github/github-mcp-server · error

failed to list organization repository security advisories:

Error message

failed to list organization repository security advisories: %w

What it means

client.SecurityAdvisories.ListRepositorySecurityAdvisoriesForOrg returned an error: the REST call to list an organization's repository security advisories failed at transport level or came back non-2xx (wrapped as *github.ErrorResponse).

Source

Thrown at pkg/github/security_advisories.go:465

			client, err := deps.GetClient(ctx)
			if err != nil {
				return nil, nil, fmt.Errorf("failed to get GitHub client: %w", err)
			}

			opts := &github.ListRepositorySecurityAdvisoriesOptions{}
			if direction != "" {
				opts.Direction = direction
			}
			if sortField != "" {
				opts.Sort = sortField
			}
			if state != "" {
				opts.State = state
			}

			advisories, resp, err := client.SecurityAdvisories.ListRepositorySecurityAdvisoriesForOrg(ctx, org, opts)
			if err != nil {
				return nil, nil, fmt.Errorf("failed to list organization repository security advisories: %w", err)
			}
			defer func() { _ = resp.Body.Close() }()

			if resp.StatusCode != http.StatusOK {
				body, err := io.ReadAll(resp.Body)
				if err != nil {
					return nil, nil, fmt.Errorf("failed to read response body: %w", err)
				}
				return ghErrors.NewGitHubAPIStatusErrorResponse(ctx, "failed to list organization repository advisories", resp, body), nil, nil
			}

			r, err := json.Marshal(advisories)
			if err != nil {
				return nil, nil, fmt.Errorf("failed to marshal advisories: %w", err)
			}

			result := utils.NewToolResultText(string(r))
			// Org-wide advisory listings span the organization's repositories

View on GitHub (pinned to 0ea1f775a7)

Solutions

1. Verify the org login spelling
2. Confirm the token's user belongs to the org and can view repository security advisories
3. Use only supported values: direction=asc|desc, sort=created|updated, state=draft|published
4. Unwrap *github.ErrorResponse for the exact status and API message

var validDirection = map[string]bool{"asc": true, "desc": true}
var validSort = map[string]bool{"created": true, "updated": true}
var validState = map[string]bool{"draft": true, "published": true}
if direction != "" && !validDirection[direction] { return fmt.Errorf("invalid direction") }
if sortField != "" && !validSort[sortField] { return fmt.Errorf("invalid sort") }
if state != "" && !validState[state] { return fmt.Errorf("invalid state") }

When it happens

Trigger: Org login misspelled or nonexistent (404); authenticated user is not an org member with visibility into repository security advisories (403/404); invalid query values (direction not asc/desc, sort not created/updated, state not draft/published); secondary rate limits.

Common situations: Using a PAT from outside the organization; org-level restrictions on security advisory visibility; passing a state value the API version rejects.

Related errors

• failed to get advisory: %w
• authorization failed: %s
• failed to list global security advisories: %w
• failed to list repository security advisories: %w
• failed to get repositories

AI-assisted analysis of github/github-mcp-server@0ea1f775a7 (2026-08-15). Data as JSON: /api/errors/9d5b9d10c5cc0b41. Report an issue: GitHub.