diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 000000000..3d984eeed --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,60 @@ +name: Bug report +description: Report a defect in the MCP server. +title: "[Bug]: " +body: + - type: markdown + attributes: + value: | + Do not report a security vulnerability here. + Use GitHub private vulnerability reporting instead. + https://github.com/zereight/gitlab-mcp/security/advisories/new + - type: input + id: version + attributes: + label: Version + description: Installed package version, for example 2.x.y. + placeholder: "2.x.y" + validations: + required: true + - type: input + id: client + attributes: + label: MCP client + description: Client name and version, such as Claude Code, Cursor, or VS Code. + placeholder: "Cursor 1.x" + validations: + required: true + - type: dropdown + id: transport + attributes: + label: Transport + description: How the client connects to this server. + options: + - stdio + - SSE + - Streamable HTTP + validations: + required: true + - type: textarea + id: gitlab + attributes: + label: GitLab + description: gitlab.com or self-managed, and the GitLab version if you know it. + placeholder: "gitlab.com, 17.x" + validations: + required: true + - type: textarea + id: repro + attributes: + label: Steps to reproduce + description: What you ran, what you expected, and what happened. + validations: + required: true + - type: textarea + id: logs + attributes: + label: Logs + description: Paste relevant logs. Remove tokens, passwords, cookies, and Authorization headers first. Replace a personal access token (glpat-) with [REDACTED]. + render: text + validations: + required: false diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 000000000..5cecaf81a --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,5 @@ +blank_issues_enabled: false +contact_links: + - name: Report a security vulnerability + url: https://github.com/zereight/gitlab-mcp/security/advisories/new + about: Use private vulnerability reporting. Do not open a public issue. diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 000000000..782f69a41 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,31 @@ +name: Feature request +description: Suggest a GitLab capability or a change to server behavior. +title: "[Feature]: " +body: + - type: markdown + attributes: + value: | + Do not report a security vulnerability here. + Use GitHub private vulnerability reporting instead. + https://github.com/zereight/gitlab-mcp/security/advisories/new + - type: textarea + id: problem + attributes: + label: Problem + description: What workflow is blocked, and why it matters. + validations: + required: true + - type: textarea + id: proposal + attributes: + label: Proposal + description: What the server should do. + validations: + required: true + - type: textarea + id: context + attributes: + label: Context + description: GitLab type, version, or a link to the API you want. Optional. + validations: + required: false diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 000000000..42c52ad4e --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,22 @@ +## Summary + + + +## Related issue + + + +## Tests + + + +- [ ] I ran the checks that cover this change. + +## Docs + +- [ ] `README.md`, `README.ko.md`, `README.zh-CN.md`, and `README.pt-BR.md` match when user-facing behavior, env vars, flags, or examples changed. +- [ ] `docs/` matches the same behavior. + +## Breaking change + + diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..59c162afe --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,42 @@ +# Security policy + +## Report a vulnerability + +Report a vulnerability with [GitHub private vulnerability reporting](https://github.com/zereight/gitlab-mcp/security/advisories/new). + +Do not report a vulnerability in a public GitHub issue. A public issue shows the details before a fix is available. + +Include the package version, the impact, and steps to reproduce. Remove tokens, passwords, cookies, and `Authorization` headers from any log you attach. + +## Supported versions + +Security fixes are provided for the latest 2.x release. + +| Version | Supported | +| -------------- | --------- | +| Latest 2.x | Yes | +| Older releases | No | + +## Security controls + +The controls below are implemented in this repository and described in the linked docs. + +### Permission mode + +`GITLAB_PERMISSION_MODE` chooses the exposed tool surface. The values are `readonly`, `modify`, and `full`. The default is `full`. `readonly` exposes read tools. `modify` allows create and update, and blocks delete and teardown tools, including destructive mutations sent through `execute_graphql`. An invalid value fails startup. + +See [`GITLAB_PERMISSION_MODE`](docs/configuration/environment-variables.md#gitlab_permission_mode). + +### Project allowlist + +`GITLAB_ALLOWED_PROJECT_IDS` is an optional comma-separated list of project ids. The list is fixed when the process starts. One id acts as a locked default project. Multiple ids restrict tool access to those projects. + +Without `ENABLE_STRICT_PROJECT_SCOPE=true`, that allowlist limits which projects tools may operate on. Listings and searches can still return everything the token can see. With the flag, the server filters `list_projects`, `list_group_projects`, and `search_repositories` down to the allowlist. On `search_repositories`, `count` and `total_pages` stay the unfiltered GitLab totals when GitLab sends `x-total` and `x-total-pages`. If GitLab omits `x-total`, `count` is the length of the filtered page. If GitLab omits `x-total-pages`, the response omits `total_pages`. The flag also refuses instance-wide and group-wide tools when `GITLAB_ALLOWED_PROJECT_IDS`, a session project scope, or `GITLAB_PROJECT_ID` is set. It cannot limit those tools to those projects. + +See [`GITLAB_ALLOWED_PROJECT_IDS`](docs/configuration/environment-variables.md#gitlab_allowed_project_ids) and [`ENABLE_STRICT_PROJECT_SCOPE`](docs/configuration/environment-variables.md#enable_strict_project_scope). + +### Response masking + +Set `GITLAB_MASKING_ENABLED` to `true` to mask sensitive text in GitLab tool results and returned error messages. The default is `false`. When masking is off, the server does not read a masking configuration file. + +See [Response masking](docs/configuration/environment-variables.md#response-masking).