Week 45, updated 2 Nov 2026

AI use cases Coding agents AI for GitHub issues and pull requests

AI for GitHub issues and pull requests

Connect an AI agent to GitHub to triage issues, summarise pull requests and open drafts. Prompts, workflow and tools with quality and safety labels.

Tools compared
4
Open source
3of 4
Reviewed
16 Oct

For: Developers

Best-scored tools for this jobscore, safety
  1. 1OpenHandsAgent framework68Caution
  2. 2Claude CodeAI tool65No dependencies scanned
  3. 3CodexAI tool58Caution
  4. 4GitHub MCP ServerMCP server41No issues found
What the score and shapes mean

Score = public maintenance, adoption and docs signals, as a percentile of 52 tools. Nobody here tested these hands-on. Shapes are the separate safety label: No issues found, No dependencies scanned, Caution.

What it does for you

Maintainers and small teams with a busy issue tracker.

  • Summarise open issues and group duplicates
  • Draft a reply or a labelled triage list for new issues
  • Summarise what changed in a pull request
  • Open a draft pull request for a well-specified issue
  • Search code and history across repositories you can access
More about this job

With a GitHub connector an agent can read issues, pull requests and code and, if you allow it, create branches and comments. Scope the access tightly: GitHub tokens are powerful.

Workflow in 5 steps

  1. Create a fine-grained token limited to the repositories and permissions you need.
  2. Connect the GitHub MCP server or an agent with GitHub access.
  3. Start with read-only summarising tasks and check them against the source.
  4. Only then allow drafts, and keep a human approving every comment or merge.
  5. Rotate the token regularly.
Full steps
  1. Create a fine-grained token limited to the repositories and permissions you need; read-only to start.
  2. Connect the GitHub MCP server or an agent with GitHub access.
  3. Start with read-only summarising tasks and check them against the source.
  4. Only then allow drafts, and keep a human approving every comment or merge.
  5. Rotate the token regularly.

Prompts to copy

Starting points we wrote, not tested results.

List the open issues labelled bug from the last 30 days, group likely duplicates, and suggest a priority for each. Read only; do not comment.

2 more prompts

Summarise pull request #123 for a reviewer: purpose, files touched, risks and anything missing.

Draft a polite reply to issue #88 asking for a minimal reproduction and the version they use. Show me the text first.

Watch out for

  • Text an agent reads from the web, issues or documents can contain hidden instructions (prompt injection).
  • Keep API keys, tokens and customer data out of prompts and out of files the agent can read.
  • Treat AI changes like a pull request from a new colleague: read the diff, run the tests and keep a human sign-off before anything ships.
  • Issue text is written by strangers.
  • Licence to check before commercial use: Claude Code (Proprietary (Anthropic Commercial Terms)).
  • CautionOpenHandsSkill/agent file instructs piping a remote script into a shell: .agents/skills/frontend-development/references/guide.md
  • No dependencies scannedClaude CodeCode checks clean, no lockfile to check
  • CautionCodex4 critical-severity known vulnerabilities in runtime dependencies (OSV)
  • No issues foundGitHub MCP ServerNo issues found in this week’s scan
Why these warnings?
  • Text an agent reads from the web, issues or documents can contain hidden instructions (prompt injection). Do not give an agent that reads untrusted content write access to anything important.
  • Keep API keys, tokens and customer data out of prompts and out of files the agent can read. Use a separate, low-privilege key for any agent.
  • Treat AI changes like a pull request from a new colleague: read the diff, run the tests and keep a human sign-off before anything ships.
  • Issue text is written by strangers. An agent that reads issues and can write to the repo is a prompt injection target, so keep write access off or approval-gated.
  • OpenHands: Skill/agent file instructs piping a remote script into a shell: .agents/skills/frontend-development/references/guide.md — curl -LsSf https://astral.sh/uv/install.sh | sh
  • Claude Code: code and instruction-file checks found nothing, but there is no runtime lockfile or manifest, so dependencies were not checked
  • Codex: 4 critical-severity known vulnerabilities in runtime dependencies (OSV)

Recommended tools

From our ranked data, highest score first. A high score does not mean a clean scan.

  • 68OpenHandsAgent framework · MIT · #10 overall
  • 65Claude CodeAI tool · Proprietary (Anthropic Commercial Terms) · #11 overall
  • 58CodexAI tool · Apache-2.0 · #16 overall
  • 41GitHub MCP ServerMCP server · MIT · #40 overall

Related jobs

Sources for tool facts

OpenHands/OpenHands · anthropics/claude-code · openai/codex · github/github-mcp-server. Data fetched 2 Nov 2026. Scores and labels are automated, relative and not a hands-on test.

Get the board every Monday

One email a week: the new top 10, the biggest score changes and every safety label that changed.

Free. Double opt-in: you confirm by email first, unsubscribe in one click.