{"record":{"id":"4a67dabfbd6c8bdf","repo":"github/github-mcp-server","slug":"lockdown-cache-is-not-configured-4a67da","errorCode":null,"errorMessage":"lockdown cache is not configured","messagePattern":"lockdown cache is not configured","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/github/pullrequests.go","lineNumber":528,"sourceCode":"\tif gqlParams.After != nil {\n\t\tvars[\"after\"] = githubv4.String(*gqlParams.After)\n\t} else {\n\t\tvars[\"after\"] = (*githubv4.String)(nil)\n\t}\n\n\t// Execute GraphQL query\n\tvar query reviewThreadsQuery\n\tif err := gqlClient.Query(ctx, &query, vars); err != nil {\n\t\treturn ghErrors.NewGitHubGraphQLErrorResponse(ctx,\n\t\t\t\"failed to get pull request review threads\",\n\t\t\terr,\n\t\t), nil\n\t}\n\n\t// Lockdown mode filtering\n\tif ff.LockdownMode {\n\t\tif cache == nil {\n\t\t\treturn nil, fmt.Errorf(\"lockdown cache is not configured\")\n\t\t}\n\n\t\t// Iterate through threads and filter comments\n\t\tfor i := range query.Repository.PullRequest.ReviewThreads.Nodes {\n\t\t\tthread := &query.Repository.PullRequest.ReviewThreads.Nodes[i]\n\t\t\tfilteredComments := make([]reviewCommentNode, 0, len(thread.Comments.Nodes))\n\n\t\t\tfor _, comment := range thread.Comments.Nodes {\n\t\t\t\tlogin := string(comment.Author.Login)\n\t\t\t\tif login != \"\" {\n\t\t\t\t\tisSafeContent, err := cache.IsSafeContent(ctx, login, owner, repo)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn nil, fmt.Errorf(\"failed to check lockdown mode: %w\", err)\n\t\t\t\t\t}\n\t\t\t\t\tif isSafeContent {\n\t\t\t\t\t\tfilteredComments = append(filteredComments, comment)\n\t\t\t\t\t}\n\t\t\t\t}","sourceCodeStart":510,"sourceCodeEnd":546,"githubUrl":"https://github.com/github/github-mcp-server/blob/0ea1f775a7c73eff1bd2e25904d01136756bbfe2/pkg/github/pullrequests.go#L510-L546","documentation":"Inside get_pull_request_review_comments: the per-request feature flags say LockdownMode is on (ff.LockdownMode from deps.GetFlags), but the cache handle returned by GetRepoAccessCache is nil. In RequestDeps, GetRepoAccessCache returns (nil, nil) exactly when the server-level lockdownMode flag is off — so this error is a configuration split-brain: feature flags enable lockdown while the server itself was not started with it.","triggerScenarios":"Remote GitHub App feature-flag payloads (or a stale flag cache) enabling lockdown while the server runs without --lockdown-mode; BaseDeps wired with a nil RepoAccessCache in an embedded deployment that also sets the lockdown flag.","commonSituations":"Rollout drift during lockdown-mode migration: flags updated on the App side before the server container is restarted with the new env; test harnesses constructing deps by hand with Flags.LockdownMode=true but no cache; multi-tenant deployments where one tenant's flags leak into another.","solutions":["Start the server with lockdown mode enabled (--lockdown-mode / LOCKDOWN_MODE) so RequestDeps actually builds the cache","Align remote feature-flag payloads with server configuration before rollout — don't let flags get ahead of the binary","If lockdown is intentionally off, clear the LockdownMode feature flag for this deployment","For embedded use, pass a non-nil RepoAccessCache when constructing BaseDeps with LockdownMode=true"],"exampleFix":"// before: flag says lockdown, server doesn't support it\nflags.LockdownMode = true\n// server started without --lockdown-mode → GetRepoAccessCache returns nil, nil\n\n// after: fail fast at startup instead of per-request\nif flags.LockdownMode && !serverLockdownMode {\n\tlog.Fatal(\"lockdown feature flag enabled but server lockdown mode is off; start with --lockdown-mode\")\n}","handlingStrategy":"validation","validationCode":"// Startup consistency check: feature flag vs server capability\nif flags.LockdownMode && !cfg.LockdownMode {\n\treturn fmt.Errorf(\"lockdown feature flag is enabled but the server was not started with lockdown mode; restart with --lockdown-mode or clear the flag\")\n}","typeGuard":null,"tryCatchPattern":"if ff.LockdownMode && cache == nil {\n\treturn nil, fmt.Errorf(\"lockdown cache is not configured\") // configuration bug — do not retry\n}","preventionTips":["Ship server config and feature-flag payloads in the same change window","Fail fast at startup when flags and server mode disagree","In tests, always pair LockdownMode=true with a NewRepoAccessCache-built cache"],"tags":["go","mcp","lockdown-mode","configuration","feature-flags"],"backgroundTag":null,"analyzedSha":"0ea1f775a7c73eff1bd2e25904d01136756bbfe2","analyzedAt":"2026-08-15T18:10:19.804Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}