host must use https to avoid sending credentials over cleart

Error message

host must use https to avoid sending credentials over cleartext: %s (http is only permitted for loopback hosts such as localhost, 127.0.0.1, or ::1)

What it means

A deliberate security control: requireSecureScheme rejects any non-https host except exact loopback names (localhost, 127.0.0.1, ::1), because every authenticated REST/GraphQL/upload/raw URL is derived from this host and cleartext http would expose the bearer token to interception and replay. There is no flag to bypass it for remote hosts.

Source

Thrown at pkg/utils/api.go:275

		return newGHECHost(s)
	default:
		return newGHESHost(s)
	}
}

// requireSecureScheme rejects hosts that would carry credentials over cleartext.
// Every REST/GraphQL/upload/raw/authorization URL is derived from this host and
// used for authenticated requests, so an http scheme would expose the bearer
// token/PAT to network interception and replay. http is permitted only for
// loopback hosts so that local development against a dev server still works.
func requireSecureScheme(u *url.URL) error {
	if u.Scheme == "https" {
		return nil
	}
	if u.Scheme == "http" && isLoopbackHost(u.Hostname()) {
		return nil
	}
	return fmt.Errorf(
		"host must use https to avoid sending credentials over cleartext: %s (http is only permitted for loopback hosts such as localhost, 127.0.0.1, or ::1)",
		u.Scheme+"://"+u.Hostname(),
	)
}

// isLoopbackHost reports whether hostname is a loopback address. Only exact
// loopback names/addresses qualify, so credentials are never sent in cleartext
// to a remote host.
func isLoopbackHost(hostname string) bool {
	switch strings.ToLower(hostname) {
	case "localhost", "127.0.0.1", "::1":
		return true
	default:
		return false
	}
}

// HostType identifies which GitHub deployment a host refers to. Tools use this

View on GitHub (pinned to 0ea1f775a7)

Solutions

Serve the appliance over TLS (or terminate TLS at a reverse proxy) and keep GITHUB_HOST=https://...; import the internal CA into the system trust store if self-signed
For local development only, use a loopback host: http://localhost:PORT
Do not try to bypass the check - fix the transport instead; the restriction is intentional

Example fix

# before
GITHUB_HOST=http://github.internal.example.com

# after
GITHUB_HOST=https://github.internal.example.com  # TLS at appliance/proxy; internal CA trusted by the OS

Defensive patterns

Strategy: validation

Validate before calling

func secureHost(s string) error {
	u, err := url.Parse(strings.TrimSpace(s))
	if err != nil {
		return err
	}
	if u.Scheme == "http" && !isLoopback(u.Hostname()) {
		return fmt.Errorf("refusing cleartext http for %s: enable TLS or use a loopback host", u.Host)
	}
	return nil
}
func isLoopback(h string) bool {
	switch strings.ToLower(h) {
	case "localhost", "127.0.0.1", "::1":
		return true
	}
	return false
}

Prevention

Provision TLS (or a TLS-terminating proxy) before pointing the server at GHES
Trust internal CAs at the OS level instead of downgrading to http
Reserve http:// for loopback development setups only

When it happens

Trigger: GITHUB_HOST=http://github.example.com for a non-loopback host - typically an attempt to work around TLS certificate problems on a GHES appliance or internal proxy. Note 'localhost' with a port (http://localhost:8080) is accepted.

Common situations: GHES fronted by plain HTTP on an internal network; test environments without certificates; misconfigured TLS termination where operators downgrade to http instead of fixing trust.

Related errors

AI-assisted analysis of github/github-mcp-server@0ea1f775a7 (2026-08-15). Data as JSON: /api/errors/27b7cbec8d4bc834. Report an issue: GitHub.