Services → GitHub — triage

Connect GitHub — triage

Issues and pull requests, without the code. The narrower of the two GitHub profiles — pick this one when the agent triages rather than reads source.

Tier 1 Fine-grained personal access token ~4 min profile github/triage-read

Setting this up with your own agent? Give it these instructions.

Which GitHub profile do I want?

github/triage-read reads issues and pull request metadata. github/code-read

reads the code — files, history, diffs — and is Tier 2 because repository contents

can carry committed secrets.

If you want both, make two connections with two tokens rather than one broad token

bound to the wider profile. The point of separate profiles is that "this connection

may read our source" stays a decision someone made, visible on the services page,

rather than a side effect of how a token was scoped months ago.

The token flow is identical to github/code-read; only the permissions differ.

**Settings → Developer settings → Personal access tokens → Fine-grained tokens → Generate new token.**
Name it prodpeek-triage-<repo> and set an expiry.
Repository access → Only select repositories, and pick one.
Repository permissions: Issues → Read-only, Pull requests → Read-only. Leave Contents at No access — that is the line between the two profiles.
Copy the token, then in Prodpeek: **Services → Add a service → GitHub — triage read, paste it, and Test connection**.

Repository access → Only select repositories → pick ONEThe token is the only thing that makes a connection repo-specific — the MCP endpoint is one URL for every repository and the repo is an argument.
Repository permissions → Issues → Read-onlyListing and reading issues.
Repository permissions → Pull requests → Read-onlyListing and reading pull requests.
Repository permissions → Metadata → Read-onlyRequired by GitHub whenever another repository permission is set.

The permissions that look harmless and quietly demote the profile from “the credential cannot” to “we asked it not to”.

Contents (any level)This profile is deliberately not about the code. If you want file contents and history, use github/code-read instead of widening this token — the two profiles exist so the choice is visible.
Any permission set to Read and writeThe profile denies create_pull_request and merge_pull_request; a token that cannot perform them means the denial holds regardless.
Secret scanning alertsThose alerts contain the detected secrets themselves.
A classic PATClassic tokens scope to accounts, not repositories, and repo includes write.