Solutions

Give your agents GitHub — read-only by default.

GitHub's MCP server hands an agent the whole repo — reads, writes, and deletes. Put it behind Meandr and the safe part flows freely while merges, pushes and deletes wait for a rule or a human. No change to your agent.

Get started See how it works

Add GitHub, then pick which tools your agents get.

Connect GitHub's MCP like any other server — its URL and the token it signs in with. Its catalog opens right away: read tools, write tools, and the read-only tags it declares. Turn on what agents need.

The add-a-server form in Meandr
Add GitHub like any server — its URL and how it signs in. Meandr holds the credential and signs each call.
A server's tool catalog in Meandr
Every tool the server exposes, each with a switch — and the read-only tags it declares about itself.

One GitHub token is all-or-nothing.

Hand an agent GitHub access and it can read a file or force-push over main — the token doesn't know the difference. The line you want is between reading and changing.

Read and write, same server

Listing files, opening issues, merging PRs, deleting branches — GitHub's MCP server exposes them all. To your agent's token they're the same access.

A leaked key is repo-wide

If the agent's credential leaks, whoever has it has everything the token can do. You want the blast radius to be "reads," not "the whole repo."

Reads are fine; changes need a look

Most of what a coding agent does is read. It's the writes — a merge to main, a force-push, a delete — that deserve a rule or a second pair of eyes.

How it works

Add GitHub. Allow reads. Gate the rest.

Your agent still calls one Meandr endpoint. GitHub sits behind it like any other server — curated and governed.

01

Add the GitHub server

Once, with a credential.

Point Meandr at GitHub's MCP endpoint and give it a token to sign in — the same add-a-server flow any server uses. Meandr holds the credential encrypted; your agents only ever hold a Meandr token.

You set up: the GitHub server and its credential, in the dashboard.

02

Curate its tools

Import the reads.

From GitHub's catalog, import the tools your agents should see. Meandr surfaces the read-only tags GitHub declares, so it's clear which tools only read.

You set up: which GitHub tools each project can call.

03

Govern the writes

Allow, approve, or deny.

Let reads through, ask a human before a merge or a push, and deny deletes outright — matched on the tool and its arguments. First match wins; every decision is logged.

You set up: the rules — reads allow, writes approve, deletes deny.

The rule reads like the intent.

"Allow GitHub reads, ask before a write, never delete." Three ordered rules — the first that matches decides.

allow   github  where  hints.read_only = true
approve github  where  tool_name in [merge_pull_request, create_release]
deny    github  where  tool_name = "delete_*"
A policy in Meandr — rules in priority order
Rules in priority order — reads allowed, writes held for a human, deletes denied. The first match wins.

Questions you'd ask anyway.

Do I have to change my agent to do this?
No. Your agent keeps calling one Meandr endpoint over standard MCP. GitHub sits behind it — the rules apply on the way through, invisibly to the agent.
Can I allow reads but require approval for merges?
Yes — that's the common shape. Rules match on the tool and its arguments, so read tools allow, a merge or release asks a human, and a delete is denied outright.
Where do my GitHub credentials live?
In Meandr, encrypted — used only to sign requests to GitHub. Your agents never hold the GitHub credential; they hold a Meandr token you can revoke in seconds.

Give your agents the repo — not the keys to it.

Point your agent at one endpoint and you're governed in minutes — no code changes, no proxy to run.

Get started

Questions? Email us