Connect GitHub to Conduit

This walkthrough connects GitHub (developer tools) to Conduit. GitHub is a hosted integration: Conduit forwards tool calls to GitHub’s own hosted MCP server, authenticated with a personal access token (PAT) you create in GitHub. Use a fine-grained PAT (github_pat_...) so you can scope exactly which repositories and permissions the AI can touch; classic tokens (ghp_...) also work.

Menu labels can change

The GitHub steps below reflect GitHub’s token flow at time of writing; labels can shift as GitHub updates its UI. If a label differs, see GitHub’s guide to managing personal access tokens.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A GitHub account with access to the repositories or organizations you want the AI to work with. The token acts as that GitHub user — every tool call the AI makes shows up in GitHub as that user, and can only reach what that user (and the token’s scopes) can reach.

Step 1 — Create a personal access token in GitHub

1. Sign in to GitHub and create a fine-grained personal access token following GitHub’s PAT guide. Expected: a token starting with github_pat_.
2. Scope it deliberately: select only the repositories (or organization) the AI should reach, and grant the narrowest permissions that cover what you want it to do — read-only repository contents and issues is a good starting point; add write permissions only if you want the AI creating issues, PRs, or commits.
3. Copy the token immediately. GitHub shows it only once — if you lose it, regenerate.

Caution

Copy the token now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the token, revoke it in GitHub first; the exposed token becomes useless immediately.

Step 2 — Connect GitHub in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find GitHub in the catalog (under Developer Tools) and click Connect. Expected: a credential form with a single Personal Access Token field (placeholder github_pat_... or ghp_...).
3. Paste the token from Step 1.
4. Click Connect. Expected: Conduit opens a real session against GitHub’s hosted MCP server with your token and shows a green Connected status. A token that can’t start an MCP session is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this GitHub connection — and every tool call acts as the GitHub user who owns the token. For per-technician identity (each person’s calls attributed to their own GitHub account), connect at the personal scope instead — see Vendor connections.

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only GitHub tool, such as listing repositories or open issues. You should get real data back, and the call appears in your audit log with the correct user, vendor (github), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Invalid GitHub token. Use a Personal Access Token (github_pat_… or ghp_…) with access to the resources you want to expose.”	The token is wrong, expired, or revoked — fine-grained PATs have an expiration date you chose at creation. Generate a fresh token and reconnect.
Connect fails with “Access denied. Ensure the token’s scopes/permissions cover the GitHub MCP server.”	The token authenticated but GitHub refused the MCP session — usually a fine-grained PAT with no useful permissions, or an organization policy that restricts PAT access. Widen the token’s permissions or have an org owner approve PAT access.
Connect fails with “GitHub MCP returned HTTP NNN”	GitHub’s MCP server responded with an unexpected status — often a transient outage. Retry after a few minutes.
Tool calls succeed but specific repos are missing	Fine-grained PATs only see the repositories selected at creation. Edit the token’s repository access in GitHub — no need to reconnect unless you regenerate the token value.
Tool calls succeed but write actions are denied	The token’s permissions are read-only for that resource. Add the matching write permission to the token in GitHub.
Need to rotate the token	Generate a new PAT in GitHub, update the credential at /org/catalog, then revoke the old token.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.
• GitHub’s MCP server documentation — what the hosted server exposes.