{"record":{"id":"8b0ad62774863e23","repo":"github/github-mcp-server","slug":"failed-to-get-repo-access-cache-w","errorCode":null,"errorMessage":"failed to get repo access cache: %w","messagePattern":"failed to get repo access cache: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/github/issues.go","lineNumber":718,"sourceCode":"\t\t\tcase \"get_sub_issues\":\n\t\t\t\tresult, err := GetSubIssues(ctx, client, deps, owner, repo, issueNumber, pagination)\n\t\t\t\treturn attachIFC(result), nil, err\n\t\t\tcase \"get_parent\":\n\t\t\t\tresult, err := GetIssueParent(ctx, gqlClient, deps, owner, repo, issueNumber)\n\t\t\t\treturn attachIFC(result), nil, err\n\t\t\tcase \"get_labels\":\n\t\t\t\tresult, err := GetIssueLabels(ctx, gqlClient, owner, repo, issueNumber)\n\t\t\t\treturn attachIFC(result), nil, err\n\t\t\tdefault:\n\t\t\t\treturn utils.NewToolResultError(fmt.Sprintf(\"unknown method: %s\", method)), nil, nil\n\t\t\t}\n\t\t})\n}\n\nfunc GetIssue(ctx context.Context, client *github.Client, deps ToolDependencies, owner string, repo string, issueNumber int) (*mcp.CallToolResult, error) {\n\tcache, err := deps.GetRepoAccessCache(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get repo access cache: %w\", err)\n\t}\n\tflags := deps.GetFlags(ctx)\n\n\tissue, resp, err := client.Issues.Get(ctx, owner, repo, issueNumber)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get issue: %w\", err)\n\t}\n\tdefer func() { _ = resp.Body.Close() }()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\tbody, err := io.ReadAll(resp.Body)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read response body: %w\", err)\n\t\t}\n\t\treturn ghErrors.NewGitHubAPIStatusErrorResponse(ctx, \"failed to get issue\", resp, body), nil\n\t}\n\n\tif flags.LockdownMode {","sourceCodeStart":700,"sourceCodeEnd":736,"githubUrl":"https://github.com/github/github-mcp-server/blob/0ea1f775a7c73eff1bd2e25904d01136756bbfe2/pkg/github/issues.go#L700-L736","documentation":"GetIssue (pkg/github/issues.go:718) starts by asking ToolDependencies.GetRepoAccessCache for the lockdown-mode repo access cache. The error wraps a failure from that dependency: under RequestDeps with lockdown mode enabled, building the cache requires constructing the GraphQL and REST clients, so a token/transport construction failure surfaces here before the issue is even fetched. Without lockdown mode the call returns (nil, nil) and cannot fail.","triggerScenarios":"Server started with --lockdown-mode (or GITHUB_MCP_SERVER_* lockdown config) where GetGQLClient or GetClient fails: unreadable/expired token provider, misconfigured GHES api host, broken transport. The request then aborts on the first dependency call.","commonSituations":"Lockdown mode enabled but the read-only/token env vars are missing or malformed; GHES host configuration where the GraphQL URL cannot be built; rotating tokens failing mid-deployment; test stubs returning errors from GetRepoAccessCache.","solutions":["Fix the token configuration used to start the server (env var/file the token provider reads)","Verify the GitHub/GHES host configuration (api host must yield both REST and GraphQL endpoints)","If lockdown mode is not intended, disable it — the cache path then short-circuits","Check server startup logs for the underlying client-construction error immediately before this one"],"exampleFix":"# before\nGITHUB_MCP_SERVER_LOCKDOWN_MODE=true ./github-mcp-server stdio  # token env missing\n\n# after\nexport GITHUB_MCP_SERVER_READ_ONLY_TOKEN=ghp_... \\\n       GITHUB_MCP_SERVER_LOCKDOWN_MODE=true\n./github-mcp-server stdio","handlingStrategy":"try-catch","validationCode":"// startup smoke test when lockdown mode is on\nif cfg.LockdownMode {\n    if _, err := deps.GetRepoAccessCache(context.Background()); err != nil {\n        log.Fatal(\"lockdown deps broken (token/host config?): \", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"cache, err := deps.GetRepoAccessCache(ctx)\nif err != nil {\n    // lockdown-mode client construction failed: token provider or api host config\n    if errors.Is(err, ErrTokenUnavailable) {\n        return fmt.Errorf(\"fix token config for lockdown mode: %w\", err)\n    }\n    return fmt.Errorf(\"repo access cache unavailable: %w\", err)\n}","preventionTips":["Validate lockdown-mode configuration (token env var + api host) at startup, not on first request","Alert on this error at the server level: it degrades every first dependency call per request","Keep a staging environment with lockdown enabled so config regressions surface before prod"],"tags":["go","lockdown-mode","auth","configuration"],"backgroundTag":null,"analyzedSha":"0ea1f775a7c73eff1bd2e25904d01136756bbfe2","analyzedAt":"2026-08-15T18:10:19.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}