What causes "authorization did not complete" in github/github-mcp-server?

Strip the leading slash: strings.TrimPrefix(path, "/")

authorization did not complete

Error message

authorization did not complete

What it means

Second guard of validateBlamePath for get_file_blame: a leading '/' is rejected because the GraphQL blame(path:) argument must be relative to the repository root. An absolute-looking path never matches a file in the repository (GitHub's git trees have no leading slash), so the server fails fast with 'path must be relative to the repository root (no leading "/")' instead of returning empty blame ranges.

Source

Thrown at internal/oauth/manager.go:417

func (m *Manager) outcomeAfterFlow(flowID string) (*Outcome, error) {
	m.mu.Lock()
	if flowID == "" || flowID != m.flowID {
		m.mu.Unlock()
		return nil, ErrStaleAuthorizationFlow
	}
	pending := m.pending
	err := m.lastErr
	m.mu.Unlock()
	if m.AccessToken() != "" {
		return nil, nil
	}
	if pending != nil {
		return &Outcome{UserAction: pending, FlowID: flowID}, nil
	}
	if err != nil {
		return nil, err
	}
	return nil, errors.New("authorization did not complete")
}

func (m *Manager) oauth2Config(redirectURL string) *oauth2.Config {
	return &oauth2.Config{
		ClientID:     m.config.ClientID,
		ClientSecret: m.config.ClientSecret,
		RedirectURL:  redirectURL,
		Scopes:       m.config.Scopes,
		Endpoint:     m.config.Endpoint,
	}
}

View on GitHub (pinned to 0ea1f775a7)

Solutions

Strip the leading slash: strings.TrimPrefix(path, "/")
Derive the argument as the path relative to the repo root, not the absolute local path
Validate client-side with the same rule before calling the tool

Example fix

// before
{"owner":"octocat","repo":"Hello-World","path":"/src/main.go"}

// after
{"owner":"octocat","repo":"Hello-World","path":"src/main.go"}

Defensive patterns

Strategy: validation

Validate before calling

func toRepoRelativePath(p string) string {
	return strings.TrimPrefix(strings.TrimSpace(p), "/")
}

Type guard

func isBlamePathError(err error) bool {
	return err != nil && strings.HasPrefix(err.Error(), "path must")
}

Try / catch

path = strings.TrimPrefix(strings.TrimSpace(path), "/")
if strings.HasPrefix(path, "/") || path == "" {
	return nil, fmt.Errorf("path must be repository-root relative")
}
res, _, err := callGetFileBlame(ctx, buildArgs(owner, repo, path))
if isBlamePathError(err) {
	return nil, fmt.Errorf("fix the path argument: %w", err)
}

Prevention

Convert editor/shell absolute paths with filepath.Rel(repoRoot, abs) before sending
Never paste absolute paths directly into the path argument
Remember the REST contents API tolerates a leading slash but get_file_blame does not
Add a client-side lint for leading '/' on tool arguments

When it happens

Trigger: Passing "/src/main.go" instead of "src/main.go"; converting a local filesystem path to the tool argument unchanged; path built with filepath.Join("/", rel).

Common situations: Developers pasting paths from editors or shells, which usually show absolute paths; porting code that used the REST contents API where a leading slash is tolerated; LLM callers normalizing paths incorrectly.

Related errors

AI-assisted analysis of github/github-mcp-server@0ea1f775a7 (2026-08-15). Data as JSON: /api/errors/16ea9a83ccc9d2fb. Report an issue: GitHub.