abhigyanpatwari/GitNexus · error

The MCP default repository is not in the configured allowlis

Error message

The MCP default repository is not in the configured allowlist.

What it means

Thrown at policy construction (startup or first policy resolution) when GITNEXUS_MCP_DEFAULT_REPO resolves to a real repository, but that repository's normalized path key is not among the entries resolved from GITNEXUS_MCP_ALLOWED_REPOS. The default must be a member of the allowlist — otherwise the server would auto-select a repo it was configured to exclude. Note a default that fails to resolve at all produces a different startup resolution error first.

Source

Thrown at gitnexus/src/mcp/repository-policy.ts:456

    const byPath = new Map<string, ResolvedRepository>();
    for (const specifier of raw.allowed) {
      const result = resolveSpecifier(specifier, registry);
      if (!result.repo) throw startupResolutionError(result.reason ?? 'invalid');
      byPath.set(result.repo.pathKey, result.repo);
    }
    allowed = [...byPath.values()];
  }

  let defaultRepo: ResolvedRepository | undefined;
  if (raw.defaultRepo) {
    const result = resolveSpecifier(raw.defaultRepo, registry);
    if (!result.repo) throw startupResolutionError(result.reason ?? 'invalid');
    defaultRepo = result.repo;
  }

  const defaultPathKey = defaultRepo?.pathKey;
  if (defaultPathKey && allowed && !allowed.some((repo) => repo.pathKey === defaultPathKey)) {
    throw new Error('The MCP default repository is not in the configured allowlist.');
  }

  return new McpRepositoryPolicy(registry, allowed, defaultRepo);
}

View on GitHub (pinned to 52924ef12c)

Solutions

1. Make GITNEXUS_MCP_DEFAULT_REPO one of the exact entries in GITNEXUS_MCP_ALLOWED_REPOS (same name or same absolute path).
2. Remove GITNEXUS_MCP_DEFAULT_REPO if no default is needed.
3. For path mismatches, use identical absolute paths in both variables; on Windows remember path keys compare lowercased, and resolve symlinks so both sides see the same real path.

Example fix

# before
GITNEXUS_MCP_ALLOWED_REPOS=/srv/repos/frontend
GITNEXUS_MCP_DEFAULT_REPO=/srv/repos/backend

# after
GITNEXUS_MCP_ALLOWED_REPOS=/srv/repos/frontend,/srv/repos/backend
GITNEXUS_MCP_DEFAULT_REPO=/srv/repos/frontend

// Preflight at startup: default must be one of the allowlist entries
const allowed = (process.env.GITNEXUS_MCP_ALLOWED_REPOS ?? '').split(',').map((s) => s.trim()).filter(Boolean);
const def = process.env.GITNEXUS_MCP_DEFAULT_REPO?.trim();
if (allowed.length > 0 && def && !allowed.includes(def)) {
  throw new Error(`GITNEXUS_MCP_DEFAULT_REPO='${def}' is not in GITNEXUS_MCP_ALLOWED_REPOS`);
}

const defaultInAllowlist = (def: string | undefined, allowed: string[]): boolean =>
  def === undefined || allowed.some((a) => path.resolve(a) === path.resolve(def));

When it happens

Trigger: GITNEXUS_MCP_ALLOWED_REPOS='/srv/repos/frontend' plus GITNEXUS_MCP_DEFAULT_REPO='/srv/repos/backend' (path key mismatch), or a default given by name whose resolved path differs (symlink, case difference on Windows where paths are lowercased, relative vs absolute path) from every allowlist entry.

Common situations: The allowlist is later tightened and the stale default is forgotten. Symlinked or differently-cased repo paths make two textual specifiers point at the same repo without matching path keys. Renaming/moving an indexed repository breaks the allowlist entry but not the default.

Related errors

• ${allowedRaw.key} must not be blank.
• ${defaultRaw.key} must not be blank.
• Group routing is unavailable when an MCP repository allowlis
• Specify an explicit repo because multiple repositories are a
• Group tools are unavailable when an MCP repository allowlist

AI-assisted analysis of abhigyanpatwari/GitNexus@52924ef12c (2026-08-20). Data as JSON: /api/errors/c10aac71a4b723cb. Report an issue: GitHub.