Secure GitHub access for AI agents
Code hosting, pull requests, and project management
Through GitHub, agents can search code, open pull requests, triage issues, and manage branches across your repositories. Every call runs through your policies and is logged for audit.
Server URL: https://api.githubcopilot.com/mcp/x/all
Credential modes
GitHub supports two modes:
- Use SecureAuth's app – uses SecureAuth's pre-registered GitHub OAuth app, so there is no app to register on GitHub's side. Recommended for most installs.
- Bring your own app – uses a GitHub OAuth App your organization owns. Choose this when you need GitHub-side audit attribution, dedicated rate limits, or your own branding on the consent screen.
See Credential modes for how the modes compare.
Before you begin
- Administrator access to your Agent Authority workspace, to add the resource.
- A GitHub organization owner. Option 2 needs one to register the OAuth App. Option 1 needs one only if your organization restricts third-party OAuth apps, and needs no GitHub-side work at all otherwise.
Option 1 stays in the Agent Authority console. Option 2 moves between two consoles: you copy a redirect URI in the Agent Authority console, register an OAuth App in GitHub, then return to the console and paste the credentials. Keep both tabs open if you take option 2.
Setup
In the Agent Authority console, go to Resources → Add Resource and select GitHub. Because GitHub supports two credential modes, the console asks you to choose how to install GitHub and shows a card for each mode. Click the card for the option you want, then follow that option below.
Either way, an Admin setup required dialog appears once the resource is added. Its View setup guide button links back to whichever option below matches the mode you picked.
Option 1: Use SecureAuth's app
Picking this option installs the resource immediately, with all tools and scopes pre-configured and no separate confirmation step.
That is the whole setup unless your GitHub organization restricts third-party OAuth apps. With restrictions on, members cannot grant a third-party app access to organization data on their own. Until an owner approves SecureAuth AI Gateway, which is GitHub's name for the pre-registered app, it can read only the organization's public resources, not private repositories.
When a member first connects, GitHub prompts them to request approval (Request access → Request approval from owners), which surfaces the app for an owner to approve once:
- Profile picture (top right) → Your organizations → select the organization → Settings
- In the left sidebar, under Third-party Access, click OAuth app policy
- Next to SecureAuth AI Gateway, click Review, then Grant access
Members can then connect and reach private organization repositories.
Option 2: Bring your own app
Picking this option opens the credentials form. Step 1 starts there.
1. Copy the redirect URI
Copy the Redirect URI shown on the form, using the Copy button next to it. It includes your tenant's region, so copy it rather than typing it. It takes the form https://oauth.aisecurity.services.<region>.connect.secureauth.com/auth/callback.
Leave this page open. You come back to it in step 3.
2. Register an OAuth App in GitHub
Register the client as a GitHub OAuth App. GitHub also offers GitHub Apps, which use a different credential model and cannot supply the client ID and secret this form expects.
Sign in to GitHub and open your organization's developer settings:
https://github.com/organizations/<your-org>/settings/applications/newConfigure:
- Application name – your preferred name, for example
<your-company> AI Gateway - Homepage URL – your company's homepage
- Authorization callback URL – the Redirect URI you copied in step 1
Click Register application. On the app's settings page, copy the Client ID, then click Generate a new client secret and copy the secret straight away.
GitHub's OAuth App form has no scope field. See Required scopes for what the gateway requests at sign-in.
3. Finish in the console
Back on the GitHub form in the Agent Authority console, paste the Client ID and Client Secret. Leave Token Endpoint Authentication on Auto-detect. Then click Add.
The resource is added with all tools and scopes pre-configured.
Verify the connection
The gateway syncs the available GitHub tools automatically. To check the connection end to end, ask your agent to run a read-only request:
Show my GitHub user detailsIf your GitHub username and account details come back, the connection is working.
How users connect
Access is per user. Each additional user connects their own GitHub account the first time their agent calls a GitHub tool: the gateway returns a sign-in link, the user authorizes once, and the tools work from then on. Go to Connections to manage linked accounts.
Each call uses the signed-in user's own token, so GitHub's own repository and organization permissions control what they can reach. The gateway does not widen access beyond what the authenticated user could already do in GitHub.
Available tools
GitHub ships 86 tools. Tool names are matched exactly by policy rules unless you use a wildcard, so copy them from here verbatim. Check the Available Tools card on the resource's Overview tab in the Agent Authority console for the authoritative list of what your install actually exposes, since upstream catalogs change faster than these docs.
Repositories and files
| Tool | Tags | Description |
|---|---|---|
get_file_contents | read-only | Get the contents of a file or directory |
create_or_update_file | write | Create or update a single file |
delete_file | destructive | Delete a file from a repository |
push_files | write | Push multiple files in a single commit |
get_repository_tree | read-only | Get the file and directory tree at a ref or SHA |
search_code | read-only | Search code across GitHub repositories |
search_repositories | read-only | Find repositories by name, description, or topics |
create_repository | write | Create a new repository |
fork_repository | write | Fork a repository to your account or an org |
create_branch | write | Create a new branch |
list_branches | read-only | List branches |
list_commits | read-only | List commits of a branch |
get_commit | read-only | Get details for a commit |
get_tag | read-only | Get details about a git tag |
list_tags | read-only | List git tags |
get_latest_release | read-only | Get the latest release |
get_release_by_tag | read-only | Get a release by tag name |
list_releases | read-only | List releases |
list_repository_collaborators | read-only | List collaborators of a repository |
list_starred_repositories | read-only | List starred repositories |
star_repository | write | Star a repository |
unstar_repository | write | Unstar a repository |
Issues
| Tool | Tags | Description |
|---|---|---|
list_issues | read-only | List issues in a repository |
search_issues | read-only | Search issues across repositories |
issue_read | read-only | Get an issue, its comments, sub-issues, or labels |
issue_write | write | Create an issue (method=create) or update one (method=update) |
sub_issue_write | write | Add, remove, or reprioritize a sub-issue |
add_issue_comment | write | Add a comment to an issue or pull request |
list_issue_types | read-only | List supported issue types for an organization |
triage_issue | write | Record a triage rationale and apply labels, type, and fields |
semantic_issues_search | read-only | Find issues by natural-language query |
semantic_issue_similarity_search | read-only | Find issues semantically similar to a given issue |
Pull requests and reviews
| Tool | Tags | Description |
|---|---|---|
list_pull_requests | read-only | List pull requests |
search_pull_requests | read-only | Search pull requests across repositories |
create_pull_request | write | Create a new pull request |
update_pull_request | write | Update an existing pull request |
update_pull_request_branch | write | Update a PR branch with changes from its base |
merge_pull_request | destructive | Merge a pull request |
pull_request_read | read-only | Get a PR's details, diff, status, files, reviews, or checks |
pull_request_review_write | destructive | Create, submit, or delete reviews and resolve threads |
add_comment_to_pending_review | write | Add a comment to your pending review |
add_reply_to_pull_request_comment | write | Reply to an existing pull request comment |
Labels, gists, and discussions
| Tool | Tags | Description |
|---|---|---|
get_label | read-only | Get a label from a repository |
list_label | read-only | List labels from a repository |
label_write | destructive | Create, update, or delete repository labels |
list_gists | read-only | List gists for a user |
get_gist | read-only | Get the content of a gist |
create_gist | write, external | Create a new gist |
update_gist | write, external | Update an existing gist |
list_discussions | read-only | List discussions for a repository or organization |
get_discussion | read-only | Get a discussion by ID |
get_discussion_comments | read-only | Get comments from a discussion |
discussion_comment_write | destructive | Add, reply, update, delete, or mark answer comments |
list_discussion_categories | read-only | List discussion categories |
Actions and Projects
| Tool | Tags | Description |
|---|---|---|
actions_list | read-only | List workflows, workflow runs, jobs, or run artifacts |
actions_get | read-only | Get a workflow, run, job, artifact, usage, or logs URL |
actions_run_trigger | destructive | Run, re-run, cancel workflow runs, or delete run logs |
get_job_logs | read-only | Get logs for workflow jobs |
projects_list | read-only | List projects, project fields, and project items |
projects_get | read-only | Get details about a project, field, or item |
projects_write | destructive | Add, update, or delete project items, or create status updates |
Security
| Tool | Tags | Description |
|---|---|---|
run_secret_scanning | read-only | Scan supplied content or diffs for secrets |
get_code_scanning_alert | read-only | Get a code scanning alert |
list_code_scanning_alerts | read-only | List code scanning alerts |
get_secret_scanning_alert | read-only | Get a secret scanning alert |
list_secret_scanning_alerts | read-only | List secret scanning alerts |
get_dependabot_alert | read-only | Get a Dependabot alert |
list_dependabot_alerts | read-only | List Dependabot alerts |
check_dependency_vulnerabilities | read-only | Check dependencies against the advisory database |
get_global_security_advisory | read-only | Get a global security advisory |
list_global_security_advisories | read-only | List global security advisories |
list_repository_security_advisories | read-only | List a repository's security advisories |
list_org_repository_security_advisories | read-only | List an organization's repository security advisories |
Copilot, users, and search
| Tool | Tags | Description |
|---|---|---|
get_me | read-only | Get details of the authenticated GitHub user |
search_users | read-only | Find GitHub users |
search_orgs | read-only | Find GitHub organizations |
get_teams | read-only | Get the teams the user is a member of |
get_team_members | read-only | Get member usernames of a team |
request_copilot_review | write | Request a Copilot code review for a pull request |
assign_copilot_to_issue | write | Assign Copilot to an issue; it opens a PR with changes |
create_pull_request_with_copilot | write | Delegate a task to the Copilot coding agent |
get_copilot_job_status | read-only | Get the status of a Copilot coding agent job |
list_copilot_spaces | read-only | List Copilot Spaces accessible to the user |
get_copilot_space | read-only | Get the contents of a Copilot Space |
web_search | read-only, external | Perform an AI-powered web search with citations |
github_support_docs_search | read-only | Search GitHub product and support documentation |
Required scopes
These are the scopes the gateway requests at sign-in, and they are the same in both credential modes:
repo– full access to repositories, including code, issues, and pull requestsread:org– read organization membership and teamsread:user– read user profile informationgist– list, create, and update gistsproject– read and write GitHub Projects boards
Neither option asks you to pick these. GitHub OAuth Apps do not carry a scope list, so the gateway sends the scopes above in each authorize request and every user sees them on GitHub's consent screen.
Policy examples
Rules are evaluated top to bottom and the first match wins; a call that matches no rule is denied. New rules are created at the top of the list, so create the rule you want evaluated last first.
- Read-only access: allow
get_*,list_*,search_*,pull_request_read, then disable or delete your organization's seeded Allow all rule. On its own the allow rule restricts nothing, because writes keep matching Allow all and succeed. Removing Allow all is org-wide, so add the allow rules for everything your agents still need before you remove it, or place an explicit deny rule for*below your allows instead. - Block repository creation and file writes: deny
create_repository,create_or_update_file,push_files,delete_fileabove any allow rules.delete_filematters, because it commits a deletion, so leaving it out still lets an agent rewrite repository contents. - Allow the PR workflow but block merges: allow
*pull_request*, and add a deny formerge_pull_requestabove that allow rule. Below it the allow matches first and merges go through. - Block destructive tools: add a deny rule with the built-in
destructivetag (Tools pill) for this resource (MCP pill).
Next steps
- Create a policy – start from the read-only pattern in Policy examples above.
- Connections – manage the GitHub accounts your users have linked.
- Block an agent from deleting GitHub branches – a worked policy for this exact resource.