Integrations Level of Access

Last updated: May 1, 2026

Integration Data Flow

Mycroft integrations operate on a pull model, meaning the platform only retrieves data from connected services and platforms like Jira, GitHub, and AWS.

Integration Best Practices

For security purposes, it's recommended to create dedicated user accounts for integrations when possible. This approach allows you to:

  • Grant only the necessary permissions required for the integration

  • Maintain better access control and audit trails

  • Follow the principle of least privilege

Some integrations, such as AWS, include the creation of a dedicated account with proper privileges as part of their setup process.

Code Repository Integrations (GitHub, Bitbucket, GitLab)

For all code repository integrations, Mycroft requests read-only access to:

  • Pull/merge requests, repositories, and code

  • Users and team memberships

What we do with this access

The read scope is in place to support upcoming features such as SBOM generation and vulnerability scanning, which will be opt-in from within the Mycroft app.

  • We do not read your code today. We do not store your code.

  • We do not use integration data to train AI models. Our AI agents have limited, scoped, and auditable access to integration data.

  • Team membership data is retained to support access reviews.

  • We do not write code. Any future change to this would require new permission scopes and explicit consent.

Provider-specific notes

GitHub and Bitbucket: Permissions are granted as a set — there is no per-scope opt-in. You can still limit which repositories are in scope during installation.

GitLab: We provide recommended scopes when generating the access token. Scopes can be revoked or adjusted at any time from your GitLab account.

Removing a required scope will disable the Mycroft features that depend on it (e.g. removing pull request access disables PR-related features).

Reconnect older integrations

If you connected before the dates below, we recommend reconnecting to use our dedicated apps, which provide tighter permission boundaries:

  • GitHub: before March 2026

  • Bitbucket: before April 2026

  • GitLab: before April 15 2026

Note: The GitHub integration currently requests write permissions due to using GitHub OAuth App instead of GitHub App, where the "repo" scope includes write access. However, Mycroft doesn't actually use these write permissions for its operations, and will be moving away from this scope in the future.

AWS Information Scope

  • Read-only basis across the account (IAM, S3, ECS, EKS, EC2, etc.) to check for cloud misconfigurations as part of Cloud Scan.

  • List of users who are in the connected AWS account via IAM - to support access reviews.