> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuphos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub

> Connect GitHub to browse pull requests, workflows, and repositories.

Nuphos connects to GitHub through the **Nuphos GitHub App**, so access is scoped
to exactly the repositories you choose and there's no personal access token to
manage. The agent can then work with pull requests, workflows, issues, and
repository contents.

## Connect

<Steps>
  <Step title="Start the install">
    In **Connectors → Connect → GitHub**, choose to install the GitHub App. Your
    browser opens GitHub's installation screen.
  </Step>

  <Step title="Choose where it can access">
    Select the organization or personal account, then **All repositories** or a
    specific set. GitHub controls exactly what the app can see.
  </Step>

  <Step title="Return to Nuphos">
    GitHub redirects back to the desktop app (via a `nuphos://github-callback`
    link) and the connection completes automatically — there's nothing to copy and
    paste.
  </Step>
</Steps>

If you later add or remove repositories from the installation on GitHub, Nuphos
picks up the change.

## In the Nuphos app

Browse the repositories you granted — pull requests, workflow runs, commits, and
repository contents — without leaving Nuphos.

## What the agent can do for you

With code and CI visible, the agent can connect what's deployed to where it came
from. Ask it things like:

* *"Did the last deploy workflow succeed, and what changed in it?"* — it reads
  the workflow run and the commits behind it.
* *"The `checkout` service started failing after yesterday's release — what
  changed?"* — it correlates the incident window with merged PRs and reads the
  diff.
* *"Open an issue summarizing this incident"* — a write, so it pauses for your
  approval first.

## Permissions & authorization

Two boundaries govern what happens through this connector:

* **Hard boundary — who can use it.** Only team **Administrators** can install
  or remove the app, and they can restrict the binding to specific members with
  a [member allow-list](/security/access-control). Within a session the agent
  only holds credentials you explicitly selected, re-checked on every request.
* **Soft boundary — what the agent may do with it.** Reading PRs, workflows, and
  code is free-form; writes (issues, comments) go through
  [plan approvals](/security/approvals) and
  [Auto-authorization](/security/auto-mode) unless you gave an explicit
  instruction.

The outer limit is the **GitHub App installation** itself: GitHub enforces which
repositories the app can see, and you change that on GitHub's side at any time.

## Good to know

* Repository selection lives on GitHub, not in Nuphos — tighten or widen it from
  your organization's **Installed GitHub Apps** settings and Nuphos picks up the
  change.
* Because it's an app installation rather than a personal token, access isn't
  tied to any one person's GitHub account and survives people leaving the org.