github/github-mcp-server · error

host must use https to avoid sending credentials over…

Error message

host must use https to avoid sending credentials over cleartext: %s (http is only permitted for loopback hosts such as localhost, 127.0.0.1, or ::1)

What it means

A deliberate security control: requireSecureScheme rejects any non-https host except exact loopback names (localhost, 127.0.0.1, ::1), because every authenticated REST/GraphQL/upload/raw URL is derived from this host and cleartext http would expose the bearer token to interception and replay. There is no flag to bypass it for remote hosts.

Solutions

1. Serve the appliance over TLS (or terminate TLS at a reverse proxy) and keep GITHUB_HOST=https://...; import the internal CA into the system trust store if self-signed
2. For local development only, use a loopback host: http://localhost:PORT
3. Do not try to bypass the check - fix the transport instead; the restriction is intentional

Example fix

# before
GITHUB_HOST=http://github.internal.example.com

# after
GITHUB_HOST=https://github.internal.example.com  # TLS at appliance/proxy; internal CA trusted by the OS

func secureHost(s string) error {
	u, err := url.Parse(strings.TrimSpace(s))
	if err != nil {
		return err
	}
	if u.Scheme == "http" && !isLoopback(u.Hostname()) {
		return fmt.Errorf("refusing cleartext http for %s: enable TLS or use a loopback host", u.Host)
	}
	return nil
}
func isLoopback(h string) bool {
	switch strings.ToLower(h) {
	case "localhost", "127.0.0.1", "::1":
		return true
	}
	return false
}

When it happens

Trigger: GITHUB_HOST=http://github.example.com for a non-loopback host - typically an attempt to work around TLS certificate problems on a GHES appliance or internal proxy. Note 'localhost' with a port (http://localhost:8080) is accepted.

Common situations: GHES fronted by plain HTTP on an internal network; test environments without certificates; misconfigured TLS termination where operators downgrade to http instead of fixing trust.

Related errors

• failed to get GitHub client
• failed to get GitHub client
• host must have a scheme (http or https)
• authentication required: set GITHUB_PERSONAL_ACCESS_TOKEN…
• could not parse host as URL

AI-assisted analysis of github/github-mcp-server@0ea1f775a7 (2026-08-15). Data as JSON: /api/errors/27b7cbec8d4bc834. Report an issue: GitHub.

Appendix: source

Thrown at pkg/utils/api.go:275

		return newGHECHost(s)
	default:
		return newGHESHost(s)
	}
}

// requireSecureScheme rejects hosts that would carry credentials over cleartext.
// Every REST/GraphQL/upload/raw/authorization URL is derived from this host and
// used for authenticated requests, so an http scheme would expose the bearer
// token/PAT to network interception and replay. http is permitted only for
// loopback hosts so that local development against a dev server still works.
func requireSecureScheme(u *url.URL) error {
	if u.Scheme == "https" {
		return nil
	}
	if u.Scheme == "http" && isLoopbackHost(u.Hostname()) {
		return nil
	}
	return fmt.Errorf(
		"host must use https to avoid sending credentials over cleartext: %s (http is only permitted for loopback hosts such as localhost, 127.0.0.1, or ::1)",
		u.Scheme+"://"+u.Hostname(),
	)
}

// isLoopbackHost reports whether hostname is a loopback address. Only exact
// loopback names/addresses qualify, so credentials are never sent in cleartext
// to a remote host.
func isLoopbackHost(hostname string) bool {
	switch strings.ToLower(hostname) {
	case "localhost", "127.0.0.1", "::1":
		return true
	default:
		return false
	}
}

// HostType identifies which GitHub deployment a host refers to. Tools use this

View on GitHub (pinned to 0ea1f775a7)