{"record":{"id":"6aa665042d548ebd","repo":"github/github-mcp-server","slug":"could-not-parse-host-as-url-s","errorCode":null,"errorMessage":"could not parse host as URL: %s","messagePattern":"could not parse host as URL: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/utils/api.go","lineNumber":239,"sourceCode":"\n\tresp, err := client.Get(subdomainURL)\n\tif err != nil {\n\t\treturn false\n\t}\n\tdefer resp.Body.Close()\n\n\treturn resp.StatusCode == http.StatusOK\n}\n\n// Note that this does not handle ports yet, so development environments are out.\nfunc parseAPIHost(s string) (APIHost, error) {\n\tif s == \"\" {\n\t\treturn newDotcomHost()\n\t}\n\n\tu, err := url.Parse(s)\n\tif err != nil {\n\t\treturn APIHost{}, fmt.Errorf(\"could not parse host as URL: %s\", s)\n\t}\n\n\tif u.Scheme == \"\" {\n\t\treturn APIHost{}, fmt.Errorf(\"host must have a scheme (http or https): %s\", s)\n\t}\n\n\t// Enforce HTTPS centrally so no deployment (GHES in particular) can build\n\t// authenticated REST/GraphQL/upload/raw URLs over cleartext http, which\n\t// would leak the bearer token/PAT to anyone on the network.\n\tif err := requireSecureScheme(u); err != nil {\n\t\treturn APIHost{}, err\n\t}\n\n\tswitch classifyHost(u) {\n\tcase HostTypeDotcom:\n\t\treturn newDotcomHost()\n\tcase HostTypeGHEC:\n\t\treturn newGHECHost(s)","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/github/github-mcp-server/blob/0ea1f775a7c73eff1bd2e25904d01136756bbfe2/pkg/utils/api.go#L221-L257","documentation":"parseAPIHost feeds the configured host string (empty means github.com) to url.Parse and this is the raw parse failure. It only fires on syntactically broken URLs - control characters, spaces, or invalid percent-encoding - because almost any hostname-shaped string parses fine and fails the later scheme checks instead.","triggerScenarios":"GITHUB_HOST / --github-host containing a space ('https://github. example.com'), a trailing newline from a docker env_file or Kubernetes secret, or stray control characters.","commonSituations":"env_file entries with trailing whitespace; k8s secrets storing values with a trailing \\n; shell quoting mistakes injecting spaces.","solutions":["Trim whitespace and newlines from the env value before use","Re-enter the value without stray characters and confirm it starts with https://","Log the exact (non-secret) host value at startup to spot invisible characters"],"exampleFix":"# before (trailing space from env_file)\nGITHUB_HOST='https://github.example.com '\n\n# after\nGITHUB_HOST=https://github.example.com","handlingStrategy":"validation","validationCode":"func validAPIHost(s string) error {\n\ts = strings.TrimSpace(s)\n\tif s == \"\" {\n\t\treturn nil // dotcom default\n\t}\n\tu, err := url.Parse(s)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unparseable host %q: %w\", s, err)\n\t}\n\tif u.Scheme == \"\" {\n\t\treturn fmt.Errorf(\"host %q must include an https:// scheme\", s)\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Trim env-sourced host strings before use","Validate GITHUB_HOST once at process start and fail fast showing the offending value (it is non-secret)","Quote values in env_file/compose files to avoid stray whitespace"],"tags":["go","configuration","url","validation","docker"],"backgroundTag":null,"analyzedSha":"0ea1f775a7c73eff1bd2e25904d01136756bbfe2","analyzedAt":"2026-08-15T18:10:19.804Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}