Give your AI agent GitHub access that expires in an hour

Описание и применение

Агенты могут выполнять только назначенные действия в GitHub в течение ограниченного времени, избегая утечки токенов и обеспечивая точечную отозвность.

Задача

AI agents often receive long‑lived GitHub PATs, exposing credentials to all sub‑agents and making revocation costly and blunt.

Результат

Agents can perform only the granted GitHub actions for a bounded time, eliminating credential leakage and enabling fine‑grained, revocable access.

Рабочий процесс

• 1. Run a local MCP server that holds the PAT and exposes GitHub tools.
• 2. Create a capability grant for the sub‑agent specifying allowed tools, max uses, and ttl (e.g., 3600 s).
• 3. The sub‑agent receives a child_id and uses the MCP broker to invoke tools via the server.
• 4. The server checks each call against the signed capability; denied calls return CapabilityDenied.
• 5. If needed, delegate a narrower capability to a worker with fewer tools and uses.
• 6. To revoke, call revoke {child_id} which invalidates all future checks for that capability.

Доказательства

The PAT lives in exactly one process — the tool server that actually calls the GitHub API

Источник

Sub‑agents get a capability: a signed, bounded permission to invoke named tools on that server

Источник