{"record":{"id":"2f8250b8d0e369dd","repo":"github/github-mcp-server","slug":"failed-to-query-repository-metadata-w","errorCode":null,"errorMessage":"failed to query repository metadata: %w","messagePattern":"failed to query repository metadata: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/lockdown/lockdown.go","lineNumber":264,"sourceCode":"\t\treturn false, \"\", fmt.Errorf(\"nil GraphQL client\")\n\t}\n\n\tvar query struct {\n\t\tViewer struct {\n\t\t\tLogin githubv4.String\n\t\t}\n\t\tRepository struct {\n\t\t\tIsPrivate githubv4.Boolean\n\t\t} `graphql:\"repository(owner: $owner, name: $name)\"`\n\t}\n\n\tvariables := map[string]any{\n\t\t\"owner\": githubv4.String(owner),\n\t\t\"name\":  githubv4.String(repo),\n\t}\n\n\tif err := c.client.Query(ctx, &query, variables); err != nil {\n\t\treturn false, \"\", fmt.Errorf(\"failed to query repository metadata: %w\", err)\n\t}\n\n\tc.logDebug(ctx, fmt.Sprintf(\"queried repo access info for %s/%s: isPrivate=%t\", owner, repo, bool(query.Repository.IsPrivate)))\n\n\treturn bool(query.Repository.IsPrivate), string(query.Viewer.Login), nil\n}\n\n// checkPushAccess checks if the user has push access to the repository via the REST permission endpoint.\nfunc (c *RepoAccessCache) checkPushAccess(ctx context.Context, username, owner, repo string) (bool, error) {\n\tif c.restClient == nil {\n\t\treturn false, fmt.Errorf(\"nil REST client\")\n\t}\n\n\tpermLevel, _, err := c.restClient.Repositories.GetPermissionLevel(ctx, owner, repo, username)\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"failed to get user permission level: %w\", err)\n\t}\n","sourceCodeStart":246,"sourceCodeEnd":282,"githubUrl":"https://github.com/github/github-mcp-server/blob/0ea1f775a7c73eff1bd2e25904d01136756bbfe2/pkg/lockdown/lockdown.go#L246-L282","documentation":"As part of a lockdown check the cache runs a GraphQL query for repository(owner:, name:){ isPrivate } with the viewer login piggy-backed. GitHub answers 'Could not resolve to a Repository' (a 404-equivalent) when the repo does not exist or is invisible to the token - by far the most common wrapped error here; the remainder are auth/network failures. The isPrivate result feeds IsSafeContent's private-repo allowance.","triggerScenarios":"Lockdown evaluation of a tool call whose owner/repo arguments name a repo that does not exist, was renamed/transferred, or is private to a token without access; or GITHUB_HOST pointing at a different GitHub instance than the one hosting the repo.","commonSituations":"Stale owner/repo pairs after forks or renames; org-private repos accessed with a token not in the org; dotcom/GHES cross-instance confusion.","solutions":["Verify owner and repo spelling in the tool arguments - typos and stale references dominate","Confirm the token can see the repo: `gh repo view owner/repo` with the same token, or check /repos/{owner}/{repo} returns 200","Check GITHUB_HOST matches the instance the repository actually lives on","In callers, treat the 404-shaped wrapped error as 'not accessible' rather than a crash"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// pre-check visibility before lockdown-dependent tool calls\nif _, err := restClient.Repositories.Get(ctx, owner, repo); err != nil {\n\treturn fmt.Errorf(\"repo %s/%s is not visible to this token; fix owner/repo or token access\", owner, repo)\n}","typeGuard":null,"tryCatchPattern":"if _, err := cache.IsSafeContent(ctx, user, owner, repo); err != nil {\n\tif strings.Contains(err.Error(), \"Could not resolve to a Repository\") || strings.Contains(err.Error(), \"Not Found\") {\n\t\t// repo missing or invisible to the token: reject/skip the content, do not retry\n\t}\n}","preventionTips":["Validate owner/repo arguments against /repos/{owner}/{repo} before lockdown checks run","Keep stored repo references fresh - handle renames and transfers","Scope tokens to the orgs whose repositories they must read"],"tags":["go","graphql","lockdown","github-api","not-found"],"backgroundTag":null,"analyzedSha":"0ea1f775a7c73eff1bd2e25904d01136756bbfe2","analyzedAt":"2026-08-15T18:10:19.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}