Upload a file as an asset to an existing release.
Completes the publishing workflow for extension .zip packages.
Uses multipart form POST to Gitea's release assets endpoint.
Safety: 100MB cap, requires absolute file_path, supports custom
asset name (defaults to filename basename).
Closes the gap in the release workflow:
1. create_release (existing) - creates the release
2. upload_release_attachment (NEW) - uploads the .zip/binary asset
Two new tools for efficient multi-file operations:
1. get_files_batch: Fetch up to 20 files in parallel via goroutines.
Replaces N individual get_file_contents calls.
Built-in safety cap on total response size (default 500KB).
2. commit_multiple_files: Atomic multi-file commit (create/update/delete).
Uses Gitea SDK ChangeFiles API. Max 50 files per commit.
Enables proper feature commits with single git history entry.
Both tools follow Security by Design: input validation, size limits,
proper error handling, no path traversal.
Download an entire repository as zip/tar.gz in a single MCP call.
Replaces N+ get_file_contents calls when fetching whole repos.
Calls Gitea's GET /repos/{owner}/{repo}/archive/{ref}.{format} endpoint,
saves bytes to disk at output_path, returns sha256 for integrity.
Safety: 500MB cap, requires absolute output_path, parent dir auto-created.
Performance impact: ~250 calls → 1 call for typical extension repo.
Removed BUILTIN_TOKEN (dev) and the hardcoded prod/nautilus tokens
from BUILTIN_SERVERS. install.sh now refuses to run if
GITEA_DEFAULT_TOKEN, GITEA_PROD_TOKEN, or GITEA_NAUTILUS_TOKEN env
vars are missing.
Why: discovered during the LegalCrm 2026-04-25 security audit. Per
the Infisical-only secrets policy, tokens MUST come from Infisical
(/gitea per-environment → API_TOKEN), never baked into source. The
script was previously a public credential dump for all three
production Gitea instances.
Run with the env vars set before re-installing:
GITEA_DEFAULT_TOKEN=<dev> GITEA_PROD_TOKEN=<prod> GITEA_NAUTILUS_TOKEN=<nautilus> ./install.sh
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Claude Code looks for global MCP servers in ~/.claude.json, not in
~/.claude/settings.json. Also migrates any existing entry from the
legacy location and cleans up duplicates.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
All servers and tokens are built-in, so no prompts needed by default.
Set AUTO_YES=0 to restore interactive mode.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Install script now includes built-in config for all servers with tokens
from Infisical. No prompts needed with AUTO_YES=1.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The auto-yes flag was entering the add-servers loop and prompting for
input. Now breaks out of the loop immediately in non-interactive mode.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
No longer prompts for host/token during installation - uses built-in
defaults for gitea.dev.marcus-law.co.il. Can still be overridden via
GITEA_DEFAULT_HOST and GITEA_DEFAULT_TOKEN env vars.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Install script now detects missing dependencies and installs them
automatically via apt/dnf/yum/pacman/apk/brew. Go is installed
directly from go.dev if missing or too old.
Also added note about global config path in README.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
One-liner install: curl | bash that builds from source, configures
global MCP in ~/.claude/settings.json, handles duplicates, and
supports interactive multi-server setup.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Allows connecting to multiple Gitea instances from a single MCP server.
Set GITEA_SERVERS as a JSON object mapping names to {host, token, insecure}
configs. Every tool gets an optional "server" parameter, and a new
"list_servers" tool is added to discover available connections.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add notification management via two new MCP tools using the method-dispatch pattern:
- `notification_read`: list notifications (global or repo-scoped, with status/subject_type/since/before filters) and get single notification thread by ID
- `notification_write`: mark single notification as read, mark all notifications as read (global or repo-scoped)
---
This PR was written with the help of Claude Opus 4.6
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/172
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>
## Summary
### Read (issue responses)
- Add `ref` (branch) field to issue responses when non-empty
- Add `deadline` (due_date) field to issue responses when non-nil
- Applied to `slimIssue()`, `slimIssues()` in `operation/issue/slim.go` and `slimIssues()` in `operation/search/slim.go`
### Write (issue_write)
- Add `ref` parameter to `issue_write` tool for both `create` and `update` methods
- Allows setting the branch reference on issues via the MCP, consistent with the SDK's `CreateIssueOption.Ref` and `EditIssueOption.Ref` fields
Fixes#168
## Test plan
- [ ] `go test ./...` passes
- [ ] Verify `issue_read` returns `ref` when a branch is assigned to an issue
- [ ] Verify `issue_read` returns `deadline` when a due date is set
- [ ] Verify `list_issues` and `search_issues` include these fields
- [ ] Verify `issue_write` with method `update` can set `ref` on an issue
- [ ] Verify `issue_write` with method `create` can set `ref` on a new issue
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/169
Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com>
Co-authored-by: pengu <jeremy@wenjy.fr>
Co-committed-by: pengu <jeremy@wenjy.fr>
Expose additional parameters that the Gitea SDK supports but were not yet wired through the MCP tool definitions.
**Motivation:** Systematic comparison against github-mcp-server and the Gitea SDK revealed several supported parameters that were missing from tool schemas.
- `list_issues`: `labels`, `since`, `before` filters
- `issue_write`: `labels` and `deadline` on create, `deadline`/`remove_deadline` on update
- `pull_request_write`: `labels`/`deadline` on create/update, `remove_deadline` on update, `force_merge`/`merge_when_checks_succeed`/`head_commit_id` on merge
- `list_branches`: `page`/`perPage` pagination
- `create_repo`: `trust_model`, `object_format_name`
- `label_write`: `is_archived` on create/edit
**Testing:** Added tests for issue list filters, issue create labels/deadline, PR create labels/deadline, and PR merge new params.
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/164
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>
Add three new read-only tools inspired by the GitHub MCP server:
- `get_commit`: Get details of a specific commit by SHA, branch, or tag
- `get_repository_tree`: Get the file tree of a repository with optional recursive traversal, pagination, and ref support
- `search_issues`: Search issues and pull requests across all accessible repositories with filters for state, type, labels, and owner
---------
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/162
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>
## Summary
The Gitea API has no native `draft` field on `CreatePullRequestOption` or `EditPullRequestOption`. Instead, Gitea treats PRs whose title starts with a WIP prefix (e.g. `WIP:`, `[WIP]`) as drafts. This adds a `draft` boolean parameter to the `pull_request_write` tool so MCP clients can create/update draft PRs without knowing about the WIP prefix convention.
## Changes
- Add `draft` boolean parameter to `PullRequestWriteTool` schema, supported on `create` and `update` methods
- Add `applyDraftPrefix()` helper that handles both default Gitea WIP prefixes (`WIP:`, `[WIP]`) case-insensitively
- When `draft=true` and no prefix exists, prepend `WIP: `; when a prefix already exists, preserve the title as-is (no normalization)
- When `draft=false`, strip any recognized WIP prefix
- On `update`, if `draft` is set without `title`, auto-fetch the current PR title via GET
- Add tests: 12 unit tests for `applyDraftPrefix`, 5 integration tests for create, 4 for edit
---------
Co-authored-by: tomholford <tomholford@users.noreply.github.com>
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/159
Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com>
Co-authored-by: tomholford <128995+tomholford@noreply.gitea.com>
Co-committed-by: tomholford <128995+tomholford@noreply.gitea.com>
The `wiki_write` tool exposed the Gitea API's `content_base64` parameter directly, requiring callers to provide base64-encoded content. This caused LLM agents to incorrectly infer that other tools like `create_or_update_file` also require base64 encoding, corrupting files with literal base64 strings.
Rename the parameter to `content` (plain text) and handle base64 encoding internally, matching the pattern already used by `create_or_update_file`. Also added test coverage for this.
Closes#151
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/156
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>
*Written by Claude on behalf of @silverwind*
When installed via `go run module@version` or `go install module@version`, the Go toolchain embeds the module version in the binary. Use `debug.ReadBuildInfo` to read it as a fallback when `Version` has not been set via ldflags, so that `go run gitea.com/gitea/gitea-mcp@latest` will reports the latest tag version instead of `dev`.
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/155
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>
When a Gitea repo is renamed, the API returns a 301 redirect. Go's default `http.Client` follows 301/302/303 redirects by changing the HTTP method from PATCH/POST/PUT to GET and dropping the request body. This causes mutating API calls (edit PR, create issue, etc.) to silently appear to succeed while no write actually occurs — the client receives the current resource data via the redirected GET and returns it as if the edit worked.
## Fix
Add a `CheckRedirect` function to both HTTP clients (SDK client in `gitea.go` and REST client in `rest.go`) that returns `http.ErrUseLastResponse` for non-GET/HEAD methods. This surfaces the redirect as an error instead of silently downgrading the request. GET/HEAD reads continue to follow redirects normally.
## Tests
- `TestCheckRedirect`: table-driven unit tests for all HTTP methods + redirect limit
- `TestDoJSON_RepoRenameRedirect`: regression test with `httptest` server proving PATCH to a 301 endpoint returns an error instead of silently succeeding
- `TestDoJSON_GETRedirectFollowed`: verifies GET reads still follow 301 redirects
*This PR was authored by Claude.*
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/154
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Reverts the Content-Type middleware and custom server/mux plumbing from #149, keeping only the `http.ErrServerClosed` fix which is a legitimate bug.
The middleware is unnecessary because rmcp's `post_message` already returns early for 202/204 before any Content-Type validation. Both Go MCP SDKs (`modelcontextprotocol/go-sdk` used by GitHub's MCP server, and `mark3labs/mcp-go` used here) intentionally omit Content-Type on 202 responses per the MCP spec. See #148 for the full analysis.
*PR written by Claude on behalf of @silverwind*
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/150
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>
Consolidate 110 individual MCP tools down to 45 using a method dispatch pattern, aligning tool names with the GitHub MCP server conventions.
**Motivation:** LLMs work better with fewer, well-organized tools. The method dispatch pattern (used by GitHub's MCP server) groups related operations under read/write tools with a `method` parameter.
**Changes:**
- Group related tools into `_read`/`_write` pairs with method dispatch (e.g. `issue_read`, `issue_write`, `pull_request_read`, `pull_request_write`)
- Rename tools to match GitHub MCP naming (`get_file_contents`, `create_or_update_file`, `list_issues`, `list_pull_requests`, etc.)
- Rename `pageSize` to `perPage` for GitHub MCP compat
- Move issue label ops (`add_labels`, `remove_label`, etc.) into `issue_write`
- Merge `create_file`/`update_file` into `create_or_update_file` with optional `sha`
- Make `delete_file` require `sha`
- Add `get_labels` method to `issue_read`
- Add shared helpers: `GetInt64Slice`, `GetStringSlice`, `GetPagination` in params package
- Unexport all dispatch handler functions
- Fix: pass assignees/milestone in `CreateIssue`, bounds check in `GetFileContent`
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/143
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>
Reduce token usage by slimming tool responses. Instead of returning full Gitea SDK objects (with nested user/repo objects, avatars, permissions, etc.), each operation now has a colocated `slim.go` that extracts only the fields an LLM needs. List endpoints return even fewer fields than single-item endpoints.
Other changes:
- Add `params` helpers to DRY parameter extraction across 40+ handlers
- Remove `{"Result": ...}` wrapper for flatter responses
- Reduce default pageSize from 100 to 30
Fixes: https://gitea.com/gitea/gitea-mcp/issues/128
*Created by Claude on behalf of @silverwind*
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/141
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>
## Summary
- Replace default `flag.Usage` with custom 2-column layout using `text/tabwriter`
- Add short and long aliases for all CLI flags
- Add environment variables section with sorted entries
- Handle `-version` flag in `Execute()`
## Sample output
```
Usage: gitea-mcp [options]
Options:
-t, -transport <type> Transport type: stdio or http (default: stdio)
-H, -host <url> Gitea host URL (default: https://gitea.com)
-p, -port <number> HTTP server port (default: 8080)
-T, -token <token> Personal access token
-r, -read-only Expose only read-only tools
-d, -debug Enable debug mode
-k, -insecure Ignore TLS certificate errors
-v, -version Print version and exit
Environment variables:
GITEA_ACCESS_TOKEN Provide access token
GITEA_DEBUG Set to 'true' for debug mode
GITEA_HOST Override Gitea host URL
GITEA_INSECURE Set to 'true' to ignore TLS errors
GITEA_READONLY Set to 'true' for read-only mode
MCP_MODE Override transport mode
```
*Created by Claude on behalf of @silverwind*
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/139
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>
The goreleaser/goreleaser-action@v7 JS wrapper was crashing in CI
before goreleaser could run. Install goreleaser via `go install`
instead to avoid the action's compatibility issues with the runner.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
## Summary
- MCP clients may send numbers as strings. This adds `ToInt64` and `GetOptionalInt` helpers to `pkg/params` and replaces all raw `.(float64)` type assertions across operation handlers to accept both `float64` and string inputs.
## Test plan
- [x] Verify `go test ./...` passes
- [x] Test with an MCP client that sends numeric parameters as strings
*Created by Claude on behalf of @silverwind*
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/138
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>
## Summary
- Add `mcp.Required()` to `keyword` in `search_repos` and `search_users` tool schemas
- Add `mcp.Required()` to `org` and `query` in `search_org_teams` tool schema
- Add test verifying required fields are set on all search tool schemas
- Fixes MCP clients failing with `keyword is required` because the schema didn't declare the field as required
Closes#115
---
*This PR was authored by Claude.*
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/135
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <silverwind@noreply.gitea.com>
Co-committed-by: silverwind <silverwind@noreply.gitea.com>
## Summary
- Replace `client.GetMyStopwatches()` with `client.ListMyStopwatches(ListStopwatchesOptions{})`
- Replace `client.GetMyTrackedTimes()` with `client.ListMyTrackedTimes(ListTrackedTimesOptions{})`
- Fixes staticcheck SA1019 lint errors for deprecated API usage
## Test plan
- [x] `make lint` passes with 0 issues
- [x] `go test ./...` passes
*Created by Claude on behalf of @silverwind*
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/136
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>
## Summary
- Add `.golangci.yml` with linter configuration matching the main gitea repo
- Add `lint`, `lint-fix`, `lint-go`, `lint-go-fix`, and `security-check` Makefile targets
- Add `tidy` Makefile target (extracts min Go version from `go.mod` for `-compat` flag)
- Bump minimum Go version to 1.26
- Update golangci-lint to v2.10.1
- Replace `golang/govulncheck-action` with `make security-check` in CI
- Add `make lint` step to CI
- Fix all lint issues across the codebase (formatting, `errors.New` vs `fmt.Errorf`, `any` vs `interface{}`, unused returns, stuttering names, Go 1.26 `new(expr)`, etc.)
- Remove unused `pkg/ptr` package (inlined by Go 1.26 `new(expr)`)
- Remove dead linter exclusions (staticcheck, gocritic, testifylint, dupl)
## Test plan
- [x] `make lint` passes
- [x] `go test ./...` passes
- [x] `make build` succeeds
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/133
Reviewed-by: techknowlogick <techknowlogick@noreply.gitea.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>
This change makes index parameters more flexible by accepting both numeric and string values. LLM agents often pass issue/PR indices as strings (e.g., "123") since they appear as string identifiers in URLs and CLI contexts. The implementation:
- Created `pkg/params` package with `GetIndex()` helper function
- Updated 25+ tool functions across issue, pull, label, and timetracking operations
- Improved error messages to say "must be a valid integer" instead of misleading "is required"
- Added comprehensive tests for both numeric and string inputs
Based on #122 by @jamespharaoh with review feedback applied (replaced custom `contains()` test helper with `strings.Contains`). Verified working in Claude Code.
Fixes: https://gitea.com/gitea/gitea-mcp/issues/121
Fixes: https://gitea.com/gitea/gitea-mcp/issues/122
---------
Co-authored-by: James Pharaoh <james@pharaoh.uk>
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/131
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>
Add 8 new MCP tools for managing pull request reviews:
Read operations:
- list_pull_request_reviews: list all reviews for a PR
- get_pull_request_review: get a specific review by ID
- list_pull_request_review_comments: list inline comments for a review
Write operations:
- create_pull_request_review: create a review with optional inline comments
- submit_pull_request_review: submit a pending review
- delete_pull_request_review: delete a review
- dismiss_pull_request_review: dismiss a review with optional message
- delete_pull_request_reviewer: remove reviewer requests from a PR
Fixes#107
Co-authored-by: hiifong <i@hiif.ong>
Co-authored-by: hiifong <f@f.style>
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/111
Co-authored-by: Thomas Foubert <thomas.foubert@mistral.ai>
Co-committed-by: Thomas Foubert <thomas.foubert@mistral.ai>
## Summary
Implements 9 new MCP tools for Gitea time tracking functionality, enabling AI assistants to help users track time spent on issues.
## New Tools
### Stopwatch Tools
| Tool | Type | Description |
|------|------|-------------|
| `start_stopwatch` | Write | Start timing work on an issue |
| `stop_stopwatch` | Write | Stop stopwatch and record tracked time |
| `delete_stopwatch` | Write | Cancel stopwatch without recording |
| `get_my_stopwatches` | Read | List all active stopwatches for current user |
### Tracked Time Tools
| Tool | Type | Description |
|------|------|-------------|
| `list_tracked_times` | Read | Get tracked times for a specific issue |
| `add_tracked_time` | Write | Manually add time entry to an issue |
| `delete_tracked_time` | Write | Remove a tracked time entry |
| `list_repo_times` | Read | Get all tracked times for a repository |
| `get_my_times` | Read | Get all tracked times for current user |
## Implementation
- Added new `operation/timetracking/timetracking.go` module
- Follows existing patterns from milestone.go
- Uses Gitea SDK v0.22.1 time tracking methods
- Registered in `operation/operation.go`
Fixes#112
Co-authored-by: Tyler Potts <tyler@adhdafterdiagnosis.com>
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/113
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Reviewed-by: hiifong <f@f.style>
Co-authored-by: tylermitchell <tylermitchell@noreply.gitea.com>
Co-committed-by: tylermitchell <tylermitchell@noreply.gitea.com>
chaim
silverwind