@zereight/mcp-gitlab 2.3.7-next.136 → 2.3.7-next.138

package/README.ko.md

@@ -36,7 +36,7 @@ PAT, OAuth, 읽기 전용 모드, 동적 API URL, 원격 인증을 지원하며
 
 ### 왜 이 GitLab MCP를 사용하나요?
 
-- **276개 도구: toolset 274개 + `execute_graphql` + `discover_tools`** — 작은 toolset으로 시작하고, 런타임에 카테고리 활성화
+- **277개 도구: toolset 275개 + `execute_graphql` + `discover_tools`** — 작은 toolset으로 시작하고, 런타임에 카테고리 활성화
 - **MR 2단계 리뷰** — `list_merge_request_changed_files` → 배치 `get_merge_request_file_diff`
 - **Agent Skill 내장** — `skills/gitlab-mcp/` 워크플로우 가이드
 - **유연한 인증** — Personal Access Token, 로컬 OAuth2 브라우저 플로우, MCP OAuth 프록시, 요청별 원격 인증
@@ -50,7 +50,7 @@ PAT, OAuth, 읽기 전용 모드, 동적 API URL, 원격 인증을 지원하며
 |                 | @zereight/mcp-gitlab                                             | GitLab MCP A (커뮤니티 CQRS형)             | GitLab 공식 MCP 서버                                                                                                                            |
 | --------------- | ---------------------------------------------------------------- | ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------- |
 | **적합한 경우** | AI 에이전트 워크플로우                                           | 엔터프라이즈 멀티 인스턴스 / 그룹형 도구   | GitLab에 내장, 별도 설치 없음                                                                                                                   |
-| **도구 모델**   | 276개 도구: toolset 274개 + `execute_graphql` + `discover_tools` | ~50–60개 `browse_*` / `manage_*` 그룹 도구 | HTTP 헤더로 고르는 toolset                                                                                                                      |
+| **도구 모델**   | 277개 도구: toolset 275개 + `execute_graphql` + `discover_tools` | ~50–60개 `browse_*` / `manage_*` 그룹 도구 | HTTP 헤더로 고르는 toolset                                                                                                                      |
 | **MR 리뷰**     | 2단계 배치 diff                                                  | 서버마다 다름                              | `get_merge_request`에 diffs                                                                                                                     |
 | **Node.js**     | >=18.17                                                          | 보통 >=24                                  | stdio는 `mcp-remote`, Node.js 20+                                                                                                               |
 | **라이선스**    | MIT                                                              | 서버마다 다름                              | GitLab의 일부                                                                                                                                   |

package/README.md

@@ -41,7 +41,7 @@ Supports PAT, OAuth, read-only mode, dynamic API URLs, and remote authorization
 
 ### Why use this GitLab MCP?
 
-- **276 tools: 274 in toolsets + `execute_graphql` + `discover_tools`** — start with a small toolset; activate more at runtime without CQRS-style grouping
+- **277 tools: 275 in toolsets + `execute_graphql` + `discover_tools`** — start with a small toolset; activate more at runtime without CQRS-style grouping
 - **MR 2-step review** — `list_merge_request_changed_files` → batched `get_merge_request_file_diff`
 - **Agent Skill built in** — workflow guidance in `skills/gitlab-mcp/`
 - **Flexible auth** — Personal Access Token, local OAuth2 browser flow, MCP OAuth proxy, and per-request remote authorization
@@ -55,7 +55,7 @@ Supports PAT, OAuth, read-only mode, dynamic API URLs, and remote authorization
 |                | @zereight/mcp-gitlab                                              | GitLab MCP A (community CQRS-style)          | GitLab official MCP server                                                                                                                       |
 | -------------- | ----------------------------------------------------------------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
 | **Best for**   | AI agent workflows                                                | Enterprise multi-instance / grouped tools    | Built into GitLab, no separate install                                                                                                           |
-| **Tool model** | 276 tools: 274 in toolsets + `execute_graphql` + `discover_tools` | ~50–60 grouped `browse_*` / `manage_*` tools | Toolsets chosen with an HTTP header                                                                                                              |
+| **Tool model** | 277 tools: 275 in toolsets + `execute_graphql` + `discover_tools` | ~50–60 grouped `browse_*` / `manage_*` tools | Toolsets chosen with an HTTP header                                                                                                              |
 | **MR review**  | 2-step batched diff                                               | Varies                                       | `get_merge_request` with diffs                                                                                                                   |
 | **Node.js**    | >=18.17                                                           | Often >=24                                   | Node.js 20+ for stdio via `mcp-remote`                                                                                                           |
 | **License**    | MIT                                                               | Varies                                       | Part of GitLab                                                                                                                                   |
@@ -686,259 +686,260 @@ Register the skill directory in your AI client to get optimal tool usage guidanc
 21. `list_protected_branches` - List protected branches in a project, supports search filter
 22. `get_protected_branch` - Get details of a single protected branch (access levels, force push settings)
 23. `protect_branch` - Protect a repository branch (set push/merge/unprotect access levels)
-24. `unprotect_branch` - Remove protection from a previously protected branch
-25. `update_default_branch` - Change the default branch of a project
-26. `get_merge_request` - Get details of a merge request (merge_request_iid or source_branch required). Set include_summaries=true for deployment/commit/approval summaries
-27. `get_merge_request_diffs` - Get the changes/diffs of a merge request (merge_request_iid or source_branch required)
-28. `list_merge_request_changed_files` - List changed file paths in a merge request without diff content (merge_request_iid or source_branch required)
-29. `list_merge_request_diffs` - List merge request diffs with pagination (merge_request_iid or source_branch required)
-30. `get_merge_request_file_diff` - Get diffs for specific files from a merge request (merge_request_iid or source_branch required)
-31. `list_merge_request_versions` - List all versions of a merge request
-32. `get_merge_request_version` - Get a specific version of a merge request
-33. `get_branch_diffs` - Get diffs between two branches or commits
-34. `update_merge_request` - Update a merge request (merge_request_iid or source_branch required)
-35. `create_note` - Create a new note (comment) to an issue or merge request
-36. `create_merge_request_thread` - Create a new thread on a merge request
-37. `resolve_merge_request_thread` - Resolve a thread on a merge request
-38. `mr_discussions` - List discussion items for a merge request
-39. `get_merge_request_discussion` - Get a single discussion item for a merge request
-40. `delete_merge_request_discussion_note` - Delete a discussion note on a merge request
-41. `update_merge_request_discussion_note` - Update a discussion note on a merge request
-42. `create_merge_request_discussion_note` - Add a new discussion note to an existing merge request thread
-43. `create_merge_request_note` - Add a new note to a merge request
-44. `delete_merge_request_note` - Delete an existing merge request note
-45. `get_merge_request_note` - Get a specific note for a merge request
-46. `get_merge_request_notes` - List notes for a merge request
-47. `update_merge_request_note` - Modify an existing merge request note
-48. `get_draft_note` - Get a single draft note from a merge request
-49. `list_draft_notes` - List draft notes for a merge request
-50. `create_draft_note` - Create a draft note for a merge request
-51. `update_draft_note` - Update an existing draft note
-52. `delete_draft_note` - Delete a draft note
-53. `publish_draft_note` - Publish a single draft note
-54. `bulk_publish_draft_notes` - Publish all draft notes for a merge request. Optionally sets reviewer_state and posts a summary note (GitLab 19.2+). Can set reviewer_state even with no drafts.
-55. `list_merge_request_emoji_reactions` - List all emoji reactions on a merge request
-56. `list_merge_request_note_emoji_reactions` - List all emoji reactions on a merge request note. Pass discussion_id for discussion thread replies.
-57. `create_merge_request_emoji_reaction` - Add an emoji reaction to a merge request (e.g. thumbsup, rocket, eyes)
-58. `delete_merge_request_emoji_reaction` - Remove an emoji reaction from a merge request
-59. `create_merge_request_note_emoji_reaction` - Add an emoji reaction to a merge request note. Pass discussion_id for discussion thread replies.
-60. `delete_merge_request_note_emoji_reaction` - Remove an emoji reaction from a merge request note. Pass discussion_id for discussion thread replies.
-61. `update_issue_note` - Modify an existing issue thread note
-62. `create_issue_note` - Add a note to an issue, optionally replying to a discussion thread
-63. `list_issue_emoji_reactions` - List all emoji reactions on an issue
-64. `list_issue_note_emoji_reactions` - List all emoji reactions on an issue note. Pass discussion_id for discussion thread replies.
-65. `create_issue_emoji_reaction` - Add an emoji reaction to an issue (e.g. thumbsup, rocket, eyes)
-66. `delete_issue_emoji_reaction` - Remove an emoji reaction from an issue
-67. `create_issue_note_emoji_reaction` - Add an emoji reaction to an issue note. Pass discussion_id for discussion thread replies.
-68. `delete_issue_note_emoji_reaction` - Remove an emoji reaction from an issue note. Pass discussion_id for discussion thread replies.
-69. `list_issues` - List issues (default: created by current user; use scope='all' for all)
-70. `my_issues` - List issues assigned to the authenticated user
-71. `get_issue` - Get details of a specific issue. Returns the issue with a slim nested milestone by default; set full_response=true for the complete milestone object
-72. `update_issue` - Update an issue. Returns a slim confirmation by default; set full_response=true for the complete updated issue object
-73. `update_issue_description_patch` - Apply a patch (search/replace or unified diff) to an issue description. Reduces token usage by allowing small changes without sending the full description. Supports dry_run to preview changes and create_note to summarize updates.
-74. `delete_issue` - Delete an issue
-75. `list_todos` - List GitLab to-do items for the current user
-76. `mark_todo_done` - Mark a GitLab to-do item as done
-77. `mark_all_todos_done` - Mark all pending GitLab to-do items as done for the current user
-78. `list_issue_links` - List all issue links for a specific issue
-79. `list_issue_discussions` - List discussions for an issue
-80. `get_issue_link` - Get a specific issue link
-81. `create_issue_link` - Create an issue link between two issues
-82. `delete_issue_link` - Delete an issue link
-83. `list_namespaces` - List all namespaces (users and groups) available to the current user. Filter by kind='group' for groups only.
-84. `get_namespace` - Get details of a namespace (user or group) by ID or path. Groups are namespaces with kind='group'.
-85. `verify_namespace` - Verify if a namespace path exists. Use parent_id to scope the check to a specific parent namespace — required for nested namespaces where the same path may exist under different parents.
-86. `get_project` - Get details of a specific project
-87. `list_projects` - List projects accessible by the current user
-88. `update_project` - Update project settings such as description, visibility, default branch, and feature access levels
-89. `list_project_members` - List members of a GitLab project
-90. `list_group_members` - List members of a GitLab group with optional name or username search
-91. `list_labels` - List labels for a project
-92. `get_label` - Get a single label from a project
-93. `create_label` - Create a new label in a project
-94. `update_label` - Update an existing label in a project
-95. `delete_label` - Delete a label from a project
-96. `list_group_projects` - List projects in a group
-97. `list_wiki_pages` - List wiki pages in a project
-98. `get_wiki_page` - Get details of a specific wiki page
-99. `create_wiki_page` - Create a wiki page in a project
-100. `update_wiki_page` - Update a wiki page in a project
-101. `delete_wiki_page` - Delete a wiki page from a project
-102. `list_group_wiki_pages` - List wiki pages in a group
-103. `get_group_wiki_page` - Get details of a specific group wiki page
-104. `create_group_wiki_page` - Create a wiki page in a group
-105. `update_group_wiki_page` - Update a wiki page in a group
-106. `delete_group_wiki_page` - Delete a wiki page from a group
-107. `get_repository_tree` - List files and directories in a repository
-108. `list_pipelines` - List pipelines with filtering options
-109. `get_pipeline` - Get details of a specific pipeline
-110. `get_pipeline_variables` - Get variables configured for a pipeline
-111. `get_pipeline_test_report` - Get pipeline test report
-112. `get_pipeline_test_report_summary` - Get pipeline test report summary
-113. `delete_pipeline` - Delete a pipeline. Requires the project Owner role, cannot be undone, and does not automatically delete child pipelines.
-114. `update_pipeline_metadata` - Update pipeline metadata
-115. `list_deployments` - List deployments with filtering options
-116. `get_deployment` - Get deployment details, including approval_summary, approvals, and pending_approval_count when GitLab provides them
-117. `create_deployment` - Create a deployment
-118. `update_deployment` - Update a deployment status
-119. `delete_deployment` - Delete a deployment
-120. `list_deployment_merge_requests` - List merge requests shipped with a deployment
-121. `approve_deployment` - Approve or reject a protected-environment deployment
-122. `list_environments` - List environments in a project
-123. `get_environment` - Get details of a specific environment
-124. `update_environment` - Update an environment
-125. `delete_environment` - Delete a stopped environment
-126. `stop_environment` - Stop an environment
-127. `stop_stale_environments` - Stop eligible stale environments; protected environments are excluded and environments are stopped, not deleted
-128. `delete_review_app_environments` - Schedule deletion of stopped review-app environments one week later; dry_run defaults to true and actual scheduling requires dry_run=false
-129. `list_pipeline_triggers` - List project pipeline trigger tokens
-130. `get_pipeline_trigger` - Get a project pipeline trigger
-131. `create_pipeline_trigger` - Create a project pipeline trigger
-132. `update_pipeline_trigger` - Update a project pipeline trigger
-133. `delete_pipeline_trigger` - Delete a project pipeline trigger
-134. `trigger_pipeline` - Trigger a pipeline with a pipeline trigger token
-135. `list_pipeline_jobs` - List all jobs in a specific pipeline
-136. `list_pipeline_trigger_jobs` - List trigger jobs (bridges) in a pipeline
-137. `get_pipeline_job` - Get details of a GitLab pipeline job number
-138. `get_pipeline_job_output` - Get the output/trace of a pipeline job with optional pagination
-139. `validate_ci_lint` - Validate provided GitLab CI/CD YAML content for a project
-140. `validate_project_ci_lint` - Validate an existing .gitlab-ci.yml configuration for a project
-141. `list_ci_catalog_resources` - List GitLab CI/CD Catalog resources/components visible to the user
-142. `get_ci_catalog_resource` - Get details for a GitLab CI/CD Catalog resource, including versions and components
-143. `create_pipeline` - Create a new pipeline for a branch or tag
-144. `retry_pipeline` - Retry a failed or canceled pipeline
-145. `cancel_pipeline` - Cancel a running pipeline
-146. `list_pipeline_schedules` - List pipeline schedules in a project, optionally filtered to active or inactive
-147. `get_pipeline_schedule` - Get details of a specific pipeline schedule, including its variables and last pipeline
-148. `list_pipeline_schedule_pipelines` - List the pipelines that a pipeline schedule has triggered
-149. `create_pipeline_schedule` - Create a new pipeline schedule for a branch or tag
-150. `update_pipeline_schedule` - Update an existing pipeline schedule
-151. `delete_pipeline_schedule` - Delete a pipeline schedule
-152. `play_pipeline_schedule` - Run a pipeline schedule immediately
-153. `take_ownership_pipeline_schedule` - Take ownership of a pipeline schedule
-154. `get_pipeline_schedule_variable` - Get a single variable of a pipeline schedule
-155. `create_pipeline_schedule_variable` - Create a variable for a pipeline schedule
-156. `update_pipeline_schedule_variable` - Update a variable of a pipeline schedule
-157. `delete_pipeline_schedule_variable` - Delete a variable from a pipeline schedule
-158. `play_pipeline_job` - Run a manual pipeline job
-159. `play_pipeline_jobs` - Play multiple manual pipeline jobs sequentially
-160. `retry_pipeline_job` - Retry a failed or canceled pipeline job
-161. `cancel_pipeline_job` - Cancel a running pipeline job
-162. `erase_pipeline_job` - Erase a pipeline job log and artifacts
-163. `wait_for_pipeline` - Wait for a pipeline to reach a terminal status
-164. `wait_for_job` - Wait for a job to reach a terminal status
-165. `list_job_artifacts` - List artifact files in a job's archive
-166. `download_job_artifacts` - Download job artifact archive (zip) and save to a local path
-167. `get_job_artifact_file` - Get content of a single file from a job's artifacts
-168. `list_merge_requests` - List merge requests (without project_id: user's MRs; with project_id: project MRs)
-169. `list_group_merge_requests` - List merge requests across all projects of a group and its subgroups
-170. `list_milestones` - List milestones with filtering options
-171. `get_milestone` - Get details of a specific milestone
-172. `create_milestone` - Create a new milestone
-173. `edit_milestone` - Edit an existing milestone
-174. `delete_milestone` - Delete a milestone
-175. `get_milestone_issue` - Get issues associated with a specific milestone
-176. `get_milestone_merge_requests` - Get merge requests associated with a specific milestone
-177. `promote_milestone` - Promote a milestone to the next stage
-178. `get_milestone_burndown_events` - Get burndown events for a specific milestone
-179. `list_group_milestones` - List group milestones with filtering options
-180. `get_group_milestone` - Get details of a specific group milestone
-181. `create_group_milestone` - Create a new group milestone
-182. `edit_group_milestone` - Edit an existing group milestone
-183. `delete_group_milestone` - Delete a group milestone
-184. `get_group_milestone_issue` - Get issues associated with a specific group milestone
-185. `get_group_milestone_merge_requests` - Get merge requests associated with a specific group milestone
-186. `get_group_milestone_burndown_events` - Get burndown events for a specific group milestone
-187. `get_users` - Get GitLab user details by usernames
-188. `get_user` - Get user details by ID
-189. `whoami` - Get current authenticated user details
-190. `list_commits` - List repository commits with filtering options
-191. `get_commit` - Get details of a specific commit
-192. `get_commit_diff` - Get changes/diffs of a specific commit
-193. `get_file_blame` - Get git blame for a file at a given ref. Each entry maps a contiguous range of source lines to the commit that last changed them (id, author, authored_date, message). Use range_start/range_end to limit blame to specific lines.
-194. `list_commit_statuses` - List statuses for a commit
-195. `create_commit_status` - Create or update the status of a commit
-196. `list_group_iterations` - List group iterations with filtering options
-197. `upload_markdown` - Upload a file for use in markdown content
-198. `download_attachment` - Download an uploaded file from a project (images returned as base64; other files, or images with local_path, are saved as new files under the download directory)
-199. `health_check` - Verify server status and authentication. Always reports the MCP server version (mcp_server_version). When authenticated, also reports the GitLab instance version from GET /api/v4/version (version, revision, enterprise). Version lookup failures do not fail the health check — those fields are omitted.
-200. `list_events` - List events for the authenticated user (before/after: YYYY-MM-DD)
-201. `get_project_events` - List events for a project (before/after: YYYY-MM-DD)
-202. `list_releases` - List all releases for a project
-203. `get_release` - Get a release by tag name
-204. `create_release` - Create a new release
-205. `update_release` - Update an existing release
-206. `delete_release` - Delete a release (does not delete the tag)
-207. `create_release_evidence` - Create release evidence (Premium/Ultimate)
-208. `download_release_asset` - Download a release asset file by direct asset path
-209. `list_tags` - List repository tags for a project
-210. `get_tag` - Get a repository tag by name
-211. `create_tag` - Create a new repository tag
-212. `delete_tag` - Delete a repository tag
-213. `get_tag_signature` - Get the X.509 signature of a signed tag (404 if unsigned)
-214. `list_protected_tags` - List protected tags in a project
-215. `get_protected_tag` - Get details of a single protected tag or wildcard (create access levels)
-216. `protect_tag` - Protect a repository tag or wildcard (set who can create it)
-217. `unprotect_tag` - Remove protection from a previously protected tag or wildcard
-218. `get_work_item` - Get a work item with full details including status, hierarchy, type, and widgets
-219. `list_work_items` - List work items with filters (type, state, search, assignees, labels)
-220. `create_work_item` - Create a work item (issue, task, incident, epic, etc.) with full field support
-221. `update_work_item` - Update a work item (title, description, labels, assignees, state, parent, custom fields, etc.)
-222. `convert_work_item_type` - Convert a work item to a different type
-223. `list_work_item_statuses` - List available statuses for a work item type (Premium/Ultimate)
-224. `list_custom_field_definitions` - List custom field definitions for a work item type
-225. `move_work_item` - Move a work item to a different project
-226. `list_work_item_notes` - List notes and discussions on a work item
-227. `create_work_item_note` - Add a note to a work item (supports Markdown, internal notes, threads)
-228. `list_work_item_emoji_reactions` - List all emoji reactions on a work item
-229. `list_work_item_note_emoji_reactions` - List all emoji reactions on a work item note (comment, thread, or thread reply)
-230. `create_work_item_emoji_reaction` - Add an emoji reaction to a work item (e.g. thumbsup, rocket, eyes)
-231. `delete_work_item_emoji_reaction` - Remove an emoji reaction from a work item
-232. `create_work_item_note_emoji_reaction` - Add an emoji reaction to a work item note (comment, thread, or thread reply)
-233. `delete_work_item_note_emoji_reaction` - Remove an emoji reaction from a work item note (comment, thread, or thread reply)
-234. `get_timeline_events` - List timeline events for an incident
-235. `create_timeline_event` - Create a timeline event on an incident
-236. `list_webhooks` - List webhooks for a project or group
-237. `create_webhook` - Create a webhook on a project or group
-238. `update_webhook` - Update an existing project or group webhook
-239. `delete_webhook` - Delete a project or group webhook
-240. `list_webhook_events` - List recent webhook events (past 7 days)
-241. `get_webhook_event` - Get full details of a specific webhook event
-242. `search_code` - Search for code across all projects (requires advanced search or Zoekt)
-243. `search_project_code` - Search for code within a specific project (requires advanced search or Zoekt)
-244. `search_group_code` - Search for code within a specific group (requires advanced search or Zoekt)
-245. `list_project_variables` - List CI/CD variables for a project
-246. `get_project_variable` - Get a single CI/CD variable from a project
-247. `create_project_variable` - Create a CI/CD variable for a project
-248. `update_project_variable` - Update an existing CI/CD variable in a project
-249. `delete_project_variable` - Delete a CI/CD variable from a project
-250. `list_group_variables` - List CI/CD variables for a group
-251. `get_group_variable` - Get a single CI/CD variable from a group
-252. `create_group_variable` - Create a CI/CD variable for a group
-253. `update_group_variable` - Update an existing CI/CD variable in a group
-254. `delete_group_variable` - Delete a CI/CD variable from a group
-255. `get_dependency_proxy_settings` - Get dependency proxy settings for a group
-256. `update_dependency_proxy_settings` - Update dependency proxy settings for a group (enable/disable, credentials for authenticated Docker Hub pulls)
-257. `list_dependency_proxy_blobs` - List cached dependency proxy blobs for a group
-258. `purge_dependency_proxy_cache` - Schedule purge of all cached dependency proxy blobs for a group
-259. `list_project_vulnerabilities` - List vulnerabilities for a project with optional state, severity, and report type filters (GraphQL-backed, cursor pagination)
-260. `get_vulnerability` - Get full details of a specific vulnerability
-261. `dismiss_vulnerability` - Dismiss a vulnerability with a reason (acceptable_risk, false_positive, used_in_tests, mitigating_control, not_applicable) and optional comment
-262. `confirm_vulnerability` - Confirm a vulnerability as a real finding requiring remediation
-263. `orbit_query` - Execute a GitLab Orbit graph query over the indexed SDLC knowledge graph
-264. `orbit_get_schema` - Fetch the current GitLab Orbit graph schema (node and edge types)
-265. `orbit_get_status` - Check GitLab Orbit indexing status for the enabled scope
-266. `orbit_list_tools` - List the MCP tool definitions exposed by GitLab Orbit
-267. `list_snippets` - List snippets — project snippets when project_id is given, otherwise personal snippets
-268. `get_snippet` - Get a snippet's metadata. Set include_content=true to also fetch the raw file content.
-269. `create_snippet` - Create a snippet — project-scoped when project_id is given, otherwise a personal snippet. Requires title plus either file_name + content (single file) or files[] (multi-file); the two shapes cannot be mixed.
-270. `update_snippet` - Update an existing snippet (provide at least one field to change). For multi-file edits — renames, deletions, additions — pass files[] with action (create/update/delete/move) and previous_path. The file_name + content shortcut still works for single-file content replacement.
-271. `delete_snippet` - Delete a snippet
-272. `list_project_runners` - List runners available to a project (type, status, paused, tag_list). Omits registration and authentication tokens.
-273. `get_runner` - Get a runner's tag_list, run_untagged, locked, and access_level. When a project allowlist is active, the runner must be available to an allowed project. Omits registration and authentication tokens.
-274. `rebase_merge_request` - Rebase the source branch of a merge request onto its target branch
-275. `gitlab_api_request` - Send one GitLab REST call under /api/v4. Enabled only when GITLAB_TOOLSETS lists api. Readonly allows GET; modify rejects DELETE.
-276. `discover_tools` - Discover and activate additional tool categories for this session. Available categories: core, merge_requests, issues, repositories, branches, projects, labels, ci, groups, pipelines, milestones, wiki, releases, tags, snippets, users, workitems, webhooks, search, variables, dependency_proxy, vulnerabilities, orbit. Already-active categories are listed in the response.
+24. `update_protected_branch` - Update an existing protected branch rule in place (access levels, force push, code owner approval)
+25. `unprotect_branch` - Remove protection from a previously protected branch
+26. `update_default_branch` - Change the default branch of a project
+27. `get_merge_request` - Get details of a merge request (merge_request_iid or source_branch required). Set include_summaries=true for deployment/commit/approval summaries
+28. `get_merge_request_diffs` - Get the changes/diffs of a merge request (merge_request_iid or source_branch required)
+29. `list_merge_request_changed_files` - List changed file paths in a merge request without diff content (merge_request_iid or source_branch required)
+30. `list_merge_request_diffs` - List merge request diffs with pagination (merge_request_iid or source_branch required)
+31. `get_merge_request_file_diff` - Get diffs for specific files from a merge request (merge_request_iid or source_branch required)
+32. `list_merge_request_versions` - List all versions of a merge request
+33. `get_merge_request_version` - Get a specific version of a merge request
+34. `get_branch_diffs` - Get diffs between two branches or commits
+35. `update_merge_request` - Update a merge request (merge_request_iid or source_branch required)
+36. `create_note` - Create a new note (comment) to an issue or merge request
+37. `create_merge_request_thread` - Create a new thread on a merge request
+38. `resolve_merge_request_thread` - Resolve a thread on a merge request
+39. `mr_discussions` - List discussion items for a merge request
+40. `get_merge_request_discussion` - Get a single discussion item for a merge request
+41. `delete_merge_request_discussion_note` - Delete a discussion note on a merge request
+42. `update_merge_request_discussion_note` - Update a discussion note on a merge request
+43. `create_merge_request_discussion_note` - Add a new discussion note to an existing merge request thread
+44. `create_merge_request_note` - Add a new note to a merge request
+45. `delete_merge_request_note` - Delete an existing merge request note
+46. `get_merge_request_note` - Get a specific note for a merge request
+47. `get_merge_request_notes` - List notes for a merge request
+48. `update_merge_request_note` - Modify an existing merge request note
+49. `get_draft_note` - Get a single draft note from a merge request
+50. `list_draft_notes` - List draft notes for a merge request
+51. `create_draft_note` - Create a draft note for a merge request
+52. `update_draft_note` - Update an existing draft note
+53. `delete_draft_note` - Delete a draft note
+54. `publish_draft_note` - Publish a single draft note
+55. `bulk_publish_draft_notes` - Publish all draft notes for a merge request. Optionally sets reviewer_state and posts a summary note (GitLab 19.2+). Can set reviewer_state even with no drafts.
+56. `list_merge_request_emoji_reactions` - List all emoji reactions on a merge request
+57. `list_merge_request_note_emoji_reactions` - List all emoji reactions on a merge request note. Pass discussion_id for discussion thread replies.
+58. `create_merge_request_emoji_reaction` - Add an emoji reaction to a merge request (e.g. thumbsup, rocket, eyes)
+59. `delete_merge_request_emoji_reaction` - Remove an emoji reaction from a merge request
+60. `create_merge_request_note_emoji_reaction` - Add an emoji reaction to a merge request note. Pass discussion_id for discussion thread replies.
+61. `delete_merge_request_note_emoji_reaction` - Remove an emoji reaction from a merge request note. Pass discussion_id for discussion thread replies.
+62. `update_issue_note` - Modify an existing issue thread note
+63. `create_issue_note` - Add a note to an issue, optionally replying to a discussion thread
+64. `list_issue_emoji_reactions` - List all emoji reactions on an issue
+65. `list_issue_note_emoji_reactions` - List all emoji reactions on an issue note. Pass discussion_id for discussion thread replies.
+66. `create_issue_emoji_reaction` - Add an emoji reaction to an issue (e.g. thumbsup, rocket, eyes)
+67. `delete_issue_emoji_reaction` - Remove an emoji reaction from an issue
+68. `create_issue_note_emoji_reaction` - Add an emoji reaction to an issue note. Pass discussion_id for discussion thread replies.
+69. `delete_issue_note_emoji_reaction` - Remove an emoji reaction from an issue note. Pass discussion_id for discussion thread replies.
+70. `list_issues` - List issues (default: created by current user; use scope='all' for all)
+71. `my_issues` - List issues assigned to the authenticated user
+72. `get_issue` - Get details of a specific issue. Returns the issue with a slim nested milestone by default; set full_response=true for the complete milestone object
+73. `update_issue` - Update an issue. Returns a slim confirmation by default; set full_response=true for the complete updated issue object
+74. `update_issue_description_patch` - Apply a patch (search/replace or unified diff) to an issue description. Reduces token usage by allowing small changes without sending the full description. Supports dry_run to preview changes and create_note to summarize updates.
+75. `delete_issue` - Delete an issue
+76. `list_todos` - List GitLab to-do items for the current user
+77. `mark_todo_done` - Mark a GitLab to-do item as done
+78. `mark_all_todos_done` - Mark all pending GitLab to-do items as done for the current user
+79. `list_issue_links` - List all issue links for a specific issue
+80. `list_issue_discussions` - List discussions for an issue
+81. `get_issue_link` - Get a specific issue link
+82. `create_issue_link` - Create an issue link between two issues
+83. `delete_issue_link` - Delete an issue link
+84. `list_namespaces` - List all namespaces (users and groups) available to the current user. Filter by kind='group' for groups only.
+85. `get_namespace` - Get details of a namespace (user or group) by ID or path. Groups are namespaces with kind='group'.
+86. `verify_namespace` - Verify if a namespace path exists. Use parent_id to scope the check to a specific parent namespace — required for nested namespaces where the same path may exist under different parents.
+87. `get_project` - Get details of a specific project
+88. `list_projects` - List projects accessible by the current user
+89. `update_project` - Update project settings such as description, visibility, default branch, and feature access levels
+90. `list_project_members` - List members of a GitLab project
+91. `list_group_members` - List members of a GitLab group with optional name or username search
+92. `list_labels` - List labels for a project
+93. `get_label` - Get a single label from a project
+94. `create_label` - Create a new label in a project
+95. `update_label` - Update an existing label in a project
+96. `delete_label` - Delete a label from a project
+97. `list_group_projects` - List projects in a group
+98. `list_wiki_pages` - List wiki pages in a project
+99. `get_wiki_page` - Get details of a specific wiki page
+100. `create_wiki_page` - Create a wiki page in a project
+101. `update_wiki_page` - Update a wiki page in a project
+102. `delete_wiki_page` - Delete a wiki page from a project
+103. `list_group_wiki_pages` - List wiki pages in a group
+104. `get_group_wiki_page` - Get details of a specific group wiki page
+105. `create_group_wiki_page` - Create a wiki page in a group
+106. `update_group_wiki_page` - Update a wiki page in a group
+107. `delete_group_wiki_page` - Delete a wiki page from a group
+108. `get_repository_tree` - List files and directories in a repository
+109. `list_pipelines` - List pipelines with filtering options
+110. `get_pipeline` - Get details of a specific pipeline
+111. `get_pipeline_variables` - Get variables configured for a pipeline
+112. `get_pipeline_test_report` - Get pipeline test report
+113. `get_pipeline_test_report_summary` - Get pipeline test report summary
+114. `delete_pipeline` - Delete a pipeline. Requires the project Owner role, cannot be undone, and does not automatically delete child pipelines.
+115. `update_pipeline_metadata` - Update pipeline metadata
+116. `list_deployments` - List deployments with filtering options
+117. `get_deployment` - Get deployment details, including approval_summary, approvals, and pending_approval_count when GitLab provides them
+118. `create_deployment` - Create a deployment
+119. `update_deployment` - Update a deployment status
+120. `delete_deployment` - Delete a deployment
+121. `list_deployment_merge_requests` - List merge requests shipped with a deployment
+122. `approve_deployment` - Approve or reject a protected-environment deployment
+123. `list_environments` - List environments in a project
+124. `get_environment` - Get details of a specific environment
+125. `update_environment` - Update an environment
+126. `delete_environment` - Delete a stopped environment
+127. `stop_environment` - Stop an environment
+128. `stop_stale_environments` - Stop eligible stale environments; protected environments are excluded and environments are stopped, not deleted
+129. `delete_review_app_environments` - Schedule deletion of stopped review-app environments one week later; dry_run defaults to true and actual scheduling requires dry_run=false
+130. `list_pipeline_triggers` - List project pipeline trigger tokens
+131. `get_pipeline_trigger` - Get a project pipeline trigger
+132. `create_pipeline_trigger` - Create a project pipeline trigger
+133. `update_pipeline_trigger` - Update a project pipeline trigger
+134. `delete_pipeline_trigger` - Delete a project pipeline trigger
+135. `trigger_pipeline` - Trigger a pipeline with a pipeline trigger token
+136. `list_pipeline_jobs` - List all jobs in a specific pipeline
+137. `list_pipeline_trigger_jobs` - List trigger jobs (bridges) in a pipeline
+138. `get_pipeline_job` - Get details of a GitLab pipeline job number
+139. `get_pipeline_job_output` - Get the output/trace of a pipeline job with optional pagination
+140. `validate_ci_lint` - Validate provided GitLab CI/CD YAML content for a project
+141. `validate_project_ci_lint` - Validate an existing .gitlab-ci.yml configuration for a project
+142. `list_ci_catalog_resources` - List GitLab CI/CD Catalog resources/components visible to the user
+143. `get_ci_catalog_resource` - Get details for a GitLab CI/CD Catalog resource, including versions and components
+144. `create_pipeline` - Create a new pipeline for a branch or tag
+145. `retry_pipeline` - Retry a failed or canceled pipeline
+146. `cancel_pipeline` - Cancel a running pipeline
+147. `list_pipeline_schedules` - List pipeline schedules in a project, optionally filtered to active or inactive
+148. `get_pipeline_schedule` - Get details of a specific pipeline schedule, including its variables and last pipeline
+149. `list_pipeline_schedule_pipelines` - List the pipelines that a pipeline schedule has triggered
+150. `create_pipeline_schedule` - Create a new pipeline schedule for a branch or tag
+151. `update_pipeline_schedule` - Update an existing pipeline schedule
+152. `delete_pipeline_schedule` - Delete a pipeline schedule
+153. `play_pipeline_schedule` - Run a pipeline schedule immediately
+154. `take_ownership_pipeline_schedule` - Take ownership of a pipeline schedule
+155. `get_pipeline_schedule_variable` - Get a single variable of a pipeline schedule
+156. `create_pipeline_schedule_variable` - Create a variable for a pipeline schedule
+157. `update_pipeline_schedule_variable` - Update a variable of a pipeline schedule
+158. `delete_pipeline_schedule_variable` - Delete a variable from a pipeline schedule
+159. `play_pipeline_job` - Run a manual pipeline job
+160. `play_pipeline_jobs` - Play multiple manual pipeline jobs sequentially
+161. `retry_pipeline_job` - Retry a failed or canceled pipeline job
+162. `cancel_pipeline_job` - Cancel a running pipeline job
+163. `erase_pipeline_job` - Erase a pipeline job log and artifacts
+164. `wait_for_pipeline` - Wait for a pipeline to reach a terminal status
+165. `wait_for_job` - Wait for a job to reach a terminal status
+166. `list_job_artifacts` - List artifact files in a job's archive
+167. `download_job_artifacts` - Download job artifact archive (zip) and save to a local path
+168. `get_job_artifact_file` - Get content of a single file from a job's artifacts
+169. `list_merge_requests` - List merge requests (without project_id: user's MRs; with project_id: project MRs)
+170. `list_group_merge_requests` - List merge requests across all projects of a group and its subgroups
+171. `list_milestones` - List milestones with filtering options
+172. `get_milestone` - Get details of a specific milestone
+173. `create_milestone` - Create a new milestone
+174. `edit_milestone` - Edit an existing milestone
+175. `delete_milestone` - Delete a milestone
+176. `get_milestone_issue` - Get issues associated with a specific milestone
+177. `get_milestone_merge_requests` - Get merge requests associated with a specific milestone
+178. `promote_milestone` - Promote a milestone to the next stage
+179. `get_milestone_burndown_events` - Get burndown events for a specific milestone
+180. `list_group_milestones` - List group milestones with filtering options
+181. `get_group_milestone` - Get details of a specific group milestone
+182. `create_group_milestone` - Create a new group milestone
+183. `edit_group_milestone` - Edit an existing group milestone
+184. `delete_group_milestone` - Delete a group milestone
+185. `get_group_milestone_issue` - Get issues associated with a specific group milestone
+186. `get_group_milestone_merge_requests` - Get merge requests associated with a specific group milestone
+187. `get_group_milestone_burndown_events` - Get burndown events for a specific group milestone
+188. `get_users` - Get GitLab user details by usernames
+189. `get_user` - Get user details by ID
+190. `whoami` - Get current authenticated user details
+191. `list_commits` - List repository commits with filtering options
+192. `get_commit` - Get details of a specific commit
+193. `get_commit_diff` - Get changes/diffs of a specific commit
+194. `get_file_blame` - Get git blame for a file at a given ref. Each entry maps a contiguous range of source lines to the commit that last changed them (id, author, authored_date, message). Use range_start/range_end to limit blame to specific lines.
+195. `list_commit_statuses` - List statuses for a commit
+196. `create_commit_status` - Create or update the status of a commit
+197. `list_group_iterations` - List group iterations with filtering options
+198. `upload_markdown` - Upload a file for use in markdown content
+199. `download_attachment` - Download an uploaded file from a project (images returned as base64; other files, or images with local_path, are saved as new files under the download directory)
+200. `health_check` - Verify server status and authentication. Always reports the MCP server version (mcp_server_version). When authenticated, also reports the GitLab instance version from GET /api/v4/version (version, revision, enterprise). Version lookup failures do not fail the health check — those fields are omitted.
+201. `list_events` - List events for the authenticated user (before/after: YYYY-MM-DD)
+202. `get_project_events` - List events for a project (before/after: YYYY-MM-DD)
+203. `list_releases` - List all releases for a project
+204. `get_release` - Get a release by tag name
+205. `create_release` - Create a new release
+206. `update_release` - Update an existing release
+207. `delete_release` - Delete a release (does not delete the tag)
+208. `create_release_evidence` - Create release evidence (Premium/Ultimate)
+209. `download_release_asset` - Download a release asset file by direct asset path
+210. `list_tags` - List repository tags for a project
+211. `get_tag` - Get a repository tag by name
+212. `create_tag` - Create a new repository tag
+213. `delete_tag` - Delete a repository tag
+214. `get_tag_signature` - Get the X.509 signature of a signed tag (404 if unsigned)
+215. `list_protected_tags` - List protected tags in a project
+216. `get_protected_tag` - Get details of a single protected tag or wildcard (create access levels)
+217. `protect_tag` - Protect a repository tag or wildcard (set who can create it)
+218. `unprotect_tag` - Remove protection from a previously protected tag or wildcard
+219. `get_work_item` - Get a work item with full details including status, hierarchy, type, and widgets
+220. `list_work_items` - List work items with filters (type, state, search, assignees, labels)
+221. `create_work_item` - Create a work item (issue, task, incident, epic, etc.) with full field support
+222. `update_work_item` - Update a work item (title, description, labels, assignees, state, parent, custom fields, etc.)
+223. `convert_work_item_type` - Convert a work item to a different type
+224. `list_work_item_statuses` - List available statuses for a work item type (Premium/Ultimate)
+225. `list_custom_field_definitions` - List custom field definitions for a work item type
+226. `move_work_item` - Move a work item to a different project
+227. `list_work_item_notes` - List notes and discussions on a work item
+228. `create_work_item_note` - Add a note to a work item (supports Markdown, internal notes, threads)
+229. `list_work_item_emoji_reactions` - List all emoji reactions on a work item
+230. `list_work_item_note_emoji_reactions` - List all emoji reactions on a work item note (comment, thread, or thread reply)
+231. `create_work_item_emoji_reaction` - Add an emoji reaction to a work item (e.g. thumbsup, rocket, eyes)
+232. `delete_work_item_emoji_reaction` - Remove an emoji reaction from a work item
+233. `create_work_item_note_emoji_reaction` - Add an emoji reaction to a work item note (comment, thread, or thread reply)
+234. `delete_work_item_note_emoji_reaction` - Remove an emoji reaction from a work item note (comment, thread, or thread reply)
+235. `get_timeline_events` - List timeline events for an incident
+236. `create_timeline_event` - Create a timeline event on an incident
+237. `list_webhooks` - List webhooks for a project or group
+238. `create_webhook` - Create a webhook on a project or group
+239. `update_webhook` - Update an existing project or group webhook
+240. `delete_webhook` - Delete a project or group webhook
+241. `list_webhook_events` - List recent webhook events (past 7 days)
+242. `get_webhook_event` - Get full details of a specific webhook event
+243. `search_code` - Search for code across all projects (requires advanced search or Zoekt)
+244. `search_project_code` - Search for code within a specific project (requires advanced search or Zoekt)
+245. `search_group_code` - Search for code within a specific group (requires advanced search or Zoekt)
+246. `list_project_variables` - List CI/CD variables for a project
+247. `get_project_variable` - Get a single CI/CD variable from a project
+248. `create_project_variable` - Create a CI/CD variable for a project
+249. `update_project_variable` - Update an existing CI/CD variable in a project
+250. `delete_project_variable` - Delete a CI/CD variable from a project
+251. `list_group_variables` - List CI/CD variables for a group
+252. `get_group_variable` - Get a single CI/CD variable from a group
+253. `create_group_variable` - Create a CI/CD variable for a group
+254. `update_group_variable` - Update an existing CI/CD variable in a group
+255. `delete_group_variable` - Delete a CI/CD variable from a group
+256. `get_dependency_proxy_settings` - Get dependency proxy settings for a group
+257. `update_dependency_proxy_settings` - Update dependency proxy settings for a group (enable/disable, credentials for authenticated Docker Hub pulls)
+258. `list_dependency_proxy_blobs` - List cached dependency proxy blobs for a group
+259. `purge_dependency_proxy_cache` - Schedule purge of all cached dependency proxy blobs for a group
+260. `list_project_vulnerabilities` - List vulnerabilities for a project with optional state, severity, and report type filters (GraphQL-backed, cursor pagination)
+261. `get_vulnerability` - Get full details of a specific vulnerability
+262. `dismiss_vulnerability` - Dismiss a vulnerability with a reason (acceptable_risk, false_positive, used_in_tests, mitigating_control, not_applicable) and optional comment
+263. `confirm_vulnerability` - Confirm a vulnerability as a real finding requiring remediation
+264. `orbit_query` - Execute a GitLab Orbit graph query over the indexed SDLC knowledge graph
+265. `orbit_get_schema` - Fetch the current GitLab Orbit graph schema (node and edge types)
+266. `orbit_get_status` - Check GitLab Orbit indexing status for the enabled scope
+267. `orbit_list_tools` - List the MCP tool definitions exposed by GitLab Orbit
+268. `list_snippets` - List snippets — project snippets when project_id is given, otherwise personal snippets
+269. `get_snippet` - Get a snippet's metadata. Set include_content=true to also fetch the raw file content.
+270. `create_snippet` - Create a snippet — project-scoped when project_id is given, otherwise a personal snippet. Requires title plus either file_name + content (single file) or files[] (multi-file); the two shapes cannot be mixed.
+271. `update_snippet` - Update an existing snippet (provide at least one field to change). For multi-file edits — renames, deletions, additions — pass files[] with action (create/update/delete/move) and previous_path. The file_name + content shortcut still works for single-file content replacement.
+272. `delete_snippet` - Delete a snippet
+273. `list_project_runners` - List runners available to a project (type, status, paused, tag_list). Omits registration and authentication tokens.
+274. `get_runner` - Get a runner's tag_list, run_untagged, locked, and access_level. When a project allowlist is active, the runner must be available to an allowed project. Omits registration and authentication tokens.
+275. `rebase_merge_request` - Rebase the source branch of a merge request onto its target branch
+276. `gitlab_api_request` - Send one GitLab REST call under /api/v4. Enabled only when GITLAB_TOOLSETS lists api. Readonly allows GET; modify rejects DELETE.
+277. `discover_tools` - Discover and activate additional tool categories for this session. Available categories: core, merge_requests, issues, repositories, branches, projects, labels, ci, groups, pipelines, milestones, wiki, releases, tags, snippets, users, workitems, webhooks, search, variables, dependency_proxy, vulnerabilities, orbit. Already-active categories are listed in the response.
 
 <!-- TOOLS-END -->
 

package/README.pt-BR.md

@@ -36,7 +36,7 @@ Suporta PAT, OAuth, modo somente leitura, URLs de API dinâmicas e autorização
 
 ### Por que usar este GitLab MCP?
 
-- **276 ferramentas: 274 em toolsets + `execute_graphql` + `discover_tools`** — comece com um toolset pequeno e ative mais categorias em tempo de execução
+- **277 ferramentas: 275 em toolsets + `execute_graphql` + `discover_tools`** — comece com um toolset pequeno e ative mais categorias em tempo de execução
 - **Revisão de MR em 2 etapas** — `list_merge_request_changed_files` → `get_merge_request_file_diff` em lote
 - **Agent Skill integrado** — orientação de workflows em `skills/gitlab-mcp/`
 - **Autenticação flexível** — Personal Access Token, fluxo OAuth2 local no navegador, proxy MCP OAuth e autorização remota por requisição
@@ -50,7 +50,7 @@ Suporta PAT, OAuth, modo somente leitura, URLs de API dinâmicas e autorização
 |                           | @zereight/mcp-gitlab                                                    | GitLab MCP A (comunidade, estilo CQRS)                    | Servidor MCP oficial do GitLab                                                                                                                                 |
 | ------------------------- | ----------------------------------------------------------------------- | --------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Mais indicado para**    | Workflows de agentes de IA                                              | Múltiplas instâncias corporativas / ferramentas agrupadas | Integrado ao GitLab, sem instalação separada                                                                                                                   |
-| **Modelo de ferramentas** | 276 ferramentas: 274 em toolsets + `execute_graphql` + `discover_tools` | ~50–60 ferramentas agrupadas `browse_*` / `manage_*`      | Toolsets escolhidos por cabeçalho HTTP                                                                                                                         |
+| **Modelo de ferramentas** | 277 ferramentas: 275 em toolsets + `execute_graphql` + `discover_tools` | ~50–60 ferramentas agrupadas `browse_*` / `manage_*`      | Toolsets escolhidos por cabeçalho HTTP                                                                                                                         |
 | **Revisão de MR**         | Diff em lote em 2 etapas                                                | Varia                                                     | `get_merge_request` com diffs                                                                                                                                  |
 | **Node.js**               | >=18.17                                                                 | Frequentemente >=24                                       | Node.js 20+ para stdio via `mcp-remote`                                                                                                                        |
 | **Licença**               | MIT                                                                     | Varia                                                     | Parte do GitLab                                                                                                                                                |

package/README.zh-CN.md

@@ -36,7 +36,7 @@ read -rs GITLAB_PERSONAL_ACCESS_TOKEN && export GITLAB_PERSONAL_ACCESS_TOKEN
 
 ### 为什么使用这个 GitLab MCP？
 
-- **276 个工具：toolset 中 274 个 + `execute_graphql` + `discover_tools`** — 从小型 toolset 开始，运行时按需激活类别
+- **277 个工具：toolset 中 275 个 + `execute_graphql` + `discover_tools`** — 从小型 toolset 开始，运行时按需激活类别
 - **MR 两步审查** — `list_merge_request_changed_files` → 批量 `get_merge_request_file_diff`
 - **内置 Agent Skill** — `skills/gitlab-mcp/` 工作流指南
 - **认证灵活** — Personal Access Token、本地 OAuth2 浏览器流程、MCP OAuth 代理、按请求远程授权
@@ -50,7 +50,7 @@ read -rs GITLAB_PERSONAL_ACCESS_TOKEN && export GITLAB_PERSONAL_ACCESS_TOKEN
 |              | @zereight/mcp-gitlab                                                 | GitLab MCP A（社区 CQRS 型）               | GitLab 官方 MCP 服务器                                                                                                                  |
 | ------------ | -------------------------------------------------------------------- | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------- |
 | **更适合**   | AI 代理工作流                                                        | 企业多实例 / 分组工具                      | 内置于 GitLab，无需单独安装                                                                                                             |
-| **工具模型** | 276 个工具：toolset 中 274 个 + `execute_graphql` + `discover_tools` | ~50–60 个 `browse_*` / `manage_*` 分组工具 | 用 HTTP 头选择 toolset                                                                                                                  |
+| **工具模型** | 277 个工具：toolset 中 275 个 + `execute_graphql` + `discover_tools` | ~50–60 个 `browse_*` / `manage_*` 分组工具 | 用 HTTP 头选择 toolset                                                                                                                  |
 | **MR 审查**  | 两步批量 diff                                                        | 因服务器而异                               | `get_merge_request` 带 diffs                                                                                                            |
 | **Node.js**  | >=18.17                                                              | 通常 >=24                                  | stdio 经 `mcp-remote`，需要 Node.js 20+                                                                                                 |
 | **许可证**   | MIT                                                                  | 因服务器而异                               | GitLab 的一部分                                                                                                                         |

package/build/index.js

@@ -94,7 +94,7 @@ import { listMcpResources, listMcpResourceTemplates, readMcpResource, } from "./
 import { getMcpPrompt, listMcpPrompts } from "./server/mcp-prompts.js";
 import { isInitializationRequestBody, isUnauthenticatedDiscoveryRequestBody, readAcceptHeader, readMcpSessionIdHeader, redactSessionIdForLog, } from "./server/request-helpers.js";
 export { readMcpSessionIdHeader } from "./server/request-helpers.js";
-import { apiUrlHostnameForLog, apiUrlUserinfoWarning, commaSplitHint, configuredApiUrlErrors, encodeGitLabPath, encodeGitLabPathSegment, invalidListEntryError, isCleartextRemoteUrl, normalizeGitLabApiUrl, parseConfiguredGitLabApiUrls, } from "./utils/url.js";
+import { apiUrlUserinfoWarning, commaSplitHint, configuredApiUrlErrors, encodeGitLabPath, encodeGitLabPathSegment, invalidListEntryError, isCleartextRemoteUrl, normalizeGitLabApiUrl, parseConfiguredGitLabApiUrls, } from "./utils/url.js";
 import { estimateMergeCommitCount, filterDiffsByPatterns, openSafeOutputWriteStream, resolveDownloadRoot, readSafeExistingFile, summarizeWebhookEvents, } from "./utils/helpers.js";
 import { graphqlQueryContainsWriteOperation, graphqlQueryContainsDeleteOperation, } from "./utils/graphql-query.js";
 import { resolveNestedWikiUpdateTitle } from "./utils/wiki-title.js";
@@ -122,7 +122,7 @@ import { createListedToolsCache, decorateToolsForList, } from "./tools/listed-to
 import { isExcludedBySlimProfile, shouldApplySlimToolProfile } from "./tools/tool-profile.js";
 import { shouldCompactToolResult } from "./utils/compact-tool-allowlist.js";
 import { BulkPublishDraftNotesSchema, CancelPipelineJobSchema, ErasePipelineJobSchema, CancelPipelineSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, // Added
-CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateMergeRequestNoteEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateGroupMilestoneSchema, CreateRepositorySchema, CreateGroupSchema, CreateWikiPageSchema, CreateGroupWikiPageSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UnprotectBranchSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupMilestoneSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteProjectMilestoneSchema, DeleteWikiPageSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, EditProjectMilestoneSchema, EditGroupMilestoneSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetBranchSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GitLabBlameEntrySchema, GetDraftNoteSchema, GetFileContentsSchema, GetIssueLinkSchema, GetIssueSchema, GetLabelSchema, GetMergeRequestDiffsSchema, GetMergeRequestSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetGroupMilestoneSchema, GetGroupMilestoneIssuesSchema, GetGroupMilestoneMergeRequestsSchema, GetGroupMilestoneBurndownEventsSchema, GetDeploymentSchema, CreateDeploymentSchema, UpdateDeploymentSchema, DeploymentApprovalSchema, ListDeploymentMergeRequestsSchema, GetEnvironmentSchema, UpdateEnvironmentSchema, StopEnvironmentSchema, StopStaleEnvironmentsSchema, DeleteReviewAppEnvironmentsSchema, PipelineTriggerIdSchema, ListPipelineTriggersSchema, CreatePipelineTriggerSchema, UpdatePipelineTriggerSchema, TriggerPipelineSchema, GetNamespaceSchema, GitLabCiLintResultSchema, GetPipelineJobOutputSchema, PipelineJobControlSchema, GetPipelineSchema, GetPipelineVariablesSchema, UpdatePipelineMetadataSchema, DeletePipelineSchema, PipelineReportSchema, WaitForPipelineSchema, WaitForPipelineJobSchema, PlayPipelineJobsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetRepositoryTreeSchema, GetUsersSchema, GetUserSchema, GitLabUserFullSchema, WhoAmISchema, GitLabCurrentUserSchema, GetWikiPageSchema, GitLabCommitSchema, GitLabCommitStatusSchema, GitLabCompareResultSchema, GitLabContentSchema, GitLabCreateUpdateFileResponseSchema, GitLabDiffSchema, 
+CreateMergeRequestNoteSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, CreateMergeRequestNoteEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateGroupMilestoneSchema, CreateRepositorySchema, CreateGroupSchema, CreateWikiPageSchema, CreateGroupWikiPageSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UpdateProtectedBranchSchema, UnprotectBranchSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupMilestoneSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteProjectMilestoneSchema, DeleteWikiPageSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, EditProjectMilestoneSchema, EditGroupMilestoneSchema, ForkRepositorySchema, GetBranchDiffsSchema, GetBranchSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GitLabBlameEntrySchema, GetDraftNoteSchema, GetFileContentsSchema, GetIssueLinkSchema, GetIssueSchema, GetLabelSchema, GetMergeRequestDiffsSchema, GetMergeRequestSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetGroupMilestoneSchema, GetGroupMilestoneIssuesSchema, GetGroupMilestoneMergeRequestsSchema, GetGroupMilestoneBurndownEventsSchema, GetDeploymentSchema, CreateDeploymentSchema, UpdateDeploymentSchema, DeploymentApprovalSchema, ListDeploymentMergeRequestsSchema, GetEnvironmentSchema, UpdateEnvironmentSchema, StopEnvironmentSchema, StopStaleEnvironmentsSchema, DeleteReviewAppEnvironmentsSchema, PipelineTriggerIdSchema, ListPipelineTriggersSchema, CreatePipelineTriggerSchema, UpdatePipelineTriggerSchema, TriggerPipelineSchema, GetNamespaceSchema, GitLabCiLintResultSchema, GetPipelineJobOutputSchema, PipelineJobControlSchema, GetPipelineSchema, GetPipelineVariablesSchema, UpdatePipelineMetadataSchema, DeletePipelineSchema, PipelineReportSchema, WaitForPipelineSchema, WaitForPipelineJobSchema, PlayPipelineJobsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetRepositoryTreeSchema, GetUsersSchema, GetUserSchema, GitLabUserFullSchema, WhoAmISchema, GitLabCurrentUserSchema, GetWikiPageSchema, GitLabCommitSchema, GitLabCommitStatusSchema, GitLabCompareResultSchema, GitLabContentSchema, GitLabCreateUpdateFileResponseSchema, GitLabDiffSchema, 
 // Discussion Schemas
 GitLabDiscussionNoteSchema, // Added
 GitLabDiscussionSchema, 
@@ -11332,6 +11332,54 @@ async function handleToolCall(params) {
                     content: [{ type: "text", text: JSON.stringify(data) }],
                 };
             }
+            case "update_protected_branch": {
+                const args = UpdateProtectedBranchSchema.parse(params.arguments);
+                const projectId = decodeURIComponent(args.project_id);
+                const effectiveProjectId = getEffectiveProjectId(projectId);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/protected_branches/${encodeGitLabPathSegment(args.branch_name)}`);
+                const body = {};
+                if (args.allow_force_push !== undefined)
+                    body.allow_force_push = args.allow_force_push;
+                if (args.code_owner_approval_required !== undefined)
+                    body.code_owner_approval_required = args.code_owner_approval_required;
+                if (args.allowed_to_push?.length)
+                    body.allowed_to_push = args.allowed_to_push;
+                if (args.allowed_to_merge?.length)
+                    body.allowed_to_merge = args.allowed_to_merge;
+                if (args.allowed_to_unprotect?.length)
+                    body.allowed_to_unprotect = args.allowed_to_unprotect;
+                // GitLab docs: keep at least one unprotect grant, or the rule can no longer be
+                // changed or removed. Only requests that destroy an unprotect record pay for this GET.
+                // Best-effort preflight: PATCH has no conditional update, so a change made to the
+                // rule between this GET and the PATCH is not detected.
+                if (args.allowed_to_unprotect?.some(entry => entry._destroy === true)) {
+                    const destroyedIds = new Set(args.allowed_to_unprotect
+                        .filter(entry => entry._destroy === true)
+                        .map(entry => entry.id));
+                    const currentResponse = await fetch(url.toString(), {
+                        ...getFetchConfig(),
+                    });
+                    await handleGitLabError(currentResponse);
+                    const current = GitLabProtectedBranchSchema.parse(await currentResponse.json());
+                    // Records without an id cannot be destroyed by id, so they stay.
+                    const kept = (current.unprotect_access_levels ?? []).filter(record => record.id === undefined || !destroyedIds.has(record.id)).length;
+                    // Entries with an id change an existing record; only entries without one add a grant.
+                    const added = args.allowed_to_unprotect.filter(entry => entry._destroy !== true && entry.id === undefined).length;
+                    if (kept + added === 0) {
+                        throw new ToolInputError(`Refusing to update protected branch '${args.branch_name}': this request would remove every allowed_to_unprotect record, and GitLab advises keeping at least one so the rule can still be changed or removed. Keep one existing record or add a replacement entry in the same request.`);
+                    }
+                }
+                const response = await fetch(url.toString(), {
+                    ...getFetchConfig(),
+                    method: "PATCH",
+                    body: JSON.stringify(body),
+                });
+                await handleGitLabError(response);
+                const data = GitLabProtectedBranchSchema.parse(await response.json());
+                return {
+                    content: [{ type: "text", text: JSON.stringify(data) }],
+                };
+            }
             case "unprotect_branch": {
                 const args = UnprotectBranchSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
@@ -12976,8 +13024,9 @@ function initOAuthClient() {
     }
     if (isCleartextRemoteUrl(GITLAB_API_URL)) {
         throw new Error(
-        // The host name only: a port can hold the start of a password (see apiUrlHostnameForLog).
-        `Refusing to send OAuth tokens over cleartext HTTP to http://${apiUrlHostnameForLog(GITLAB_API_URL)}. ` +
+        // The host name only, from the list GITLAB_API_URL is the first of: a port, or a
+        // whole URL split off by a comma, can be part of a password (see parseConfiguredGitLabApiUrls).
+        `Refusing to send OAuth tokens over cleartext HTTP to http://${CONFIGURED_GITLAB_API_URLS.hostnamesForLog[0]}. ` +
             "Use an https:// GITLAB_API_URL (http:// is only allowed for localhost).");
     }
     oauthClient = createGitLabOAuthClient(GITLAB_API_URL.replace(/\/api\/v4$/, ""));
@@ -13017,9 +13066,11 @@ async function runServer() {
                 }
             });
         }
-        // Host names only. GITLAB_API_URL is GITLAB_API_URLS[0], so it is logged the same way.
-        logger.info(`Configured GitLab API URLs: ${GITLAB_API_URLS.map(apiUrlHostnameForLog).join(", ")}`);
-        logger.info(`Default GitLab API URL: ${apiUrlHostnameForLog(GITLAB_API_URL)}`);
+        // Host names only, decided for the whole list (see parseConfiguredGitLabApiUrls).
+        // GITLAB_API_URL is GITLAB_API_URLS[0], so it is logged the same way.
+        const hostnames = CONFIGURED_GITLAB_API_URLS.hostnamesForLog;
+        logger.info(`Configured GitLab API URLs: ${hostnames.join(", ")}`);
+        logger.info(`Default GitLab API URL: ${hostnames[0]}`);
         if (GITLAB_OAUTH_ALLOWED_GROUPS) {
             logger.info(`Group access control enabled for: ${GITLAB_OAUTH_ALLOWED_GROUPS.join(", ")}`);
         }

package/build/schemas.js

@@ -2102,6 +2102,87 @@ export const ProtectBranchSchema = z.preprocess(input => {
     allow_force_push: stringBoolean.describe("Allow force push to the protected branch. Default: false"),
     code_owner_approval_required: stringBoolean.describe("Require code owner approval before merging (PREMIUM). Default: false"),
 }));
+// null → undefined, so entries copied from get_protected_branch (user_id: null, ...) still parse.
+const optionalProtectedBranchRecordId = z.preprocess(val => (val == null ? undefined : val), z.coerce.number().int().positive().optional());
+// One allowed_to_push / allowed_to_merge / allowed_to_unprotect entry for PATCH.
+// Add: one of access_level, user_id, group_id, deploy_key_id (push only).
+// Change an existing record: its id plus the new value. Remove: { id, _destroy: true }.
+// member_role_id (Ultimate custom roles) is not supported: z.object drops it, so an entry
+// with only member_role_id fails with "Set one of ...".
+const protectedBranchAccessEntry = z.object({
+    id: optionalProtectedBranchRecordId.describe("ID of an existing access level record (from get_protected_branch). Required with _destroy; with a new value it changes that record in place."),
+    access_level: z
+        .preprocess(val => (val == null ? undefined : val), protectedBranchAccessLevel.optional())
+        .describe("Role access level (0=No access, 30=Developer, 40=Maintainer, 60=Admin)"),
+    user_id: optionalProtectedBranchRecordId.describe("ID of a user to grant access"),
+    group_id: optionalProtectedBranchRecordId.describe("ID of a group to grant access"),
+    deploy_key_id: optionalProtectedBranchRecordId.describe("ID of a deploy key to grant push access (allowed_to_push only)"),
+    _destroy: stringBoolean.describe("Set true with id to remove that access level record"),
+});
+const PROTECTED_BRANCH_ACCESS_FIELDS = [
+    "allowed_to_push",
+    "allowed_to_merge",
+    "allowed_to_unprotect",
+];
+export const UpdateProtectedBranchSchema = ProjectParamsSchema.extend({
+    branch_name: z.string().describe("Name or wildcard pattern of the existing protected branch"),
+    allow_force_push: stringBoolean.describe("Allow users who can push to the branch to force push"),
+    code_owner_approval_required: stringBoolean.describe("Require code owner approval before merging. GitLab documents this as Premium/Ultimate"),
+    allowed_to_push: z
+        .array(protectedBranchAccessEntry)
+        .optional()
+        .describe("Push access entries to add, change, or remove. GitLab documents access_level, user_id, and group_id entries as Premium/Ultimate, and deploy_key_id entries as Free from 18.10"),
+    allowed_to_merge: z
+        .array(protectedBranchAccessEntry)
+        .optional()
+        .describe("Merge access entries to add, change, or remove. GitLab documents access_level, user_id, and group_id entries as Premium/Ultimate"),
+    allowed_to_unprotect: z
+        .array(protectedBranchAccessEntry)
+        .optional()
+        .describe("Unprotect access entries to add, change, or remove; 0 is not allowed. GitLab documents access_level, user_id, and group_id entries as Premium/Ultimate"),
+})
+    .refine(args => args.allow_force_push !== undefined ||
+    args.code_owner_approval_required !== undefined ||
+    PROTECTED_BRANCH_ACCESS_FIELDS.some(field => (args[field]?.length ?? 0) > 0), { message: "Provide at least one protected branch setting to update" })
+    .superRefine((args, ctx) => {
+    for (const field of PROTECTED_BRANCH_ACCESS_FIELDS) {
+        args[field]?.forEach((entry, index) => {
+            const path = [field, index];
+            const targets = ["access_level", "user_id", "group_id", "deploy_key_id"].filter(key => entry[key] !== undefined);
+            if (entry._destroy === true && entry.id === undefined) {
+                ctx.addIssue({ code: z.ZodIssueCode.custom, path, message: "_destroy requires id" });
+            }
+            if (entry._destroy !== true && targets.length === 0) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    path,
+                    message: "Set one of access_level, user_id, group_id, deploy_key_id, or id with _destroy: true",
+                });
+            }
+            if (targets.length > 1) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    path,
+                    message: `Set only one of access_level, user_id, group_id, deploy_key_id (got ${targets.join(", ")})`,
+                });
+            }
+            if (entry.deploy_key_id !== undefined && field !== "allowed_to_push") {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    path,
+                    message: "deploy_key_id is only valid in allowed_to_push",
+                });
+            }
+            if (entry.access_level === 0 && field === "allowed_to_unprotect") {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    path,
+                    message: "access_level 0 (No access) is not valid for allowed_to_unprotect",
+                });
+            }
+        });
+    }
+});
 export const UnprotectBranchSchema = ProjectParamsSchema.extend({
     branch_name: z.string().describe("Name of the protected branch to unprotect"),
 });
@@ -2110,8 +2191,12 @@ export const UpdateDefaultBranchSchema = ProjectParamsSchema.extend({
     default_branch: z.string().describe("The new default branch name for the project"),
 });
 export const GitLabProtectedBranchAccessLevelSchema = z.object({
+    // member_role_id (Ultimate custom roles) is not kept, and update_protected_branch does not accept it.
+    // Record id: update_protected_branch takes it to change or remove this entry
+    id: z.number().optional(),
     access_level: z.number().nullable().optional(),
     access_level_description: z.string().optional(),
+    deploy_key_id: z.number().nullable().optional(),
     // GitLab returns null for role-based access levels (not user-/group-specific)
     user_id: z.number().nullable().optional(),
     group_id: z.number().nullable().optional(),

package/build/tools/registry.js

@@ -1,7 +1,7 @@
 import { toJSONSchema } from "../utils/schema.js";
 import { USE_GITLAB_WIKI, USE_MILESTONE, USE_PIPELINE, SSE, STREAMABLE_HTTP } from "../config.js";
 import { getToolDescription } from "./tool-descriptions.js";
-import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, ErasePipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateGroupMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWebhookSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, ProtectTagSchema, UnprotectBranchSchema, UnprotectTagSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupMilestoneSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWebhookSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadAttachmentRemoteSchema, DownloadJobArtifactsSchema, DownloadJobArtifactsRemoteSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, EditGroupMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, HealthCheckSchema, GetBranchSchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GetDeploymentSchema, CreateDeploymentSchema, UpdateDeploymentSchema, DeploymentApprovalSchema, ListDeploymentMergeRequestsSchema, GetDraftNoteSchema, GetEnvironmentSchema, UpdateEnvironmentSchema, StopEnvironmentSchema, StopStaleEnvironmentsSchema, DeleteReviewAppEnvironmentsSchema, PipelineTriggerIdSchema, ListPipelineTriggersSchema, CreatePipelineTriggerSchema, UpdatePipelineTriggerSchema, TriggerPipelineSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestDiscussionSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetGroupMilestoneSchema, GetGroupMilestoneIssuesSchema, GetGroupMilestoneMergeRequestsSchema, GetGroupMilestoneBurndownEventsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, PipelineJobControlSchema, GetPipelineSchema, GetRunnerSchema, GetPipelineVariablesSchema, UpdatePipelineMetadataSchema, DeletePipelineSchema, PipelineReportSchema, WaitForPipelineSchema, WaitForPipelineJobSchema, PlayPipelineJobsSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetProtectedTagSchema, GetTimelineEventsSchema, GetUsersSchema, GetUserSchema, WhoAmISchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListBranchesSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupMilestonesSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListGroupMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListPipelinesSchema, ListPipelineSchedulesSchema, GetPipelineScheduleSchema, ListPipelineSchedulePipelinesSchema, CreatePipelineScheduleSchema, UpdatePipelineScheduleSchema, DeletePipelineScheduleSchema, PlayPipelineScheduleSchema, TakeOwnershipPipelineScheduleSchema, GetPipelineScheduleVariableSchema, CreatePipelineScheduleVariableSchema, UpdatePipelineScheduleVariableSchema, DeletePipelineScheduleVariableSchema, ListGroupMembersSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListProjectRunnersSchema, ListReleasesSchema, ListTagsSchema, ListProtectedTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, OrbitQuerySchema, OrbitSchemaSchema, OrbitStatusSchema, OrbitToolsSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, ListSnippetsSchema, GetSnippetSchema, CreateSnippetSchema, UpdateSnippetSchema, DeleteSnippetSchema, UnapproveMergeRequestSchema, RebaseMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWebhookSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListProjectVulnerabilitiesSchema, GetVulnerabilitySchema, DismissVulnerabilitySchema, ConfirmVulnerabilitySchema, } from "../schemas.js";
+import { ApproveMergeRequestSchema, BulkPublishDraftNotesSchema, CancelPipelineJobSchema, ErasePipelineJobSchema, CancelPipelineSchema, ConvertWorkItemTypeSchema, CreateBranchSchema, CreateDraftNoteSchema, CreateGroupSchema, CreateGroupWikiPageSchema, CreateIssueLinkSchema, CreateIssueNoteSchema, CreateIssueSchema, CreateIssueEmojiReactionSchema, CreateIssueNoteEmojiReactionSchema, ListIssueEmojiReactionsSchema, ListIssueNoteEmojiReactionsSchema, CreateLabelSchema, MarkAllTodosDoneSchema, ListTodosSchema, MarkTodoDoneSchema, CreateMergeRequestDiscussionNoteSchema, CreateMergeRequestEmojiReactionSchema, ListMergeRequestEmojiReactionsSchema, ListMergeRequestNoteEmojiReactionsSchema, CreateMergeRequestNoteSchema, CreateMergeRequestNoteEmojiReactionSchema, CreateMergeRequestSchema, CreateMergeRequestThreadSchema, CreateNoteSchema, CreateCommitStatusSchema, CreateOrUpdateFileSchema, CreatePipelineSchema, CreateProjectMilestoneSchema, CreateGroupMilestoneSchema, CreateReleaseEvidenceSchema, CreateReleaseSchema, CreateRepositorySchema, CreateTagSchema, CreateTimelineEventSchema, CreateWebhookSchema, CreateWikiPageSchema, CreateWorkItemNoteSchema, CreateWorkItemEmojiReactionSchema, CreateWorkItemNoteEmojiReactionSchema, ListWorkItemEmojiReactionsSchema, ListWorkItemNoteEmojiReactionsSchema, CreateWorkItemSchema, DeleteBranchSchema, GetProtectedBranchSchema, ListProtectedBranchesSchema, ProtectBranchSchema, UpdateProtectedBranchSchema, ProtectTagSchema, UnprotectBranchSchema, UnprotectTagSchema, UpdateDefaultBranchSchema, DeleteDraftNoteSchema, DeleteGroupMilestoneSchema, DeleteGroupWikiPageSchema, DeleteIssueLinkSchema, DeleteIssueSchema, DeleteIssueEmojiReactionSchema, DeleteIssueNoteEmojiReactionSchema, DeleteLabelSchema, DeleteMergeRequestDiscussionNoteSchema, DeleteMergeRequestNoteSchema, DeleteMergeRequestEmojiReactionSchema, DeleteMergeRequestNoteEmojiReactionSchema, DeleteProjectMilestoneSchema, DeleteReleaseSchema, DeleteTagSchema, DeleteWebhookSchema, DeleteWikiPageSchema, DeleteWorkItemEmojiReactionSchema, DeleteWorkItemNoteEmojiReactionSchema, DownloadAttachmentSchema, DownloadAttachmentRemoteSchema, DownloadJobArtifactsSchema, DownloadJobArtifactsRemoteSchema, DownloadReleaseAssetSchema, EditProjectMilestoneSchema, EditGroupMilestoneSchema, ExecuteGraphQLSchema, ForkRepositorySchema, HealthCheckSchema, GetBranchSchema, GetBranchDiffsSchema, GetCommitDiffSchema, GetCommitSchema, GetFileBlameSchema, GetDeploymentSchema, CreateDeploymentSchema, UpdateDeploymentSchema, DeploymentApprovalSchema, ListDeploymentMergeRequestsSchema, GetDraftNoteSchema, GetEnvironmentSchema, UpdateEnvironmentSchema, StopEnvironmentSchema, StopStaleEnvironmentsSchema, DeleteReviewAppEnvironmentsSchema, PipelineTriggerIdSchema, ListPipelineTriggersSchema, CreatePipelineTriggerSchema, UpdatePipelineTriggerSchema, TriggerPipelineSchema, GetFileContentsSchema, GetGroupWikiPageSchema, GetIssueLinkSchema, GetIssueSchema, GetJobArtifactFileSchema, GetLabelSchema, GetMergeRequestApprovalStateSchema, GetMergeRequestConflictsSchema, GetMergeRequestDiffsSchema, GetMergeRequestFileDiffSchema, GetMergeRequestDiscussionSchema, GetMergeRequestNoteSchema, GetMergeRequestNotesSchema, GetMergeRequestSchema, GetMergeRequestVersionSchema, GetMilestoneBurndownEventsSchema, GetMilestoneIssuesSchema, GetMilestoneMergeRequestsSchema, GetGroupMilestoneSchema, GetGroupMilestoneIssuesSchema, GetGroupMilestoneMergeRequestsSchema, GetGroupMilestoneBurndownEventsSchema, GetNamespaceSchema, GetPipelineJobOutputSchema, PipelineJobControlSchema, GetPipelineSchema, GetRunnerSchema, GetPipelineVariablesSchema, UpdatePipelineMetadataSchema, DeletePipelineSchema, PipelineReportSchema, WaitForPipelineSchema, WaitForPipelineJobSchema, PlayPipelineJobsSchema, GetProjectEventsSchema, GetProjectMilestoneSchema, GetProjectSchema, GetReleaseSchema, GetRepositoryTreeSchema, GetTagSchema, GetTagSignatureSchema, GetProtectedTagSchema, GetTimelineEventsSchema, GetUsersSchema, GetUserSchema, WhoAmISchema, GetWebhookEventSchema, GetWikiPageSchema, GetWorkItemSchema, ListBranchesSchema, ListCommitsSchema, ListCommitStatusesSchema, ListCustomFieldDefinitionsSchema, ListDeploymentsSchema, ListDraftNotesSchema, ListEnvironmentsSchema, ListEventsSchema, ListGroupIterationsSchema, ListGroupMilestonesSchema, ListGroupProjectsSchema, ListGroupWikiPagesSchema, ListIssueDiscussionsSchema, ListIssueLinksSchema, ListIssuesSchema, ListJobArtifactsSchema, ListLabelsSchema, ListMergeRequestChangedFilesSchema, ListMergeRequestDiffsSchema, ListMergeRequestDiscussionsSchema, ListMergeRequestPipelinesSchema, ListMergeRequestVersionsSchema, ListMergeRequestsSchema, ListGroupMergeRequestsSchema, ListNamespacesSchema, ListPipelineJobsSchema, ListPipelineTriggerJobsSchema, ValidateCiLintSchema, ValidateProjectCiLintSchema, ListCiCatalogResourcesSchema, GetCiCatalogResourceSchema, ListPipelinesSchema, ListPipelineSchedulesSchema, GetPipelineScheduleSchema, ListPipelineSchedulePipelinesSchema, CreatePipelineScheduleSchema, UpdatePipelineScheduleSchema, DeletePipelineScheduleSchema, PlayPipelineScheduleSchema, TakeOwnershipPipelineScheduleSchema, GetPipelineScheduleVariableSchema, CreatePipelineScheduleVariableSchema, UpdatePipelineScheduleVariableSchema, DeletePipelineScheduleVariableSchema, ListGroupMembersSchema, ListProjectMembersSchema, ListProjectMilestonesSchema, ListProjectsSchema, ListProjectRunnersSchema, ListReleasesSchema, ListTagsSchema, ListProtectedTagsSchema, ListWebhookEventsSchema, ListWebhooksSchema, ListWikiPagesSchema, ListWorkItemNotesSchema, ListWorkItemStatusesSchema, ListWorkItemsSchema, MarkdownUploadSchema, MarkdownUploadRemoteSchema, MergeMergeRequestSchema, MoveWorkItemSchema, MyIssuesSchema, OrbitQuerySchema, OrbitSchemaSchema, OrbitStatusSchema, OrbitToolsSchema, PlayPipelineJobSchema, PromoteProjectMilestoneSchema, PublishDraftNoteSchema, PushFilesSchema, ResolveMergeRequestThreadSchema, RetryPipelineJobSchema, RetryPipelineSchema, SearchCodeSchema, SearchGroupCodeSchema, SearchProjectCodeSchema, SearchRepositoriesSchema, ListSnippetsSchema, GetSnippetSchema, CreateSnippetSchema, UpdateSnippetSchema, DeleteSnippetSchema, UnapproveMergeRequestSchema, RebaseMergeRequestSchema, UpdateDraftNoteSchema, UpdateGroupWikiPageSchema, UpdateIssueNoteSchema, UpdateIssueSchema, UpdateIssueDescriptionPatchSchema, UpdateLabelSchema, UpdateProjectSchema, UpdateMergeRequestDiscussionNoteSchema, UpdateMergeRequestNoteSchema, UpdateMergeRequestSchema, UpdateReleaseSchema, UpdateWebhookSchema, UpdateWikiPageSchema, UpdateWorkItemSchema, VerifyNamespaceSchema, ListProjectVariablesSchema, GetProjectVariableSchema, CreateProjectVariableSchema, UpdateProjectVariableSchema, DeleteProjectVariableSchema, ListGroupVariablesSchema, GetGroupVariableSchema, CreateGroupVariableSchema, UpdateGroupVariableSchema, DeleteGroupVariableSchema, GetDependencyProxySettingsSchema, UpdateDependencyProxySettingsSchema, ListDependencyProxyBlobsSchema, PurgeDependencyProxyCacheSchema, ListProjectVulnerabilitiesSchema, GetVulnerabilitySchema, DismissVulnerabilitySchema, ConfirmVulnerabilitySchema, } from "../schemas.js";
 import { GitLabApiRequestSchema } from "./gitlab-api-request.js";
 const IS_REMOTE = SSE || STREAMABLE_HTTP;
 // Define all available tools
@@ -121,6 +121,11 @@ export const allTools = [
         description: "Protect a repository branch (set push/merge/unprotect access levels)",
         inputSchema: toJSONSchema(ProtectBranchSchema),
     },
+    {
+        name: "update_protected_branch",
+        description: "Update an existing protected branch rule in place (access levels, force push, code owner approval)",
+        inputSchema: toJSONSchema(UpdateProtectedBranchSchema),
+    },
     {
         name: "unprotect_branch",
         description: "Remove protection from a previously protected branch",
@@ -1621,6 +1626,9 @@ export const destructiveTools = new Set([
     "delete_branch",
     "unprotect_branch",
     "protect_branch",
+    // Can loosen protection (force push, wider access). Not in deleteTools: the rule stays,
+    // and modify mode needs an in-place update because unprotect_branch is blocked there.
+    "update_protected_branch",
     "unprotect_tag",
     "protect_tag",
     "update_default_branch",
@@ -1930,6 +1938,7 @@ export const TOOLSET_DEFINITIONS = [
             "list_protected_branches",
             "get_protected_branch",
             "protect_branch",
+            "update_protected_branch",
             "unprotect_branch",
             "update_default_branch",
             "list_commits",

package/build/tools/tool-descriptions.js

@@ -16,8 +16,9 @@ const TOOL_GUIDANCE = {
     fork_repository: "Use this to create a copy of an existing project in the current user's namespace or a permitted namespace; use `search_repositories` or `get_project` to inspect projects without copying them. The operation creates a new project, requires fork permission, and returns the forked project or a namespace/permission error.",
     create_branch: "Use this to create a branch from a branch, tag, or commit; use `get_branch` or `list_branches` to inspect branches and `protect_branch` to configure protection afterward. The operation changes remote repository state, requires branch-creation permission, and returns the new branch or a validation, missing-ref, protected-project, or already-exists error. `project_id` accepts a numeric ID or URL-encoded path, `branch` is the new name, and `ref` selects its starting revision.",
     delete_branch: "Use this only after confirming the branch name and intended data loss; use `get_branch` or `list_branches` before deletion and never use it to remove branch protection. The operation permanently removes a remote branch, requires branch-delete permission, and returns the deletion result or a protected-branch, missing-resource, or permission error.",
-    protect_branch: "Use this to create or update protection rules for a branch or wildcard; use `get_protected_branch` to inspect existing rules first. The operation changes who may push, merge, or unprotect, may enable force-push or code-owner settings, requires maintainer-level permission, and returns the protection rule or a validation/permission error.",
-    unprotect_branch: "Use this to remove protection from an existing branch; use `protect_branch` to change access levels without removing the rule. The operation changes repository security controls, requires permission to manage protected branches, and returns the result or an error when the branch is missing or policy forbids the change.",
+    protect_branch: "Use this to create a protection rule for a branch or wildcard that has none; it does not update an existing rule (GitLab returns 409 Conflict), so use `get_protected_branch` to check first and `update_protected_branch` to change a rule. The operation changes who may push, merge, or unprotect, may enable force-push or code-owner settings, requires maintainer-level permission, and returns the protection rule or a validation/permission/conflict error.",
+    update_protected_branch: "Use this to change an existing protection rule for a branch or wildcard in place, so the branch is never left unprotected; use `protect_branch` to create a rule and `get_protected_branch` to read the access level record `id`s first. In `allowed_to_push`, `allowed_to_merge`, and `allowed_to_unprotect`, add an entry with one of `access_level`, `user_id`, `group_id`, or `deploy_key_id` (push only); change a record with its `id` and the new value; remove one with `{id, _destroy: true}`. `member_role_id` (custom roles) is not supported; an entry with only that key is rejected. For example, `allowed_to_push: [{id: 12, access_level: 0}]` sets that push record to No access. GitLab documents `access_level`, `user_id`, and `group_id` entries and `code_owner_approval_required` as Premium/Ultimate, and `deploy_key_id` push entries as Free from 18.10; check the returned rule to see what was applied. A request whose `_destroy` entries would leave `allowed_to_unprotect` with no records is refused before the update (a best-effort check; concurrent changes between the read and the update are not detected); keep one or add a replacement in the same request. GitLab may reject the update when the caller is not allowed by the rule's current `allowed_to_unprotect` settings, even as a Maintainer; check current unprotect access with `get_protected_branch` first, especially before replacing an unprotect record. The operation changes repository security controls, requires maintainer-level permission, and returns the updated rule or a validation, missing-rule, or permission error.",
+    unprotect_branch: "Use this to remove protection from an existing branch; use `update_protected_branch` to change access levels or force push while keeping the rule. The operation changes repository security controls, requires permission to manage protected branches, and returns the result or an error when the branch is missing or policy forbids the change.",
     protect_tag: "Use this to protect a tag or wildcard such as `v*` so protected CI/CD variables reach tag pipelines; use `get_protected_tag` or `list_protected_tags` to inspect existing rules first. The operation changes who may create matching tags, requires maintainer-level permission, and returns the protection rule or a validation/permission error.",
     unprotect_tag: "Use this to remove protection from an existing tag or wildcard. To change the create access level, use `unprotect_tag` first, then `protect_tag`; `protect_tag` creates a rule and does not update an existing rule. This change is unavailable in `modify` mode because `unprotect_tag` is blocked there. The operation changes repository security controls, requires permission to manage protected tags, and returns the result or an error when the tag is missing or policy forbids the change.",
     update_default_branch: "Use this to change which branch GitLab treats as the project's default; use `create_branch` to create a branch rather than changing project defaults. The operation changes project settings and may affect clone, merge request, and CI defaults, requires project-maintainer permission, and returns the updated project or a validation/permission error.",

package/build/utils/url.js

@@ -102,19 +102,43 @@ function apiUrlProblem(url) {
  * them would fail every request and echo the password in the error.
  */
 export function parseConfiguredGitLabApiUrls(value) {
-    const entries = splitCommaSeparatedUrls(value).map(stripUrlUserinfo);
+    const rawEntries = splitCommaSeparatedUrls(value);
+    const entries = rawEntries.map(stripUrlUserinfo);
+    const urls = entries.map(entry => normalizeGitLabApiUrl(entry.url));
     return {
-        urls: entries.map(entry => normalizeGitLabApiUrl(entry.url)),
+        urls,
         hadUserinfo: entries.some(entry => entry.hadUserinfo),
+        hostnamesForLog: apiUrlHostnamesForLog(rawEntries, urls),
     };
 }
+const INVALID_HOSTNAME = "<invalid>";
 /**
- * The host name of a configured API URL, for the startup log. A password with a
- * literal comma can be split into two URLs, and "http://alice:12" then reads
+ * The host name of each configured API URL, for the startup log. `rawEntries`
+ * are the entries as split, before userinfo is dropped, and `urls` the URLs
+ * built from them. A password with literal commas can be split into several
+ * URLs: "http://alice:12,http://password:34,http://tail@host" gives
+ * "http://password:34", whose host is part of the password, and no single
+ * entry shows that. The password ends at an "@", so every entry before the last
+ * one with an "@" shows as "<invalid>", even when it is a whole URL of its own.
+ */
+function apiUrlHostnamesForLog(rawEntries, urls) {
+    let lastWithAt = -1;
+    rawEntries.forEach((entry, index) => {
+        if (entry.includes("@")) {
+            lastWithAt = index;
+        }
+    });
+    return urls.map((url, index) => index < lastWithAt ? INVALID_HOSTNAME : apiUrlHostnameForLog(url));
+}
+/**
+ * The host name of one configured API URL, for the startup log. A password with
+ * a literal comma can be split into two URLs, and "http://alice:12" then reads
  * the start of the password as a port, which text redaction keeps. The port,
  * userinfo, path, and query are left out. An IPv6 host keeps its brackets.
  * An "@" after the host means the host can be part of a password
  * ("http://sec/ret@host" from "alice:12,http://sec/ret@host"), so it is not shown.
+ * The host of a URL cut out of the middle of a password looks like any other
+ * host here, so the startup log uses the list from parseConfiguredGitLabApiUrls.
  */
 export function apiUrlHostnameForLog(url) {
     let parsed;
@@ -122,10 +146,10 @@ export function apiUrlHostnameForLog(url) {
         parsed = new URL(url);
     }
     catch {
-        return "<invalid>";
+        return INVALID_HOSTNAME;
     }
     const atAfterHost = parsed.pathname.includes("@") || parsed.search.includes("@") || parsed.hash.includes("@");
-    return parsed.hostname.length === 0 || atAfterHost ? "<invalid>" : parsed.hostname;
+    return parsed.hostname.length === 0 || atAfterHost ? INVALID_HOSTNAME : parsed.hostname;
 }
 const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.3.7-next.136",
+  "version": "2.3.7-next.138",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [