What causes "failed to get repo access cache: %w" in github/github-mcp-server?

Fix the token configuration used to start the server (env var/file the token provider reads)

failed to get repo access cache

Error message

failed to get repo access cache: %w

What it means

GetIssue (pkg/github/issues.go:718) starts by asking ToolDependencies.GetRepoAccessCache for the lockdown-mode repo access cache. The error wraps a failure from that dependency: under RequestDeps with lockdown mode enabled, building the cache requires constructing the GraphQL and REST clients, so a token/transport construction failure surfaces here before the issue is even fetched. Without lockdown mode the call returns (nil, nil) and cannot fail.

Solutions

Fix the token configuration used to start the server (env var/file the token provider reads)
Verify the GitHub/GHES host configuration (api host must yield both REST and GraphQL endpoints)
If lockdown mode is not intended, disable it — the cache path then short-circuits
Check server startup logs for the underlying client-construction error immediately before this one

Example fix

# before
GITHUB_MCP_SERVER_LOCKDOWN_MODE=true ./github-mcp-server stdio  # token env missing

# after
export GITHUB_MCP_SERVER_READ_ONLY_TOKEN=ghp_... \
       GITHUB_MCP_SERVER_LOCKDOWN_MODE=true
./github-mcp-server stdio

Defensive patterns

Strategy: try-catch

Validate before calling

// startup smoke test when lockdown mode is on
if cfg.LockdownMode {
    if _, err := deps.GetRepoAccessCache(context.Background()); err != nil {
        log.Fatal("lockdown deps broken (token/host config?): ", err)
    }
}

Try / catch

cache, err := deps.GetRepoAccessCache(ctx)
if err != nil {
    // lockdown-mode client construction failed: token provider or api host config
    if errors.Is(err, ErrTokenUnavailable) {
        return fmt.Errorf("fix token config for lockdown mode: %w", err)
    }
    return fmt.Errorf("repo access cache unavailable: %w", err)
}

Prevention

Validate lockdown-mode configuration (token env var + api host) at startup, not on first request
Alert on this error at the server level: it degrades every first dependency call per request
Keep a staging environment with lockdown enabled so config regressions surface before prod

When it happens

Trigger: Server started with --lockdown-mode (or GITHUB_MCP_SERVER_* lockdown config) where GetGQLClient or GetClient fails: unreadable/expired token provider, misconfigured GHES api host, broken transport. The request then aborts on the first dependency call.

Common situations: Lockdown mode enabled but the read-only/token env vars are missing or malformed; GHES host configuration where the GraphQL URL cannot be built; rotating tokens failing mid-deployment; test stubs returning errors from GetRepoAccessCache.

Related errors

AI-assisted analysis of github/github-mcp-server@0ea1f775a7 (2026-08-15). Data as JSON: /api/errors/8b0ad62774863e23. Report an issue: GitHub.

Appendix: source

Thrown at pkg/github/issues.go:718

			case "get_sub_issues":
				result, err := GetSubIssues(ctx, client, deps, owner, repo, issueNumber, pagination)
				return attachIFC(result), nil, err
			case "get_parent":
				result, err := GetIssueParent(ctx, gqlClient, deps, owner, repo, issueNumber)
				return attachIFC(result), nil, err
			case "get_labels":
				result, err := GetIssueLabels(ctx, gqlClient, owner, repo, issueNumber)
				return attachIFC(result), nil, err
			default:
				return utils.NewToolResultError(fmt.Sprintf("unknown method: %s", method)), nil, nil
			}
		})
}

func GetIssue(ctx context.Context, client *github.Client, deps ToolDependencies, owner string, repo string, issueNumber int) (*mcp.CallToolResult, error) {
	cache, err := deps.GetRepoAccessCache(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to get repo access cache: %w", err)
	}
	flags := deps.GetFlags(ctx)

	issue, resp, err := client.Issues.Get(ctx, owner, repo, issueNumber)
	if err != nil {
		return nil, fmt.Errorf("failed to get issue: %w", err)
	}
	defer func() { _ = resp.Body.Close() }()

	if resp.StatusCode != http.StatusOK {
		body, err := io.ReadAll(resp.Body)
		if err != nil {
			return nil, fmt.Errorf("failed to read response body: %w", err)
		}
		return ghErrors.NewGitHubAPIStatusErrorResponse(ctx, "failed to get issue", resp, body), nil
	}

	if flags.LockdownMode {

View on GitHub (pinned to 0ea1f775a7)