{"record":{"id":"a527fe2bfc96cd64","repo":"github/github-mcp-server","slug":"host-must-have-a-scheme-http-or-https-s","errorCode":null,"errorMessage":"host must have a scheme (http or https): %s","messagePattern":"host must have a scheme \\(http or https\\): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/utils/api.go","lineNumber":243,"sourceCode":"\t}\n\tdefer resp.Body.Close()\n\n\treturn resp.StatusCode == http.StatusOK\n}\n\n// Note that this does not handle ports yet, so development environments are out.\nfunc parseAPIHost(s string) (APIHost, error) {\n\tif s == \"\" {\n\t\treturn newDotcomHost()\n\t}\n\n\tu, err := url.Parse(s)\n\tif err != nil {\n\t\treturn APIHost{}, fmt.Errorf(\"could not parse host as URL: %s\", s)\n\t}\n\n\tif u.Scheme == \"\" {\n\t\treturn APIHost{}, fmt.Errorf(\"host must have a scheme (http or https): %s\", s)\n\t}\n\n\t// Enforce HTTPS centrally so no deployment (GHES in particular) can build\n\t// authenticated REST/GraphQL/upload/raw URLs over cleartext http, which\n\t// would leak the bearer token/PAT to anyone on the network.\n\tif err := requireSecureScheme(u); err != nil {\n\t\treturn APIHost{}, err\n\t}\n\n\tswitch classifyHost(u) {\n\tcase HostTypeDotcom:\n\t\treturn newDotcomHost()\n\tcase HostTypeGHEC:\n\t\treturn newGHECHost(s)\n\tdefault:\n\t\treturn newGHESHost(s)\n\t}\n}","sourceCodeStart":225,"sourceCodeEnd":261,"githubUrl":"https://github.com/github/github-mcp-server/blob/0ea1f775a7c73eff1bd2e25904d01136756bbfe2/pkg/utils/api.go#L225-L261","documentation":"The configured host parsed as a URL but had an empty scheme. parseAPIHost requires a full origin like https://github.example.com and rejects bare hostnames such as github.example.com or localhost:8443. This is the most common GHES onboarding mistake; an empty value is fine and means github.com.","triggerScenarios":"Setting GITHUB_HOST=github.mycompany.com or --github-host github.mycompany.com without the https:// prefix.","commonSituations":"Operators pasting the appliance hostname from internal docs; CI configs assuming a scheme is prepended automatically.","solutions":["Set the full origin: GITHUB_HOST=https://github.mycompany.com","For local development use http://localhost:PORT - loopback http is allowed","Inspect the live value: printenv GITHUB_HOST"],"exampleFix":"# before\nGITHUB_HOST=github.mycompany.com\n\n# after\nGITHUB_HOST=https://github.mycompany.com","handlingStrategy":"validation","validationCode":"host := strings.TrimSpace(os.Getenv(\"GITHUB_HOST\"))\nif host != \"\" && !strings.Contains(host, \"://\") {\n\treturn fmt.Errorf(\"GITHUB_HOST %q must include a scheme, e.g. https://%s\", host, host)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Document GHES onboarding with the full https origin, never a bare hostname","Fail fast at startup on scheme-less hosts","Remember empty GITHUB_HOST means github.com - do not set it to a bare hostname for dotcom"],"tags":["go","configuration","ghes","url","host"],"backgroundTag":null,"analyzedSha":"0ea1f775a7c73eff1bd2e25904d01136756bbfe2","analyzedAt":"2026-08-15T18:10:19.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}