github/github-mcp-server · warning

no authorization code in callback

Error message

no authorization code in callback

What it means

The callback request reached the server with the right shape (no error param, state matched) but carried no code query parameter, so there is nothing to exchange. Reported at internal/oauth/callback.go:103-106 after the empty-string check on q.Get("code"). The user sees the friendly page 'no authorization code received' while the flow records the precise error.

Source

Thrown at internal/oauth/callback.go:104

		if errCode := q.Get("error"); errCode != "" {
			msg := errCode
			if desc := q.Get("error_description"); desc != "" {
				msg = fmt.Sprintf("%s: %s", errCode, desc)
			}
			cs.report(callbackResult{err: fmt.Errorf("authorization failed: %s", msg)})
			renderError(w, msg)
			return
		}

		if q.Get("state") != expectedState {
			cs.report(callbackResult{err: fmt.Errorf("state mismatch (possible CSRF)")})
			renderError(w, "state mismatch")
			return
		}

		code := q.Get("code")
		if code == "" {
			cs.report(callbackResult{err: fmt.Errorf("no authorization code in callback")})
			renderError(w, "no authorization code received")
			return
		}

		cs.report(callbackResult{code: code})
		renderSuccess(w)
	})
	return mux
}

// report delivers the first outcome and drops later ones (the channel is
// buffered for one; subsequent redirect retries must not block the handler).
func (cs *callbackServer) report(res callbackResult) {
	select {
	case cs.results <- res:
	default:
	}
}

View on GitHub (pinned to 0ea1f775a7)

Solutions

1. Always reach /callback only via GitHub's redirect — open the authorization URL shown in the prompt and complete consent
2. Disable URL 'cleaning' features of extensions/security software for localhost
3. If a probe/monitor causes it, exclude the callback port from health checks
4. Retry the login flow — a clean attempt delivers code the first time

if strings.Contains(err.Error(), "no authorization code in callback") {
    // benign probe or param stripping: instruct the user to restart and use the redirect only
}

When it happens

Trigger: User navigates directly to http://localhost:PORT/callback by hand; a browser extension or prefetcher fetches the redirect URI without GitHub's parameters; a health-check/probe hits /callback; GitHub redirects with state but the code parameter is stripped by an over-aggressive URL cleaner or security product on the machine.

Common situations: Curious user typing the callback URL into the browser; antivirus/web-filter stripping unknown query params from localhost URLs; an old bookmark to the callback page; test suites probing the port; SSRF-ish scanners inside a container network hitting the published callback port.

Related errors

• App not connected
• authentication required: set GITHUB_PERSONAL_ACCESS_TOKEN, c
• authorization failed: %s
• state mismatch (possible CSRF)
• exchanging authorization code: %w

AI-assisted analysis of github/github-mcp-server@0ea1f775a7 (2026-08-15). Data as JSON: /api/errors/6b86325ebc795156. Report an issue: GitHub.