GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion

Summary

When running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials. The singleton is never updated to reflect later users' tokens.

Details

The singleton is defined in pkg/lockdown/lockdown.go:

var (
    instance   *RepoAccessCache
    instanceMu sync.Mutex
)

func GetInstance(client *githubv4.Client, opts ...RepoAccessOption) *RepoAccessCache {
    instanceMu.Lock()
    defer instanceMu.Unlock()
    if instance == nil {
        instance = &RepoAccessCache{
            client: client,  // only stored on first call
        }
    }
    return instance  // subsequent callers receive the same object regardless of their client
}

In HTTP mode, pkg/github/dependencies.go calls this per request:

func (d *RequestDeps) GetRepoAccessCache(ctx context.Context) (*lockdown.RepoAccessCache, error) {
    gqlClient, err := d.GetGQLClient(ctx)  // creates client with request's token
    ...
    instance := lockdown.GetInstance(gqlClient, d.RepoAccessOpts...)
    // gqlClient is silently dropped if singleton already exists
    return instance, nil
}

The singleton's internal client field is never updated after the first initialization. All lockdown GraphQL queries that check repository access and visibility (queryRepoAccessInfo, called by IsSafeContent) run under the first authenticated user's token for the lifetime of the process.

IsSafeContent is called in at least six places across pkg/github/issues.go and pkg/github/pullrequests.go to decide whether to trust or sanitize content from external contributors.

PoC

The following program demonstrates that two distinct GraphQL clients produce the same singleton pointer, confirming that the second client is discarded:

<img width="1642" height="450" alt="image" src="https://github.com/user-attachments/assets/bec46420-9ba7-458e-8710-62f951cb836a" />