Give your AI agent GitHub access that expires in an hour

说明与用途

代理只能在限定时间内执行授予的 GitHub 操作，避免凭证泄露，实现细粒度可撤销访问。

问题

AI agents often receive long‑lived GitHub PATs, exposing credentials to all sub‑agents and making revocation costly and blunt.

结果

Agents can perform only the granted GitHub actions for a bounded time, eliminating credential leakage and enabling fine‑grained, revocable access.

工作流

• 1. Run a local MCP server that holds the PAT and exposes GitHub tools.
• 2. Create a capability grant for the sub‑agent specifying allowed tools, max uses, and ttl (e.g., 3600 s).
• 3. The sub‑agent receives a child_id and uses the MCP broker to invoke tools via the server.
• 4. The server checks each call against the signed capability; denied calls return CapabilityDenied.
• 5. If needed, delegate a narrower capability to a worker with fewer tools and uses.
• 6. To revoke, call revoke {child_id} which invalidates all future checks for that capability.

证据

The PAT lives in exactly one process — the tool server that actually calls the GitHub API

来源

Sub‑agents get a capability: a signed, bounded permission to invoke named tools on that server

来源