Tools

GitHub's official CLI: manage pull requests, issues, releases and Actions workflows from the terminal. Most commands support --json output that agents can parse, and an official agent skill is available. Run gh auth login first.

GitHub's official MCP server: lets agents read and write repositories and code, manage issues and pull requests, and check Actions workflows and code-scanning alerts. Use the hosted remote server or run it locally in Docker; needs a personal access token or OAuth.

Runs GitHub Actions workflows locally in Docker, so you can test .github/workflows changes without repeated commits and pushes, or use workflows as a local task runner. Needs Docker installed.

Static security analysis for CI/CD config: finds template injection, credential leaks, excessive permissions and more in GitHub Actions workflows, also covers Dependabot and pre-commit configs, and auto-fixes some findings.

GitHub's official gh extension for writing Actions workflows in Markdown that AI agents execute, compiled into standard Actions. Choose engines like Copilot, Claude Code or Codex; runs in a read-only sandbox by default. Requires gh.