Skip to main content
Connect GitHub and CloudThinker agents can read your repositories, pull requests, issues, and GitHub Actions runs, and Review can post AI code reviews on pull requests. You connect by installing the CloudThinker GitHub App on an account or organization, so there’s no token to create or paste.

​
Prerequisites

  • Access to the GitHub repositories you want agents to read.
  • To install on a GitHub organization: the Owner role in that organization, or an owner willing to approve the install.
  • The Admin role in your CloudThinker workspace, which can add and edit connections. See Roles.
  • A GitHub.com account or organization. Setup installs the app from GitHub.com and has no field for a GitHub Enterprise Server URL.

​
Setup

1

Open GitHub in CloudThinker

In the sidebar, click More → Workspace settings → Connections. On the Builtin Connections tab, search for GitHub and click Connect.The Connect GitHub dialog lists what the app requests: access to the repositories you select, read and write permissions for pull requests, and webhook events for code review.
2

Install the GitHub App

Click Install GitHub App. GitHub opens and asks where to install it. Pick the account or organization, then choose All repositories or Only select repositories.Pick only the repositories agents need. You can add more later from GitHub.
3

Approve and return

Click Install on GitHub. GitHub sends you back to CloudThinker, which shows Processing GitHub App installation… and then Successfully installed!Success state: GitHub shows Connected on the Builtin Connections tab.
The app registers its own webhooks (event notifications GitHub sends when a pull request changes), so GitHub needs no webhook setup for Review.

​
Connection details

GitHub has no fields to fill in. CloudThinker stores the GitHub App installation when you approve it.

​
Required permissions

The app’s permissions are fixed. You decide its reach by choosing which repositories it’s installed on. The app requests the permissions below. The Connect GitHub dialog lists the first three; the app also asks for read and write on issues, which Cyber uses. If the app’s permissions change, GitHub asks an organization owner to accept the updated permissions before they apply. GitHub’s install screen lists every permission by its GitHub name, with its access level. Check it there before you click Install.
Install the app on Only select repositories and start with the ones you want reviewed or investigated. To change the list later on GitHub, go to Organization settings → GitHub Apps (or Settings → Applications → Installed GitHub Apps for a personal account), click Configure next to the CloudThinker app, and edit GitHub’s Repository access.

​
Control access in CloudThinker

Two settings on the connection’s detail panel narrow what agents do with the installation. Open More → Workspace settings → Connections, select GitHub, and look under Settings. Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself. To block GitHub writes outright, turn Allow writes off. These settings only narrow what GitHub already grants. Choosing which repositories Review runs on is a separate step in Review setup.

​
Agent capabilities

Agents work through the GitHub CLI (gh). Reads run without asking. Writes need Allow writes on and pass through your Rules and Approval mode first. Comments and pull requests appear on GitHub as the app’s bot account, cloudthinker-ai[bot].

​
Verify the connection

A working connection names your real repositories and counts. A generic answer about GitHub means the connection isn’t being used. Check GitHub’s Repository access on the app install, then CloudThinker’s Repository access setting.

​
Example prompts

​
Troubleshooting

The redirect back from GitHub was interrupted, or you approved the install from a different GitHub account. Sign in to the right account, return to More → Workspace settings → Connections, select GitHub, and click Connect again.
Only organization owners can install apps on a GitHub organization. When a member picks the organization, GitHub offers to send the owners a request instead of installing. Nothing is installed until an owner approves it. After approval, click Connect again and pick the organization.
Check both layers. On GitHub, the app install’s Repository access must include that repository. In CloudThinker, the connection’s Repository access setting must be All, or Selected with that repository in the list.
CloudThinker could no longer use the installation, often because the app was uninstalled or suspended on GitHub. Open the connection and click Connect to install the app again.
Allow writes is off on the connection, or a Rule refused the action. Turn on Allow writes if you want agents to propose changes, then check your approval rules.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Scope the installation. The app reaches only the repositories you grant it on GitHub, and you can narrow that list at any time.
  • Uninstall to revoke. On the app’s Configure page on GitHub, click Uninstall. Access to every repository stops, and the connection then shows Reconnect GitHub to renew its App installation credentials.

Set Up Review

Choose repositories and start AI code reviews on pull requests

Provider Authentication

Compare how GitHub, GitLab, and other Git providers connect