--- name: iblai-connect-github description: "Read and write GitHub data through the GitHub REST API and GraphQL API and expose it to an ibl.ai agent as an MCP tool. Use when the user asks an agent to work with GitHub data, or to set up a GitHub MCP connection on ibl.ai." metadata: kind: guide --- # GitHub connector for AI agents > A starting point maintained on ibl.ai at https://ibl.ai/developer/connectors/github — not part of the iblai/vibe repository. Checked against GitHub's documentation on October 20, 2026; test it against your own GitHub setup before you rely on it. GitHub holds an organization's Git repositories, issues, pull requests and reviews, Actions workflows and runs, code security alerts, discussions, projects and organization membership. ## Auth & conventions - **API:** GitHub REST API and GraphQL API (Mixed). REST endpoints by resource (repos, issues, pulls, actions, orgs) versioned with the X-GitHub-Api-Version header, and a GraphQL API at https://api.github.com/graphql. - **Base URL:** https://api.github.com/ - **Access:** Public, self-serve. Any account can create a personal access token or register a GitHub App or OAuth app. Organization owners choose which repositories a GitHub App can access and can require approval for fine-grained tokens. - **Auth:** GitHub App (installation access token); Fine-grained personal access token; OAuth app (authorization code); Personal access token (classic). GitHub Apps use fine-grained permissions and short-lived tokens, acting as the app or for a user. Fine-grained PATs are limited to one owner and chosen repositories; classic PATs use broad scopes. - **Limits:** 5,000 requests/hour authenticated (15,000 for Enterprise Cloud apps), 60/hour unauthenticated. Secondary limits: 100 concurrent requests, 900 points/min per REST endpoint, 80 content-creating requests/min. 403 or 429 when exceeded. - Keep GitHub credentials in environment variables or the ibl.ai credential store. Never print a token in chat and never commit one to a file. - Destructive or outward-facing calls are marked **Confirm with the user first** — do. ## Reads - **Issues** — GET /repos/{owner}/{repo}/issues. - **Pull requests** — GET /repos/{owner}/{repo}/pulls, /pulls/{pull_number} and /pulls/{pull_number}/files (up to 3,000 files). - **Repository contents** — Read repositories, branches and file contents via the REST or GraphQL API. - **Actions and security** — Workflow runs, code scanning and Dependabot alerts (toolsets on the GitHub MCP Server). ## Writes - **Create issue** — POST /repos/{owner}/{repo}/issues; fine-grained permission Issues write. - **Update issue** — PATCH /repos/{owner}/{repo}/issues/{issue_number} to edit, label, assign or close. - **Create pull request** — Open a pull request from a head branch to a base branch; drafts supported. - **Merge pull request** — PUT /repos/{owner}/{repo}/pulls/{pull_number}/merge with merge, squash or rebase. **Confirm with the user first.** ## Expose it to an ibl.ai agent (MCP) GitHub publishes an official MCP server, GitHub MCP Server (https://github.com/github/github-mcp-server). Register it below as-is, or host your own server that wraps the calls in this skill. First install the ibl.ai platform skills and connect your organization (writes `IBLAI_ORG`, `IBLAI_USERNAME` and `IBLAI_API_KEY` to `.env`): ```bash npx skills add iblai/vibe --all # then, in your coding agent: /iblai-api-login ``` Every call below sends `Authorization: Api-Token $IBLAI_API_KEY`. 1. **Register the server** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-servers/` with `name`, `url`, `transport` (`sse` | `websocket` | `streamable_http`) and `auth_type` (`none` | `token` | `oauth2`). Capture the returned `id`. - GitHub supports per-user OAuth: `auth_type=oauth2` with `auth_scope=user` and a linked `oauth_service` makes each person connect their own account in the chat. It needs an `auth_{provider}` credential in the organization's credential store first. 2. **Create the connection** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-server-connections/` with `server`, `scope` (`platform` | `mentor` | `user`), `auth_type`, and either `credentials` + `authorization_scheme` or a `connected_service` id for OAuth. Credentials are masked on read; never send a masked value back. 3. **Enable it on the agent** — `GET https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mentors/{agent_id}/settings/`, add `mcp-tool` to `tool_slugs` and the server id to `mcp_servers`, then `PATCH` the full lists back. They are replaced, not merged. Full reference: https://ibl.ai/developer/platform/mcp/mcp-connections and the `/iblai-api-agent-mcp` skill. ## Example prompts - "List open pull requests in acme/api that are waiting on my review" - "Create an issue in acme/web for the broken checkout button and label it bug" - "Summarize the changes in pull request 482 and flag risky files" - "Which Dependabot alerts are open across our critical repositories?" ## Guardrails - Repositories hold source code, which is trade-secret intellectual property, and can contain committed secrets or personal data in issues and commits. - Request the narrowest GitHub scopes or role the task needs, and prefer a read-only credential for agents that only answer questions. - Return the fields the user asked for, not whole records; do not paste personal data into chat that the user did not request. - Before any write, show the user exactly what will change and wait for a yes. - Respect the documented limits above: page through results and back off on rate-limit responses instead of retrying in a loop. ## References - About the REST API: https://docs.github.com/en/rest/about-the-rest-api/about-the-rest-api - Rate limits for the REST API: https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api - GitHub MCP Server: https://github.com/github/github-mcp-server - GitHub MCP Server: https://github.com/github/github-mcp-server - This connector on ibl.ai: https://ibl.ai/developer/connectors/github - ibl.ai MCP server connections: https://ibl.ai/developer/platform/mcp/mcp-connections