Git Provider Connections

DevSpec needs git access before you can track repositories in a project. GitHub is organization access by default. Other hosts still use a personal account.

• GitHub — Give DevSpec access on GitHub. That access belongs to your DevSpec organization, not to one person. A personal GitHub account remains available as a fallback.
• Bitbucket Cloud — personal OAuth.
• GitLab — gitlab.com (OAuth) or a self-managed instance (OAuth or a personal access token).
• Gitea / Forgejo / Codeberg — self-hosted Gitea or Forgejo, and Codeberg, via OAuth or a personal access token.

GitHub: organization access

On GitHub, the usual path is Give DevSpec access on GitHub from setup, the repository picker, or You → Connections.

That grant lives on your DevSpec organization. Every project in that organization can use the repositories you allowed. Tracking is still a per-project choice: Add in this project's repository list does not add it to another project.

On GitHub, choose All repositories if you want new ones to show up here automatically. Only select repositories means you will grant each new one on GitHub. You will need someone who can manage that GitHub organization.

Don't see a repository? Give access to more repositories on GitHub. Removing a repo in DevSpec only stops this project watching it — it does not revoke the GitHub grant.

If GitHub access is reduced or suspended, DevSpec will ask you to manage access on GitHub. It will not ask you to reconnect a personal GitHub account for that failure.

A personal GitHub account is the fallback: Use a personal GitHub account instead. That connection belongs to you (You → Connections) and is how GitHub used to work. Existing projects that already track repos that way keep working until you Add them through organization access instead.

When you track a repository into a project, every member of that project can read that repository's code through the access you used. Keep that in mind on a shared project.

Connecting other providers

Bitbucket, GitLab, and Gitea still connect under You → Connections, or when you start adding a repository in a project.

Cloud providers (Bitbucket, GitLab.com)

• Pick your provider and click "Authorize."
• Approve DevSpec on the provider's consent screen.
• You're redirected back with your account connected. The connection now appears in You → Connections.

Self-managed GitLab or Gitea / Forgejo

• Enter your instance URL (for Codeberg, use https://codeberg.org).
• Authorize with OAuth, or paste a personal access token with repository + webhook access.
• DevSpec validates the credential and connects the instance to your account.

You can disconnect any connection at any time from You → Connections (and revoke DevSpec entirely from the provider's own settings).

What DevSpec can access

DevSpec only reads your code. It indexes your tracked repositories, reads files, pull/merge requests and commits, and listens for pushes. It never commits, pushes, or modifies your code. When you implement changes via Autopilot or the MCP, that's your local agent acting with your own local git credentials — entirely under your control.

Organization GitHub access is limited to the repositories you allowed on GitHub. Personal OAuth (GitHub fallback, Bitbucket, GitLab, Gitea) is coarser — the token can technically reach every repo that account can, but DevSpec only uses it for the repos you track into projects.

• GitHub (organization access) — contents, metadata, and pull requests, read only. Pushes arrive through DevSpec's GitHub webhook, not a per-repo hook.
• GitHub (personal account fallback) — the repo scope (which also covers webhook management).
• Bitbucket — account, repository, pullrequest, webhook.
• GitLab — the api scope (GitLab has no narrower webhook-only scope).
• Gitea / Forgejo — repository read + webhook, per the instance's OAuth app or token.

Revoking organization GitHub access is done on GitHub. Disconnecting a personal connection is You → Connections (or the provider's settings).

If access breaks

• Organization GitHub access — DevSpec asks you to manage access on GitHub. It will not ask you to reconnect a personal GitHub account.
• Personal OAuth — whoever connected it re-authorizes in You → Connections, or another project admin can re-point those repos onto their own connection.