{"record":{"id":"16033260a6f7c023","repo":"github/github-mcp-server","slug":"lockdown-cache-is-not-configured-160332","errorCode":null,"errorMessage":"lockdown cache is not configured","messagePattern":"lockdown cache is not configured","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/github/lockdown.go","lineNumber":25,"sourceCode":"\t\"github.com/modelcontextprotocol/go-sdk/mcp\"\n\n\t\"github.com/github/github-mcp-server/pkg/lockdown\"\n\t\"github.com/github/github-mcp-server/pkg/utils\"\n)\n\n// Restriction messages returned when lockdown mode withholds content from a read tool.\nconst (\n\tlockdownPullRequestRestrictedMessage = \"access to pull request is restricted by lockdown mode\"\n\tlockdownIssueRestrictedMessage       = \"access to issue details is restricted by lockdown mode\"\n)\n\n// authorLockdownResult returns a restricted tool result when content authored by\n// authorLogin cannot be surfaced for owner/repo under lockdown mode, and (nil, nil)\n// when access is permitted. It should only be called when lockdown mode is enabled.\n// It fails closed: a missing cache, an empty author, or a lookup error denies access.\nfunc authorLockdownResult(ctx context.Context, cache *lockdown.RepoAccessCache, owner, repo, authorLogin, restrictedMessage string) (*mcp.CallToolResult, error) {\n\tif cache == nil {\n\t\treturn nil, fmt.Errorf(\"lockdown cache is not configured\")\n\t}\n\tif authorLogin == \"\" {\n\t\treturn utils.NewToolResultError(restrictedMessage), nil\n\t}\n\tisSafeContent, err := cache.IsSafeContent(ctx, authorLogin, owner, repo)\n\tif err != nil {\n\t\treturn utils.NewToolResultError(fmt.Sprintf(\"failed to check lockdown mode: %v\", err)), nil\n\t}\n\tif !isSafeContent {\n\t\treturn utils.NewToolResultError(restrictedMessage), nil\n\t}\n\treturn nil, nil\n}\n","sourceCodeStart":7,"sourceCodeEnd":39,"githubUrl":"https://github.com/github/github-mcp-server/blob/0ea1f775a7c73eff1bd2e25904d01136756bbfe2/pkg/github/lockdown.go#L7-L39","documentation":"authorLockdownResult enforces lockdown mode and intentionally fails closed: when the passed *lockdown.RepoAccessCache is nil it returns this error instead of allowing access. The cache is constructed at server startup when lockdown mode is enabled, so a nil cache here means the read tool (issue/PR detail) was invoked with lockdown active but the cache was never wired in — a server configuration/wiring defect, not a caller mistake.","triggerScenarios":"Lockdown mode is enabled and a read tool (e.g. get_issue/get_pull_request paths that call authorLockdownResult) runs against a server whose dependency injection did not include a RepoAccessCache — e.g. a custom embedding or a hand-built BaseDeps with RepoAccessCache left nil.","commonSituations":"Embedding github-mcp-server programmatically and enabling lockdown without passing the cache; a bug in a server version where the cache is only built on certain startup paths; running tests with stub deps that omit the cache.","solutions":["Ensure the server is started through the standard entrypoints (cmd/github-mcp-server, pkg/http) so the RepoAccessCache is built when lockdown is enabled","If embedding, construct lockdown.NewRepoAccessCache(gqlClient, restClient, opts...) and set it on BaseDeps.RepoAccessCache / RequestDeps.RepoAccessOpts","Upgrade github-mcp-server in case the nil-cache path is a fixed wiring bug","Do not attempt to bypass: the guard is fail-closed by design"],"exampleFix":"// before\ndeps := github.NewBaseDeps(nil, tc, rc, pc, nil /* cache */, true, nil)\n// after\ncache := lockdown.NewRepoAccessCache(gqlClient, restClient)\ndeps := github.NewBaseDeps(nil, tc, rc, pc, cache, true, nil)","handlingStrategy":"validation","validationCode":"// Before serving traffic with lockdown enabled, assert the cache is wired:\nif cfg.LockdownMode && repoAccessCache == nil {\n    log.Fatal(\"lockdown mode enabled but RepoAccessCache is nil — refusing to start\")\n}","typeGuard":"func hasLockdownCache(cache *lockdown.RepoAccessCache) bool {\n\treturn cache != nil\n}","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"lockdown cache is not configured\") {\n    // Server misconfiguration. Stop retrying; fix startup wiring or disable lockdown mode.\n}","preventionTips":["Run a startup self-test that calls a lockdown-guarded read tool when lockdown is enabled","Never hand-construct BaseDeps without the cache; use the standard server constructors","Remember the guard fails closed — any wiring bug surfaces as denied access, so alert on this message"],"tags":["lockdown","configuration","security","fail-closed","server-setup"],"backgroundTag":null,"analyzedSha":"0ea1f775a7c73eff1bd2e25904d01136756bbfe2","analyzedAt":"2026-08-15T18:10:19.804Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}