{"record":{"id":"866fc0fd32e6d2b4","repo":"github/github-mcp-server","slug":"failed-to-get-advisory-w","errorCode":null,"errorMessage":"failed to get advisory: %w","messagePattern":"failed to get advisory: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/github/security_advisories.go","lineNumber":366,"sourceCode":"\t\t\t\t},\n\t\t\t\tRequired: []string{\"ghsaId\"},\n\t\t\t},\n\t\t},\n\t\t[]scopes.Scope{scopes.SecurityEvents},\n\t\tfunc(ctx context.Context, deps ToolDependencies, _ *mcp.CallToolRequest, args map[string]any) (*mcp.CallToolResult, any, error) {\n\t\t\tclient, err := deps.GetClient(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, nil, fmt.Errorf(\"failed to get GitHub client: %w\", err)\n\t\t\t}\n\n\t\t\tghsaID, err := RequiredParam[string](args, \"ghsaId\")\n\t\t\tif err != nil {\n\t\t\t\treturn utils.NewToolResultError(fmt.Sprintf(\"invalid ghsaId: %v\", err)), nil, nil\n\t\t\t}\n\n\t\t\tadvisory, resp, err := client.SecurityAdvisories.GetGlobalSecurityAdvisories(ctx, ghsaID)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, nil, fmt.Errorf(\"failed to get advisory: %w\", err)\n\t\t\t}\n\t\t\tdefer func() { _ = resp.Body.Close() }()\n\n\t\t\tif resp.StatusCode != http.StatusOK {\n\t\t\t\tbody, err := io.ReadAll(resp.Body)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, nil, fmt.Errorf(\"failed to read response body: %w\", err)\n\t\t\t\t}\n\t\t\t\treturn ghErrors.NewGitHubAPIStatusErrorResponse(ctx, \"failed to get advisory\", resp, body), nil, nil\n\t\t\t}\n\n\t\t\tr, err := json.Marshal(advisory)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, nil, fmt.Errorf(\"failed to marshal advisory: %w\", err)\n\t\t\t}\n\n\t\t\tresult := utils.NewToolResultText(string(r))\n\t\t\t// A global advisory is world-readable (public) but externally","sourceCodeStart":348,"sourceCodeEnd":384,"githubUrl":"https://github.com/github/github-mcp-server/blob/0ea1f775a7c73eff1bd2e25904d01136756bbfe2/pkg/github/security_advisories.go#L348-L384","documentation":"Thrown by the get_global_security_advisory MCP tool when client.SecurityAdvisories.GetGlobalSecurityAdvisories returns a non-nil error. The go-github client errors on transport failures (DNS, TLS, timeout, proxy) and also converts non-2xx HTTP responses into *github.ErrorResponse, so the wrapped %w chain usually carries the status code and the GitHub API message.","triggerScenarios":"Calling the tool with a ghsaId that does not exist (404), a malformed ID (valid shape is GHSA-xxxx-xxxx-xxxx), a token without access, or when the server cannot reach the API host (air-gapped network, corporate proxy, TLS interception, rate limit exhausted).","commonSituations":"Typos in the GHSA identifier; missing/expired GITHUB_MCP_BACKEND_GITHUB_TOKEN or OAuth token; 403 secondary rate limits; runners without egress to api.github.com; GHES host mismatch between token and configured host.","solutions":["Verify the advisory ID has the GHSA-xxxx-xxxx-xxxx shape and exists at github.com/advisories","Check the token is set, valid, and issued for the configured host (dotcom vs GHES)","Unwrap the error with errors.As(*github.ErrorResponse) to distinguish 404 vs 401 vs 403 and act accordingly","For transport errors, verify HTTPS_PROXY/egress and retry with backoff"],"exampleFix":"// before\nadvisory, resp, err := client.SecurityAdvisories.GetGlobalSecurityAdvisories(ctx, ghsaID)\nif err != nil {\n\treturn nil, nil, fmt.Errorf(\"failed to get advisory: %w\", err)\n}\n\n// after - surface API errors as a tool result like the status-code path below it does\nadvisory, resp, err := client.SecurityAdvisories.GetGlobalSecurityAdvisories(ctx, ghsaID)\nif err != nil {\n\tvar ghErr *github.ErrorResponse\n\tif errors.As(err, &ghErr) {\n\t\treturn ghErrors.NewGitHubAPIStatusErrorResponse(ctx, \"failed to get advisory\", ghErr.Response, []byte(ghErr.Message)), nil, nil\n\t}\n\treturn nil, nil, fmt.Errorf(\"failed to get advisory: %w\", err)\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"var ghErr *github.ErrorResponse\nif errors.As(err, &ghErr) {\n\tswitch ghErr.Response.StatusCode {\n\tcase http.StatusNotFound:\n\t\t// treat unknown GHSA id as an empty result, not a crash\n\tcase http.StatusUnauthorized, http.StatusForbidden:\n\t\t// surface credential/rate-limit problem to operator\n\tdefault:\n\t\t// retryable only for 5xx and transport errors\n\t}\n}","preventionTips":["Normalize GHSA IDs client-side to the GHSA-xxxx-xxxx-xxxx shape before invoking the tool","Keep a valid token for the configured host and rotate it before expiry","Wrap calls with retry-on-5xx/transport-error logic, never on 404/401"],"tags":["github-api","network","security-advisory","mcp-tool"],"backgroundTag":null,"analyzedSha":"0ea1f775a7c73eff1bd2e25904d01136756bbfe2","analyzedAt":"2026-08-15T18:10:19.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}