zereight/gitlab-mcp v2.3.10

on GitHub

Changes in v2.3.10

🔒 Security

• GHSA-2p72-j379-vmm3 — two fixes:
  • Session owner binding with REMOTE_AUTHORIZATION=true: a stateful session now belongs to the GitLab user whose token opened it (or, for an unauthenticated tool-discovery session, the first user who authenticates on it). A request with another user's Private-Token, JOB-TOKEN, or Authorization token gets 404 Session not found and can no longer replace the session's stored token. GET / DELETE /mcp for such a session now need a token of its user (401 without one). A new token of the same user, including a CI job token of one of the user's jobs, still works.
  • download_job_artifacts confined to GITLAB_DOWNLOAD_DIR: in stdio mode artifacts_job_<id>.zip is now saved under GITLAB_DOWNLOAD_DIR (default .gitlab-mcp-downloads) instead of the working directory, local_path is relative to that directory, an existing file is no longer overwritten, and an interrupted download leaves no partial file — matching download_attachment.
• Header-authenticated /downloads/* project scope: with REMOTE_AUTHORIZATION=true and ENABLE_DYNAMIC_PROJECT_SCOPE=true, a /downloads/* request authenticated by Private-Token, JOB-TOKEN, or Authorization (instead of a download token) ignored its own X-GitLab-Allowed-Project-Ids header. It is now enforced like on /mcp: an empty value or one naming a project outside GITLAB_ALLOWED_PROJECT_IDS → 401, a project outside the header scope → 403. Without the header, only GITLAB_ALLOWED_PROJECT_IDS applies.

Upgrade to v2.3.10 if you run the server in remote mode (REMOTE_AUTHORIZATION=true) or use download_job_artifacts.

⚠️ Breaking changes

• download_job_artifacts (stdio) writes to GITLAB_DOWNLOAD_DIR instead of the working directory and refuses to replace an existing archive.

🐛 Bug Fixes

• fix: bind remote-auth sessions to their user and enforce download scope #923

Contributors

• @zereight (1 PR: #923)

⚠️ Deprecation notice

Deprecated configuration options (e.g. GITLAB_READ_ONLY_MODE, USE_GITLAB_WIKI, and other legacy flags) still work during the grace period, but they will be removed in v3.0.0. Please migrate to the replacements described in the pinned issue #815.