Connect GitHub repositories to Managed Deep Agents

• Tools: GitHub is a tool server integration like Gmail or Linear, so the connector can load LangChain-authored GitHub API tools through LangSmith’s gateway. The provider token stays in LangSmith’s vault.
• Sandbox: the connector also prepares repositories, the gh CLI, and credentials inside a managed sandbox, so the agent can inspect or change checkouts directly.
• Events: pass events to receive GitHub App webhooks. Any webhook event can invoke the agent, which can auto-reply as an issue or pull request comment. See Receive GitHub App webhooks.

​

Add the connector

from managed_deepagents import connectors

connector = connectors.github(
    repositories=[
        {
            "repo": "acme/api",
            "path": "workspace/api",
            "ref": "main",
            "depth": 1,
            "on_reuse": "fetch",
        }
    ],
)

import { connectors } from "managed-deepagents";

export const connector = connectors.github({
  repositories: [
    {
      repo: "acme/api",
      path: "workspace/api",
      ref: "main",
      depth: 1,
      onReuse: "fetch",
    },
  ],
});

​

Tools and the installCLI rule

from managed_deepagents import connectors

# Tools on: no gh in the sandbox, so the agent uses the integration's tools
connector = connectors.github(
    install_cli=False,
    include_tools=["github_create_pull_request"],
)

import { connectors } from "managed-deepagents";

// Tools on: no gh in the sandbox, so the agent uses the integration's tools
export const connector = connectors.github({
  installCLI: false,
  includeTools: ["github_create_pull_request"],
});

​

Configure options

​

Receive GitHub App webhooks

from managed_deepagents import connectors

connector = connectors.github(
    events=[
        {
            "on": "pull_request.opened",
            "repositories": ["acme/api"],  # optional; omit = any repo
            "auto_reply": True,  # default; comment when address is owner/repo#N
            "prompt": lambda event: (
                f"Review {event['repository']}#"
                f"{event.get('issue_or_pull_number')}: "
                f"{event['payload']['pull_request']['title']}"
            ),
        },
    ],
)

import type { PullRequestOpenedEvent } from "@octokit/webhooks-types";
import { connectors } from "managed-deepagents";

export const connector = connectors.github({
  events: [
    {
      on: "pull_request.opened",
      repositories: ["acme/api"], // optional; omit = any repo
      autoReply: true, // default; comment when address is owner/repo#N
      prompt(event) {
        // MDA keeps payload untyped — narrow with Octokit in the agent project
        const pr = event.payload as PullRequestOpenedEvent;
        return `Review ${event.repository}#${pr.pull_request.number}: ${pr.pull_request.title}`;
      },
    },
  ],
});

​

Event filters (on)

​

prompt vs instructions.md

​

How GitHub webhooks work

1. GitHub POSTs to https://<agent-server>/connectors/github/events (the connector name becomes the path segment).
2. The runtime verifies X-Hub-Signature-256 against GITHUB_WEBHOOK_SECRET, dedupes on X-GitHub-Delivery, and returns HTTP 202.
3. It picks the first matching handler, calls prompt to build the inbound text, then invokes the graph over trusted loopback with user and source-thread identity (source.provider: "github").
4. When the matched handler has autoReply enabled and the conversation address is owner/repo#N, it posts the agent response as an issue/PR comment with the App installation token. Events without an issue/PR number skip the comment even when autoReply is true.

​

Event handler options

​

Required webhook secrets

​

Configure the GitHub App

1. Create a GitHub App (or reuse one you control) with permissions implied by your handlers (at minimum metadata:read; issues:write and pull_requests:read when any handler has autoReply enabled). Tighten App permissions in GitHub settings to match what you actually use.
2. Subscribe the App to the webhook events your handlers need (for example Pull request for pull_request.opened, or broader events if you use "*" / event-level filters).
3. Set the webhook URL to https://<agent-server>/connectors/github/events and configure the webhook secret as GITHUB_WEBHOOK_SECRET.
4. Install the App on the target org or repositories and copy the installation id into GITHUB_INSTALLATION_ID.
5. Copy the App id and private key into GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY.

​

Test and deploy

​

Webhook troubleshooting

​

Next steps