What causes "GitHub App REST base URL is required" in github/github-mcp-server?

Read the wrapped cause to route the fix (auth vs host config)

GitHub App REST base URL is required

Error message

GitHub App REST base URL is required

What it means

Thrown by the unstar_repository tool handler when deps.GetClient(ctx) fails before client.Activity.Unstar runs. In per-request deployments (RequestDeps) the client is built from token info in the context plus API host config, so the wrapped cause is 'no token info in context', 'failed to get base REST URL'/'failed to get upload URL', or 'failed to create REST client'. Stdio BaseDeps returns a stored client and cannot produce this error.

Source

Thrown at internal/githubapp/githubapp.go:59

	// PrivateKeyPEM is the RSA key used to sign app JWTs.
	PrivateKeyPEM []byte

	// BaseRESTURL is the REST API base, e.g. https://api.github.com/ for
	// github.com or https://HOST/api/v3/ for GitHub Enterprise Server.
	BaseRESTURL string
}

func (c Config) validate() error {
	switch {
	case c.AppID == "":
		return errors.New("GitHub App ID or client ID is required (GITHUB_APP_ID)")
	case c.InstallationID == "":
		return errors.New("GitHub App installation ID is required (GITHUB_APP_INSTALLATION_ID)")
	case len(c.PrivateKeyPEM) == 0:
		return errors.New("GitHub App private key is required (GITHUB_APP_PRIVATE_KEY_PATH or GITHUB_APP_PRIVATE_KEY)")
	case c.BaseRESTURL == "":
		return errors.New("GitHub App REST base URL is required")
	}
	return nil
}

func parsePrivateKey(pemBytes []byte) (*rsa.PrivateKey, error) {
	block, _ := pem.Decode(pemBytes)
	if block == nil {
		return nil, errors.New("no PEM block found in private key")
	}
	if key, err := x509.ParsePKCS1PrivateKey(block.Bytes); err == nil {
		return key, nil
	}
	parsed, err := x509.ParsePKCS8PrivateKey(block.Bytes)
	if err != nil {
		return nil, fmt.Errorf("parsing private key (want PKCS#1 or PKCS#8 RSA): %w", err)
	}
	key, ok := parsed.(*rsa.PrivateKey)
	if !ok {

View on GitHub (pinned to 0ea1f775a7)

Solutions

Read the wrapped cause to route the fix (auth vs host config)
Provide a valid token with 'user' scope to the server process/request
Correct API host env vars and restart
Smoke-test auth before running unstar workflows

Example fix

// before
//   unstar_repository -> "failed to get GitHub client: failed to get base REST URL: ..."
export GITHUB_BASE_URL="github.example.com"  # missing scheme

// after
export GITHUB_BASE_URL="https://github.example.com"
export GITHUB_PERSONAL_ACCESS_TOKEN=ghp_xxxxxxxxxxxx

Defensive patterns

Strategy: try-catch

Validate before calling

func preflightGitHubClient() error {
	if os.Getenv("GITHUB_PERSONAL_ACCESS_TOKEN") == "" {
		return fmt.Errorf("missing token: unstar_repository cannot build a client")
	}
	return nil
}

Type guard

func isGitHubClientError(err error) bool {
	return err != nil && strings.Contains(err.Error(), "failed to get GitHub client")
}

Try / catch

result, _, err := callUnstarRepository(ctx, owner, repo)
if err != nil {
	if isGitHubClientError(err) {
		// deterministic config fault: fix token/host env, restart, then re-run
		return fmt.Errorf("server auth/host misconfiguration: %w", err)
	}
	return err
}

Prevention

Check enterprise URL env vars include the scheme (https://)
Re-verify tokens after infrastructure migrations
Smoke-test with get_me before unstar workflows
Alert on client-construction errors instead of retrying them

When it happens

Trigger: Calling unstar_repository when no token info is present in the context, when enterprise host env vars are malformed, or when go-github rejects the configured URLs.

Common situations: Expired or missing GITHUB_PERSONAL_ACCESS_TOKEN; gateway not forwarding Authorization; enterprise URL misconfig after infrastructure migration.

Related errors

AI-assisted analysis of github/github-mcp-server@0ea1f775a7 (2026-08-15). Data as JSON: /api/errors/572197f6aea10bb2. Report an issue: GitHub.