github/github-mcp-server · error

failed to check lockdown mode: %w

Error message

failed to check lockdown mode: %w

What it means

While get_pull_request_review_comments filters review threads under lockdown mode, each comment author is checked with cache.IsSafeContent (pkg/lockdown/lockdown.go). That method queries GraphQL for the author's repo access and the viewer login; any of those failing (network error, GraphQL error, empty viewer login, nil client) is wrapped as 'failed to check lockdown mode'.

Source

Thrown at pkg/github/pullrequests.go:541

	}

	// Lockdown mode filtering
	if ff.LockdownMode {
		if cache == nil {
			return nil, fmt.Errorf("lockdown cache is not configured")
		}

		// Iterate through threads and filter comments
		for i := range query.Repository.PullRequest.ReviewThreads.Nodes {
			thread := &query.Repository.PullRequest.ReviewThreads.Nodes[i]
			filteredComments := make([]reviewCommentNode, 0, len(thread.Comments.Nodes))

			for _, comment := range thread.Comments.Nodes {
				login := string(comment.Author.Login)
				if login != "" {
					isSafeContent, err := cache.IsSafeContent(ctx, login, owner, repo)
					if err != nil {
						return nil, fmt.Errorf("failed to check lockdown mode: %w", err)
					}
					if isSafeContent {
						filteredComments = append(filteredComments, comment)
					}
				}
			}

			thread.Comments.Nodes = filteredComments
			thread.Comments.TotalCount = githubv4.Int(int32(len(filteredComments))) //nolint:gosec // comment count is bounded by API limits
		}
	}

	return MarshalledTextResult(convertToMinimalReviewThreadsResponse(query)), nil
}

func GetPullRequestReviews(ctx context.Context, client *github.Client, deps ToolDependencies, owner, repo string, pullNumber int, pagination PaginationParams) (*mcp.CallToolResult, error) {
	cache, err := deps.GetRepoAccessCache(ctx)
	if err != nil {

View on GitHub (pinned to 0ea1f775a7)

Solutions

1. Read the wrapped cause — it distinguishes GraphQL transport failures from viewer-login problems
2. Verify the token can query GraphQL: a Viewer { login } query with the same credentials
3. Check GITHUB_GRAPHQL_URL / GHES GraphQL availability and egress rules
4. Retry the tool call — transient GraphQL 502s are common; the access cache also caches results so retries are cheaper

Example fix

// before
isSafeContent, err := cache.IsSafeContent(ctx, login, owner, repo)
if err != nil {
	return nil, fmt.Errorf("failed to check lockdown mode: %w", err)
}

// after — keep the author context for actionable failures
isSafeContent, err := cache.IsSafeContent(ctx, login, owner, repo)
if err != nil {
	return nil, fmt.Errorf("lockdown check failed for author %s on %s/%s: %w", login, owner, repo, err)
}

// Pre-flight: prove GraphQL works with this token before lockdown-filtered tools
var q struct{ Viewer struct{ Login githubv4.String } }
if err := gqlClient.Query(ctx, &q, nil); err != nil {
	return fmt.Errorf("GraphQL unavailable for lockdown checks: %w", err)
}

func isGraphQLTransient(err error) bool {
	msg := err.Error()
	return strings.Contains(msg, "502") || strings.Contains(msg, "connection reset") ||
		strings.Contains(msg, "EOF")
}

isSafe, err := cache.IsSafeContent(ctx, login, owner, repo)
if err != nil {
	if isGraphQLTransient(err) {
		isSafe, err = cache.IsSafeContent(ctx, login, owner, repo) // cache makes retry cheap
	}
}
if err != nil {
	return nil, fmt.Errorf("failed to check lockdown mode: %w", err)
}

When it happens

Trigger: IsSafeContent's getRepoAccessInfo GraphQL query fails (expired token, GITHUB_GRAPHQL_URL pointing at a broken endpoint, 502 from GraphQL), or viewerLoginFor fails with 'failed to query viewer login' / 'viewer login returned empty' (token without GraphQL access, GHES GraphQL disabled), or the cache was built with a nil GraphQL client.

Common situations: Classic PATs work for REST but the GraphQL endpoint is blocked by egress policy; GHES deployments where /api/graphql requires separate enablement; tokens expiring mid-session during long comment-listing runs; network blips during per-comment fan-out.

Related errors

• failed to query viewer login: %w
• owner is required
• failed to get GitHub client: %w
• lockdown cache is not configured
• failed to get GitHub client: %w

AI-assisted analysis of github/github-mcp-server@0ea1f775a7 (2026-08-15). Data as JSON: /api/errors/4e2d7f5ccdcdc1e6. Report an issue: GitHub.