When an agent builds a web page, a Next.js or Vue project, or any code for you, it can publish that project to your own GitHub with one instruction (for example, "push this to a new repo called acme-site"). To enable it, connect a GitHub Personal Access Token (PAT) once.

Step 1 — Create a token on GitHub (use a Classic token)

Use a Classic personal access token — it's the simplest to scope correctly for everything Ambrose does (create repos, push code, push workflow files, and packages).

  1. Sign in to github.com.
  2. Open the new-token page directly: https://github.com/settings/tokens/new (this is Settings → Developer settings → Personal access tokens → Tokens (classic) → Generate new token (classic)).
  3. Give it a Note (e.g. "Ambrose") and set an Expiration.
  4. Tick these scopes:
    • repo — full control of repositories (read + write code, create repos). Required.
    • workflow — lets Ambrose push GitHub Actions workflow files (.github/workflows/…).
    • write:packages — publish packages (under write:packages).
    • admin:org → write:org — create/manage repos inside an organization you own. (Skip if you only push to your personal account.)
  5. Click Generate token and copy it now — GitHub shows it only once. A classic token looks like ghp_….
Fine-grained alternative. If your org requires fine-grained tokens, that works too — grant Repository permissions: Contents: Read and write, Administration: Read and write (to create repos), Workflows: Read and write, and (for packages) the relevant package permission. A fine-grained token looks like github_pat_…. Classic is recommended for simplicity.

Step 2 — Save it in Ambrose

  1. Open Settings → Keys in Ambrose.
  2. Find the GitHub card, paste your token into Personal Access Token, and click Save.

The token is stored encrypted and scoped to your agency only — no other agency can use or see it.

Step 3 — Use it

In chat or the War Room, ask an agent to push a project, for example: "Create a simple landing page for my agency and push it to a new private repo called acme-landing." The agent builds the files, creates the repo if needed, pushes them as one commit, and hands you the repo and commit links.

Two tools become available to any agent/team that has the github spoke enabled (and they work over a published team MCP too):

  • github_list_repos — lists the repos your token can see, to help pick a target.
  • github_push — pushes the agent's workspace (or specific files) to owner/repo@branch as one commit, creating the repo first if it doesn't exist.

Good to know

  • Scope: a classic token with repo covers reading/writing code and creating repos. Add workflow to push .github/workflows files, write:packages to publish packages, and write:org (under admin:org) to create repos inside an organization.
  • Expiration: if you set an expiry, re-paste a new token when it lapses.
  • Org repos: Ambrose can push to an existing org/repo your token can access; it only auto-creates repos under your own account.
  • Security: the token is stored as a secret, scoped to your agency only — it is never returned to the UI (only a "saved" flag + last 4 chars). Revoke it anytime on GitHub to instantly cut access.

Troubleshooting

  • "Save failed" — make sure you pasted the token value (starts with ghp_ or github_pat_), not the token's name or URL. Generate a fresh one if you're unsure — GitHub only shows the value once.
  • Agent says "No GitHub token connected" — the token didn't save, or it was saved for a different agency. Re-open Settings → Keys, confirm the GitHub card shows Saved, and save again.
  • Push rejected — the token is missing scope. Generate a classic token at github.com/settings/tokens/new with repo (+ workflow for Actions files, write:packages for packages, write:org for org repos).