@zereight/mcp-gitlab 2.3.8-next.149 → 2.3.8

package/README.ko.md

@@ -252,7 +252,7 @@ command = lib.getExe inputs.gitlab-mcp.packages.${system}.default;
 
 예시는 기존 `mcp-gitlab`보다 충돌 가능성이 낮은 `zereight-mcp-gitlab` 별칭을 사용합니다. MCP 클라이언트가 찾지 못하면 `which zereight-mcp-gitlab`의 절대 경로를 사용하세요.
 
-전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.3.6`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. `main`에 머지된 수정을 다음 안정 버전 전에 확인하려면 프리릴리스 빌드인 `npx -y @zereight/mcp-gitlab@next`를 사용하세요(운영 환경용이 아닙니다). 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
+전역 설치를 쓰지 않으려면 `npx -y @zereight/mcp-gitlab@2.3.7`처럼 직전 안정 버전(문서가 권장하는 버전)으로 고정하세요. 항상 최신 버전을 원하면 `npx -y @zereight/mcp-gitlab@latest`를 사용하세요. `main`에 머지된 수정을 다음 안정 버전 전에 확인하려면 프리릴리스 빌드인 `npx -y @zereight/mcp-gitlab@next`를 사용하세요(운영 환경용이 아닙니다). 새 버전이 나오면 서버가 시작 시 stderr로 알려줍니다(`GITLAB_DISABLE_VERSION_CHECK=true`로 비활성화 가능).
 
 #### Claude Desktop 원클릭 설치(MCP Bundle)
 

package/README.md

@@ -258,7 +258,7 @@ The store path is pinned by your lock file; update it with `nix flake update git
 
 The examples use `zereight-mcp-gitlab`, a less collision-prone alias for the legacy `mcp-gitlab` binary. If your MCP client cannot find it, use the absolute path from `which zereight-mcp-gitlab`.
 
-No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.3.6`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. To try a fix merged to `main` before the next stable release, use `npx -y @zereight/mcp-gitlab@next`, a pre-release build that is not meant for production. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
+No global install? Pin `npx` to the previous stable release (the version these docs recommend), for example `npx -y @zereight/mcp-gitlab@2.3.7`. If you always want the newest release, use `npx -y @zereight/mcp-gitlab@latest` instead. To try a fix merged to `main` before the next stable release, use `npx -y @zereight/mcp-gitlab@next`, a pre-release build that is not meant for production. The server prints a notice to stderr on startup when a newer version is available (disable with `GITLAB_DISABLE_VERSION_CHECK=true`).
 
 #### Claude Desktop one-click install (MCP Bundle)
 

package/README.pt-BR.md

@@ -252,7 +252,7 @@ O caminho no store é fixado pelo seu lock file; atualize-o com `nix flake updat
 
 Os exemplos usam `zereight-mcp-gitlab`, um alias com menor chance de conflito que o binário legado `mcp-gitlab`. Se o seu cliente MCP não o encontrar, use o caminho absoluto retornado por `which zereight-mcp-gitlab`.
 
-Não quer instalar globalmente? Fixe o `npx` na versão estável anterior (a versão recomendada por esta documentação), por exemplo `npx -y @zereight/mcp-gitlab@2.3.6`. Se quiser sempre a versão mais recente, use `npx -y @zereight/mcp-gitlab@latest`. Para testar uma correção já mesclada na `main` antes da próxima versão estável, use `npx -y @zereight/mcp-gitlab@next`, um build de pré-lançamento que não é indicado para produção. O servidor exibe um aviso no stderr durante a inicialização quando existe uma versão mais nova disponível (desative com `GITLAB_DISABLE_VERSION_CHECK=true`).
+Não quer instalar globalmente? Fixe o `npx` na versão estável anterior (a versão recomendada por esta documentação), por exemplo `npx -y @zereight/mcp-gitlab@2.3.7`. Se quiser sempre a versão mais recente, use `npx -y @zereight/mcp-gitlab@latest`. Para testar uma correção já mesclada na `main` antes da próxima versão estável, use `npx -y @zereight/mcp-gitlab@next`, um build de pré-lançamento que não é indicado para produção. O servidor exibe um aviso no stderr durante a inicialização quando existe uma versão mais nova disponível (desative com `GITLAB_DISABLE_VERSION_CHECK=true`).
 
 #### Instalação com um clique no Claude Desktop (MCP Bundle)
 

package/README.zh-CN.md

@@ -252,7 +252,7 @@ command = lib.getExe inputs.gitlab-mcp.packages.${system}.default;
 
 示例使用 `zereight-mcp-gitlab`，这是比旧的 `mcp-gitlab` 更不容易冲突的别名。如果 MCP 客户端找不到它，请使用 `which zereight-mcp-gitlab` 输出的绝对路径。
 
-如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.3.6`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。如需在下一个稳定版本发布前试用已合并到 `main` 的修复，请使用 `npx -y @zereight/mcp-gitlab@next`（预发布版本，不适用于生产环境）。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
+如果不想全局安装，请将 `npx` 固定到上一个稳定版本（即文档推荐的版本），例如 `npx -y @zereight/mcp-gitlab@2.3.7`。如果始终想使用最新版本，请改用 `npx -y @zereight/mcp-gitlab@latest`。如需在下一个稳定版本发布前试用已合并到 `main` 的修复，请使用 `npx -y @zereight/mcp-gitlab@next`（预发布版本，不适用于生产环境）。有新版本发布时，服务器会在启动时通过 stderr 提示（可用 `GITLAB_DISABLE_VERSION_CHECK=true` 关闭）。
 
 #### Claude Desktop 一键安装（MCP Bundle）
 

package/build/downloads/proxy.js

@@ -11,6 +11,18 @@ function canonicalizeQueryParams(params) {
     }
     return JSON.stringify(normalized);
 }
+/**
+ * Check the requested project against the env allowlist (getEffectiveProjectId) and
+ * against the allowlist sealed into the download token, since the proxy runs
+ * outside the session that issued it.
+ */
+function resolveDownloadProjectId(deps, projectId, sealedProjectIds) {
+    const effectiveProjectId = deps.getEffectiveProjectId(decodeURIComponent(projectId));
+    if (sealedProjectIds.length > 0 && !sealedProjectIds.includes(effectiveProjectId)) {
+        throw new Error(`Access denied: Project ${effectiveProjectId} is outside the project scope of this download token`);
+    }
+    return effectiveProjectId;
+}
 /**
  * Register the /downloads/:type proxy endpoint on an Express app.
  * Streams GitLab API responses directly to the client. Auth is read from
@@ -46,6 +58,7 @@ export function registerDownloadProxy(app, deps) {
         // Try embedded encrypted token first (self-contained URL), then headers
         const encryptedToken = req.query._token;
         let tokenApiUrl;
+        let sealedProjectIds = [];
         if (encryptedToken) {
             const decrypted = decryptDownloadToken(encryptedToken);
             if (!decrypted) {
@@ -70,6 +83,7 @@ export function registerDownloadProxy(app, deps) {
             headers[decrypted.header] = decrypted.token;
             rateLimitKey = decrypted.token;
             tokenApiUrl = decrypted.apiUrl;
+            sealedProjectIds = decrypted.allowedProjectIds;
         }
         else {
             const privateToken = req.headers["private-token"];
@@ -119,7 +133,7 @@ export function registerDownloadProxy(app, deps) {
                         res.status(400).json({ error: "project_id and job_id are required" });
                         return;
                     }
-                    const effectiveProjectId = deps.getEffectiveProjectId(decodeURIComponent(project_id));
+                    const effectiveProjectId = resolveDownloadProjectId(deps, project_id, sealedProjectIds);
                     gitlabUrl = `${apiUrl}/projects/${deps.encodeGitLabPathSegment(effectiveProjectId)}/jobs/${deps.encodeGitLabPathSegment(job_id)}/artifacts`;
                     break;
                 }
@@ -129,7 +143,7 @@ export function registerDownloadProxy(app, deps) {
                         res.status(400).json({ error: "project_id, secret, and filename are required" });
                         return;
                     }
-                    const effectiveProjectId = deps.getEffectiveProjectId(decodeURIComponent(project_id));
+                    const effectiveProjectId = resolveDownloadProjectId(deps, project_id, sealedProjectIds);
                     // The uploads route takes one filename segment; a slash inside the name must
                     // stay inside that segment instead of turning into another route level.
                     gitlabUrl = `${apiUrl}/projects/${deps.encodeGitLabPathSegment(effectiveProjectId)}/uploads/${deps.encodeGitLabPathSegment(secret)}/${deps.encodeGitLabPathSegment(filename)}`;
@@ -143,7 +157,7 @@ export function registerDownloadProxy(app, deps) {
                             .json({ error: "project_id, tag_name, and direct_asset_path are required" });
                         return;
                     }
-                    const effectiveProjectId = deps.getEffectiveProjectId(decodeURIComponent(project_id));
+                    const effectiveProjectId = resolveDownloadProjectId(deps, project_id, sealedProjectIds);
                     gitlabUrl = `${apiUrl}/projects/${deps.encodeGitLabPathSegment(effectiveProjectId)}/releases/${deps.encodeGitLabPathSegment(tag_name)}/downloads/${deps.encodeGitLabPath(direct_asset_path)}`;
                     break;
                 }

package/build/index.js

@@ -8,25 +8,32 @@ const STREAMABLE_HTTP_AUTH_TOKEN = getConfig("streamable-http-auth-token", "STRE
  * Build a URL pointing to the download proxy endpoint.
  * Embeds an encrypted auth token (and API URL for dynamic routing)
  * from the current session so the URL works standalone.
+ * @throws {ProjectAccessDeniedError} If the project is outside the effective allowlist
  */
-function buildDownloadUrl(type, params) {
+function buildDownloadUrl(type, projectId, params) {
+    // Decoded once, like the /downloads proxy does, so both check the same value
+    const resourceParams = {
+        ...params,
+        project_id: getEffectiveProjectId(decodeURIComponent(projectId)),
+    };
     const base = MCP_SERVER_URL || sessionAuthStore.getStore()?.publicBaseUrl || `http://${HOST}:${PORT}`;
     const baseUrl = new URL(base);
     // Preserve any path prefix (e.g. /gitlab-mcp) from the base URL
     const basePath = baseUrl.pathname.replace(/\/+$/, "");
     const safeBasePath = basePath ? `/${basePath.replace(/^\/+/, "")}` : "";
     const url = new URL(`${safeBasePath}/downloads/${type}`, baseUrl.origin);
-    for (const [key, value] of Object.entries(params)) {
+    for (const [key, value] of Object.entries(resourceParams)) {
         url.searchParams.set(key, value);
     }
     // Embed auth (and apiUrl when dynamic routing is active) from current session or static config
     // Token is bound to the specific resource (type + params) to prevent URL tampering
-    const resource = { type, params };
+    const resource = { type, params: resourceParams };
+    const allowedProjectIds = getEffectiveAllowedProjectIds();
     const ctx = sessionAuthStore.getStore();
     if (ctx?.token) {
         const headerValue = ctx.header === "Authorization" ? `Bearer ${ctx.token}` : ctx.token;
         const apiUrl = ENABLE_DYNAMIC_API_URL && ctx.apiUrl !== GITLAB_API_URL ? ctx.apiUrl : undefined;
-        url.searchParams.set("_token", createDownloadToken(ctx.header, headerValue, apiUrl, resource));
+        url.searchParams.set("_token", createDownloadToken(ctx.header, headerValue, allowedProjectIds, apiUrl, resource));
     }
     else {
         // Fallback for SSE/static-token mode (no session auth context)
@@ -48,7 +55,7 @@ function buildDownloadUrl(type, params) {
                 header = "Authorization";
                 headerValue = `Bearer ${staticToken}`;
             }
-            url.searchParams.set("_token", createDownloadToken(header, headerValue, undefined, resource));
+            url.searchParams.set("_token", createDownloadToken(header, headerValue, allowedProjectIds, undefined, resource));
         }
     }
     return url.toString();
@@ -10095,7 +10102,7 @@ async function handleToolCall(params) {
                     if (local_path) {
                         throw new Error("local_path cannot be used in remote mode — use the returned download_url instead");
                     }
-                    const downloadUrl = buildDownloadUrl("job-artifacts", { project_id, job_id });
+                    const downloadUrl = buildDownloadUrl("job-artifacts", project_id, { job_id });
                     return {
                         content: [
                             {
@@ -10614,8 +10621,7 @@ async function handleToolCall(params) {
                 // In remote mode for non-image files, return proxy URL
                 const mimeType = getImageMimeType(args.filename);
                 if (IS_REMOTE && !mimeType) {
-                    const downloadUrl = buildDownloadUrl("attachment", {
-                        project_id: args.project_id,
+                    const downloadUrl = buildDownloadUrl("attachment", args.project_id, {
                         secret: args.secret,
                         filename: args.filename,
                     });
@@ -10753,8 +10759,7 @@ async function handleToolCall(params) {
             case "download_release_asset": {
                 const args = DownloadReleaseAssetSchema.parse(params.arguments);
                 if (IS_REMOTE) {
-                    const downloadUrl = buildDownloadUrl("release-asset", {
-                        project_id: args.project_id,
+                    const downloadUrl = buildDownloadUrl("release-asset", args.project_id, {
                         tag_name: args.tag_name,
                         direct_asset_path: args.direct_asset_path,
                     });

package/build/utils/download-token.js

@@ -21,14 +21,17 @@ const DOWNLOAD_TOKEN_TTL = Number.isFinite(parsedDownloadTokenTtl) && parsedDown
     : DEFAULT_DOWNLOAD_TOKEN_TTL;
 /**
  * Create a self-contained encrypted download token for a specific GitLab resource.
+ * `allowedProjectIds` is the project allowlist of the issuing request (session scope
+ * or GITLAB_ALLOWED_PROJECT_IDS), because the download proxy runs outside that request.
  */
-export function createDownloadToken(header, token, apiUrl, resource) {
+export function createDownloadToken(header, token, allowedProjectIds, apiUrl, resource) {
     const iv = randomBytes(12);
     const cipher = createCipheriv("aes-256-gcm", DOWNLOAD_TOKEN_KEY, iv);
     const payload = JSON.stringify({
         h: header,
         t: token,
         e: Math.floor(Date.now() / 1000) + DOWNLOAD_TOKEN_TTL,
+        s: allowedProjectIds,
         ...(apiUrl ? { u: apiUrl } : {}),
         ...(resource ? { r: resource.type, p: resource.params } : {}),
     });
@@ -36,8 +39,13 @@ export function createDownloadToken(header, token, apiUrl, resource) {
     const tag = cipher.getAuthTag();
     return Buffer.concat([iv, tag, encrypted]).toString("base64url");
 }
+function isStringArray(value) {
+    return Array.isArray(value) && value.every(item => typeof item === "string");
+}
 /**
  * Decrypt and validate a download token, returning null when it is invalid or expired.
+ * A token without a sealed project allowlist was issued by an older release, which
+ * did not check the session scope, so it is invalid too.
  */
 export function decryptDownloadToken(tokenStr) {
     try {
@@ -58,9 +66,12 @@ export function decryptDownloadToken(tokenStr) {
             return null;
         if (typeof payload.t !== "string" || payload.t.length === 0)
             return null;
+        if (!isStringArray(payload.s))
+            return null;
         return {
             header: payload.h,
             token: payload.t,
+            allowedProjectIds: payload.s,
             ...(payload.u ? { apiUrl: payload.u } : {}),
             ...(payload.r ? { resourceType: payload.r, resourceParams: payload.p } : {}),
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.3.8-next.149",
+  "version": "2.3.8",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [