René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"list_dependabot_alerts fails with HTTP 400 since pagination was added (page-based params on a cursor-only API)","articleBody":"### Describe the bug\n\nSince #2451 (merged 2026-05-20), `list_dependabot_alerts` always returns:\n\n```\n400 Pagination using the `page` parameter is not supported\n```\n\nThe tool is effectively unusable — **any** call fails, regardless of arguments, because the handler unconditionally sends `page=1`.\n\nThe GitHub Dependabot alerts REST API (`GET /repos/{owner}/{repo}/dependabot/alerts`) does **not** support page-based pagination. It only supports cursor-based pagination (`before` / `after`). Sending a `page` query parameter is rejected with a 400.\n\n### Root cause\n\n#2451 wired all three GHAS list tools to the **page-based** helper `OptionalPaginationParams`, which defaults `page` to `1`:\n\n```go\n// pkg/github/params.go\nfunc OptionalPaginationParams(args map[string]any) (PaginationParams, error) {\n    page, err := OptionalIntParamWithDefault(args, \"page\", 1) // \u003c- always 1 by default\n    ...\n}\n```\n\n`pkg/github/dependabot.go` then puts that on the request options unconditionally:\n\n```go\npagination, err := OptionalPaginationParams(args)\n...\nListOptions: github.ListOptions{\n    Page:    pagination.Page,    // = 1  -\u003e sent as ?page=1 -\u003e 400\n    PerPage: pagination.PerPage,\n},\n```\n\nSo a `page` query param is sent on every call, which the Dependabot alerts endpoint rejects.\n\nThis is correct for `list_code_scanning_alerts` (that endpoint *does* support `page`), which is likely why it slipped through review — only one of the three endpoints in the PR is cursor-only.\n\nThe codebase already has the right helper for this case, in the same file:\n\n```go\n// pkg/github/params.go\n// OptionalCursorPaginationParams returns the \"perPage\" and \"after\" parameters,\n// without the \"page\" parameter, suitable for cursor-based pagination only.\nfunc OptionalCursorPaginationParams(args map[string]any) (CursorPaginationParams, error) { ... }\n```\n\n### Suggested fix\n\nSwitch `list_dependabot_alerts` from page-based to cursor-based pagination:\n\n- Use `WithCursorPagination(schema)` instead of `WithPagination(schema)` so the tool exposes `perPage` / `after` but **not** `page`.\n- In the handler, use `OptionalCursorPaginationParams(args)` and populate only `PerPage` and `After` on `github.AlertListOptions` (do not set `Page`).\n\n`secret_scanning.go` should be audited too — the secret scanning alerts API is likewise cursor-based and may have the same regression.\n\n### Why tests didn't catch it\n\n`dependabot_test.go` mocks the GitHub API and happily returns data for `page=1`, so the real 400 from the live endpoint never surfaces in CI. A test that asserts no `page` query parameter is sent (or a mock that 400s on `page`) would have caught it.\n\n### Steps to reproduce\n\n1. Call `list_dependabot_alerts` with any args, e.g. `{ \"owner\": \"\u003corg\u003e\", \"repo\": \"\u003crepo\u003e\", \"state\": \"fixed\" }`.\n2. Observe: `400 Pagination using the page parameter is not supported`.\n\n### Workaround\n\nUse the REST API directly, which negotiates cursor pagination correctly:\n\n```bash\ngh api repos/{owner}/{repo}/dependabot/alerts --paginate -f state=fixed\n```\n\n### Affected version\n\nRemote/hosted MCP server, and any build including #2451 (merged 2026-05-20).\n\n### References\n\n- Introduced by #2451 (\"feat: add pagination to list GHAS alerts tools\")\n- Originating feature request: #2363\n","author":{"url":"https://github.com/Janosch","@type":"Person","name":"Janosch"},"datePublished":"2026-06-08T15:38:14.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/2649/github-mcp-server/issues/2649"}