GitHub CLI extension · least-privilege

$ gh claude

Claude Code on your private repos — never your real credential.

A GitHub CLI extension that launches Claude Code with a temporary, least-privilege token: read-only on source code (no push), read/write on issues and pull requests, expiring after 7 days, and stored in your OS keychain. Claude only ever sees the scoped token — not your keychain, not your real gh login.

zsh — install

gh extension install
                        bitwise-media-group/gh-claude

$ gh claude

Get started Star on GitHub

gh claude · scoped launch ● read-only · no push

1launch

$ gh claude

✓ stored token — @deavon · 6d 23h remaining

→ GH_TOKEN + GITHUB_TOKEN exported

→ git credential helper wired (GIT_CONFIG_*)

→ launching claude in ~/work/private-api …

✳ Claude Code is ready

2what claude gets

✓contentsread-only

✓issuesread / write

✓pull requestsread / write

✗git pushrejected

◆expiry7 days

◆storagemacOS Keychain

$ gh claude status

Expires: Thu, 09 Jul 2026 (6d 23h remaining)

One command mints (or reuses) the scoped token, wires it into gh and git, and hands over to Claude — [1] the launch · [2] exactly what Claude gets.

read-onlyon source code

7 daysthen the token dies

0pushes possible

~1browser click a week

// WHAT GH-CLAUDE DOES

A scoped token for Claude — minted in the browser, stored in the keychain, wired in at launch.

Least-privilege token

A fine-grained PAT scoped to contents: read and issues + pull requests: read/write, across every repo you can access. Claude works your backlog; the credential stays yours.

No push, by design

contents: read means git push is rejected outright. If the token ever leaks, the blast radius stops at read.

Expires in 7 days

Tokens live a week, and reuse stops five minutes before expiry. GitHub has no API to mint fine-grained PATs, so the browser step comes round about once a week — pre-filled, one click.

Native keychains

macOS Keychain and Windows Credential Manager via the standard library — no cgo, no third-party keyring. Linux and WSL2 fall back to an AES-256-GCM encrypted file at 0600.

Claude never sees your credential

Only the scoped token, via GITHUB_TOKEN. Your keychain and your real gh login are never read, never exported, never touched.

Wired into gh and git

GH_TOKEN plus a per-process git credential helper (GIT_CONFIG_*): clones and fetches work on private repos, and nothing global is modified.

Claude gets

scoped GITHUB_TOKEN contents: read issues: read/write pull requests: read/write

Claude never sees

your keychain your real gh credential git push anything past 7 days

// SEVEN COMMANDS, ONE JOB

Everything hangs off gh claude — the launch is the default.

gh claude --help

$ gh claude # ensure a valid token, then launch Claude here

$ gh claude -- --resume # pass arguments through to claude after --

$ gh claude login # force-create a fresh token, no launch

$ gh claude status # account, expiry, and where the token lives

$ gh claude verify # verify the binary's build provenance

$ gh claude logout # remove the stored token

$ gh claude --op --vault
                        Engineering

# keep the token in 1Password instead

// THREE STEPS TO A SCOPED LAUNCH

Install

One command. Needs the gh CLI (authenticated), git, and claude on your PATH.

Alternative methods

gh extension install
                        bitwise-media-group/gh-claude

Generate

Your browser opens the token page pre-filled — choose "All repositories", click Generate, paste it back (input hidden).

$ gh claude login

Launch

Claude starts with the scoped token wired into gh and git — and the token is reused until it expires.

$ gh claude