github/github-mcp-server · error

failed to query repository metadata: %w

Error message

failed to query repository metadata: %w

What it means

As part of a lockdown check the cache runs a GraphQL query for repository(owner:, name:){ isPrivate } with the viewer login piggy-backed. GitHub answers 'Could not resolve to a Repository' (a 404-equivalent) when the repo does not exist or is invisible to the token - by far the most common wrapped error here; the remainder are auth/network failures. The isPrivate result feeds IsSafeContent's private-repo allowance.

Source

Thrown at pkg/lockdown/lockdown.go:264

		return false, "", fmt.Errorf("nil GraphQL client")
	}

	var query struct {
		Viewer struct {
			Login githubv4.String
		}
		Repository struct {
			IsPrivate githubv4.Boolean
		} `graphql:"repository(owner: $owner, name: $name)"`
	}

	variables := map[string]any{
		"owner": githubv4.String(owner),
		"name":  githubv4.String(repo),
	}

	if err := c.client.Query(ctx, &query, variables); err != nil {
		return false, "", fmt.Errorf("failed to query repository metadata: %w", err)
	}

	c.logDebug(ctx, fmt.Sprintf("queried repo access info for %s/%s: isPrivate=%t", owner, repo, bool(query.Repository.IsPrivate)))

	return bool(query.Repository.IsPrivate), string(query.Viewer.Login), nil
}

// checkPushAccess checks if the user has push access to the repository via the REST permission endpoint.
func (c *RepoAccessCache) checkPushAccess(ctx context.Context, username, owner, repo string) (bool, error) {
	if c.restClient == nil {
		return false, fmt.Errorf("nil REST client")
	}

	permLevel, _, err := c.restClient.Repositories.GetPermissionLevel(ctx, owner, repo, username)
	if err != nil {
		return false, fmt.Errorf("failed to get user permission level: %w", err)
	}

View on GitHub (pinned to 0ea1f775a7)

Solutions

1. Verify owner and repo spelling in the tool arguments - typos and stale references dominate
2. Confirm the token can see the repo: `gh repo view owner/repo` with the same token, or check /repos/{owner}/{repo} returns 200
3. Check GITHUB_HOST matches the instance the repository actually lives on
4. In callers, treat the 404-shaped wrapped error as 'not accessible' rather than a crash

// pre-check visibility before lockdown-dependent tool calls
if _, err := restClient.Repositories.Get(ctx, owner, repo); err != nil {
	return fmt.Errorf("repo %s/%s is not visible to this token; fix owner/repo or token access", owner, repo)
}

if _, err := cache.IsSafeContent(ctx, user, owner, repo); err != nil {
	if strings.Contains(err.Error(), "Could not resolve to a Repository") || strings.Contains(err.Error(), "Not Found") {
		// repo missing or invisible to the token: reject/skip the content, do not retry
	}
}

When it happens

Trigger: Lockdown evaluation of a tool call whose owner/repo arguments name a repo that does not exist, was renamed/transferred, or is private to a token without access; or GITHUB_HOST pointing at a different GitHub instance than the one hosting the repo.

Common situations: Stale owner/repo pairs after forks or renames; org-private repos accessed with a token not in the org; dotcom/GHES cross-instance confusion.

Related errors

• failed to get issue ID: %w
• perPage value %d exceeds maximum of 100
• perPage value %d cannot be negative
• failed to get latest release: %w
• failed to list repository security advisories: %w

AI-assisted analysis of github/github-mcp-server@0ea1f775a7 (2026-08-15). Data as JSON: /api/errors/2f8250b8d0e369dd. Report an issue: GitHub.