Skip to content

ADR-0007: Tool the Archivist with GitHub (least privilege)

Guide

ADR-0007: Tool the Archivist with GitHub (least privilege)

  • Status: Accepted · Date: 2026-05-30 · Approved by: Kevin Wong
  • Request: SOP-001 / AR-001 (hr/access/requests.md)

Context

The methodology deferred agent tooling (“tool agents later”), and GR-4 requires a needs analysis before tooling. The Archivist already runs git via Bash, but the record’s fidelity also depends on the remote state — that pushes landed and that main stays fast-forwarded to the working branch (ADR-0005). Verifying and managing that by hand is toil and error-prone.

Decision

Grant the Archivist a least-privilege GitHub MCP tool set — read/verify (get_commit, list_commits, list_branches, list_tags, get_tag, get_file_contents, list_pull_requests, pull_request_read, search_code, get_me) plus branch/PR/push (create_branch, create_pull_request, update_pull_request, update_pull_request_branch, push_files, create_or_update_file). No merge, delete, admin, or secret scope.

This is the first deliberate tooling of an agent — a considered exception to “tool later,” justified by the AR-001 needs analysis and approved by the Principal.

Consequences

  • The Archivist can verify pushes, keep main synced, and manage draft PRs/branches.
  • The grant is recorded in the access register and reflected in .claude/agents/archivist.md tools:. Future tooling follows the same SOP-001 path.
  • Routine commits still prefer local git; GitHub tools are for verification and PR/branch management.