Create a GitHub issue
Let your AI file GitHub issues with a fine-grained PAT it never touches.
Open an issue in a fixed repository through a signed pipe. The fine-grained PAT is scoped to that one repo and lives server-side.
The credential never enters the model context: it lives in the FlurryPORT secret store, deliveries are signed server-side, and every send returns a receipt your agent can quote.
What this is
Your AI files GitHub issues in one fixed repository through a pipe whose fine-grained PAT it never touches. The AI sends a title and body; FlurryPORT adds the credential server-side and returns GitHub's answer as a receipt.Setup in two steps
- GitHub side. Settings, Developer settings, Fine-grained tokens: generate a token for ONLY the target repository with Issues read and write. Nothing broader; the pipe needs nothing broader.
- FlurryPORT side. Your AI requests secret setup and FlurryPORT emails you a secure page. Paste the token there and the pipe goes live.
Credential custody
The PAT is stored encrypted, added at delivery, and scrubbed from stored responses. Scoping it to a single repository means even a fully compromised pipe could only ever file issues in that one place.What to expect
Receipts carry GitHub's response, with one famous quirk: a 404 usually means the token is not granted to the repository, because GitHub hides existence rather than admitting permission trouble. Fix the token's repository access and the same call succeeds.Pairs naturally with git activity: an AI that flagged a push can file the follow-up issue through this pipe when its human says go.
Install with your agent
npx flurryport mcp
Point your agent at the FlurryPORT MCP server (npx flurryport mcp) and ask it for the flurryport:github-create-issue recipe. Works from AI clients that can run a local process: desktop apps and terminal agents. Web-only chat clients cannot reach a local MCP server; open a desktop client instead.
Tools your agent gains
flry_github_create_issue- Create an issue in the configured repository. Input: title (required), body, labels[].
Setup walkthrough
GITHUB_PAT: GitHub Settings, Developer settings, Fine-grained tokens: generate for ONLY the target repository with Issues read and write. Paste it in the FlurryPORT secret page.
Intent schema
{
"type": "object",
"required": [
"title"
],
"properties": {
"title": {
"type": "string",
"maxLength": 256
},
"body": {
"type": "string"
},
"labels": {
"type": "array",
"items": {
"type": "string"
}
}
}
}Install-time parameters
owner- install-time: Repository owner (org or user).
repo- install-time: Repository name.
Transformation
{ "title": $body.title, "body": $body.body, "labels": $body.labels }Delivery target
POST https://api.github.com/repos/$install.owner/$install.repo/issues
Placeholders like $secrets.NAME resolve server-side at delivery, never in the agent.
Gotchas
- GitHub requires a User-Agent header on API calls; the pipe sends one for you.
- A 404 from the API usually means the PAT is not granted to that repository: GitHub hides existence rather than answering 403.
Where this fits
Related recipes
Create and update Azure DevOps work items in one batched pipe: priority, state, tags, and sprint included.
Query Azure DevOps work items with WIQL and read the matching ids back, without your AI ever holding the PAT.
Read fields for a batch of Azure DevOps work items by id: title, state, tags, priority, iteration.
Let your AI file Azure DevOps work items (bugs, tasks) the model never holds credentials for.
Let your AI file Jira Cloud issues with an API token it never touches.
Let your AI file Linear issues with an API key it never touches.