fix: use ServerVersion for connection check instead of GetMyUserInfo #112

Merged

synath merged 0 commits from refs/pull/112/head into main

2026-05-02 09:59:35 +00:00

synath commented

2026-05-02 02:57:29 +00:00

(Migrated from codeberg.org)

Problem

VerifyConnection() and HealthCheck() both call GetMyUserInfo() as a connectivity probe. This requires the read:user scope.

Forgejo enforces that tokens scoped to specific repositories can only use read:issue, write:issue, read:repository, and write:repository — read:user is explicitly disallowed. This causes the server to crash at startup with:

token does not have at least one of required scope(s): [read:user]

This affects any user following least-privilege token practices by scoping their token to specific repositories.

Fix

Replace GetMyUserInfo() with Client().ServerVersion(), which hits /api/v1/version. That endpoint requires no authentication at all, making it a strictly better connectivity probe: it confirms the server is reachable and the URL is correct without imposing any scope requirements on the token.

The log output is adjusted accordingly — server_version is logged instead of authenticated_user.

Testing

Tested against Codeberg with a repository-scoped token (issue + repository scopes only). Server starts cleanly, registers all tools, and responds to MCP handshake.

## Problem `VerifyConnection()` and `HealthCheck()` both call `GetMyUserInfo()` as a connectivity probe. This requires the `read:user` scope. Forgejo enforces that tokens scoped to specific repositories can only use `read:issue`, `write:issue`, `read:repository`, and `write:repository` — `read:user` is explicitly disallowed. This causes the server to crash at startup with: ``` token does not have at least one of required scope(s): [read:user] ``` This affects any user following least-privilege token practices by scoping their token to specific repositories. ## Fix Replace `GetMyUserInfo()` with `Client().ServerVersion()`, which hits `/api/v1/version`. That endpoint requires no authentication at all, making it a strictly better connectivity probe: it confirms the server is reachable and the URL is correct without imposing any scope requirements on the token. The log output is adjusted accordingly — `server_version` is logged instead of `authenticated_user`. ## Testing Tested against Codeberg with a repository-scoped token (issue + repository scopes only). Server starts cleanly, registers all tools, and responds to MCP handshake.

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

agentic-forges/forgejo-mcp!112

No description provided.

Rows
Columns