request_copilot_review returns 404 for PR author on cross-fork PR while GitHub UI succeeds #3027

Describe the bug

The request_copilot_review tool returns HTTP 404 when the authenticated user is the author of a public cross-fork pull request but does not have write access to the upstream repository.

The same user can successfully request and re-request a Copilot review using the GitHub web UI on the same pull request.

The MCP server is authenticated as sean-mcmanus. Other GitHub MCP read and write operations work correctly. The affected pull request is public: microsoft/vscode#328635. It targets microsoft/vscode:main from a branch in the author's sean-mcmanus/vscode fork.

The tool implementation calls the standard review-request REST endpoint with copilot-pull-request-reviewer[bot]. GitHub's documentation states that pull request authors can request reviews and that Copilot reviews can be requested through this endpoint.

Affected version

This uses the hosted remote GitHub MCP Server with OAuth, not the Docker image, so the Docker version command is not applicable.

VS Code MCP Gallery metadata reports version 1.6.0.

Sanitized configuration:

{
  "servers": {
    "io.github.github/github-mcp-server": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp/",
      "gallery": "https://api.mcp.github.com",
      "version": "1.6.0"
    }
  },
  "inputs": []
}

Steps to reproduce the behavior

1. Authenticate the remote GitHub MCP Server using OAuth as a GitHub user.

2. As that user, create a pull request from the user's fork into a public upstream repository where the user does not have write access.

3. Request an initial Copilot review through the GitHub web UI and wait for it to complete.

4. Push another commit to the pull request.

5. Invoke the MCP tool:

   request_copilot_review(
     owner="microsoft",
     repo="vscode",
     pullNumber=328635
   )
   

6. Observe that the tool returns HTTP 404.

7. Open the same pull request in the GitHub web UI and click Re-request review next to Copilot.

8. Observe that the web UI successfully requests another Copilot review.

Authentication can be verified with get_me, which returns sean-mcmanus.

Expected vs actual behavior

Expected

request_copilot_review successfully requests a Copilot review or re-review for a pull request authored by the authenticated user, consistent with the GitHub web UI and the documented REST API behavior.

A successful request should produce a new review-request event and start a Copilot review.

Actual

The MCP tool calls the review-request endpoint and receives HTTP 404, even though:

• The pull request exists and is publicly readable.
• The authenticated user is the pull request author.
• Copilot review is enabled for the repository.
• The same authenticated user can request the review through the GitHub web UI.
• Other GitHub MCP operations work.

Logs

failed to request copilot review:
POST https://api.github.com/repos/microsoft/vscode/pulls/328635/requested_reviewers:
404 Not Found []

The failing MCP request is equivalent to requesting:

{
  "reviewers": [
    "copilot-pull-request-reviewer[bot]"
  ]
}

Note

This bug report was created by Copilot (with GPT-5.6 Sol) after failing to use the MCP server and reading the docs at https://github.com/github/github-mcp-server/blob/main/README.md . (Claude Opus 4.8 also hit the issue earlier). It works when I have write access to the repo, e.g. https://github.com/microsoft/vscode-cpptools .