{"record":{"id":"051653cabb6ddc4b","repo":"github/github-mcp-server","slug":"github-app-installation-id-is-required-github-app","errorCode":null,"errorMessage":"GitHub App installation ID is required (GITHUB_APP_INSTALLATION_ID)","messagePattern":"GitHub App installation ID is required \\(GITHUB_APP_INSTALLATION_ID\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/githubapp/githubapp.go","lineNumber":55,"sourceCode":"\tAppID string\n\n\t// InstallationID identifies the installation whose access token is minted.\n\tInstallationID string\n\n\t// PrivateKeyPEM is the RSA key used to sign app JWTs.\n\tPrivateKeyPEM []byte\n\n\t// BaseRESTURL is the REST API base, e.g. https://api.github.com/ for\n\t// github.com or https://HOST/api/v3/ for GitHub Enterprise Server.\n\tBaseRESTURL string\n}\n\nfunc (c Config) validate() error {\n\tswitch {\n\tcase c.AppID == \"\":\n\t\treturn errors.New(\"GitHub App ID or client ID is required (GITHUB_APP_ID)\")\n\tcase c.InstallationID == \"\":\n\t\treturn errors.New(\"GitHub App installation ID is required (GITHUB_APP_INSTALLATION_ID)\")\n\tcase len(c.PrivateKeyPEM) == 0:\n\t\treturn errors.New(\"GitHub App private key is required (GITHUB_APP_PRIVATE_KEY_PATH or GITHUB_APP_PRIVATE_KEY)\")\n\tcase c.BaseRESTURL == \"\":\n\t\treturn errors.New(\"GitHub App REST base URL is required\")\n\t}\n\treturn nil\n}\n\nfunc parsePrivateKey(pemBytes []byte) (*rsa.PrivateKey, error) {\n\tblock, _ := pem.Decode(pemBytes)\n\tif block == nil {\n\t\treturn nil, errors.New(\"no PEM block found in private key\")\n\t}\n\tif key, err := x509.ParsePKCS1PrivateKey(block.Bytes); err == nil {\n\t\treturn key, nil\n\t}\n\tparsed, err := x509.ParsePKCS8PrivateKey(block.Bytes)\n\tif err != nil {","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/github/github-mcp-server/blob/0ea1f775a7c73eff1bd2e25904d01136756bbfe2/internal/githubapp/githubapp.go#L37-L73","documentation":"Thrown by the star_repository tool handler when deps.GetClient(ctx) fails before client.Activity.Star can run. In remote/server deployments (RequestDeps) the REST client is constructed per call from token info in the request context and configured API hosts; failure wraps 'no token info in context', 'failed to get base REST URL'/'failed to get upload URL', or 'failed to create REST client'. In stdio BaseDeps mode the prebuilt client is returned and this cannot fire.","triggerScenarios":"Calling star_repository when the request context lacks token info, when enterprise API host env vars are malformed so URL resolution fails, or when WithEnterpriseURLs rejects a non-absolute base/upload URL.","commonSituations":"Token env var missing or expired in CI where starring runs; proxy stripping Authorization; enterprise base URL typos like 'github.example.com' without scheme; deployment where env vars are set after process start.","solutions":["Check the wrapped cause string to identify auth vs host-config failure","Provide a valid token with 'user' scope (starring requires it) to the server","Fix GITHUB_API_HOSTS / GITHUB_BASE_URL / GITHUB_UPLOAD_URL and restart","Pre-flight with an authenticated read like get_me to fail before attempting writes"],"exampleFix":"// before: token absent from the runtime env\n//   star_repository -> \"failed to get GitHub client: no token info in context\"\n\n// after\nexport GITHUB_PERSONAL_ACCESS_TOKEN=ghp_xxxxxxxxxxxx  # needs 'user' scope\nexport GITHUB_API_HOSTS=api.github.com","handlingStrategy":"try-catch","validationCode":"func preflightGitHubClient() error {\n\tif os.Getenv(\"GITHUB_PERSONAL_ACCESS_TOKEN\") == \"\" {\n\t\treturn fmt.Errorf(\"missing token: star_repository cannot build a client\")\n\t}\n\treturn nil\n}","typeGuard":"func isGitHubClientError(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"failed to get GitHub client\")\n}","tryCatchPattern":"result, _, err := callStarRepository(ctx, owner, repo)\nif err != nil {\n\tif isGitHubClientError(err) {\n\t\t// config fault: verify token ('user' scope) and host env; do not retry\n\t\treturn fmt.Errorf(\"server auth/host misconfiguration: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Ensure the token has 'user' scope for starring before scripting star jobs","Pre-flight auth with get_me in the same pipeline","Fail the whole batch early when the first call returns a client-construction error","Never retry client-construction errors - they are deterministic until config changes"],"tags":["go","github","authentication","configuration"],"backgroundTag":null,"analyzedSha":"0ea1f775a7c73eff1bd2e25904d01136756bbfe2","analyzedAt":"2026-08-15T18:10:19.804Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}