How to connect GitHub to OpenClaw (no API keys)

The usual route to GitHub access for OpenClaw is an MCP server you configure and keep running, plus your own OAuth app or API keys. ClawLink gives OpenClaw a more practical GitHub setup: install one ClawHub skill, connect GitHub in the browser, and OpenClaw can call real GitHub actions from any chat surface with no auth, token refresh, or tool wiring to build yourself.

Copy this prompt into OpenClaw, or open the GitHub skill on ClawHub.

Prompt for OpenClaw

Before installing anything, inspect the ClawHub skill metadata and setup requirements.
If the skill asks you to install a third-party package or CLI, verify its source, maintainer, and package contents before running the install command.
Install the skill "GitHub" (hith3sh/github-repos) from ClawHub only after those checks pass.
Skill page: https://clawhub.ai/hith3sh/github-repos
Keep the work scoped to this skill only.
After install, help me finish setup from verified skill metadata.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Setup

It takes three steps to connect OpenClaw to GitHub.

1
Install the plugin
Paste the setup prompt into OpenClaw, or install from the terminal and ask OpenClaw to pair:
openclaw plugins install clawhub:clawlink-plugin
2
Connect GitHub
One-click OAuth in the dashboard.
3
Use it from chat
Ask OpenClaw: "What can you do with GitHub?"

Install by command

The setup prompt above does all of this in one paste. By hand, it is one install command plus a browser approval:

openclaw plugins install clawhub:clawlink-plugin

Then ask OpenClaw to set up ClawLink. It starts browser pairing and prints an approval link — open it, approve the device, return to the chat, and say done. Finally, connect GitHub in the ClawLink dashboard — a one-click OAuth approval, no API keys.

Verify the connection by asking OpenClaw:

Search GitHub repositories with the query topic:rag language:python stars:>500 and per_page 25, then tell me the top 5 and what each one does.

Using a different agent?

The OpenClaw plugin is one client of ClawLink's MCP server. Claude Code, Cursor, Codex, or any agent that can run a shell command pairs with the same ClawLink account through the CLI:

npx -y @useclawlink/cli login

login opens the same browser approval and stores a credential locally. Once GitHub is connected in the dashboard, that agent calls the same 846 GitHub tools over MCP. Full setup for MCP clients and shell agents: connect apps to any AI agent.

GitHub MCP for OpenClaw

Looking for a GitHub MCP server for OpenClaw? ClawLink connects GitHub to OpenClaw and exposes 846 GitHub tools your agent can call over MCP, with hosted auth and nothing to run or maintain yourself. Using Hermes instead? The Hermes GitHub integration works the same way.

You can connect GitHub to OpenClaw without a personal access token. That is the route this page exists for. GitHub's OAuth flow, hosted by ClawLink, means no PAT is created, no GITHUB_PERSONAL_ACCESS_TOKEN sits in an MCP server config, and nothing expires. You approve the connection on GitHub's own consent screen once, and the 846 tools below run through the connected account.

Ways to connect GitHub to OpenClaw

There are four routes, and the one you have read about determines the errors you will meet. Here is the map with the tradeoffs, including the parts ClawLink does not do.

OpenClaw's official GitHub skill + GitHub CLI. The skill OpenClaw ships for GitHub wraps the gh CLI: it requires the gh binary (brew install gh), you run gh auth login once, and GH_CONFIG_DIR must point at the operator's home if the gateway runs under a different user. Fast, official, and entirely local — but the credential lives on the machine, and the skill only covers what gh exposes.
GitHub's official MCP server. Two variants: the hosted endpoint https://api.githubcopilot.com/mcp/ (OAuth or a PAT in a header) or the local server from ghcr.io/github/github-mcp-server with GITHUB_PERSONAL_ACCESS_TOKEN. You configure it in the MCP host's config file and keep it running. It is the widest official catalog — but it is a server you run, a token or app you manage, and a config file your agent may not reload on its own.
Your own GitHub OAuth app. Register an app, configure the redirect URL, run the consent flow, and refresh tokens yourself. This is the full DIY route; nothing wrong with it, but it is the one with the longest setup and the most failure modes.
ClawLink (this page). Hosted OAuth: approve GitHub once in the browser, and the 846 tools on this page run through your connected account. No token is stored on your machine, the grant is revocable at github.com/settings/applications, and the agent discovers tools through the plugin. What ClawLink does not do: we do not run a local MCP server for you (some hosts need one regardless), and organization repositories stay out of reach if the org enforces OAuth app restrictions until an admin approves the app.

The three DIY routes are all fine answers, and for orgs with strict OAuth policies they may be the only ones that work. What ClawLink removes is the machine-held credential and the config file — the two things that keep breaking in the guides you have read.

What the OpenClaw GitHub integration can do

846 GitHub tools are ready for OpenClaw once the account is connected. The 30 below are the ones people reach for most; your agent can call all 846.

30 of 846 GitHub tools for OpenClaw

Tool	What it does
Abort repository migration `github_abort_repository_migration`	Tool to abort a repository migration that is queued or in progress. Use when you need to cancel an ongoing migration operation.
Accept repository invitation `github_accept_repository_invitation`	Accepts a PENDING repository invitation that has been issued to the authenticated user.
Add a repository collaborator `github_add_a_repository_collaborator`	Adds a GitHub user as a repository collaborator, or updates their permission if already a collaborator; `permission` applies to organization-owned repositories (personal ones default to 'push' and ignore this field), and an invitation…
Add app access restrictions `github_add_app_access_restrictions`	Adds GitHub Apps to the list of apps allowed to push to a protected branch. The branch must already have protection rules with restrictions enabled.
Add assignees to an issue `github_add_assignees_to_an_issue`	Adds assignees to a GitHub issue. This action only adds users - it does not remove existing assignees. Changes are silently ignored if the authenticated user lacks push access to the repository.
Add email address for authenticated user `github_add_email_address_for_authenticated_user`	Adds one or more email addresses (which will be initially unverified) to the authenticated user's GitHub account; use this to associate new emails, noting an email verified for another account will error, while an existing email for the…
Add field to user project `github_add_field_to_user_project`	Tool to add a custom field to a user-owned GitHub Projects V2 project. Use when you need to add fields like status, priority, or custom data to organize project items.
Add item to user project `github_add_item_to_user_project`	Tool to add an issue or pull request to a user-owned GitHub project. Use when you need to add existing repository items to a project board.
Add labels to an issue `github_add_labels_to_an_issue`	Adds labels (provided in the request body) to a repository issue; labels that do not already exist are created.
Add or update team membership for user `github_add_or_update_team_membership_for_user`	Adds a GitHub user to a team or updates their role (member or maintainer), inviting them to the organization if not already a member; idempotent, returning current details if no change is made.
Add or update team project permissions `github_add_or_update_team_project_permissions`	Adds a classic project to a team or updates the team's permission on it. This endpoint grants or updates permissions for a team on a specific classic project (not Projects V2).
Add or update team repository permissions `github_add_or_update_team_repository_permissions`	Sets or updates a team's permission level for a repository within an organization; the team must be a member of the organization.
API root `github_api_root`	Retrieves a map of all top-level GitHub REST API resource URLs and their templates
Check if gist is starred `github_check_if_gist_is_starred`	Checks if a gist is starred by the authenticated user
Check if pull request has been merged `github_check_if_pull_request_has_been_merged`	Checks if a specified GitHub pull request has been merged, indicated by a 204 HTTP status
Check if user can be assigned `github_check_if_user_can_be_assigned`	Verifies if a GitHub user can be assigned to issues in a repository; assignability is confirmed
Check if user can be assigned to issue `github_check_if_user_can_be_assigned_to_issue`	Checks if a specified GitHub user can be assigned to a given issue within a repository
Check if user follows another user `github_check_if_user_follows_another_user`	Checks if a GitHub user `username` follows `target_user`; returns a 204 HTTP status if true
Check if user is blocked by authenticated user `github_check_if_user_is_blocked_by_authenticated_user`	Checks if the specified GitHub user is blocked by the authenticated user; a 204 No Content
Check if user is blocked by organization `github_check_if_user_is_blocked_by_organization`	Checks if a GitHub user is blocked by an organization
Check if user is repository collaborator `github_check_if_user_is_repository_collaborator`	Checks if a user is a collaborator on a specified GitHub repository, returning a 204 status if
Check person followed by auth user `github_check_person_followed_by_auth_user`	Checks if the authenticated GitHub user follows a target GitHub user
Check private vulnerability reporting status `github_check_private_vulnerability_reporting_status`	Checks if private vulnerability reporting is enabled for the specified repository
Check public organization membership for user `github_check_public_organization_membership_for_user`	Check if a user is a public member of an organization
Check team permissions for a project `github_check_team_permissions_for_a_project`	Checks if a team has 'read', 'write', or 'admin' permissions for an organization's specific
Check team permissions for a repository `github_check_team_permissions_for_a_repository`	Checks a team's permissions for a specific repository within an organization, including
Check token `github_check_token`	Checks if a GitHub App or OAuth access_token is valid for the specified client_id and retrieves
Compare two commits `github_compare_two_commits`	Compares two commit points (commits, branches, tags, or SHAs) within a repository or across
Create inference chat completions `github_create_inference_chat_completions`	Create chat completions using GitHub Models inference API
Create inference embeddings `github_create_inference_embeddings`	Create inference embeddings using GitHub's AI models

Try it: find the GitHub tool you need

Browse the 30 GitHub tools

Click any tool to see exactly what OpenClaw can do and copy a ready-to-use prompt.

Example prompts

Search GitHub repositories with the query topic:rag language:python stars:>500 and per_page 25, then tell me the top 5 and what each one does.

Search issues and pull requests with the query repo:octocat/hello-world is:issue is:open label:"help wanted", then summarize the three oldest and draft a comment for the most urgent one. Show me the comment before adding it.

List pull requests for octocat/hello-world with state open, sorted by updated, per_page 20. For each one show the title, author, and what files it touches (list_pull_requests_files).

In octocat/hello-world, on a branch called fix/readme-typo, update the file README.md to fix the typo in the first line (commit message: "fix: correct README typo"). Then open a pull request from fix/readme-typo into main with a one-line summary. Confirm the head branch is ahead of main before creating the PR.

What to tell the agent when it calls GitHub

These are the behaviors the GitHub tools actually run with. None of them are visible in the tool descriptions, and each one has changed an agent's answer in our logs.

owner and repo are separate arguments and must be names, not URLs. github.com/octocat/hello-world will fail; octocat and hello-world will not. Case is not sensitive; the .git suffix is not accepted.
Search tools take a real GitHub search query with qualifiers: language:python, stars:>500, repo:octocat/hello-world, is:issue is:open, label:"help wanted", user:octocat. A plain "find me the repo" works, but the qualifiers are what turn a vague request into the exact repo, and the schema examples carry them.
Search endpoints are rate-limited separately from everything else: 30 requests per minute when authenticated, and 10 per minute for code search (GITHUB_SEARCH_CODE). A loop of small code searches will 403 where a single per_page: 100 call succeeds. The overall API budget is 5,000 requests per hour per token.
per_page defaults to 30 and caps at 100 on every list and search tool. "List my pull requests" returns 30 unless you say how many.
GITHUB_CREATE_OR_UPDATE_FILE_CONTENTS takes the new file as plain text and base64-encodes it itself, auto-fetches the current sha when you omit it, and retries a 409 conflict automatically up to 5 times. The only thing it needs from you is owner, repo, path, message, and content.
On GITHUB_CREATE_AN_ISSUE, labels, assignees, and milestone are silently dropped when the account lacks push access — the issue still opens, just without them. The account with push access can set them.
GITHUB_SEARCH_ISSUES_AND_PULL_REQUESTS returns an AI-optimized summary by default (response_detail: minimal). If the agent needs the full GitHub response (exact fields, raw bodies), the schema accepts response_detail: "full".
GITHUB_LIST_PULL_REQUESTS defaults to state: open and sorts by created. "Show me closed PRs" requires the argument, not the description.

ClawLink vs. building it yourself

The alternative to ClawLink is usually manual OAuth app setup plus your own token handling, permission troubleshooting, and tool plumbing for OpenClaw. That is fine if you want to build and maintain the integration yourself. Most teams just want GitHub working from chat.

	Manual	ClawLink
Connection flow	Register a GitHub app, configure redirect URLs, manage consent details, and reconnect users when auth settings drift.	Users connect GitHub through the hosted browser flow and ClawLink keeps the token lifecycle out of your app code.
Ongoing maintenance	You own refresh logic, permission debugging, environment config, and every provider-specific edge case for GitHub.	ClawLink handles the repetitive integration plumbing so your team can focus on the workflow instead of the infrastructure.
Agent usability	You still need to expose the right GitHub actions to the runtime in a format your agent can reliably use.	846 tools for GitHub are already exposed through ClawLink, so the agent can read and act from chat immediately.

ClawLink vs. Composio

Composio also exposes GitHub to AI agents. It is developer infrastructure: Python and TypeScript SDKs, an MCP server, and a catalog past 1,000 apps, aimed at teams shipping agent products. ClawLink is built for OpenClaw users instead. You install the plugin once, connect GitHub in the browser, and the 846 tools above work from chat. There is no SDK, no config file, and no API key handling. Choosing between them? Read the full Composio alternatives comparison.

Troubleshooting

OpenClaw installed the GitHub skill but can't call the tools

The ClawHub skill teaches OpenClaw about GitHub, but the calls run through the ClawLink plugin and your connected account. Make sure GitHub is connected in the dashboard, then start a fresh chat so OpenClaw reloads the tool catalog. If OpenClaw runs as a persistent gateway, restart it so the new tools register.

Connection succeeds but no tools appear

Reconnect GitHub from the dashboard, then start a fresh chat if the runtime still has the old tool catalog loaded.

"Tool schema not loaded yet" error when calling GitHub tools

GitHub tool schemas load on demand the first time a tool runs and are cached after that, so this error usually clears on its own: wait a few seconds and retry the same request. If every GitHub call keeps failing with it in a fresh chat, reconnect from the dashboard, and contact support if it still persists — that pattern points to a configuration problem on our side, not something you can fix by reconnecting again.

GitHub returns 403 or "permission denied" on one action while others work

Two usual causes. The connected account may not have access to the specific workspace, inbox, store, or project in the request — check that first. If access looks right, the agent may have sent a placeholder value (like "YOUR_ID" or an example id from documentation) instead of a real one: ask it to run a list or search tool first, then retry the action with a real id from those results. Most failures at this stage are one of these two, not ClawLink bugs.

Tool 'github_search_repos' not found. Did you mean: 'github_search_repositories'?

The agent guessed a tool name that is not in the GitHub toolkit — usually a shorter version of the real one. The most common guesses in our logs are github_search_repos (real name GITHUB_SEARCH_REPOSITORIES), github_list_issues (GITHUB_LIST_REPOSITORY_ISSUES), github_create_issue (GITHUB_CREATE_AN_ISSUE), github_get_authenticated_user (GITHUB_GET_THE_AUTHENTICATED_USER), and github_create_repo (GITHUB_CREATE_A_REPOSITORY_FOR_THE_AUTHENTICATED_USER). Ask the agent to run clawlink_search_tools (or use the tool explorer on this page) and call the exact name it returns. This is not an account problem — reconnecting will not fix a made-up tool name.

Ask the agent to diagnose it:

Run clawlink_search_tools for "github" and list the exact tool names. Then identify which of them the user's intent maps to and retry only that one.

Although you appear to have the correct authorization credentials, the `\<org>` organization has enabled OAuth App access restrictions

The organization has turned on GitHub's third-party OAuth access restrictions, which block every OAuth app — ClawLink included — from its repositories. You can reconnect, sign out, and sign in again; the org will still refuse the app, because the restriction is per-organization, not per-connection. An organization admin must go to the org's settings → Third-party access and approve the ClawLink GitHub app. Personal repositories are unaffected; only repositories owned by the restricted org are.

Ask the agent to diagnose it:

Ask the user which organization owns the repository that failed, then tell them the org admin must approve the ClawLink app under Organization settings → Third-party access. Do not retry the call until the admin confirms approval.

Issues are disabled: The repository '\<repo>' has issues disabled

The repository exists and the account has access — issues are simply turned off for it. A repository owner can enable them under the repo's settings → Features → Issues. Until then, issue tools on that repository return this exact error no matter what the agent tries.

"No commits between main and test" when creating a pull request

GitHub rejects a pull request when the head branch has no commits beyond the base branch — there is literally nothing to merge. The agent usually called create_a_pull_request before any commit landed on the head branch, or pointed head and base at branches that are identical. Push a commit to the head branch first (or pick the branch that actually carries the change), then retry the pull request.

Ask the agent to diagnose it:

Compare the two branches the user named (compare_two_commits or list_commits on each) and confirm the head branch is ahead of the base before retrying create_a_pull_request.

Must have admin rights to Repository

GitHub returned 403 for a repository-admin operation — deleting or archiving a repository, changing its visibility, or editing protected-branch rules — because the connected account has write access but not admin on that repository. Ask the account owner to check the repository's Collaborators → Roles screen: what matters is the role on the repository itself, not the org membership. If you only need to create or update files, the regular tools work with write access; the admin-only tools do not.

Connected account is not in an ACTIVE state. Current status is "REVOKED"

The GitHub user revoked ClawLink's access at github.com/settings/applications (or the org revoked it for them). GitHub keeps the connection row around, so tools keep failing with this exact status until the user reconnects: dashboard → GitHub → reconnect and complete the consent flow again. No tool call will succeed on a revoked grant.

Ask the agent to diagnose it:

Run clawlink_list_integrations and report GitHub's auth state exactly as returned. If it says revoked, tell the user to reconnect GitHub from the dashboard and stop there.

GitHub returns 404 Not Found on a repository the user is sure exists

Two causes, in order of likelihood. The repository is private and the connected account is not a collaborator on it — OAuth tokens see only repositories the user can see, and "the team's repo" on a shared laptop account is frequently owned by a different GitHub identity. Or the agent passed an owner or repo name that does not match exactly (case and the .git suffix matter: the tools want owner and repo as separate names, not the clone URL). Have the agent run github_list_repositories_for_the_authenticated_user and compare the returned names with what it asked for.

Ask the agent to diagnose it:

Run github_list_repositories_for_the_authenticated_user and show the user which repositories the connected account actually sees. Compare those names with the failing request.

OAuth finished in the browser but the account is still missing

Try reconnecting GitHub and complete the consent flow in the same browser session. Partial OAuth approvals or switching accounts mid-flow can leave the connection incomplete.

FAQ

Is there a OpenClaw GitHub integration?

Yes. ClawLink is the fastest way to connect OpenClaw to GitHub: link your GitHub account once in the browser and OpenClaw can call the GitHub API through 846 ready-made tools — no custom code or token handling.

How do I add GitHub to OpenClaw with ClawLink?

Paste the setup prompt from this page into OpenClaw. It installs the ClawLink GitHub skill from ClawHub, then you click Connect in the dashboard to authorize GitHub. OpenClaw calls the tools from the next message — no config files or API keys to manage.

How long does it take to connect GitHub to OpenClaw?

About two minutes. Sign in, click Connect next to GitHub in the dashboard, authenticate, and OpenClaw can use it from the next chat message.

Why use ClawLink instead of wiring GitHub up myself?

Do I need a GitHub personal access token to connect GitHub to OpenClaw?

No. ClawLink connects through GitHub's hosted OAuth flow, so no token is ever created, printed, or stored in a config file on your machine. The token-shaped setup you have read about belongs to the DIY route: a fine-grained or classic personal access token pasted into an MCP server's config (the GITHUB_PERSONAL_ACCESS_TOKEN environment variable used by GitHub's own MCP server, for example). A PAT has an expiry and can leak wherever the config file lives. With ClawLink you approve GitHub on its own consent screen once, and the grant is revoked at github.com/settings/applications.

What permissions does ClawLink request when connecting GitHub?

ClawLink's GitHub connection uses GitHub's classic OAuth scope set: repo, user, gist, notifications, project, workflow, and codespace. That is the same family of scopes a gh auth login requests, and it is what lets the 846 tools read and update repositories, issues, pull requests, gists, and Actions workflows. The grant is listed under your GitHub settings → Applications, and one click there revokes it without touching your account password.

Is it safe to connect my GitHub account to OpenClaw?

The honest version. ClawLink's connection can write: it can create issues, open pull requests, push file changes, and trigger Actions workflows — that is what the tools on this page do. The mitigations are structural rather than rhetorical: no token sits in a config file or chat log on your machine, every call goes through GitHub's own API with your identity, the grant is visible and revocable at github.com/settings/applications, and the agent only acts when you ask. The two risks worth knowing: a prompt-injection trick in content the agent reads (issue text, PR bodies, commit messages) can make it attempt actions you did not ask for — use draft-and-review flows for writes — and organization repositories may be governed by the org's own OAuth app restrictions (see the troubleshooting section). If you want a hard boundary, connect an account or organization that only holds the repositories you are comfortable handing an agent.

OpenClaw installed the GitHub skill but can't call the tools

How to connect GitHub to OpenClaw

Setup

Install the plugin

Connect GitHub

Use it from chat

Install by command

Using a different agent?

GitHub MCP for OpenClaw

Ways to connect GitHub to OpenClaw

What the OpenClaw GitHub integration can do

30 of 846 GitHub tools for OpenClaw

Try it: find the GitHub tool you need

Example prompts

What to tell the agent when it calls GitHub

ClawLink vs. building it yourself

ClawLink vs. Composio

Troubleshooting

FAQ

PagerDuty tools

OpenClaw SafetyCulture integration

OpenClaw LaunchDarkly integration

On this page