403 Forbidden for some users | Remote MCP

[hayescode]

Describe the bug

I am able to use the remote MCP server with my classic PAT with (repo/user) permissions. When some of my co-workers create a classic PAT with the exact permission/expiration/etc. they get 403 forbidden. Code/Token is identical so I am perplexed.

Code

from openai.types.responses.tool_param import Mcp
import utils.credentials as creds
from openai import AsyncOpenAI

llm = AsyncOpenAI(
    base_url=creds.AZURE_OPENAI_BASE+"openai/v1/",
    api_key=creds.AZURE_OPENAI_KEY,
    default_query={"api-version": "preview"},
)
pat_token = 'ghp_xxx'

mcp_github = Mcp(
    server_label="github",
    server_url="https://api.githubcopilot.com/mcp/",
    type="mcp",
    headers={"Authorization": f"Bearer {pat_token}"},
    require_approval="never"
)

response = await llm.responses.create(
    model="gpt-4.1",
    tools=[mcp_github],
    input="What is my GitHub username?",
)
print(response.output_text)

InternalServerError: Error code: 500 - {'error': {'message': "Error retrieving tool list from MCP server: 'github'. Http status code: 403 (Forbidden)", 'type': 'external_connector_error', 'param': 'tools', 'code': 'http_error'}}

[hayescode]

i guess a copilot license is required to use it? Related to #660

[smflorentino]

I hope a copilot license is not required just to use their MCP server. That would be quite unfortunate.

[keirans]

I've also encountered this and there is another report of this issue below that can be combined with this one.

• Is a Copilot License required to use the remote MCP Server? #660

I've ensure that the access the token has suitable access, I don't currently have a full copilot licence however and am looking to integrate the github tools into other AI tools, in this case, Amazon Q Developer.

This is the first time i've set this up, but sounds like other people had this working previously without a full copilot licence.

Runtime environment is Ubuntu using npx as transport.

$ npx -y mcp-remote https://api.githubcopilot.com/mcp/ --header "Authorization: Bearer SNIPPED" 
[17685] Using automatically selected callback port: 8872
[17685] Using custom headers: {"Authorization":" Bearer SNIPPED"}
[17685] [17685] Connecting to remote server: https://api.githubcopilot.com/mcp/
[17685] Using transport strategy: http-first
[17685] Connection error: Error: Error POSTing to endpoint (HTTP 403): unauthorized: not licensed to use Copilot

    at StreamableHTTPClientTransport.send (file:///home/keiran/.npm/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-OXNXVROF.js:13266:15)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
[17685] Fatal error: Error: Error POSTing to endpoint (HTTP 403): unauthorized: not licensed to use Copilot

    at StreamableHTTPClientTransport.send (file:///home/keiran/.npm/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-OXNXVROF.js:13266:15)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
$ 

Tried an individual service URL as per the documentation here

And got the same error. So this issue is currently scoped MCP wide.

$ npx -y mcp-remote https://api.githubcopilot.com/mcp/x/pull_requests --header "Authorization: Bearer SNIPPED" 
[18149] Using automatically selected callback port: 15107
[18149] Using custom headers: {"Authorization":" Bearer SNIPPED"}
[18149] [18149] Connecting to remote server: https://api.githubcopilot.com/mcp/x/pull_requests
[18149] Using transport strategy: http-first
[18149] Connection error: Error: Error POSTing to endpoint (HTTP 403): unauthorized: not licensed to use Copilot

    at StreamableHTTPClientTransport.send (file:///home/keiran/.npm/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-OXNXVROF.js:13266:15)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
[18149] Fatal error: Error: Error POSTing to endpoint (HTTP 403): unauthorized: not licensed to use Copilot

    at StreamableHTTPClientTransport.send (file:///home/keiran/.npm/_npx/705d23756ff7dacc/node_modules/mcp-remote/dist/chunk-OXNXVROF.js:13266:15)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
$ 

Slight Update: I have also tried this with a PAT token created for my account which also throws the same error message.

Any guidance or feedback would be appreciated.

[LuluBeatson]

Thank you @hayescode, @smflorentino, @keirans for raising this.

A Copilot license is NOT required to use Remote GitHub MCP. We have resolved #660 today.

[hayescode]

Thanks @LuluBeatson !