github/github-mcp-server · error

failed to list repository security advisories

Error message

failed to list repository security advisories: %w

What it means

client.SecurityAdvisories.ListRepositorySecurityAdvisories returned an error. go-github converts any non-2xx into an error, so the usual causes are 404 (owner/repo typo, repo renamed or deleted, or token lacks read access to a private repo), 403 (rate limit or blocked), and transport failures. Like the global variant, the raw error is wrapped directly rather than going through the structured GitHubAPIErrorResponse helper.

Solutions

1. Unwrap with errors.As(err, *github.ErrorResponse): 404 -> verify owner/repo spelling and that the token can see the repo; 403 -> check rate limit and scopes
2. Confirm the repo is reachable: curl -H "Authorization: Bearer $TOKEN" https://api.github.com/repos/OWNER/REPO
3. On rate limits, back off until x-ratelimit-reset
4. Code improvement: use NewGitHubAPIErrorResponse for structured API-error messages

Example fix

// before
advisories, resp, err := client.SecurityAdvisories.ListRepositorySecurityAdvisories(ctx, owner, repo, opts)
if err != nil {
    return nil, nil, fmt.Errorf("failed to list repository security advisories: %w", err)
}
// after
var ghErr *github.ErrorResponse
if errors.As(err, &ghErr) {
    return ghErrors.NewGitHubAPIErrorResponse(ctx, "failed to list repository security advisories", resp, err), nil, nil
}
return nil, nil, fmt.Errorf("failed to list repository security advisories: %w", err)

// Verify the repo is visible with this token before listing advisories
repoResp, err := client.Repositories.Get(ctx, owner, repo)
if err != nil {
    var ghErr *github.ErrorResponse
    if errors.As(err, &ghErr) && ghErr.Response != nil && ghErr.Response.StatusCode == 404 {
        return fmt.Errorf("repo %s/%s not visible to this token", owner, repo)
    }
    return fmt.Errorf("repo check failed: %w", err)
}

func isGitHubAPIError(err error) (*github.ErrorResponse, bool) {
	var ghErr *github.ErrorResponse
	if errors.As(err, &ghErr) {
		return ghErr, true
	}
	return nil, false
}

func isRetryableListErr(err error) bool {
	ghErr, ok := isGitHubAPIError(err)
	if !ok {
		var netErr net.Error
		return errors.As(err, &netErr)
	}
	return ghErr.Response != nil &&
		(ghErr.Response.StatusCode == 429 || ghErr.Response.StatusCode >= 500)
}

advisories, resp, err := client.SecurityAdvisories.ListRepositorySecurityAdvisories(ctx, owner, repo, opts)
if err != nil {
    if ghErr, ok := isGitHubAPIError(err); ok {
        switch ghErr.Response.StatusCode {
        case 404:
            return nil, fmt.Errorf("repo %s/%s not found or inaccessible; check spelling and token scope", owner, repo)
        case 403, 429:
            time.Sleep(backoff)
            return listAgain(ctx, owner, repo, opts)
        }
    }
    if isRetryableListErr(err) {
        return listAgain(ctx, owner, repo, opts)
    }
    return nil, fmt.Errorf("failed to list repository security advisories: %w", err)
}

When it happens

Trigger: Calling the tool with a misspelled owner/repo; repo renamed so the old name 404s; PAT without access to the private repo; primary rate limit exhausted; DNS/TLS failures to the API host.

Common situations: Hardcoded repo names drifting after renames; scoped fine-grained PATs missing the repository; CI rate-limit pressure.

Related errors

• failed to list global security advisories
• failed to fetch raw content
• failed to get GitHub client
• failed to get GitHub client
• failed to get issue ID

AI-assisted analysis of github/github-mcp-server@0ea1f775a7 (2026-08-15). Data as JSON: /api/errors/062b3f2613e3d84d. Report an issue: GitHub.

Appendix: source

Thrown at pkg/github/security_advisories.go:299

			client, err := deps.GetClient(ctx)
			if err != nil {
				return nil, nil, fmt.Errorf("failed to get GitHub client: %w", err)
			}

			opts := &github.ListRepositorySecurityAdvisoriesOptions{}
			if direction != "" {
				opts.Direction = direction
			}
			if sortField != "" {
				opts.Sort = sortField
			}
			if state != "" {
				opts.State = state
			}

			advisories, resp, err := client.SecurityAdvisories.ListRepositorySecurityAdvisories(ctx, owner, repo, opts)
			if err != nil {
				return nil, nil, fmt.Errorf("failed to list repository security advisories: %w", err)
			}
			defer func() { _ = resp.Body.Close() }()

			if resp.StatusCode != http.StatusOK {
				body, err := io.ReadAll(resp.Body)
				if err != nil {
					return nil, nil, fmt.Errorf("failed to read response body: %w", err)
				}
				return ghErrors.NewGitHubAPIStatusErrorResponse(ctx, "failed to list repository advisories", resp, body), nil, nil
			}

			r, err := json.Marshal(advisories)
			if err != nil {
				return nil, nil, fmt.Errorf("failed to marshal advisories: %w", err)
			}

			result := utils.NewToolResultText(string(r))
			// Repository advisories carry externally authored prose (untrusted).

View on GitHub (pinned to 0ea1f775a7)