MCP Error Decoder
Search exact error strings and stack traces from Claude Desktop, Cursor, and OpenAI Codex CLI. Inspect root causes and copy verified terminal fixes.
GitHub MCP 403: Resource protected by organization SAML
GitHub MCP server fails to read enterprise repositories with 403 Forbidden error.
Your Personal Access Token (PAT) has not been authorized for SAML Single Sign-On (SSO) by the target GitHub Organization.
Visit GitHub Settings → Personal Access Tokens → Click 'Configure SSO' next to your token and authorize it for your organization.
# Verify GitHub PAT authorization:
curl -H "Authorization: token ghp_..." https://api.github.com/user/orgs# Verify GitHub PAT authorization:
curl.exe -H "Authorization: token ghp_..." https://api.github.com/user/orgs# Verify GitHub PAT authorization:
curl -H "Authorization: token ghp_..." https://api.github.com/user/orgs{
"mcpServers": {
"github": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-github"],
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_SAML_AUTHORIZED_TOKEN}"
}
}
}
}Architecture of Model Context Protocol Failures
MCP server issues typically stem from process isolation mismatches, stdio stream contamination, or environment inheritance limitations. Because the host AI application communicates across child-process stdio pipes or Server-Sent Events (SSE) connections, traditional browser debugging tools cannot directly capture errors.
Stdio vs. Stderr Separation
The primary rule of local MCP servers is that STDOUT belongs exclusively to the JSON-RPC wire protocol. If a server library outputs diagnostic logs, banner messages, or package notices to STDOUT, the host JSON parser crashes with an unrecoverable framing error. All server logging must route to STDERR.
GUI Subprocess Environment Isolation
Desktop GUI hosts (such as Claude Desktop or Cursor) are launched by the desktop window manager, not your shell profile (.bashrc or .zshrc). They inherit a minimal system PATH. Tools installed via nvm, pyenv, or Homebrew often require absolute binary paths in the configuration.