Summary
On July 23, 2026, Vercel released GitHub tools as an installable eve extension (@github-tools/eve-extension). It uses Vercel Connect to mint short-lived, scoped GitHub tokens at runtime, ships presets for code-review, issue-triage, repo-explorer, ci-ops, and maintainer, and requires approval on every write tool by default.
What changed
Vercel packaged its GitHub tools as an installable eve extension. Developers install @github-tools/eve-extension and register it from agent/extensions/. It uses Vercel Connect connector-backed auth to mint short-lived, scoped GitHub tokens at runtime; provides presets (code-review, issue-triage, repo-explorer, ci-ops, maintainer) that map to Connect scopes automatically; and requires approval on every write tool by default, gatable per tool with always, once, or input-dependent predicates.
Why it matters
Giving agents GitHub access has been a security minefield; this bakes least-privilege into the distribution format. Short-lived scoped tokens and default-on write approvals make it safer to let an eve agent triage issues or review PRs, and it shows agent frameworks maturing toward governed, permissioned tool packages rather than raw API keys.
Evidence excerpt
Connector-backed auth via Vercel Connect that mints short-lived, scoped GitHub tokens at runtime... Every write tool requires approval by default.