The GitHub login on the developer machine is the leak. Take it off.

While there’s a GitHub token, PAT or SSH key on the machine, anyone or any coding agent with a shell can push your source somewhere else. AgentValet speaks git’s own protocol, so the machine keeps one agent key and every clone, pull and push goes through the broker: checked against the repositories that agent may reach, logged, and revocable in one click.

Livelast reviewed 24 September 2026

Three commands, then git works as it always did

Only the remote URL changes. Branch, commit, pull, rebase and push are all as before; a small credential helper answers git’s password prompt with a short-lived token that proves which agent is calling.

1
Register this machine as an agent, once.
Terminal
```
npx @agentvalet/register
```
2
Tell git to authenticate to the broker with the agent key. This adds a credential helper to your global git config; add --local to set it for one repository only.
Terminal
```
npx @agentvalet/register git-setup
```
In the dashboard, connect GitHub once and grant the agent github:contents.read (and github:contents.write if it may push). On that grant, open Restrict to repositories and list what it may reach, such as acme/ledger-service or acme/*.

Use the broker as the remote.

Terminal

git clone https://api.agentvalet.ai/git/acme/ledger-service.git

Move an existing clone onto the broker

1
Point the remote at the broker. Then remove any GitHub credential on the machine, or it’s still another way out.
Terminal
```
git remote set-url origin https://api.agentvalet.ai/git/acme/ledger-service.git
```

What’s governed here

Nothing is allowed until you grant it. This is a typical first grant for Git itself; you decide every row, and you can change it without touching the agent.

A git operation runs through the same checks as any other governed call: who is calling, whether the agent is live, whether the scope is granted, whether the repository is on the list, and whether your policies agree. Only then does the broker reach GitHub.

Example grant for Git itself. Platforms and actions are illustrative.
What the agent tries	Platform	Decision
Clone or pull acme/ledger-service	GitHub	Allowed within grant
Push a branch to acme/ledger-service	GitHub	Allowed within grant
Push to a personal repository	GitHub	Not on the list
A push your policy marks for approval	GitHub	Refused, can’t wait

The log names the identity, the repository and the branches

For a push, the broker reads git’s command header (never the file contents) and records the branches that changed. An auditor can answer who pushed to main on the ledger service last Tuesday from the same log as every other agent action.

Audit row, metadata.git

{
  "service": "receive-pack",
  "upstream_status": 200,
  "request_bytes": 48213,
  "refs": [ { "ref": "refs/heads/main", "op": "update" } ]
}

It’s the only path when there’s no other one

AgentValet governs what goes through it. To make it the only way out, pair it with a short perimeter checklist.

No GitHub credential: No gh auth login, no PAT, no SSH key, no Git Credential Manager account on the machine.
Egress allow-list: Allow api.agentvalet.ai; deny github.com, api.github.com and *.githubusercontent.com.
One agent per machine: With a GitHub grant carrying the repository list, and no other platform with an upload or send scope on the same agent.
GitHub’s own controls: SSO enforced, forking off, PAT creation restricted, an organisation IP allow-list that includes the broker.

Governed git reference in the docsThe longer walkthrough, kept with the product docs.

All integrations or the platforms your agents can reach

Put Git itself behind AgentValet.

Register the agent, grant only what it needs, and approve the risky calls from your phone. Free to start, no credit card.

Protect my first agent Watch your agent’s calls live, no signup