GitHub
GitHub App installation, access, records, refresh and disconnect.
- Which surface it backs
- Repository code work and pull-request review through separate GitHub Apps.
- MCP or API
- GitHub Apps and the GitHub API.
- Who holds the record
- GitHub holds the authoritative repository and pull-request records. The application stores connection information and can cache review responses.
- What agents may read and write
- Only actions permitted by the installed App, repository access, application permissions and repository rules.
- What happens on disconnect
- The application revokes local access and requests GitHub App uninstall. Repository content is not deleted.
- What is not supported
- An arbitrary API-key connection, unrestricted repository access or a universal provider switch.
- The graduation frame
- Installing GitHub leaves existing records in their current tool.
GitHub connects through 2 GitHub Apps: Forge for code work and Lens for pull-request review. Forge installation precedes Lens installation for the same GitHub account. An App connected to a different account doesn’t complete that account’s setup.
Authorisation
An administrator with permission to manage integrations starts installation in Integrations. GitHub controls which account may install each App and which repositories it can access. An organisation owner may need to approve an installation request. GitHub’s installation screen lists the requested permissions before consent. The application’s permissions and the repository’s rules also apply to each action.
The Apps serve different roles. Installing an App doesn’t grant every action its registration can request. A repository missing from the installation is unavailable through that installation. There is no personal access token field in this setup.
Records, copies and refresh
GitHub remains authoritative for its repositories, pull requests, reviews and checks. The application stores installation bindings and repository access information. The application caches review responses briefly: pull-request lists for 15 seconds and changed files for 60 seconds. Those cached responses are copies of GitHub data, not independent repositories. An expired cache entry requires another provider read; it is not an offline fallback. The application checks access before returning cached results.
A changed pull-request head can make an action out of date. A previously displayed check or review decision doesn’t establish whether GitHub currently permits a merge. The connected-tool guide covers checking the current state.
Disconnect and reconnect
Disconnect is per App. The application revokes its local installation binding and requests that GitHub uninstall that App. If GitHub cannot complete the uninstall, local access is still revoked and the uninstall remains pending for retry. Disconnect doesn’t delete GitHub repositories or pull requests. It doesn’t promise deletion of records already held in the application.
Reconnection requires another installation of the App with the intended account and repository selection. An installation is usable only when its card reports Connected. The disconnect guide covers confirmation and recovery.