# GitHub and repositories

Distinguish local checkout identity from an authorized GitHub connection.


## Two different connections

**Local identity** records repository name, branch, and application directory. It does not upload source files or authorize Everock to read GitHub contents.

**GitHub integration** uses the configured GitHub App and your authorization to access repositories you permitted. Connecting it is separate from runtime SDK installation.

```bash title="Terminal"
pnpm --filter @everock/cli start github connect
```

## First authorization

The initial flow opens GitHub when identity or repository authorization is missing. You choose the repositories. Once access exists, your agent can connect additional permitted repositories without opening the dashboard for each one.

CLI login alone cannot grant new GitHub permissions. Organization restrictions, a missing App installation, revoked access, or an unauthorized repository require the corresponding GitHub action.

## From MCP

Use `get_component_connection_links` to retrieve authorization links and `connect_component_repository` to connect a component. Use `link_component_checkout` when only local identity is needed. Inspect the returned state rather than treating a repository name as proof of connection.

## Code privacy

SDK telemetry does not upload your whole repository. Local identity linking also does not upload source. An authorized GitHub integration can read permitted source files for the features that use them. Source-map uploads and architecture summaries are separate, explicit data paths.

For a deployment you operate, configure the GitHub App's credentials, webhook secret, stable public URLs, and `/connect/github/callback`. Keep private keys and OAuth secrets outside the repository.