What causes "failed to get repo access cache: %w" in github/github-mcp-server?

Fix the token configuration used to start the server (env var/file the token provider reads)

failed to get repo access cache: %w

Error message

failed to get repo access cache: %w

What it means

GetIssue (pkg/github/issues.go:718) starts by asking ToolDependencies.GetRepoAccessCache for the lockdown-mode repo access cache. The error wraps a failure from that dependency: under RequestDeps with lockdown mode enabled, building the cache requires constructing the GraphQL and REST clients, so a token/transport construction failure surfaces here before the issue is even fetched. Without lockdown mode the call returns (nil, nil) and cannot fail.

Source

Thrown at pkg/github/issues.go:718

			case "get_sub_issues":
				result, err := GetSubIssues(ctx, client, deps, owner, repo, issueNumber, pagination)
				return attachIFC(result), nil, err
			case "get_parent":
				result, err := GetIssueParent(ctx, gqlClient, deps, owner, repo, issueNumber)
				return attachIFC(result), nil, err
			case "get_labels":
				result, err := GetIssueLabels(ctx, gqlClient, owner, repo, issueNumber)
				return attachIFC(result), nil, err
			default:
				return utils.NewToolResultError(fmt.Sprintf("unknown method: %s", method)), nil, nil
			}
		})
}

func GetIssue(ctx context.Context, client *github.Client, deps ToolDependencies, owner string, repo string, issueNumber int) (*mcp.CallToolResult, error) {
	cache, err := deps.GetRepoAccessCache(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to get repo access cache: %w", err)
	}
	flags := deps.GetFlags(ctx)

	issue, resp, err := client.Issues.Get(ctx, owner, repo, issueNumber)
	if err != nil {
		return nil, fmt.Errorf("failed to get issue: %w", err)
	}
	defer func() { _ = resp.Body.Close() }()

	if resp.StatusCode != http.StatusOK {
		body, err := io.ReadAll(resp.Body)
		if err != nil {
			return nil, fmt.Errorf("failed to read response body: %w", err)
		}
		return ghErrors.NewGitHubAPIStatusErrorResponse(ctx, "failed to get issue", resp, body), nil
	}

	if flags.LockdownMode {

View on GitHub (pinned to 0ea1f775a7)

Solutions

Fix the token configuration used to start the server (env var/file the token provider reads)
Verify the GitHub/GHES host configuration (api host must yield both REST and GraphQL endpoints)
If lockdown mode is not intended, disable it — the cache path then short-circuits
Check server startup logs for the underlying client-construction error immediately before this one

Example fix

# before
GITHUB_MCP_SERVER_LOCKDOWN_MODE=true ./github-mcp-server stdio  # token env missing

# after
export GITHUB_MCP_SERVER_READ_ONLY_TOKEN=ghp_... \
       GITHUB_MCP_SERVER_LOCKDOWN_MODE=true
./github-mcp-server stdio

Defensive patterns

Strategy: try-catch

Validate before calling

// startup smoke test when lockdown mode is on
if cfg.LockdownMode {
    if _, err := deps.GetRepoAccessCache(context.Background()); err != nil {
        log.Fatal("lockdown deps broken (token/host config?): ", err)
    }
}

Try / catch

cache, err := deps.GetRepoAccessCache(ctx)
if err != nil {
    // lockdown-mode client construction failed: token provider or api host config
    if errors.Is(err, ErrTokenUnavailable) {
        return fmt.Errorf("fix token config for lockdown mode: %w", err)
    }
    return fmt.Errorf("repo access cache unavailable: %w", err)
}

Prevention

Validate lockdown-mode configuration (token env var + api host) at startup, not on first request
Alert on this error at the server level: it degrades every first dependency call per request
Keep a staging environment with lockdown enabled so config regressions surface before prod

When it happens

Trigger: Server started with --lockdown-mode (or GITHUB_MCP_SERVER_* lockdown config) where GetGQLClient or GetClient fails: unreadable/expired token provider, misconfigured GHES api host, broken transport. The request then aborts on the first dependency call.

Common situations: Lockdown mode enabled but the read-only/token env vars are missing or malformed; GHES host configuration where the GraphQL URL cannot be built; rotating tokens failing mid-deployment; test stubs returning errors from GetRepoAccessCache.

Related errors

AI-assisted analysis of github/github-mcp-server@0ea1f775a7 (2026-08-15). Data as JSON: /api/errors/8b0ad62774863e23. Report an issue: GitHub.