9.0.2 (2026-06-07)
9.0.1 (2026-06-07)
- db: add repository field for npm provenance (#507) (bc52381), closes #506
- release: resolve workspace: deps before publishing db to npm (#512) (946652b)
9.0.0 (2026-06-07)
- OAuth deployments must rename GITLAB_OAUTH_CLIENT_ID, GITLAB_OAUTH_CLIENT_SECRET, and GITLAB_OAUTH_SCOPES to their OAUTH_ equivalents.
- pipelines: the manage_pipeline_job tool is removed. Callers must use manage_pipeline with the play_job / retry_job / cancel_job actions instead of manage_pipeline_job with play / retry / cancel.
- mrs: Individual MR tools replaced with action-based CQRS tools
- files: Replace 5 individual file tools with 2 CQRS-aligned tools
- Major architectural improvements and feature additions
- access-tokens: expose personal/project/group token management (#478) (509bc03)
- audit-events: expose instance/group/project audit events (#480) (50b951c), closes #439
- availability: extend tier matrix with per-parameter gating (#150) (1ae98c8)
- availability: use WidgetAvailability for version-based widget validation (#140) (66e0215)
- Bump version to 5.0.0 (9f85a7b)
- ci: add CI/CD job token scope and allowlist management (#452) (f61c308)
- cli: add --env-gates flag to list-tools for USE_* documentation (#59) (579c682), closes #53
- cli: add install and docker subcommands (#122) (36d38d0)
- cli: add interactive setup wizard (gitlab-mcp init) (#101) (cb6f080)
- cli: add profile/preset inspection flags to list-tools (#64) (70f7994)
- cli: add unified setup wizard consolidating init/install/docker flows (#132) (ae5d009)
- comprehensive project cleanup and test verification (5815eb8)
- config: GITLAB_CROSS_REFS toggle for Related description hints (#174) (871dc6c)
- connection: add TTL/LRU eviction to ConnectionManager instance cache (#404) (229c92c)
- container-registry: expose Container Registry via GraphQL (#476) (5acd068)
- context: add manage_context CQRS tool for runtime session management (#96) (5108186)
- context: add whoami action for token introspection (#203) (#205) (fc0c568)
- context: probe admin mode elevation and expose in whoami (#459) (5c163d6)
- core: add todos data lifecycle tests and address Copilot review feedback (b909916)
- core: add todos tools and CQRS consolidation (#4, #16) (0abbf3b)
- core: add todos tools and CQRS consolidation (#4, #16) (d6fc3ee)
- dashboard: add instance health dashboard on GET / endpoint (#286) (de47c40)
- deploy-keys: expose deploy keys under a CI access umbrella flag (#453) (d44f419)
- deps: upgrade Zod from v3 to v4 with native JSON Schema generation (e605eef)
- descriptions: intent-first tool descriptions with dynamic Related resolution (#172) (065e53b), closes #169
- discovery: add auto-discovery from git remote (#67) (dba44ff)
- docs: add --export flag to list-tools for TOOLS.md generation (#51) (25f5393)
- docs: add "Report a Bug" feedback widget to documentation site (#148) (00ff2ed)
- docs: add Google Analytics tracking to VitePress documentation (#216) (675ea12), closes #214
- docs: add JSON-LD structured data for SEO (#306) (07e6261)
- docs: add sponsor heart icon and donate page (#161) (e0d68bd), closes #160
- docs: consent banner + vue-privacy 1.2.2 with gtag fix (#255) (75eb54b)
- docs: migrate domain, add branding assets, remove dead code (#156) (ce8f18f), closes #145
- docs: upgrade vue-privacy with GA4 tracking + dependency updates (#284) (9d43ae6)
- docs: use versioned MCPB download links with VERSION placeholder (#200) (68b284f)
- enhance pipeline job output handling and improve test coverage (86be293)
- enhance test infrastructure and fix code quality issues (95b3529)
- environments: expose Environments and Deployments (#463) (5668b61)
- errors: add structured error handling with tier awareness (#75) (2b5088c)
- establish v5.0.0 baseline for semantic versioning (f5ac7a5)
- fetch: add Node.js v24 compatibility with Undici dispatcher pattern (da74392)
- fetch: add retry logic for idempotent API operations (#120) (bc6d1ac)
- files: add overwrite parameter to manage_files for auto create/update (#327) (ad7d525)
- files: CQRS consolidation - 5 tools to 2 tools (b29c0c8), closes #12
- fix double URL encoding issue and improve pipeline API compliance (dc886d9)
- health: add XState connection health monitor with per-URL state (#387) (3d09be9)
- health: detect token revocation via authenticated health checks (#409) (5a74f2d)
- iid: add IID support for work items and milestones (#102) (513e9ce)
- implement comprehensive GitLab MCP enhancements v4.4.0 (60fd9d8)
- integrations: Add project integrations management entity (#38) (7e68150)
- labels: consolidate 5 label tools into 2 CQRS tools (c54243f)
- labels: consolidate 5 label tools into 2 CQRS tools (fc18e60), closes #8
- logging: add LOG_FILTER for access log noise reduction (#295) (d0c3d0d)
- logging: add LOG_FORMAT env var and improve session ID truncation (#215) (df655f2)
- logging: Implement condensed access log format with request stack aggregation (#196) (8871fad)
- logging: structured request context and rate limit debugging (#124) (e4b212d)
- MCP Registry integration with dynamic tool counts and MCPB toggles (#192) (9ba94e2)
- mcp: MCP Ecosystem Compatibility - Graceful Startup, Static Manifest, and Release Pipeline Improvements (#212) (2ecb70d)
- members: add members management entity with CQRS tools (#89) (aa0924d)
- milestones: consolidate 9 milestone tools into 2 CQRS tools (7fa5c79)
- milestones: consolidate 9 milestone tools into 2 CQRS tools (2d054dd)
- move test_mcp.sh to scripts directory and update documentation (71a24d5)
- mrs: add file exclusion patterns for MR diffs (#270) (39d6dd0)
- mrs: add MR approval and discussion management actions (#86) (8e719ff)
- mrs: add MR versions support (list and get diff versions) (#271) (12424fe)
- mrs: consolidate 20 MR tools into 5 CQRS tools (#15) (f41a505)
- mrs: consolidate 20 MR tools into 5 CQRS tools (#15) (ec06fae)
- mrs: implement GitLab Suggestions API integration (#70) (b9ca090), closes #66
- multi-instance: Multi-Instance OAuth Federation with per-session introspection (#277) (1fc0a8f)
- namespaces: add restore action to manage_namespace (#468) (2f19625)
- oauth: add OAuth 2.1 authentication with GitLab Device Flow (3d6d34d)
- pipelines: add inputs parameter for typed pipeline inputs (GitLab 15.5+) (#273) (2c2d31c)
- pipelines: fold manage_pipeline_job into manage_pipeline (#485) (ed53eea)
- profiles: add 7 role-based presets (#63) (5f05913)
- profiles: add configuration profiles infrastructure (#60) (171b625)
- profiles: add project-level configuration support (#65) (94e8e99)
- profiles: add six domain feature flags and a security profile (#457) (9fcc007)
- projects: add restore action to manage_project (#464) (bb8b7bf)
- projects: filter browse_projects by marked_for_deletion_on (#465) (f8e8689)
- projects: list soft-deleted projects with include_deleted (#460) (c206cb1)
- projects: support 'active' filter on browse_projects list (#472) (545c777)
- refs: add refs management entity with CQRS tools (#88) (852cccc)
- registry: declare tool requirements via InstanceCapabilities layer (#449) (7e6484e)
- releases: add releases management entity with CQRS tools (#87) (a38ad60)
- runners: expose CI runner management via GraphQL (#477) (a9aefc3)
- schema: add auto-detection schema mode from clientInfo (#52) (9ec6368)
- schema: add dynamic action filtering with schema transformation pipeline (#44) (10069c9)
- schemas: add paginationFields() utility for dynamic pagination descriptions (#118) (963b08e)
- search: add global search entity with CQRS browse_search tool (#93) (90aecdc)
- security: add rate limiting middleware for anonymous requests (234a412), closes #6
- server: add /health endpoint for load balancer health checks (#289) (5f4f00c)
- server: add TLS/HTTPS support with reverse proxy configuration (4203e17)
- session: proactive re-pin of session URL after switch_profile (#427) (6965d09)
- snippets: Add snippets management entity with consolidated tools (#39) (6ebbbe1)
- test: improve unit test coverage and pipeline job output limits (cf5dd75)
- tests: improve unit test coverage from 88.48% to 90.34% (62d0f5b)
- tiers: add action-level tier requirements for consolidated tools (#77) (8e5ae0e)
- Token scope detection at startup with graceful degradation (#190) (28bab03)
- tools: consolidate legacy tool names into CQRS pattern (#149) (#166) (82718ab)
- ux: graceful startup without credentials + docs clarity (#180) (6f77771)
- variables: consolidate 5 CI/CD variable tools into 2 CQRS tools (#43) (4b6b82a)
- variables: enhance error handling and improve masking documentation (e39dc51)
- vulnerabilities: expose Vulnerability Management via GraphQL (#481) (cebd310)
- webhooks: Add webhooks management entity with action-based CRUD (#35) (2b7761d)
- wiki: consolidate 5 wiki tools into 2 CQRS tools (578be93)
- wiki: consolidate 5 wiki tools into 2 CQRS tools (9185496), closes #10
- workitems: add timelog deletion support via delete_timelog action (#312) (52172ea)
- workitems: add verification status and test reports for requirements (#325) (0dcfd59)
- workitems: consolidate 5 work item tools into 2 CQRS tools (5ea300b)
- workitems: consolidate 5 work item tools into 2 CQRS tools (#11) (cd12ffc)
- workitems: extend manage_work_item with date, time tracking, and tier-specific widgets (#163) (d63a757)
- workitems: include time tracking in browse_work_items (#241) (1886a7f)
- workitems: support linkType/targetId in update action (#233) (a336638)
- address additional Copilot review comments (8759662)
- address Copilot review comments and lockfile bin path (ca376c1)
- auth: use PRIVATE-TOKEN header for PAT authentication instead of Bearer (#189) (7799dde)
- build: include prisma generate in build script for Docker compatibility (3a094be)
- ci: add Prisma client generation to ci-cd workflow (7f11e80)
- ci: add Prisma dependencies and generate step to workflows (76e2233)
- ci: configure git credentials for semantic-release tag upload (#298) (6563291), closes #297
- ci: exclude dismissed CodeQL alerts from thread blocking (#279) (19a97ce)
- ci: handle null values from jq in coverage report formatting (5621352)
- ci: prevent transitive skip propagation in release pipeline (#266) (f809a7a)
- ci: remove deleted worker deploy job (#227) (f33f3ba), closes #226
- ci: remove duplicate Authorization header, add token scope (#300) (4032584), closes #299
- ci: remove generated artifacts from repo, fix MCPB 404 race condition (#181) (#182) (6f17c99)
- ci: replace heredoc with quoted strings in thread-gate job (#246) (9470b50), closes #245
- ci: unblock release pipeline on push to main (#264) (59b8cbe), closes #263
- ci: use GitHub App token for semantic-release (2fd91fc)
- ci: use GitHub App token for semantic-release to bypass branch protection (c8a6e1a)
- ci: use JSON summary for coverage report percentages (c558cc0)
- ci: use JSON summary for coverage report percentages (07f05ca)
- cli: add input validation and security hardening (#128) (1e6f28c)
- conditionally append % to coverage metrics, avoiding N/A% (b984c75)
- core: address PR review feedback from Copilot (b664354)
- core: clarify verify_namespace tool description for agentic usage (2871398)
- deps: add prisma generate to postinstall script (1c41931)
- deps: make postinstall conditional for Docker compatibility (185a9a3)
- deps: resolve esbuild CORS vulnerability (GHSA-67mh-4wv8-2f99) (#152) (b1e0c3a), closes #151
- deps: update hono from 4.11.5 to 4.11.7 (#248) (71cc831), closes #247
- detect and kill zombie connections where response write stalls (#392) (9ee114b)
- docker: copy prisma schema to builder stage (42200fd)
- docs: add Codecov badge and always generate VitePress report (#168) (2e5e004), closes #167
- docs: add GA4 consent mode to enable analytics tracking (#230) (aac2fa5), closes #229
- docs: deploy bug report API as CF Worker + improve widget & layout (#154) (e8284bc)
- docs: inline constants removed with dead code cleanup (#158) (c93585f), closes #157
- docs: migrate domain from docs.gitlab-mcp to gitlab-mcp.sw.foundation (#155) (42ebef3)
- docs: move generated API reference to /tools/ directory (#304) (2b262b3), closes #303
- docs: redirect edit links for generated .md files to .md.in templates (#218) (2889e23), closes #217
- docs: rename gtag.d.ts to gtag.ts for Vite compatibility (#287) (b3e980e), closes #285
- docs: reorder MCPB download before VitePress build (#176) (b4c1205)
- docs: replace hardcoded 'latest' MCPB link with versioned URL in README (#206) (a0266a4), closes #204
- docs: replace Structured World with sw.foundation (#308) (eef1e8d), closes #307
- docs: resolve SEO issues in VitePress documentation (#249) (#250) (3e05717)
- docs: track SPA navigation in Google Analytics (#221) (252f0be)
- docs: use canonical URL for TOOLS reference in README (#252) (5ac56cc), closes #251
- docs: use raw HTML for MCPB download link to prevent VitePress .html suffix (#186) (fffe90b), closes #185
- exempt stdio session from idle timeout cleanup (#363) (ca563bd)
- fetch: proper timeout architecture and connection pool tuning (#314) (4977828)
- files: correct get_file_contents API endpoint and response handling (62fb9f8)
- files: make batch file content required per API spec (7a0ff07)
- handlers: handle 204 No Content responses and FormData uploads (8ecc3ef)
- logging: Access logs output single-line format with LOG_JSON mode (#208) (499854d)
- logging: Apply LOG_JSON pattern to all logger calls (#211) (168783a)
- mcpb: preserve yaml/dist/doc and install required peer deps (#202) (a96d258), closes #201
- mcpb: reduce bundle size from 84MB to ~45MB (#184) (37f9c29)
- milestones: simplify schema to use single milestone_id field (#121) (00f93d2)
- mrs: add default per_page=20 to browse_mr_discussions (#98) (4819a8c), closes #97
- mrs: address PR #23 review comments and increase coverage (0e6410b)
- mrs: address PR review comments from Copilot (#23) (1905ac4)
- mrs: Pre-check mergeability before calling merge API to avoid 405 errors (#198) (aa9bb83)
- mrs: use bracket notation for position in form-encoded requests (#95) (02b9ae7)
- mrs: use global API endpoints for code change proposals (#116) (891b5b1), closes #115
- pipelines: add proper validation for required ID fields (bd8f431)
- pipelines: position-aware log truncation and pagination metadata (#310) (e3dc1db)
- pipelines: serialize array query params as key[] for GitLab Rails API (#262) (955a3c1)
- rehydrate SchemaIntrospector widget cache on introspection cache hit (#393) (60de37b), closes #374
- restore STDIO transport mode and use yarn for prisma (0fadedf)
- security: add CodeQL suppression for rate limiting false positives (a1be5c4)
- security: change default HOST from 0.0.0.0 to 127.0.0.1 (#336) (039c369), closes #333
- server: TCP keepalive and stale connection detection (#316) (2b2b183)
- server: validate session ID in StreamableHTTP transport (#318) (2262fb8)
- tests: add todos to TestDataState and remove unused import (f170a95)
- tests: make Todos tests resilient to GitLab API variations (c51f997)
- tests: update integration tests to use CQRS tool names (32b88fb)
- transport: add SSE keepalive and configure HTTP server timeouts for proxy chain (#147) (382490b), closes #139
- transport: single Server instance causes response routing to wrong clients (#141) (86f5317)
- types: resolve TypeScript errors in server-launcher.ts (c06a097)
- utils: use nullish coalescing for requiredId helper (9a7c395)
- workitems: align linkType enum to GitLab API values (#178) (3b4ba6e)
- workitems: normalize legacy GIDs and improve ID field descriptions (#92) (54db7de)
- workitems: remove unused 'active' parameter from work items schema (99a91f3)
- workitems: update comment to reflect CQRS tool name (f9dc19b)
- workitems: use two-step approach for timeEstimate on create (#195) (98abf4e)
- api: add unified GitLab REST API client and fix lint errors (711db20), closes #17
- api: add unified GitLab REST API client and OAuth storage backends (1e23bdd)
- core: convert remaining discriminated unions to flat schemas (32efcdc)
- entities: standardize namespace parameter naming across all tools (d1eb0fd)
- entities: thread request-context instanceUrl through handler call sites (#482) (283e56b), closes #397
- files: remove unnecessary Uint8Array wrapper (322bc4b)
- nx monorepo with optional gitlab-mcp-db package (#493) (b18085d)
- pipelines: consolidate 12 tools into 3 CQRS tools (ce66319)
- pipelines: consolidate 12 tools into 3 CQRS tools (85de70f), closes #14
- read-only: move read-only actions from manage_* to browse_* tools (#142) (0c325e2), closes #134
- registry: fail-close on unexpected errors in loadInstanceContext/getFilterStats (#399) (70a5fea)
- registry: split getAllToolDefinitions into catalog vs discovery APIs (#401) (b084a81), closes #377
- schemas: convert CQRS schemas from discriminated unions to flat schemas (e889bcc)
- schemas: convert CQRS schemas from discriminated unions to flat schemas (f934cfd), closes #29
- schemas: replace z.coerce.string() with requiredId for all required ID fields (393a7c8)
- schemas: replace z.coerce.string() with requiredId for all required ID fields (3461cfb)
- session: per-session instance URL tracking for session-aware ListTools (#406) (5f8b9cf)
- thread instanceUrl and key caches by URL (#396) (1ec52aa)
- use undici.fetch() instead of native fetch() for dispatcher compatibility (#390) (76d1d09)
- workitems: improve list_work_items tool description for agent guidance (d9cf052)
- remove custom CodeQL workflow due to SARIF upload conflict (aa47e12)