[awf] mcpg-proxy: GraphQL 404 on GHE Cloud data residency hosts

[lpcox]

Problem: On GHE Cloud with data residency (e.g., sj.ghe.com), the DIFC proxy (ghcr.io/github/gh-aw-mcpg:v0.3.19) correctly routes REST (/api/v3) but returns HTTP 404 for GraphQL (/api/graphql). The Copilot agent fails immediately on its first GraphQL call, blocking agent startup entirely.

Context: gh-aw#36209 — GHE Cloud data residency (sj.ghe.com), gh aw v0.76.1. Logs: [startup] Upstream GitHub API URL: (copilotapi.sj.ghe.com/redacted) ✓ then `HTTP 404: 404 Not Found ((localhost/redacted)

Root Cause: The DIFC/MCP gateway proxy does not map the /api/graphql path to the correct upstream for GHE data residency hosts. It resolves the upstream correctly for /api/v3 (REST) but lacks a route entry for /api/graphql, returning 404.

Proposed Solution:

1. In the MCP gateway proxy route table, forward /api/graphql to the same upstream host used for REST, applying the same host-resolution logic as /api/v3.
2. Validate GITHUB_GRAPHQL_URL at proxy startup and use it as the upstream target for all GraphQL requests.
3. Add an integration test covering GHE data-residency copilot-api.*.ghe.com endpoints for both REST and GraphQL paths.

Generated by Firewall Issue Dispatcher · sonnet46 4.4M · ◷

[github-actions]

👋 Hello! I noticed this issue might be related to existing issues:

• [awf] mcpg-proxy: GraphQL 404 on GHE Cloud data residency hosts #4477 — Exact duplicate: same title and body, created at the same timestamp (2026-06-07T07:54:35Z). This appears to be two issues filed simultaneously for the same problem — one of them can likely be closed.
• [awf] Security Guard workflow fails: DIFC proxy returns 404 on GraphQL API #2059 (closed) — "[awf] Security Guard workflow fails: DIFC proxy returns 404 on GraphQL API" — describes the same root symptom (DIFC/mcpg proxy returning HTTP 404 on /api/graphql), though the context differs (that issue was about localhost:18443 on github.com, while this one is specifically about GHE Cloud data residency hosts like sj.ghe.com).

If #4477 is a duplicate, please consider closing one of them. If your issue is distinct from #2059 (e.g., the GHE data residency path was not covered by that fix), feel free to clarify!

This is an automated message from the issue duplication detector.

Generated by Issue Duplication Detector for issue #4476 · sonnet46 602.3K · ◷

[lpcox]

Fixed in gh-aw-mcpg via PR #6861 (commit 81d43c8e).

The proxy's forwardToGitHub now detects GHE Cloud data residency hosts (copilot-api.*.ghe.com) and correctly routes /api/graphql to the upstream's /api/graphql path instead of returning 404. The fix is available in mcpg >= v0.3.20.