GitHub agents your security team can sign off on

Integrations · GitHub

Guild gives agents authenticated access to the GitHub REST API through a GitHub App: tokens generated on demand and refreshed automatically, access limited to the repositories you choose, every operation policy-checked and logged. The same integration powers the Software Factory, where labeled issues come back as reviewed pull requests.

Book a demo

See how teams govern agents against their own repositories.

Start free

Connect the GitHub App and scope your first agent.

The whole GitHub API, with guardrails that read like English

Guild’s GitHub tools are generated from GitHub’s official OpenAPI specification, so tool names match GitHub’s own operation IDs: github_pulls_get is pulls_get. Your agent gets the real API surface, and your policies decide which slices of it each agent may use. Read issues but never close them. Open pull requests but never merge them. One YAML rule each, default deny underneath.

How it works

Connect the GitHub App

Authorize Guild on your organization, choose the repositories. Tokens are generated on demand and refreshed automatically; agents never see them.

Scope each agent

Credential policies decide which operations each agent may perform, per repository, per workspace. DENY beats ALLOW.

Put it to work

Triage issues, review pull requests, respond to events with GitHub event triggers, or run the full Software Factory: labeled issues in, reviewed pull requests out, with a person owning the merge.

Your repos are the crown jewels; treat agent access that way

An agent with GitHub access can read source, open branches, and touch CI. That is exactly why it is valuable, and exactly why “we gave it a PAT” is not a security model. On Guild the agent has an identity, the credential has a policy, every call lands in a tamper-evident audit log, and a running session can be stopped mid-task. The Factory proves the model at scale: 34% of Guild’s own merged PRs are written autonomously, at roughly $12 of model spend per merged PR, with building kept separate from reviewing so no agent merges its own work.

Authentication

Type: GitHub App
Token management: Generated on-demand and refreshed automatically
Scoping: Limited to repositories where the Guild GitHub App is installed

Setup

Open Credentials

Go to Credentials in Guild.

Connect GitHub

Click GitHub and authorize the Guild app on your organization or repository.

Select repositories

Choose which repositories to grant access to.

Guild has two other GitHub integrations. guildai~github-oauth connects your personal GitHub account with OAuth, using the repo, user:email, and admin:repo_hook scopes, so calls act as you rather than as the Guild GitHub App. guildai~github-graphql calls GitHub’s GraphQL API. The package, tools, and events on this page are for guildai~github.

Usage

import { gitHubTools } from "@guildai-services/guildai~github"
import { llmAgent } from "@guildai/agents-sdk"

export default llmAgent({
  description: "An agent that manages GitHub issues",
  tools: { ...gitHubTools },
})

Selecting specific tools

Agents perform better with fewer tools. Use pick() to include only what your agent needs. Tools are named with the github_ prefix — for example, pulls_get becomes github_pulls_get.

import { gitHubTools } from "@guildai-services/guildai~github"
import { llmAgent, pick } from "@guildai/agents-sdk"

export default llmAgent({
  description: "An agent that reviews pull requests",
  tools: {
    ...pick(gitHubTools, [
      "github_pulls_list",
      "github_pulls_get",
      "github_pulls_list_reviews",
      "github_pulls_create_review",
    ]),
  },
})

Trimming responses

GitHub API responses can be large. Use guildServiceTool() with githubSchemasLite to strip unnecessary fields before the LLM sees them.

import {
  githubSchemas as gh,
  githubSchemasLite as ghlite,
  gitHubEndpoints,
} from "@guildai-services/guildai~github"
import { guildServiceTool, llmAgent } from "@guildai/agents-sdk"
import { z } from "zod"

const github_issues_list_for_repo = guildServiceTool("github", {
  description: gitHubEndpoints["issues_list_for_repo"].description,
  inputSchema: gitHubEndpoints["issues_list_for_repo"].parameterSchema,
  outputSchema: z
    .array(gh.IssueSchema)
    .transform((issues) => issues.map((x) => ghlite.IssueSchema.parse(x))),
})

export default llmAgent({
  description: "An agent that triages GitHub issues",
  tools: { github_issues_list_for_repo },
})

Tools

Tools in the latest published version of guildai~github:

All 189 tools

Tool	What it does
`github_actions_delete_workflow_run`	Deletes a specific workflow run.
`github_actions_delete_workflow_run_logs`	Deletes all logs for a workflow run.
`github_actions_download_job_logs_for_workflow_run`	Gets a redirect URL to download a plain text file of logs for a workflow job.
`github_actions_download_workflow_run_attempt_logs`	Gets a redirect URL to download an archive of log files for a specific workflow run attempt.
`github_actions_download_workflow_run_logs`	Gets a redirect URL to download an archive of log files for a workflow run.
`github_actions_force_cancel_workflow_run`	Cancels a workflow run and bypasses conditions that would otherwise cause a workflow execution to continue, such as an `always()` condition on a job.
`github_actions_get_workflow`	Gets a specific workflow.
`github_actions_get_workflow_run`	Gets a specific workflow run.
`github_actions_get_workflow_run_attempt`	Gets a specific workflow run attempt.
`github_actions_list_jobs_for_workflow_run`	Lists jobs for a workflow run.
`github_actions_list_jobs_for_workflow_run_attempt`	Lists jobs for a specific workflow run attempt.
`github_actions_list_repo_workflows`	Lists the workflows in a repository.
`github_actions_list_workflow_run_artifacts`	Lists artifacts for a workflow run.
`github_actions_list_workflow_runs`	List all workflow runs for a workflow.
`github_actions_list_workflow_runs_for_repo`	Lists all workflow runs for a repository.
`github_actions_re_run_job_for_workflow_run`	Re-run a job and its dependent jobs in a workflow run.
`github_actions_re_run_workflow`	Re-runs your workflow run using its `id`.
`github_actions_re_run_workflow_failed_jobs`	Re-run all of the failed jobs and their dependent jobs in a workflow run using the `id` of the workflow run.
`github_activity_list_public_events_for_user`	List public events for a user.
`github_checks_create`	Creates a new check run for a specific commit in a repository.
`github_checks_get`	Gets a single check run using its `id`.
`github_checks_list_annotations`	Lists annotations for a check run using the annotation `id`.
`github_checks_list_for_ref`	Lists check runs for a commit ref.
`github_checks_rerequest_run`	Triggers GitHub to rerequest an existing check run, without pushing new code to a repository.
`github_checks_update`	Updates a check run for a specific commit in a repository.
`github_gists_create`	Allows you to add a new gist with one or more files.
`github_gists_create_comment`	Creates a comment on a gist.
`github_gists_delete`	Gists delete.
`github_gists_get`	Gets a specified gist.
`github_gists_list`	Lists the authenticated user’s gists or if called anonymously, this endpoint returns all public gists.
`github_gists_list_comments`	Lists the comments on a gist.
`github_gists_list_for_user`	Lists public gists for the specified user.
`github_gists_list_public`	List public gists sorted by most recently updated to least recently updated.
`github_gists_update`	Allows you to update a gist’s description and to update, delete, or rename gist files.
`github_git_create_blob`	Git create blob.
`github_git_create_commit`	Creates a new Git commit object.
`github_git_create_ref`	Creates a reference for your repository.
`github_git_create_tag`	Create a tag object.
`github_git_create_tree`	The tree creation API accepts nested entries.
`github_git_delete_ref`	Deletes the provided reference.
`github_git_get_commit`	Gets a Git commit object.
`github_git_get_ref`	Returns a single reference from your Git database.
`github_git_get_tag`	Get a tag object.
`github_git_get_tree`	Returns a single tree using the SHA1 value or ref name for that tree.
`github_git_list_matching_refs`	Returns an array of references from your Git database that match the supplied name.
`github_git_update_ref`	Updates the provided reference to point to a new SHA.
`github_issues_add_assignees`	Adds up to 10 assignees to an issue.
`github_issues_add_blocked_by_dependency`	You can use the REST API to add a ‘blocked by’ relationship to an issue.
`github_issues_add_labels`	Adds labels to an issue.
`github_issues_add_sub_issue`	You can use the REST API to add sub-issues to issues.
`github_issues_check_user_can_be_assigned`	Checks if a user has permission to be assigned to an issue in this repository.
`github_issues_check_user_can_be_assigned_to_issue`	Checks if a user has permission to be assigned to a specific issue.
`github_issues_create`	Any user with pull access to a repository can create an issue.
`github_issues_create_comment`	You can use the REST API to create comments on issues and pull requests.
`github_issues_create_label`	Creates a label for the specified repository with the given name and color.
`github_issues_delete_comment`	You can use the REST API to delete comments on issues and pull requests.
`github_issues_delete_label`	Deletes a label using the given label name.
`github_issues_get`	Get an issue.
`github_issues_get_comment`	You can use the REST API to get comments on issues and pull requests.
`github_issues_get_event`	Gets a single event by the event id.
`github_issues_get_label`	Gets a label using the given name.
`github_issues_get_parent`	You can use the REST API to get the parent issue of a sub-issue.
`github_issues_list_assignees`	Lists the available assignees for issues in a repository.
`github_issues_list_comments`	You can use the REST API to list comments on issues and pull requests.
`github_issues_list_comments_for_repo`	You can use the REST API to list comments on issues and pull requests for a repository.
`github_issues_list_dependencies_blocked_by`	You can use the REST API to list the dependencies an issue is blocked by.
`github_issues_list_dependencies_blocking`	You can use the REST API to list the dependencies an issue is blocking.
`github_issues_list_events`	Lists all events for an issue.
`github_issues_list_events_for_repo`	Lists events for a repository.
`github_issues_list_events_for_timeline`	List all timeline events for an issue.
`github_issues_list_for_repo`	List issues in a repository.
`github_issues_list_labels_for_repo`	Lists all labels for a repository.
`github_issues_list_labels_on_issue`	Lists all labels for an issue.
`github_issues_list_sub_issues`	You can use the REST API to list the sub-issues on an issue.
`github_issues_lock`	Users with push access can lock an issue or pull request’s conversation.
`github_issues_remove_all_labels`	Removes all labels from an issue.
`github_issues_remove_assignees`	Removes one or more assignees from an issue.
`github_issues_remove_dependency_blocked_by`	You can use the REST API to remove a dependency that an issue is blocked by.
`github_issues_remove_label`	Removes the specified label from the issue, and returns the remaining labels on the issue.
`github_issues_remove_sub_issue`	You can use the REST API to remove a sub-issue from an issue.
`github_issues_reprioritize_sub_issue`	You can use the REST API to reprioritize a sub-issue to a different position in the parent list.
`github_issues_set_labels`	Removes any previous labels and sets the new labels for an issue.
`github_issues_unlock`	Users with push access can unlock an issue’s conversation.
`github_issues_update`	Issue owners and users with push access or Triage role can edit an issue.
`github_issues_update_comment`	You can use the REST API to update comments on issues and pull requests.
`github_issues_update_label`	Updates a label using the given label name.
`github_orgs_create_issue_type`	Create a new issue type for an organization.
`github_orgs_list_issue_types`	Lists all issue types for an organization.
`github_orgs_list_members`	List all users who are members of an organization.
`github_pulls_check_if_merged`	Checks if a pull request has been merged into the base branch.
`github_pulls_create`	Create a pull request.
`github_pulls_create_reply_for_review_comment`	Creates a reply to a review comment for a pull request.
`github_pulls_create_review`	Creates a review on a specified pull request.
`github_pulls_create_review_comment`	Creates a review comment on the diff of a specified pull request.
`github_pulls_delete_pending_review`	Deletes a pull request review that has not been submitted.
`github_pulls_delete_review_comment`	Deletes a review comment.
`github_pulls_get`	Get a pull request.
`github_pulls_get_review`	Retrieves a pull request review by its ID.
`github_pulls_get_review_comment`	Provides details for a specified review comment.
`github_pulls_list`	Lists pull requests in a specified repository.
`github_pulls_list_comments_for_review`	Lists comments for a specific pull request review.
`github_pulls_list_commits`	Lists a maximum of 250 commits for a pull request.
`github_pulls_list_files`	Lists the files in a specified pull request.
`github_pulls_list_requested_reviewers`	Gets the users or teams whose review is requested for a pull request.
`github_pulls_list_review_comments`	Lists all review comments for a specified pull request.
`github_pulls_list_review_comments_for_repo`	Lists review comments for all pull requests in a repository.
`github_pulls_list_reviews`	Lists all reviews for a specified pull request.
`github_pulls_merge`	Merges a pull request into the base branch.
`github_pulls_remove_requested_reviewers`	Removes review requests from a pull request for a given set of users and/or teams.
`github_pulls_request_reviewers`	Requests reviews for a pull request from a given set of users and/or teams.
`github_pulls_submit_review`	Submits a pending review for a pull request.
`github_pulls_update`	Update a pull request.
`github_pulls_update_review`	Updates the contents of a specified review summary comment.
`github_pulls_update_review_comment`	Edits the content of a specified review comment.
`github_repos_compare_commits`	Compares two commits against one another.
`github_repos_create_commit_comment`	Create a comment for a commit using its `:commit_sha`.
`github_repos_create_deployment`	Deployments offer a few configurable parameters with certain defaults.
`github_repos_create_deployment_status`	Users with `push` access can create deployment statuses for a given deployment.
`github_repos_create_in_org`	Creates a new repository in the specified organization.
`github_repos_create_or_update_file_contents`	Creates a new file or replaces an existing file in a repository.
`github_repos_create_release`	Users with push access to the repository can create a release.
`github_repos_create_webhook`	Repositories can have multiple webhooks installed.
`github_repos_delete`	Deleting a repository requires admin access.
`github_repos_delete_commit_comment`	Repos delete commit comment.
`github_repos_delete_deployment`	If the repository only has one deployment, you can delete the deployment regardless of its status.
`github_repos_delete_file`	Deletes a file in a repository.
`github_repos_delete_release`	Users with push access to the repository can delete a release.
`github_repos_delete_webhook`	Delete a webhook for an organization.
`github_repos_download_zipball_archive`	Gets a redirect URL to download a zip archive for a repository.
`github_repos_generate_release_notes`	Generate a name and body describing a release.
`github_repos_get`	Get a repository.
`github_repos_get_branch`	Repos get branch.
`github_repos_get_code_frequency_stats`	Returns a weekly aggregate of the number of additions and deletions pushed to a repository.
`github_repos_get_combined_status_for_ref`	Users with pull access in a repository can access a combined view of commit statuses for a given ref.
`github_repos_get_commit`	Returns the contents of a single commit reference.
`github_repos_get_commit_activity_stats`	Returns the last year of commit activity grouped by week.
`github_repos_get_commit_comment`	Gets a specified commit comment.
`github_repos_get_content`	Gets the contents of a file or directory in a repository.
`github_repos_get_contributors_stats`	Returns the `total` number of commits authored by the contributor.
`github_repos_get_deployment`	Repos get deployment.
`github_repos_get_deployment_status`	Users with pull access can view a deployment status for a deployment.
`github_repos_get_latest_release`	View the latest published full release for the repository.
`github_repos_get_participation_stats`	Returns the total commit counts for the `owner` and total commit counts in `all`. `all` is everyone combined, including the `owner` in the last 52 weeks.
`github_repos_get_punch_card_stats`	Get the hourly commit count for each day of the week.
`github_repos_get_readme`	Gets the preferred README for a repository.
`github_repos_get_readme_in_directory`	Gets the README from a repository directory.
`github_repos_get_release`	Gets a public release with the specified release ID.
`github_repos_get_release_by_tag`	Get a published release with the specified tag.
`github_repos_get_webhook`	Returns a webhook configured in a repository.
`github_repos_get_webhook_config_for_repo`	Returns the webhook configuration for a repository.
`github_repos_get_webhook_delivery`	Returns a delivery for a webhook configured in a repository.
`github_repos_list_activities`	Lists a detailed history of changes to a repository, such as pushes, merges, force pushes, and branch changes, and associates these changes with commits and users.
`github_repos_list_branches`	Repos list branches.
`github_repos_list_comments_for_commit`	Lists the comments for a specified commit.
`github_repos_list_commit_comments_for_repo`	Lists the commit comments for a specified repository.
`github_repos_list_commits`	List commits on a repository.
`github_repos_list_contributors`	Lists contributors to the specified repository and sorts them by the number of commits per contributor in descending order.
`github_repos_list_deployments`	Simple filtering of deployments is available via query parameters.
`github_repos_list_deployment_statuses`	Users with pull access can view deployment statuses for a deployment.
`github_repos_list_for_org`	Lists repositories for the specified organization.
`github_repos_list_for_user`	Lists public repositories for the specified user.
`github_repos_list_languages`	Lists languages for the specified repository.
`github_repos_list_pull_requests_associated_with_commit`	Lists the merged pull request that introduced the commit to the repository.
`github_repos_list_releases`	This returns a list of releases, which does not include regular Git tags that have not been associated with a release.
`github_repos_list_tags`	Repos list tags.
`github_repos_list_webhook_deliveries`	Returns a list of webhook deliveries for a webhook configured in a repository.
`github_repos_list_webhooks`	Lists webhooks for a repository. `last response` may return null if there have not been any deliveries within 30 days.
`github_repos_ping_webhook`	This will trigger a ping event to be sent to the hook.
`github_repos_redeliver_webhook_delivery`	Redeliver a webhook delivery for a webhook configured in a repository.
`github_repos_test_push_webhook`	This will trigger the hook with the latest push to the current repository if the hook is subscribed to `push` events.
`github_repos_update`	Update a repository.
`github_repos_update_commit_comment`	Updates the contents of a specified commit comment.
`github_repos_update_release`	Users with push access to the repository can edit a release.
`github_repos_update_webhook`	Updates a webhook configured in a repository.
`github_repos_update_webhook_config_for_repo`	Updates the webhook configuration for a repository.
`github_search_code`	Searches for query terms inside of a file.
`github_search_commits`	Find commits via various criteria on the default branch (usually `main`).
`github_search_issues_and_pull_requests`	Find issues by state and keyword.
`github_search_labels`	Find labels in a repository with names or descriptions that match search keywords.
`github_search_repos`	Find repositories via various criteria.
`github_search_topics`	Find topics via various criteria.
`github_search_users`	Find users via various criteria.
`github_security_advisories_create_private_vulnerability_report`	Report a security vulnerability to the maintainers of the repository.
`github_security_advisories_create_repository_advisory`	Creates a new repository security advisory.
`github_security_advisories_create_repository_advisory_cve_request`	If you want a CVE identification number for the security vulnerability in your project, and don’t already have one, you can request a CVE identification number from GitHub.
`github_security_advisories_get_repository_advisory`	Get a repository security advisory using its GitHub Security Advisory (GHSA) identifier.
`github_security_advisories_list_repository_advisories`	Lists security advisories in a repository.
`github_security_advisories_update_repository_advisory`	Update a repository security advisory using its GitHub Security Advisory (GHSA) identifier.
`github_users_get_by_username`	Provides publicly available information about someone with a GitHub account.

Webhook events

GitHub uses an app-scoped webhook model — a single webhook receives all events and Guild routes them to matching triggers. A trigger can narrow an event to one action, such as guild trigger create --event pull_request --action opened. Without an action it fires on every action of that event. Events marked Any take no action.

Event	Description	Actions
`check_run`	Check run created, completed, or rerequested	`completed`, `created`, `requested_action`, `rerequested`
`commit_comment`	Comment created on a commit	`created`
`issue_comment`	Comment created, edited, or deleted on an issue	`created`, `deleted`, `edited`
`issues`	Issue opened, closed, edited, assigned, or labeled	`assigned`, `closed`, `deleted`, `edited`, `labeled`, `milestoned`, `opened`, `reopened`, `transferred`, `unassigned`, `unlabeled`
`pull_request`	PR opened, closed or merged, edited, or review requested	`assigned`, `closed`, `converted_to_draft`, `edited`, `labeled`, `opened`, `ready_for_review`, `reopened`, `review_requested`, `synchronize`, `unlabeled`
`pull_request_review`	Review submitted, edited, or dismissed	`dismissed`, `edited`, `submitted`
`pull_request_review_comment`	Review comment created, edited, or deleted	`created`, `deleted`, `edited`
`pull_request_review_thread`	Review thread resolved or unresolved	`resolved`, `unresolved`
`push`	Commits or tags pushed	Any
`release`	Release created, published, edited, or deleted	`created`, `deleted`, `edited`, `prereleased`, `published`, `released`, `unpublished`
`workflow_job`	Workflow job queued, in progress, or completed	`completed`, `in_progress`, `queued`, `waiting`
`workflow_run`	Workflow run requested or completed	`completed`, `requested`

Guild preprocesses webhook payloads before passing them to agents, removing avatar URLs, permalink URLs, and deeply nested metadata to reduce payload size. A run started by a GitHub event acts as the organization member mapped to the GitHub user who caused it, or as the trigger’s creator when there is no mapping. See Identity mapping.

Limitations

Access is scoped to repositories where the GitHub App is installed
Rate limits follow GitHub’s standard limits (5,000 requests/hour for authenticated apps)

Frequently asked questions

How do AI agents authenticate to GitHub on Guild?

Through a GitHub App. Tokens are generated on demand and refreshed automatically, scoped to the repositories where the app is installed. Agents never hold long-lived credentials.

Can I limit what an agent does in my repos?

Yes, per operation. Credential policies are default-deny YAML rules scoped by operation, resource, agent, and workspace, and DENY always beats ALLOW.

Can an agent merge its own pull request?

Not in the Factory pattern. Building stays separate from reviewing, and a person owns the outcome. That separation is deliberate.

Can agents react to GitHub events?

Yes. Event triggers run an agent automatically when something happens in a connected service, GitHub included.

What does it cost to run coding agents against our repos?

On Guild’s own codebase, the published figure is roughly $12 of model spend per merged PR, visible per agent in Spend Explorer.

Put a governed agent on your repos this week

Book a demo

Walk through policies and the Factory with the team.

Start free

Connect the GitHub App and scope your first agent.

Also runs on Guild: Slack · OpenClaw · Goose · Jira Read: Docs: Software Factory · Credential policies · Software Factories, by the Numbers

Overview

Models

Inference providers

Code & CI/CD

Communication

Project management

Testing

Productivity

Monitoring & observability

Data

Customer support

Sales & finance

Recruiting

GitHub agents your security team can sign off on

Book a demo

Start free

The whole GitHub API, with guardrails that read like English

How it works

Your repos are the crown jewels; treat agent access that way

Authentication

Setup

Usage

Selecting specific tools

Trimming responses

Tools

Webhook events

Limitations

Frequently asked questions

Put a governed agent on your repos this week

Book a demo

Start free

Book a demo

Start free

​The whole GitHub API, with guardrails that read like English

​How it works

​Your repos are the crown jewels; treat agent access that way

​Authentication

​Setup

​Usage

​Selecting specific tools

​Trimming responses

​Tools

​Webhook events

​Limitations

​Frequently asked questions

​Put a governed agent on your repos this week

Book a demo

Start free

​Related

The whole GitHub API, with guardrails that read like English

How it works

Your repos are the crown jewels; treat agent access that way

Authentication

Setup

Usage

Selecting specific tools

Trimming responses

Tools

Webhook events

Limitations

Frequently asked questions

Put a governed agent on your repos this week

Related