agentic-forges/forgejo-mcp
Watch
5
0
Fork
You've already forked forgejo-mcp
 1
Code Issues 9 Pull requests 5 Projects Releases 32 Packages 1 Activity

fix: use ServerVersion for connection check instead of GetMyUserInfo #112

Merged
synath merged 0 commits from refs/pull/112/head into main 2026-05-02 09:59:35 +00:00
Conversation 0 Commits - Files changed 331 +2656 -38717
synath commented 2026-05-02 02:57:29 +00:00 (Migrated from codeberg.org)
Copy link

Problem

VerifyConnection() and HealthCheck() both call GetMyUserInfo() as a connectivity probe. This requires the read:user scope.

Forgejo enforces that tokens scoped to specific repositories can only use read:issue, write:issue, read:repository, and write:repository — read:user is explicitly disallowed. This causes the server to crash at startup with:

token does not have at least one of required scope(s): [read:user]

This affects any user following least-privilege token practices by scoping their token to specific repositories.

Fix

Replace GetMyUserInfo() with Client().ServerVersion(), which hits /api/v1/version. That endpoint requires no authentication at all, making it a strictly better connectivity probe: it confirms the server is reachable and the URL is correct without imposing any scope requirements on the token.

The log output is adjusted accordingly — server_version is logged instead of authenticated_user.

Testing

Tested against Codeberg with a repository-scoped token (issue + repository scopes only). Server starts cleanly, registers all tools, and responds to MCP handshake.

## Problem `VerifyConnection()` and `HealthCheck()` both call `GetMyUserInfo()` as a connectivity probe. This requires the `read:user` scope. Forgejo enforces that tokens scoped to specific repositories can only use `read:issue`, `write:issue`, `read:repository`, and `write:repository` — `read:user` is explicitly disallowed. This causes the server to crash at startup with: ``` token does not have at least one of required scope(s): [read:user] ``` This affects any user following least-privilege token practices by scoping their token to specific repositories. ## Fix Replace `GetMyUserInfo()` with `Client().ServerVersion()`, which hits `/api/v1/version`. That endpoint requires no authentication at all, making it a strictly better connectivity probe: it confirms the server is reachable and the URL is correct without imposing any scope requirements on the token. The log output is adjusted accordingly — `server_version` is logged instead of `authenticated_user`. ## Testing Tested against Codeberg with a repository-scoped token (issue + repository scopes only). Server starts cleanly, registers all tools, and responds to MCP handshake.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
Compat/Breaking
Breaking change that won't be backward compatible

  
Kind/Bug
Something is not working

  
Kind/Documentation
Documentation changes

  
Kind/Enhancement
Improve existing functionality

  
Kind/Feature
New functionality

  
Kind/OpenSpec
OpenSpec change proposal / spec-driven work

  
Kind/Security
This is security issue

  
Kind/Testing
Issue or pull request related to testing

  
Priority/Critical
The priority is critical

  
Priority/High
The priority is high

  
Priority/Low
The priority is low

  
Priority/Medium
The priority is medium

  
RFC - Request For Comments
Request For Comments — design/spec open for feedback before implementation

  
Reviewed/Confirmed
Issue has been confirmed

  
Reviewed/Duplicate
This issue or pull request already exists

  
Reviewed/Invalid
Invalid issue

  
Reviewed/Won't Fix
This issue won't be fixed

  
Status/Abandoned
Somebody has started to work on this but abandoned work

  
Status/Blocked
Something is blocking this issue or pull request

  
Status/Need More Info
Feedback is required to reproduce issue or to continue work

  
approved
Spec/deliverable approved (set by castra finish)

  
area:client-host
Issues in the Phase 1 client host (pi.dev) lane

  
area:item-interaction
Issues in the item interaction foundation lane

  
area:meta-tooling
Issues in the meta-tooling lane (castra, agent coordination, skill maintenance)

  
area:operator-dev-loop
Issues in the operator and development loop lane

  
area:repository-hygiene
Issues in the repository hygiene and small-fix lane

  
area:typescript-sdk
Issues in the TypeScript SDK / server parity lane

  
area:website
Issues for public website and domain-facing surfaces

  
blocked
Agent cannot proceed; prerequisite missing or ambiguous input

  
bug
Bounded defect fix; handled directly without an openspec change

  
castra:bot-active
castra is actively working this

  
castra:human
Castra escalated — human must look closely (remove to hand back)

  
change
Feature or design work; routed through the openspec change flow

  
checker:tobi
Trigger castra checker-tobi — print the version step + a haiku-written version-info background

  
close-suggested
intake: recommended for closing (noise/obsolete)

  
code
Trigger castra code bot — implement issue, push branch, open PR

  
copilot-conflict
Trigger Copilot cloud agent to resolve an existing PR merge conflict

  
deferred
Out of current scope; excluded from triage and routing until removed

  
dependencies
Pull requests that update a dependency file

  
docs-ok
Authorable-surface PR checked — no docs/modding change needed (skips docs-modding gate)

  
enhancement

   
fast-track
Human-scoped — portfolio-em sends straight to code (skip intake)

  
groom:close-suggested
groom: recommended for closing (noise/obsolete)

  
hermes-attempted
Hermes attempted but produced no changes

  
hermes-needs-clarification
Quality gate flagged, needs human input

  
hermes-ready
Ready for hermes to process

  
hermes-review
Hermes PR awaiting review

  
hermes-wip
Hermes is working on this

  
human
A human must act before any agent continues (fullsend escalation)

  
human-required
Hermes gave up after 3 attempts

  
intake
Trigger castra-intake — assess one issue end-to-end (ADR-0051 entry)

  
merge
Authorize castra-merge: bring up to date with main, resolve conflicts, merge when CI green

  
merge-conflict
PR conflicts with the base branch — resolve before merge

  
needs-scope
groom: real but needs scoping/decision

  
no-concept-doc

   
no-demo
Refactor/CI-only PR with no demo to show (skips demo gate)

  
plan-approved
Plan reviewed and approved — castra dispatches implementer on next run

  
plan-needs-revision
castra plan-implement: AI returned blocked — review reason in latest *update — blocked PR comment

  
portfolio:infrastructure
Portfolio class: build/test/agent/CI/telemetry/dev-loop/repo operations

  
portfolio:mixed
Portfolio class: both product-facing and infrastructure/tooling work are load-bearing

  
portfolio:product
Portfolio class: product-facing behavior, authored world semantics, clients, or product promise

  
portfolio:unknown
Portfolio class: insufficient evidence to classify yet

  
prioritize
Trigger castra prioritize bot — RICE-scores via Claude

  
prioritized
RICE score assigned (detail in comment) — set by the portfolio layer

  
priority:high
RICE priority: high

  
priority:low
RICE priority: low

  
priority:medium
RICE priority: medium

  
propose
Trigger castra-propose — author an OpenSpec proposal (spec_first, canon-clean)

  
ready
groom: bounded + agent-implementable

  
retro
Trigger castra retro bot — files improvement proposals

  
retro-proposal
Improvement proposed by castra-retro

  
review
Trigger castra review bot — verdict via gh pr review

  
stage:backlog
Pipeline stage: not yet assessed

  
stage:blocked
Pipeline stage: blocked

  
stage:code
Pipeline stage: implementing

  
stage:done
Pipeline stage: merged/closed

  
stage:intake
Pipeline stage: intake assessment (ADR-0051)

  
stage:merge
Pipeline stage: READY — awaiting human merge

  
stage:propose
Pipeline stage: authoring an OpenSpec proposal (spec_first)

  
stage:review
Pipeline stage: in review

  
stage:waiting
Pipeline stage: waiting on a human/reporter

  
status:waiting
Agent done, waiting for human response

  
tracker
Living issue used to coordinate triage lanes

  
triage
Trigger castra triage bot — info-sufficiency assessment + label suggestion

No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/OpenSpec
Kind/Security
Kind/Testing
Priority/Critical
Priority/High
Priority/Low
Priority/Medium
RFC - Request For Comments
Reviewed/Confirmed
Reviewed/Duplicate
Reviewed/Invalid
Reviewed/Won't Fix
Status/Abandoned
Status/Blocked
Status/Need More Info
approved
area:client-host
area:item-interaction
area:meta-tooling
area:operator-dev-loop
area:repository-hygiene
area:typescript-sdk
area:website
blocked
bug
castra:bot-active
castra:human
change
checker:tobi
close-suggested
code
copilot-conflict
deferred
dependencies
docs-ok
enhancement
fast-track
groom:close-suggested
hermes-attempted
hermes-needs-clarification
hermes-ready
hermes-review
hermes-wip
human
human-required
intake
merge
merge-conflict
needs-scope
no-concept-doc
no-demo
plan-approved
plan-needs-revision
portfolio:infrastructure
portfolio:mixed
portfolio:product
portfolio:unknown
prioritize
prioritized
priority:high
priority:low
priority:medium
propose
ready
retro
retro-proposal
review
stage:backlog
stage:blocked
stage:code
stage:done
stage:intake
stage:merge
stage:propose
stage:review
stage:waiting
status:waiting
tracker
triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
agentic-forges/forgejo-mcp!112
No description provided.