> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amnify.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub Permissions

> How Amnify connects to GitHub with a GitHub App, and why it needs write access to open pull requests — never to push to your default branch.

## How Amnify authenticates

Amnify connects to GitHub through the **[Amnify Agent GitHub App](https://github.com/apps/amnify-agent)**. You install the app on your organization or account and grant it access to all repositories in your organization or **only the repositories you choose**. GitHub issues the app a **short-lived installation token** at scan time; there is no long-lived secret for you to generate, paste, or rotate.

Every action Amnify takes runs **as the installation you authorized**, scoped to exactly the repositories you selected and the permissions listed below. You can narrow the repository list or revoke access entirely at any time from **GitHub → Settings → Installed GitHub Apps** or within Amnify.

<Card title="Install the Amnify Agent GitHub App" icon="github" href="https://github.com/apps/amnify-agent">
  Install the app on your organization or account and select which repositories Amnify may access. You choose the repositories, and you can change or revoke the selection at any time.
</Card>

## Why GitHub is not read-only

The cloud providers Amnify connects to — [Azure](/agent/permissions/azure), [AWS](/agent/permissions/aws), and [GCP](/agent/permissions/gcp) — are strictly **read-only**: Amnify reads their configuration to assess posture and changes nothing. GitHub is different. Amnify scans your repositories for issues like leaked secrets, vulnerable dependencies, insecure code patterns, and infrastructure-as-code misconfigurations — and then it **prepares merge-ready fixes**. Delivering a fix means writing to the repository, so the Amnify Agent GitHub App requests write access.

That write access is deliberately bounded by how Amnify uses it:

* Amnify **never commits or pushes to your default branch** (such as `main`).
* Every change is written to a **new branch** and delivered as a **pull request**.
* **Nothing merges without your approval.** You review the pull request like any other and merge it or close it yourself.

In other words, Amnify can *propose* changes but cannot *ship* them. Your existing branch protections, required reviews, and CI checks all still apply to the pull requests Amnify opens.

## Steps to connect

<Steps>
  <Step title="Install the GitHub App">
    Open the [Amnify Agent GitHub App](https://github.com/apps/amnify-agent) and click **Install**. Choose the organization or account to install it on.
  </Step>

  <Step title="Select the repositories">
    Choose **Only select repositories** and pick the repositories you want Amnify to scan and fix. You can add or remove repositories later without reinstalling. Installing on an organization may require an organization owner to approve the app first.
  </Step>

  <Step title="Confirm the permissions">
    GitHub shows the exact permissions the app requests (the four listed in [Tier 1](#tier-1-repository-access-required) below). Review and approve them to finish installing.
  </Step>

  <Step title="Review the pull requests Amnify opens">
    When Amnify finds an issue it can fix, it opens a pull request from a new branch against your repository. Review it and merge it if you're satisfied.
  </Step>
</Steps>

## Tier 1: Repository access (required)

The Amnify Agent GitHub App requests four repository permissions, scoped to the repositories you select:

| Permission        | Access         | Why Amnify needs it                                                                                                                                                   |
| ----------------- | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Contents**      | Read and write | Read your code to assess it, and write the fix to a **new branch**. Write is never used against your default branch.                                                  |
| **Pull requests** | Read and write | Open the pull request that delivers a fix, and read pull-request state to track review.                                                                               |
| **Issues**        | Read and write | Comment on the pull requests Amnify opens — in GitHub's API, pull-request comments are issue comments — and open issues to surface findings that need your attention. |
| **Metadata**      | Read-only      | Mandatory baseline that every GitHub App receives: read basic repository metadata such as names and branch lists.                                                     |

## How access is scoped and revoked

* **Scoped by repository.** The app only sees the repositories you select during installation. Repositories you don't select are invisible to Amnify.
* **Short-lived tokens.** Amnify authenticates with installation access tokens that GitHub issues on demand and that expire automatically. No static credential is stored on your behalf.
* **Change the scope anytime.** In **GitHub → Settings → Installed GitHub Apps → Amnify Agent → Configure**, add or remove repositories.
* **Revoke anytime.** From the same page, **Suspend** or **Uninstall** the app to immediately cut off all access. Any pull requests Amnify already opened stay in your repository for you to merge or close as you see fit.

<Warning>
  **What Amnify never does on GitHub**

  * **Never pushes to your default branch.** Changes only ever arrive as a pull request from a new branch.
  * **Never merges its own pull requests.** You review and merge, your branch protections and required reviews still apply.
  * **Never touches repositories you didn't select**, and never requests organization-wide administration, member management, or account settings access.
  * **Never asks for a personal access token or password.** Access is a revocable GitHub App installation, scoped to the repositories you choose.
</Warning>