Connect GitHub repositories to Managed Deep Agents

The GitHub connector gives the agent two independent ways to work with GitHub:

Tools — GitHub is a tool server integration like Gmail or Linear, so the connector can load LangChain-authored GitHub API tools through LangSmith’s gateway. The provider token stays in LangSmith’s vault.
Sandbox — the connector also prepares repositories, the gh CLI, and credentials inside a managed sandbox, so the agent can inspect or change checkouts directly.

The GitHub connector requires managed-deepagents>=0.4.0.

Managed Deep Agents is in private beta, available on LangSmith Cloud in the US region only. Join the waitlist to request access.

This connector is separate from the GitHub channel, which receives App webhooks, and Connect-with-GitHub under identity.

Add the connector

Create connectors/github.py or connectors/github.ts and export a named connector:

from managed_deepagents import connectors

connector = connectors.github(
    repositories=[
        {
            "repo": "acme/api",
            "path": "workspace/api",
            "ref": "main",
            "depth": 1,
            "on_reuse": "fetch",
        }
    ],
)

import { connectors } from "managed-deepagents";

export const connector = connectors.github({
  repositories: [
    {
      repo: "acme/api",
      path: "workspace/api",
      ref: "main",
      depth: 1,
      onReuse: "fetch",
    },
  ],
});

The connector clones each repository when the sandbox is created. On reuse, on_reuse / onReuse controls whether it keeps, resets, or fetches the checkout. The default is fetch.

Tools and the `installCLI` rule

The two halves meet in exactly one rule: installCLI decides the default tool surface. With gh in the sandbox (the default), the agent already reaches the GitHub API, so the integration’s tool definitions stay off—adding them would be a second route to the same endpoints. Naming tools with include_tools / includeTools, or setting installCLI: false, turns them on. An explicit selection always wins, exclude_tools / excludeTools on its own included. That means a checkout-only project needs no tool config and no connected GitHub integration in the workspace—the gateway is never called:

from managed_deepagents import connectors

# Tools on: no gh in the sandbox, so the agent uses the integration's tools
connector = connectors.github(
    install_cli=False,
    include_tools=["github_create_pull_request"],
)

import { connectors } from "managed-deepagents";

// Tools on: no gh in the sandbox, so the agent uses the integration's tools
export const connector = connectors.github({
  installCLI: false,
  includeTools: ["github_create_pull_request"],
});

Tool names are provider-qualified (github_create_pull_request), not prefixed. For how the gateway resolves credentials, see Tool server integrations.

Configure options

Option (Python / TypeScript)	Default	Purpose
`repositories`	`[]`	Repository checkouts and their sandbox paths.
`install_cli` / `installCLI`	`true`	Install the GitHub CLI in the sandbox. `true` also defaults the integration’s tools off.
`inject_credentials` / `injectCredentials`	`true`	Expose resolved GitHub credentials to `git` and `gh`.
`include_tools` / `includeTools`	all tools (when on)	Allowlist of integration tool names to load.
`exclude_tools` / `excludeTools`	(none)	Denylist of integration tool names.

Repository paths must be relative and unique. Set write to true on a checkout that needs write credentials. For private repositories, configure GitHub credentials through identity. The runtime injects the resolved token as GH_TOKEN and configures Git credentials without storing it in thread state.

Test and deploy

Test the project locally with mda dev, then deploy it with mda deploy. Open deployment traces in LangSmith to inspect model calls, tool calls, errors, and latency. The sandbox half runs only when the project declares a managed sandbox. After startup, ask the agent to inspect the configured path or run gh auth status.

Next steps

Tool server integrations

See how LangSmith-hosted integration tools reach the agent.

Connectors

Compare connector types.

GitHub channel

Receive GitHub App webhooks.

Identity

Scope callers and resolve credentials.

Configure a sandbox

Configure sandbox scope and lifecycle.

Connect these docs to Claude, VSCode, and more via MCP for real-time answers.

Edit this page on GitHub or file an issue.

​Add the connector

​Tools and the installCLI rule

​Configure options

​Test and deploy

​Next steps

Tool server integrations

Connectors

GitHub channel

Identity

Configure a sandbox

Add the connector

Tools and the `installCLI` rule

Configure options

Test and deploy

Next steps