Give your AI agent GitHub access that expires in an hour

Description and use

Agents can perform only the granted GitHub actions for a bounded time, eliminating credential leakage and enabling fine‑grained, revocable access.

Problem

AI agents often receive long‑lived GitHub PATs, exposing credentials to all sub‑agents and making revocation costly and blunt.

Outcome

Agents can perform only the granted GitHub actions for a bounded time, eliminating credential leakage and enabling fine‑grained, revocable access.

Workflow

• 1. Run a local MCP server that holds the PAT and exposes GitHub tools.
• 2. Create a capability grant for the sub‑agent specifying allowed tools, max uses, and ttl (e.g., 3600 s).
• 3. The sub‑agent receives a child_id and uses the MCP broker to invoke tools via the server.
• 4. The server checks each call against the signed capability; denied calls return CapabilityDenied.
• 5. If needed, delegate a narrower capability to a worker with fewer tools and uses.
• 6. To revoke, call revoke {child_id} which invalidates all future checks for that capability.

Evidence

The PAT lives in exactly one process — the tool server that actually calls the GitHub API

Source

Sub‑agents get a capability: a signed, bounded permission to invoke named tools on that server

Source