# GitHub and AI agents: what runs on its own and what waits for approval The agent reads the code, opens the PR and waits for you. Here is the level of every action, from clone to merge. · [Português (Brasil)](https://agentes.chat/pt/integracoes/github.md) Checked on October 29, 2026 **Short answer:** In agentes.chat, your workspace connects GitHub once and each agent gets only the repos and access you pick. The agent reads code, PRs and issues, creates branches and opens PRs on its own. It can push only to its own branches. Merging and running Actions workflows always wait for a person to approve. ## How do I connect GitHub to agentes.chat? A workspace admin connects GitHub once, through the agentes.chat GitHub App or OAuth. Tokens are sealed on the server and never sent to a browser or app. Then each agent gets only what it needs. You pick its repos and its access: no access, read, or read and write. You can also grant tools one by one. Only workspace owners and admins create and edit agents. The tools follow GitHub's official MCP server, which reads repos, manages issues and pull requests and works with Actions\[1\]. When an agent clones a repo on the workspace's computer, git goes through our proxy, so the GitHub token never enters the machine. ## What can the agent do on its own in GitHub? Reading and investigating never ask. With the right access, the agent also writes without waiting, inside fixed rules: * **Read:** files, commits, code search, PRs with their diff and checks, issues and Actions runs. * **Work on issues:** create issues and comment. * **Open PRs:** create the branch, push, open the PR and leave review comments. * **Work on the workspace's computer:** clone the repo, run the tests and open the PR from there. Pushes follow a fixed rule: only to agentes/agent-name/… branches. Never the default branch, no force push, no tags. Nothing the agent writes reaches your main code without a PR. ## What needs approval, and what is blocked? | Action | Access in agentes.chat | What happens | | --- | --- | --- | | Read code, commits, PRs, issues and runs | Read code, Read pull requests, Read issues | Runs on its own | | Clone the repo on the agent's computer | Clone repositories (git) | Runs on its own | | Create a branch and push | Write code, Push branches (git push) | Runs on its own, on the agent's branch only | | Open a PR and comment | Open pull requests | Runs on its own | | Create an issue and comment | Write issues | Runs on its own | | Merge a PR | Merge pull requests | **Always asks** (one click) | | Run an Actions workflow | Run workflows | **Always asks**: it may deploy | | Push to the default branch, force push, tags | No access allows it | Blocked | Default level of each GitHub action in agentes.chat Any tool with merge, deploy, rollback or promote in its name always asks, whatever the settings say. The request is a card in the chat with the exact action. It runs once, exactly as approved, and expires after 24 hours. The agent's owner or an admin decides. If you refuse, your reason becomes a lesson for the agent. > Routines run without anyone asking, so every write they make in a connected app waits for a person, even opening a PR or commenting. ## What does it look like day to day? **Example · Acme (fictional company)** ### A bug fix at Acme Someone at Acme gives the task “CSV export drops accented letters” to the Dev agent. The task moves to In progress by itself. The agent clones the repo on the workspace's computer, finds the cause, writes a test and the fix, and pushes to agentes/dev/csv-accents. It opens the PR and the task moves to In review. In the channel, it asks to merge. The person reads the diff and clicks Approve. The merge runs once, exactly as shown on the card. A routine can also review each new PR as soon as it opens and post a summary in the team's channel. For the whole incident flow, from alert to approved rollback, read [AI agents for incident response](https://agentes.chat/en/use-cases/incident-response). ## How do I get started? GitHub is one of the agentes.chat connectors. The others come through MCP, explained in [MCP connectors](https://agentes.chat/en/guides/mcp-connectors). agentes.chat is in early access and opens by invitation, in waves. Join the waitlist to connect your team's GitHub. ## Frequently asked questions ### Can the agent push straight to main? No. It pushes only to agentes/agent-name/… branches, with no force push and no tags. To reach the default branch, the code goes through a PR, and the merge waits for a person. ### Does a merge always need approval? Yes. Merges, deploys and rollbacks always ask, whatever the connector settings. On the card, a merge is approved with one click. ### Can I limit an agent to some repos? Yes. Repos are picked per agent, and so is access: none, read, or read and write, or tool by tool. ### Does the GitHub token live on the agent's computer? No. Tokens are sealed on the server. Clones and pushes go through a proxy, so the token never enters the agent's machine. ## Sources Links checked on October 29, 2026. What this page says about agentes.chat describes the product on that date and may change during early access. 1. GitHub, [GitHub MCP Server](https://github.com/github/github-mcp-server). github.com/github/github-mcp-server · checked on October 29, 2026 ## Read next - [AI agents for incident response: from Sentry alert to approved rollback](https://agentes.chat/en/use-cases/incident-response) - [MCP connectors explained: how AI agents use your tools](https://agentes.chat/en/guides/mcp-connectors) - [Human-in-the-loop AI agents: how approvals for sensitive actions work](https://agentes.chat/en/guides/human-in-the-loop-ai-agents) --- **Save a spot for your team.** Leave your email. We'll let you know when it's your wave's turn. [Join the list](https://agentes.chat/en#lista)