Connect GitHub repositories to Managed Deep Agents

The GitHub connector prepares repositories, the gh CLI, and credentials inside a managed sandbox. Use it when the agent needs to inspect or change GitHub repositories.

The GitHub connector requires managed-deepagents>=0.4.0.

Managed Deep Agents is in private beta, available on LangSmith Cloud in the US region only. Join the waitlist to request access.

This connector is separate from the GitHub channel, which receives App webhooks, and Connect-with-GitHub under identity.

Add the connector

Create connectors/github.py or connectors/github.ts:

from managed_deepagents.connectors import github

connector = github.connector(
    repositories=[
        {
            "repo": "acme/api",
            "path": "workspace/api",
            "ref": "main",
            "depth": 1,
            "on_reuse": "fetch",
        }
    ],
)

import { github } from "managed-deepagents";

export default github.connector({
  repositories: [
    {
      repo: "acme/api",
      path: "workspace/api",
      ref: "main",
      depth: 1,
      onReuse: "fetch",
    },
  ],
});

The connector clones each repository when the sandbox is created. On reuse, on_reuse / onReuse controls whether it keeps, resets, or fetches the checkout. The default is fetch.

Configure options

Option (Python / TypeScript)	Default	Purpose
`repositories`	`[]`	Repository checkouts and their sandbox paths.
`allowlist`	`[]`	Allowed repositories as `owner/repo` or `owner/*`.
`install_cli` / `installCLI`	`true`	Install the GitHub CLI in the sandbox.
`inject_credentials` / `injectCredentials`	`true`	Expose resolved GitHub credentials to `git` and `gh`.

Repository paths must be relative and unique. Set write to true on a checkout that needs write credentials. For private repositories, configure GitHub credentials through identity. The runtime injects the resolved token as GH_TOKEN and configures Git credentials without storing it in thread state.

Test and deploy

Test the project locally with mda dev, then deploy it with mda deploy. Open deployment traces in LangSmith to inspect model calls, tool calls, errors, and latency. The connector runs only when the project declares a managed sandbox. After startup, ask the agent to inspect the configured path or run gh auth status.

Next steps

Connectors

Compare connector types.

GitHub channel

Receive GitHub App webhooks.

Identity

Scope callers and resolve credentials.

Configure a sandbox

Configure sandbox scope and lifecycle.

Connect these docs to Claude, VSCode, and more via MCP for real-time answers.

Edit this page on GitHub or file an issue.

​Add the connector

​Configure options

​Test and deploy

​Next steps

Connectors

GitHub channel

Identity

Configure a sandbox

Add the connector

Configure options

Test and deploy

Next steps