DIFC proxy returns 404 on /api/graphql for github.com repos

[lpcox]

Summary

The DIFC proxy (mcpg) returns HTTP 404: Not Found when agents call the GitHub GraphQL API via https://localhost:18443/api/graphql. This causes Claude-engine workflows to spend all their turns retrying the failing call until they timeout.

Error

HTTP 404: Not Found (https://localhost:18443/api/graphql)

Root Cause

The /api/graphql path is the GHES-style endpoint. For github.com, the GraphQL endpoint is /graphql (no /api prefix). The proxy may not be rewriting the path correctly for github.com repos.

Affected Workflows

Any workflow using features.cli-proxy: true where the agent calls gh api graphql:

• security-guard (Claude engine)
• secret-digger-claude
• Potentially any Claude/Codex workflow using the GitHub MCP tools via cli-proxy

Reproduction

1. Create a PR in a github.com repo with cli-proxy enabled workflows
2. A Claude-engine workflow triggers (e.g., Security Guard)
3. Agent attempts GraphQL API call via cli-proxy
4. Gets 404 and retries until timeout

Example Run

• Run 24572922812 / Job 71850659501 (Security Guard in gh-aw-firewall)

Related

• bug: DIFC proxy returns 404 for GHES API paths (/api/graphql, /api/v3/...) #3969 — may be the same or related issue
• [awf] Security Guard workflow fails: DIFC proxy returns 404 on GraphQL API gh-aw-firewall#2059 — downstream tracking issue