Dome Systems
Dashboard
DocsLearnHands-on LabsTemplatesHelpChangelogCLIAPIMCPSDKs

Ask questions about GitHub

A managed agent for read-only GitHub investigation.

User
Caller
  • chat
App
Agent
  • github-answerer
Governance
Gateway
  • github-readonly
Pool

github-answerer-pool

  • github-answerer-model
Tools

github

    What this template gives you

    • Interface

      A chat window, in your browser

      Use the included interface to send a request to this template.

    • Gateway

      github-readonly gateway

      This template sends its requests through github-readonly gateway, where its access rules and limits apply.

    • Model

      github-answerer-model

      This template uses github-answerer-model through the github-answerer-pool pool.

    Usage

    Hand this template to an AI agent to set up this template

    Node.js and npm to run npx.

    Dome CLI, installed with brew install dome-systems/tap/dome, then signed in with dome auth login.

    Docker Compose to run the companion app locally.

    1. 1

      Create a workspace

      dome workspaces create --name <workspace-name>

      The CLI creates and selects a workspace context for you.

    2. 2

      Confirm the workspace context

      dome context list

      The workspace you just created is already selected.

    3. 3

      Pull the template

      npx @domesystems/templates pull dome-systems/ai-agent-for-github@0.1.0 --dir ai-agent-for-github

      Downloads this immutable release and verifies its digest.

    4. 4

      Run the template

      npx @domesystems/templates up --dir ai-agent-for-github

      Imports it into Dome and starts the companion app.

    Dome import variables

    npx @domesystems/templates up imports the template into Dome and prompts for required values. For unattended runs, set them as DOME_IMPORT_VAR_… environment variables.

    Required values

    • DOME_IMPORT_VAR_github_oauth_client_id
    • DOME_IMPORT_VAR_github_oauth_client_secret
    • DOME_IMPORT_VAR_anthropic_api_key

    Setup guide

    Follow this template's setup guidance for agent variables and upstream connections.

    # Configure GitHub

GitHub's hosted MCP server supports OAuth, but does not expose Dynamic Client
Registration. Before import, create a GitHub OAuth app in the
[GitHub developer settings](https://github.com/settings/developers): select
**OAuth Apps**, then **New OAuth App**. Use a recognizable name, your
organization's homepage URL, and this callback URL:

```text
https://api.domesystems.ai/oauth/callback
```

After creating the app, copy its client ID and generate its client secret.
GitHub's [OAuth-app creation guide](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app)
has the current field-by-field instructions.

- `github_oauth_client_id` and `github_oauth_client_secret`: enter the GitHub
  OAuth app credentials. Configure the app's callback URL as
  `https://api.domesystems.ai/oauth/callback`.
- `anthropic_api_key`: enter the Anthropic key used by this agent's model.
- After import, start the shared GitHub OAuth connection and approve it as a
  dedicated test user. The template requests `public_repo` and `read:org`, and
  connects to GitHub's read-only MCP endpoint. This permits public-repository
  investigation while preventing the MCP server from exposing write tools.
- Before relying on the connection, verify the consent scopes and organization
  OAuth-app policy, then test one allowed public repository. GitHub OAuth does
  not have a read-only private-repository scope: do not grant `repo` merely to
  make this template work. Keep repository administration, workflow, package,
  and organization-write access out of the authorization.

For a headless connection, use the separate fine-grained-PAT configuration and
limit it to the intended repositories with read-only permissions.

    Runtime environment

    These variables are required to run the agent. During pull, .env.example is copied to .env when available. If they’re missing, npx @domesystems/templates up retrieves them from Dome and saves them in .env. Pass --provision to refresh them.

    No .env.example is included in this release.

    Agent instructions

    You investigate the connected GitHub repositories and answer from the evidence
you retrieve.

Use the available GitHub tools to inspect repositories, issues, pull requests,
commits, files, and code search results. Give repository and issue or pull
request identifiers when they are available. Do not infer facts that the tools
did not establish.

This is a read-only investigation assistant. Never create, edit, close,
merge, label, assign, comment on, or delete any GitHub resource. If the user
asks for a change, provide a concise proposed action instead.