{"record":{"id":"27b7cbec8d4bc834","repo":"github/github-mcp-server","slug":"host-must-use-https-to-avoid-sending-credentials-o","errorCode":null,"errorMessage":"host must use https to avoid sending credentials over cleartext: %s (http is only permitted for loopback hosts such as localhost, 127.0.0.1, or ::1)","messagePattern":"host must use https to avoid sending credentials over cleartext: (.+?) \\(http is only permitted for loopback hosts such as localhost, 127\\.0\\.0\\.1, or ::1\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/utils/api.go","lineNumber":275,"sourceCode":"\t\treturn newGHECHost(s)\n\tdefault:\n\t\treturn newGHESHost(s)\n\t}\n}\n\n// requireSecureScheme rejects hosts that would carry credentials over cleartext.\n// Every REST/GraphQL/upload/raw/authorization URL is derived from this host and\n// used for authenticated requests, so an http scheme would expose the bearer\n// token/PAT to network interception and replay. http is permitted only for\n// loopback hosts so that local development against a dev server still works.\nfunc requireSecureScheme(u *url.URL) error {\n\tif u.Scheme == \"https\" {\n\t\treturn nil\n\t}\n\tif u.Scheme == \"http\" && isLoopbackHost(u.Hostname()) {\n\t\treturn nil\n\t}\n\treturn fmt.Errorf(\n\t\t\"host must use https to avoid sending credentials over cleartext: %s (http is only permitted for loopback hosts such as localhost, 127.0.0.1, or ::1)\",\n\t\tu.Scheme+\"://\"+u.Hostname(),\n\t)\n}\n\n// isLoopbackHost reports whether hostname is a loopback address. Only exact\n// loopback names/addresses qualify, so credentials are never sent in cleartext\n// to a remote host.\nfunc isLoopbackHost(hostname string) bool {\n\tswitch strings.ToLower(hostname) {\n\tcase \"localhost\", \"127.0.0.1\", \"::1\":\n\t\treturn true\n\tdefault:\n\t\treturn false\n\t}\n}\n\n// HostType identifies which GitHub deployment a host refers to. Tools use this","sourceCodeStart":257,"sourceCodeEnd":293,"githubUrl":"https://github.com/github/github-mcp-server/blob/0ea1f775a7c73eff1bd2e25904d01136756bbfe2/pkg/utils/api.go#L257-L293","documentation":"A deliberate security control: requireSecureScheme rejects any non-https host except exact loopback names (localhost, 127.0.0.1, ::1), because every authenticated REST/GraphQL/upload/raw URL is derived from this host and cleartext http would expose the bearer token to interception and replay. There is no flag to bypass it for remote hosts.","triggerScenarios":"GITHUB_HOST=http://github.example.com for a non-loopback host - typically an attempt to work around TLS certificate problems on a GHES appliance or internal proxy. Note 'localhost' with a port (http://localhost:8080) is accepted.","commonSituations":"GHES fronted by plain HTTP on an internal network; test environments without certificates; misconfigured TLS termination where operators downgrade to http instead of fixing trust.","solutions":["Serve the appliance over TLS (or terminate TLS at a reverse proxy) and keep GITHUB_HOST=https://...; import the internal CA into the system trust store if self-signed","For local development only, use a loopback host: http://localhost:PORT","Do not try to bypass the check - fix the transport instead; the restriction is intentional"],"exampleFix":"# before\nGITHUB_HOST=http://github.internal.example.com\n\n# after\nGITHUB_HOST=https://github.internal.example.com  # TLS at appliance/proxy; internal CA trusted by the OS","handlingStrategy":"validation","validationCode":"func secureHost(s string) error {\n\tu, err := url.Parse(strings.TrimSpace(s))\n\tif err != nil {\n\t\treturn err\n\t}\n\tif u.Scheme == \"http\" && !isLoopback(u.Hostname()) {\n\t\treturn fmt.Errorf(\"refusing cleartext http for %s: enable TLS or use a loopback host\", u.Host)\n\t}\n\treturn nil\n}\nfunc isLoopback(h string) bool {\n\tswitch strings.ToLower(h) {\n\tcase \"localhost\", \"127.0.0.1\", \"::1\":\n\t\treturn true\n\t}\n\treturn false\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Provision TLS (or a TLS-terminating proxy) before pointing the server at GHES","Trust internal CAs at the OS level instead of downgrading to http","Reserve http:// for loopback development setups only"],"tags":["go","security","tls","ghes","configuration"],"backgroundTag":null,"analyzedSha":"0ea1f775a7c73eff1bd2e25904d01136756bbfe2","analyzedAt":"2026-08-15T18:10:19.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}