github/github-mcp-server · error

failed to get GitHub client: %w

Error message

failed to get GitHub client: %w

What it means

Returned by the list_actions_resources tool handler (pkg/github/actions.go:355) when deps.GetClient(ctx) fails before any API call is made. With BaseDeps (local stdio mode) GetClient cannot fail, so this error only occurs in the request-scoped (remote/hosted HTTP) deployment where GetClient re-creates a client per call: it fails with 'no token info in context', 'failed to get base REST URL', 'failed to get upload URL', or 'failed to create REST client' (pkg/github/dependencies.go:308-334).

Source

Thrown at pkg/github/actions.go:355

			method, err := RequiredParam[string](args, "method")
			if err != nil {
				return utils.NewToolResultError(err.Error()), nil, nil
			}

			resourceID, err := OptionalParam[string](args, "resource_id")
			if err != nil {
				return utils.NewToolResultError(err.Error()), nil, nil
			}

			pagination, err := OptionalPaginationParams(args)
			if err != nil {
				return utils.NewToolResultError(err.Error()), nil, nil
			}

			client, err := deps.GetClient(ctx)
			if err != nil {
				return nil, nil, fmt.Errorf("failed to get GitHub client: %w", err)
			}

			// attachIFC adds the IFC label to a successful Actions result when
			// IFC labels are enabled. Workflow definitions, runs, jobs,
			// artifacts and logs echo attacker-influenceable run output, so
			// integrity is untrusted; confidentiality follows repo visibility.
			attachIFC := func(r *mcp.CallToolResult) *mcp.CallToolResult {
				return attachRepoVisibilityIFCLabel(ctx, deps, client, owner, repo, r, ifc.LabelActionsResult)
			}

			var resourceIDInt int64
			var parseErr error
			switch method {
			case actionsMethodListWorkflows:
				// Do nothing, no resource ID needed
			case actionsMethodListWorkflowRuns:
				// resource_id is optional for list_workflow_runs
				// If not provided, list all workflow runs in the repository

View on GitHub (pinned to 0ea1f775a7)

Solutions

1. Send a valid PAT on every HTTP request: Authorization: Bearer <token> so the middleware can populate TokenInfo
2. Verify GHES env vars: GITHUB_API_HOST like https://ghes.example.com/api/v3 and matching upload host
3. Check proxies/LBs forward the Authorization header unmodified
4. If embedding, attach the token before invoking the tool: ctx = ghcontext.WithTokenInfo(ctx, &ghcontext.TokenInfo{Token: t})

Example fix

// before (remote-server client)
req, _ := http.NewRequest(http.MethodPost, srv.URL, body)
req.Header.Set("Accept", "application/json")
// tool call -> "failed to get GitHub client: no token info in context"

// after
req, _ := http.NewRequest(http.MethodPost, srv.URL, body)
req.Header.Set("Authorization", "Bearer "+pat)
req.Header.Set("Accept", "application/json, text/event-stream")

// MCP HTTP client: assert auth is wired before any tool call
req.Header.Set("Authorization", "Bearer "+pat)
if req.Header.Get("Authorization") == "" {
    return errors.New("missing PAT: remote server requires Authorization header")
}

// Embedder: assert token info is in context
if _, ok := ghcontext.GetTokenInfo(ctx); !ok {
    ctx = ghcontext.WithTokenInfo(ctx, &ghcontext.TokenInfo{Token: pat})
}

client, err := deps.GetClient(ctx)
if err != nil {
    if strings.Contains(err.Error(), "no token info in context") {
        return fixAuthHeaderThenRetry() // client-side config, not GitHub
    }
    return err // GHES URL misconfiguration: check GITHUB_API_HOST / upload host
}

When it happens

Trigger: Calling list_actions_resources on the remote server variant when the request context lacks TokenInfo (no Authorization header propagated), when GHES host configuration (GH_HOST / GITHUB_API_HOST / GITHUB_UPLOAD_HOST) fails to parse into valid URLs, or when gogithub.NewClient rejects the enterprise URLs.

Common situations: Self-hosting the HTTP transport and forgetting the Authorization: Bearer header; misconfigured GHES env vars (trailing slashes, missing /api/v3, unreachable host scheme); load balancers stripping auth headers; embedding the server without attaching token info to the context.

Related errors

• failed to get repo access cache: %w
• failed to get GitHub client: %w
• failed to get GitHub client: %w
• failed to get GitHub client: %w
• host must have a scheme (http or https): %s

AI-assisted analysis of github/github-mcp-server@0ea1f775a7 (2026-08-15). Data as JSON: /api/errors/141c68b28a484c39. Report an issue: GitHub.