# How to connect GitHub to OpenClaw (no API keys)

> Connect GitHub to OpenClaw with ClawLink in one click — 846 tools your AI agent can call from chat via hosted OAuth. No API keys, no manual setup.

Web version: https://claw-link.dev/openclaw/github

The usual route to GitHub access for OpenClaw is an MCP server you configure and keep running, plus your own OAuth app or API keys. ClawLink gives OpenClaw a more practical GitHub setup: install one ClawHub skill, connect GitHub in the browser, and OpenClaw can call real GitHub actions from any chat surface with no auth, token refresh, or tool wiring to build yourself.

**Start here:** install the ClawLink plugin (`openclaw plugins install clawhub:clawlink-plugin`), pair it in the browser, then connect the app in the ClawLink dashboard. The interactive install prompt is on the web version of this page: https://claw-link.dev/openclaw/github

## Setup

It takes three steps to connect OpenClaw to GitHub.

1. **Install ClawLink** — add the plugin to OpenClaw once.
2. **Connect GitHub** — one-click OAuth in the ClawLink dashboard.
3. **Use it from chat** — ask OpenClaw in plain English.

**Alternative for any agent (no plugin needed):** if the OpenClaw plugin route isn't available or doesn't work, any AI agent with shell access can use the ClawLink CLI instead:

```bash
npx -y @useclawlink/cli login          # sign in via browser — no API key to paste
npx -y @useclawlink/cli connect github  # connect GitHub (browser OAuth)
npx -y @useclawlink/cli actions github  # list available actions
npx -y @useclawlink/cli run github <action> --input '<json>'  # execute (add --confirm for writes)
```

### Install by command

The setup prompt above does all of this in one paste. By hand, it is one install command plus a browser approval:

```bash
openclaw plugins install clawhub:clawlink-plugin
```

Then ask OpenClaw to set up ClawLink. It starts browser pairing and prints an approval link — open it, approve the device, return to the chat, and say `done`. Finally, connect GitHub in the [ClawLink dashboard](https://claw-link.dev/dashboard) — a one-click OAuth approval, no API keys.

Verify the connection by asking OpenClaw:

> Search GitHub repositories with the query `topic:rag language:python stars:>500` and per_page 25, then tell me the top 5 and what each one does.

### Using a different agent?

The OpenClaw plugin is one client of ClawLink's MCP server. Claude Code, Cursor, Codex, or any agent that can run a shell command pairs with the same ClawLink account through the CLI:

```bash
npx -y @useclawlink/cli login
```

`login` opens the same browser approval and stores a credential locally. Once GitHub is connected in the dashboard, that agent calls the same 846 GitHub tools over MCP. Full setup for MCP clients and shell agents: [connect apps to any AI agent](https://claw-link.dev/learn/connect-apps-to-any-ai-agent).

## GitHub MCP for OpenClaw

Looking for a GitHub MCP server for OpenClaw? ClawLink connects GitHub to OpenClaw and exposes 846 GitHub tools your agent can call over [MCP](https://claw-link.dev/learn/what-is-an-mcp-server), with [hosted auth](https://claw-link.dev/learn/oauth-for-ai-agents) and nothing to run or maintain yourself. Using Hermes instead? The [Hermes GitHub integration](https://claw-link.dev/hermes/github) works the same way.

You can connect GitHub to OpenClaw without a personal access token. That is the route this page exists for. GitHub's OAuth flow, hosted by ClawLink, means no PAT is created, no `GITHUB_PERSONAL_ACCESS_TOKEN` sits in an MCP server config, and nothing expires. You approve the connection on GitHub's own consent screen once, and the 846 tools below run through the connected account.

## Ways to connect GitHub to OpenClaw

There are four routes, and the one you have read about determines the errors you will meet. Here is the map with the tradeoffs, including the parts ClawLink does not do.

- **OpenClaw's official GitHub skill + GitHub CLI.** The skill OpenClaw ships for GitHub wraps the `gh` CLI: it requires the `gh` binary (`brew install gh`), you run `gh auth login` once, and `GH_CONFIG_DIR` must point at the operator's home if the gateway runs under a different user. Fast, official, and entirely local — but the credential lives on the machine, and the skill only covers what `gh` exposes.
- **GitHub's official MCP server.** Two variants: the hosted endpoint `https://api.githubcopilot.com/mcp/` (OAuth or a PAT in a header) or the local server from `ghcr.io/github/github-mcp-server` with `GITHUB_PERSONAL_ACCESS_TOKEN`. You configure it in the MCP host's config file and keep it running. It is the widest official catalog — but it is a server you run, a token or app you manage, and a config file your agent may not reload on its own.
- **Your own GitHub OAuth app.** Register an app, configure the redirect URL, run the consent flow, and refresh tokens yourself. This is the full DIY route; nothing wrong with it, but it is the one with the longest setup and the most failure modes.
- **ClawLink (this page).** Hosted OAuth: approve GitHub once in the browser, and the 846 tools on this page run through your connected account. No token is stored on your machine, the grant is revocable at github.com/settings/applications, and the agent discovers tools through the plugin. What ClawLink does not do: we do not run a local MCP server for you (some hosts need one regardless), and organization repositories stay out of reach if the org enforces OAuth app restrictions until an admin approves the app.

The three DIY routes are all fine answers, and for orgs with strict OAuth policies they may be the only ones that work. What ClawLink removes is the machine-held credential and the config file — the two things that keep breaking in the guides you have read.

## What the OpenClaw GitHub integration can do

846 GitHub tools are ready for OpenClaw once the account is connected. The 30 below are the ones people reach for most; your agent can call all 846.

### 30 of 846 GitHub tools for OpenClaw

| Tool | What it does |
|---|---|
| **Abort repository migration** `github_abort_repository_migration` | Tool to abort a repository migration that is queued or in progress. Use when you need to cancel an ongoing migration operation. |
| **Accept repository invitation** `github_accept_repository_invitation` | Accepts a PENDING repository invitation that has been issued to the authenticated user. |
| **Add a repository collaborator** `github_add_a_repository_collaborator` | Adds a GitHub user as a repository collaborator, or updates their permission if already a collaborator; `permission` applies to organization-owned repositories (personal ones default to 'push' and ignore this field), and an invitation… |
| **Add app access restrictions** `github_add_app_access_restrictions` | Adds GitHub Apps to the list of apps allowed to push to a protected branch. The branch must already have protection rules with restrictions enabled. |
| **Add assignees to an issue** `github_add_assignees_to_an_issue` | Adds assignees to a GitHub issue. This action only adds users - it does not remove existing assignees. Changes are silently ignored if the authenticated user lacks push access to the repository. |
| **Add email address for authenticated user** `github_add_email_address_for_authenticated_user` | Adds one or more email addresses (which will be initially unverified) to the authenticated user's GitHub account; use this to associate new emails, noting an email verified for another account will error, while an existing email for the… |
| **Add field to user project** `github_add_field_to_user_project` | Tool to add a custom field to a user-owned GitHub Projects V2 project. Use when you need to add fields like status, priority, or custom data to organize project items. |
| **Add item to user project** `github_add_item_to_user_project` | Tool to add an issue or pull request to a user-owned GitHub project. Use when you need to add existing repository items to a project board. |
| **Add labels to an issue** `github_add_labels_to_an_issue` | Adds labels (provided in the request body) to a repository issue; labels that do not already exist are created. |
| **Add or update team membership for user** `github_add_or_update_team_membership_for_user` | Adds a GitHub user to a team or updates their role (member or maintainer), inviting them to the organization if not already a member; idempotent, returning current details if no change is made. |
| **Add or update team project permissions** `github_add_or_update_team_project_permissions` | Adds a classic project to a team or updates the team's permission on it. This endpoint grants or updates permissions for a team on a specific classic project (not Projects V2). |
| **Add or update team repository permissions** `github_add_or_update_team_repository_permissions` | Sets or updates a team's permission level for a repository within an organization; the team must be a member of the organization. |
| **API root** `github_api_root` | Retrieves a map of all top-level GitHub REST API resource URLs and their templates |
| **Check if gist is starred** `github_check_if_gist_is_starred` | Checks if a gist is starred by the authenticated user |
| **Check if pull request has been merged** `github_check_if_pull_request_has_been_merged` | Checks if a specified GitHub pull request has been merged, indicated by a 204 HTTP status |
| **Check if user can be assigned** `github_check_if_user_can_be_assigned` | Verifies if a GitHub user can be assigned to issues in a repository; assignability is confirmed |
| **Check if user can be assigned to issue** `github_check_if_user_can_be_assigned_to_issue` | Checks if a specified GitHub user can be assigned to a given issue within a repository |
| **Check if user follows another user** `github_check_if_user_follows_another_user` | Checks if a GitHub user `username` follows `target_user`; returns a 204 HTTP status if true |
| **Check if user is blocked by authenticated user** `github_check_if_user_is_blocked_by_authenticated_user` | Checks if the specified GitHub user is blocked by the authenticated user; a 204 No Content |
| **Check if user is blocked by organization** `github_check_if_user_is_blocked_by_organization` | Checks if a GitHub user is blocked by an organization |
| **Check if user is repository collaborator** `github_check_if_user_is_repository_collaborator` | Checks if a user is a collaborator on a specified GitHub repository, returning a 204 status if |
| **Check person followed by auth user** `github_check_person_followed_by_auth_user` | Checks if the authenticated GitHub user follows a target GitHub user |
| **Check private vulnerability reporting status** `github_check_private_vulnerability_reporting_status` | Checks if private vulnerability reporting is enabled for the specified repository |
| **Check public organization membership for user** `github_check_public_organization_membership_for_user` | Check if a user is a public member of an organization |
| **Check team permissions for a project** `github_check_team_permissions_for_a_project` | Checks if a team has 'read', 'write', or 'admin' permissions for an organization's specific |
| **Check team permissions for a repository** `github_check_team_permissions_for_a_repository` | Checks a team's permissions for a specific repository within an organization, including |
| **Check token** `github_check_token` | Checks if a GitHub App or OAuth access_token is valid for the specified client_id and retrieves |
| **Compare two commits** `github_compare_two_commits` | Compares two commit points (commits, branches, tags, or SHAs) within a repository or across |
| **Create inference chat completions** `github_create_inference_chat_completions` | Create chat completions using GitHub Models inference API |
| **Create inference embeddings** `github_create_inference_embeddings` | Create inference embeddings using GitHub's AI models |

## Example prompts

**Find a repository**

> Search GitHub repositories with the query `topic:rag language:python stars:>500` and per_page 25, then tell me the top 5 and what each one does.

**Triage open issues**

> Search issues and pull requests with the query `repo:octocat/hello-world is:issue is:open label:"help wanted"`, then summarize the three oldest and draft a comment for the most urgent one. Show me the comment before adding it.

**List pull requests to review**

> List pull requests for octocat/hello-world with state open, sorted by updated, per_page 20. For each one show the title, author, and what files it touches (list_pull_requests_files).

**Commit a fix and open a PR**

> In octocat/hello-world, on a branch called fix/readme-typo, update the file README.md to fix the typo in the first line (commit message: "fix: correct README typo"). Then open a pull request from fix/readme-typo into main with a one-line summary. Confirm the head branch is ahead of main before creating the PR.

## What to tell the agent when it calls GitHub

These are the behaviors the GitHub tools actually run with. None of them are visible in the tool descriptions, and each one has changed an agent's answer in our logs.

- `owner` and `repo` are separate arguments and must be names, not URLs. `github.com/octocat/hello-world` will fail; `octocat` and `hello-world` will not. Case is not sensitive; the `.git` suffix is not accepted.
- Search tools take a real GitHub search query with qualifiers: `language:python`, `stars:>500`, `repo:octocat/hello-world`, `is:issue is:open`, `label:"help wanted"`, `user:octocat`. A plain "find me the repo" works, but the qualifiers are what turn a vague request into the exact repo, and the schema examples carry them.
- Search endpoints are rate-limited separately from everything else: **30 requests per minute** when authenticated, and **10 per minute for code search** (`GITHUB_SEARCH_CODE`). A loop of small code searches will 403 where a single `per_page: 100` call succeeds. The overall API budget is 5,000 requests per hour per token.
- `per_page` defaults to **30** and caps at **100** on every list and search tool. "List my pull requests" returns 30 unless you say how many.
- `GITHUB_CREATE_OR_UPDATE_FILE_CONTENTS` takes the new file as plain text and base64-encodes it itself, auto-fetches the current `sha` when you omit it, and retries a `409` conflict automatically up to 5 times. The only thing it needs from you is owner, repo, path, message, and content.
- On `GITHUB_CREATE_AN_ISSUE`, `labels`, `assignees`, and `milestone` are **silently dropped** when the account lacks push access — the issue still opens, just without them. The account with push access can set them.
- `GITHUB_SEARCH_ISSUES_AND_PULL_REQUESTS` returns an AI-optimized summary by default (`response_detail: minimal`). If the agent needs the full GitHub response (exact fields, raw bodies), the schema accepts `response_detail: "full"`.
- `GITHUB_LIST_PULL_REQUESTS` defaults to `state: open` and sorts by `created`. "Show me closed PRs" requires the argument, not the description.

## ClawLink vs. building it yourself

The alternative to ClawLink is usually manual OAuth app setup plus your own token handling, permission troubleshooting, and tool plumbing for OpenClaw. That is fine if you want to build and maintain the integration yourself. Most teams just want GitHub working from chat.

| | Manual | ClawLink |
|---|---|---|
| **Connection flow** | Register a GitHub app, configure redirect URLs, manage consent details, and reconnect users when auth settings drift. | Users connect GitHub through the hosted browser flow and ClawLink keeps the token lifecycle out of your app code. |
| **Ongoing maintenance** | You own refresh logic, permission debugging, environment config, and every provider-specific edge case for GitHub. | ClawLink handles the repetitive integration plumbing so your team can focus on the workflow instead of the infrastructure. |
| **Agent usability** | You still need to expose the right GitHub actions to the runtime in a format your agent can reliably use. | 846 tools for GitHub are already exposed through ClawLink, so the agent can read and act from chat immediately. |

## ClawLink vs. Composio

Composio also exposes GitHub to AI agents. It is developer infrastructure: Python and TypeScript SDKs, an MCP server, and a catalog past 1,000 apps, aimed at teams shipping agent products. ClawLink is built for OpenClaw users instead. You install the plugin once, connect GitHub in the browser, and the 846 tools above work from chat. There is no SDK, no config file, and no API key handling. Choosing between them? Read the full [Composio alternatives](https://claw-link.dev/hub/composio-alternatives) comparison.

### OpenClaw installed the GitHub skill but can't call the tools
The ClawHub skill teaches OpenClaw about GitHub, but the calls run through the ClawLink plugin and your connected account. Make sure GitHub is connected in the dashboard, then start a fresh chat so OpenClaw reloads the tool catalog. If OpenClaw runs as a persistent gateway, restart it so the new tools register.

### Connection succeeds but no tools appear
Reconnect GitHub from the dashboard, then start a fresh chat if the runtime still has the old tool catalog loaded.

### "Tool schema not loaded yet" error when calling GitHub tools
GitHub tool schemas load on demand the first time a tool runs and are cached after that, so this error usually clears on its own: wait a few seconds and retry the same request. If every GitHub call keeps failing with it in a fresh chat, reconnect from the dashboard, and contact support if it still persists — that pattern points to a configuration problem on our side, not something you can fix by reconnecting again.

### GitHub returns 403 or "permission denied" on one action while others work
Two usual causes. The connected account may not have access to the specific workspace, inbox, store, or project in the request — check that first. If access looks right, the agent may have sent a placeholder value (like "YOUR_ID" or an example id from documentation) instead of a real one: ask it to run a list or search tool first, then retry the action with a real id from those results. Most failures at this stage are one of these two, not ClawLink bugs.

### Tool 'github_search_repos' not found. Did you mean: 'github_search_repositories'?
The agent guessed a tool name that is not in the GitHub toolkit — usually a shorter version of the real one. The most common guesses in our logs are `github_search_repos` (real name `GITHUB_SEARCH_REPOSITORIES`), `github_list_issues` (`GITHUB_LIST_REPOSITORY_ISSUES`), `github_create_issue` (`GITHUB_CREATE_AN_ISSUE`), `github_get_authenticated_user` (`GITHUB_GET_THE_AUTHENTICATED_USER`), and `github_create_repo` (`GITHUB_CREATE_A_REPOSITORY_FOR_THE_AUTHENTICATED_USER`). Ask the agent to run `clawlink_search_tools` (or use the tool explorer on this page) and call the exact name it returns. This is not an account problem — reconnecting will not fix a made-up tool name.

Ask the agent to diagnose it:

```text
Run clawlink_search_tools for "github" and list the exact tool names. Then identify which of them the user's intent maps to and retry only that one.
```

### Although you appear to have the correct authorization credentials, the `\\<org>` organization has enabled OAuth App access restrictions
The organization has turned on GitHub's third-party OAuth access restrictions, which block every OAuth app — ClawLink included — from its repositories. You can reconnect, sign out, and sign in again; the org will still refuse the app, because the restriction is per-organization, not per-connection. An organization admin must go to the org's settings → Third-party access and approve the ClawLink GitHub app. Personal repositories are unaffected; only repositories owned by the restricted org are.

Ask the agent to diagnose it:

```text
Ask the user which organization owns the repository that failed, then tell them the org admin must approve the ClawLink app under Organization settings → Third-party access. Do not retry the call until the admin confirms approval.
```

### Issues are disabled: The repository '\\<repo>' has issues disabled
The repository exists and the account has access — issues are simply turned off for it. A repository owner can enable them under the repo's settings → Features → Issues. Until then, issue tools on that repository return this exact error no matter what the agent tries.

### "No commits between main and test" when creating a pull request
GitHub rejects a pull request when the head branch has no commits beyond the base branch — there is literally nothing to merge. The agent usually called `create_a_pull_request` before any commit landed on the head branch, or pointed head and base at branches that are identical. Push a commit to the head branch first (or pick the branch that actually carries the change), then retry the pull request.

Ask the agent to diagnose it:

```text
Compare the two branches the user named (compare_two_commits or list_commits on each) and confirm the head branch is ahead of the base before retrying create_a_pull_request.
```

### Must have admin rights to Repository
GitHub returned 403 for a repository-admin operation — deleting or archiving a repository, changing its visibility, or editing protected-branch rules — because the connected account has write access but not admin on that repository. Ask the account owner to check the repository's Collaborators → Roles screen: what matters is the role on the repository itself, not the org membership. If you only need to create or update files, the regular tools work with write access; the admin-only tools do not.

### Connected account is not in an ACTIVE state. Current status is "REVOKED"
The GitHub user revoked ClawLink's access at github.com/settings/applications (or the org revoked it for them). GitHub keeps the connection row around, so tools keep failing with this exact status until the user reconnects: dashboard → GitHub → reconnect and complete the consent flow again. No tool call will succeed on a revoked grant.

Ask the agent to diagnose it:

```text
Run clawlink_list_integrations and report GitHub's auth state exactly as returned. If it says revoked, tell the user to reconnect GitHub from the dashboard and stop there.
```

### GitHub returns 404 Not Found on a repository the user is sure exists
Two causes, in order of likelihood. The repository is private and the connected account is not a collaborator on it — OAuth tokens see only repositories the user can see, and "the team's repo" on a shared laptop account is frequently owned by a different GitHub identity. Or the agent passed an owner or repo name that does not match exactly (case and the `.git` suffix matter: the tools want `owner` and `repo` as separate names, not the clone URL). Have the agent run `github_list_repositories_for_the_authenticated_user` and compare the returned names with what it asked for.

Ask the agent to diagnose it:

```text
Run github_list_repositories_for_the_authenticated_user and show the user which repositories the connected account actually sees. Compare those names with the failing request.
```

### OAuth finished in the browser but the account is still missing
Try reconnecting GitHub and complete the consent flow in the same browser session. Partial OAuth approvals or switching accounts mid-flow can leave the connection incomplete.

### Is there a OpenClaw GitHub integration?
Yes. ClawLink is the fastest way to connect OpenClaw to GitHub: link your GitHub account once in the browser and OpenClaw can call the GitHub API through 846 ready-made tools — no custom code or token handling.

### How do I add GitHub to OpenClaw with ClawLink?
Paste the setup prompt from this page into OpenClaw. It installs the ClawLink GitHub skill from ClawHub, then you click Connect in the dashboard to authorize GitHub. OpenClaw calls the tools from the next message — no config files or API keys to manage.

### How long does it take to connect GitHub to OpenClaw?
About two minutes. Sign in, click Connect next to GitHub in the dashboard, authenticate, and OpenClaw can use it from the next chat message.

### Why use ClawLink instead of wiring GitHub up myself?
The alternative to ClawLink is usually manual OAuth app setup plus your own token handling, permission troubleshooting, and tool plumbing for OpenClaw. That is fine if you want to build and maintain the integration yourself. Most teams just want GitHub working from chat.

### Do I need a GitHub personal access token to connect GitHub to OpenClaw?
No. ClawLink connects through GitHub's hosted OAuth flow, so no token is ever created, printed, or stored in a config file on your machine. The token-shaped setup you have read about belongs to the DIY route: a fine-grained or classic personal access token pasted into an MCP server's config (the `GITHUB_PERSONAL_ACCESS_TOKEN` environment variable used by GitHub's own MCP server, for example). A PAT has an expiry and can leak wherever the config file lives. With ClawLink you approve GitHub on its own consent screen once, and the grant is revoked at github.com/settings/applications.

### What permissions does ClawLink request when connecting GitHub?
ClawLink's GitHub connection uses GitHub's classic OAuth scope set: `repo`, `user`, `gist`, `notifications`, `project`, `workflow`, and `codespace`. That is the same family of scopes a `gh auth login` requests, and it is what lets the 846 tools read and update repositories, issues, pull requests, gists, and Actions workflows. The grant is listed under your GitHub settings → Applications, and one click there revokes it without touching your account password.

### Is it safe to connect my GitHub account to OpenClaw?
The honest version. ClawLink's connection can write: it can create issues, open pull requests, push file changes, and trigger Actions workflows — that is what the tools on this page do. The mitigations are structural rather than rhetorical: no token sits in a config file or chat log on your machine, every call goes through GitHub's own API with your identity, the grant is visible and revocable at github.com/settings/applications, and the agent only acts when you ask. The two risks worth knowing: a prompt-injection trick in content the agent reads (issue text, PR bodies, commit messages) can make it attempt actions you did not ask for — use draft-and-review flows for writes — and organization repositories may be governed by the org's own OAuth app restrictions (see the troubleshooting section). If you want a hard boundary, connect an account or organization that only holds the repositories you are comfortable handing an agent.

### OpenClaw installed the GitHub skill but can't call the tools
The ClawHub skill teaches OpenClaw about GitHub, but the calls run through the ClawLink plugin and your connected account. Make sure GitHub is connected in the dashboard, then start a fresh chat so OpenClaw reloads the tool catalog. If OpenClaw runs as a persistent gateway, restart it so the new tools register.

## Related

- [PagerDuty tools](https://claw-link.dev/openclaw/pagerduty) — Manage incidents, on-call schedules, and services
- [OpenClaw SafetyCulture integration](https://claw-link.dev/openclaw/safetyculture) — SafetyCulture (formerly iAuditor) is a workplace operations platform that enables teams to conduct digital inspections, manage audits, track issues, schedule tasks, and maintain compliance through mobile and web applications.
- [OpenClaw LaunchDarkly integration](https://claw-link.dev/openclaw/launch-darkly) — A feature management platform that helps teams build better software faster using feature flags.