } from "undici";
+import { redactUrlSecretsInText } from "./redact-url.js";
 /** Maximum number of redirect hops an outbound download request may follow. */
 export const DEFAULT_MAX_REDIRECTS = 5;
 /**
@@ -308,7 +309,8 @@ export async function fetchWithValidatedRedirects(url, options) {
         // keeps — on the wire in cleartext, so it is refused before the destination is
         // evaluated and before any trust decision can re-enable the credentials.
         if (currentProtocol === "https:" && target.protocol === "http:") {
-            throw new UnsafeRedirectError(`Refusing to follow redirect from ${currentUrl} to cleartext ${target.toString()}`);
+            // The download proxy returns this message to the client, and Location can carry userinfo.
+            throw new UnsafeRedirectError(redactUrlSecretsInText(`Refusing to follow redirect from ${currentUrl} to cleartext ${target.toString()}`));
         }
         // A hop that stays on the originating origin needs no destination check. It keeps
         // the credentials only when they were not withheld on the way here: a target that

package/build/utils/url.js

@@ -1,3 +1,4 @@
+import { splitCommaSeparatedUrls, stripUrlUserinfo } from "./redact-url.js";
 /**
  * Smart URL handling for GitLab API
  *
@@ -17,6 +18,27 @@ export function normalizeGitLabApiUrl(url) {
     }
     return normalizedUrl;
 }
+/**
+ * Startup warning for a configured API URL that had userinfo. `source` names
+ * where the URL came from. The advice stays generic: a remote-authorization or
+ * MCP OAuth deployment must not be told to add a server token.
+ */
+export function apiUrlUserinfoWarning(source) {
+    return (`${source} contains a username or password before the host. It is ignored: requests ` +
+        "go to the URL without it. Use a token or OAuth configuration to authenticate instead.");
+}
+/**
+ * Split a comma-separated GITLAB_API_URL, drop userinfo from each entry, and
+ * normalize it. fetch() refuses a URL with credentials, so a URL that kept
+ * them would fail every request and echo the password in the error.
+ */
+export function parseConfiguredGitLabApiUrls(value) {
+    const entries = splitCommaSeparatedUrls(value).map(stripUrlUserinfo);
+    return {
+        urls: entries.map(entry => normalizeGitLabApiUrl(entry.url)),
+        hadUserinfo: entries.some(entry => entry.hadUserinfo),
+    };
+}
 const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
 /**
  * True when the URL is plain `http://` to a non-loopback host, i.e. credentials sent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.3.4",
+  "version": "2.3.5-next.125",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [