Evidence
observed · not disputed
Coverage
complete · 16/16 graded0/5 barrier checks verified
Freshness
fresh
Last tested
Revision
sha256:b05d6f473be2…

Agent report card

Can an agent use GitHub REST API through Repository operations?

Grade B: Only some material eligibility conditions are decidable before commitment.

GitHub / active

Agent ReadinessBLimited

Five-stage assessment

Where agent autonomy holds and where it breaks

Five states · each from its own evidence · lifecycle order, not a journey
  1. EvaluateLimited
  2. Sign upReady
  3. PayReady
  4. ProvisionLimited
  5. OperateLimited
  1. 01

    Evaluate

    Limited

    Only some material eligibility conditions are decidable before commitment.

    The exact service and stable evaluation or access entrypoints are publicly discoverable.

    Applicable terms are stable, readable, retrievable, and materially complete.

    Price or no-charge status, variables, currency, and material conditions are explicit.

    Evidence and actions6 signals

    Can an agent decide every material eligibility condition before commitment?

    supported: fresh

    Only some material eligibility conditions are decidable before commitment.

    GitHub specifies basic account signup requirements, such as providing a valid email address and complying with age and export control or sanctions laws. However, the evidence does not provide complete eligibility criteria for every organization or specialized account type.

    eligibility_decidability: Limited: tested 20 Aug

    Method public-http-semantic-assessment 2026-08-20

    Can an agent estimate cost or confirm no-charge status before commitment?

    supported: fresh

    Price or no-charge status, variables, currency, and material conditions are explicit.

    GitHub's pricing page explicitly states the Free tier plan costs $0 USD per month forever for basic features for individuals and organizations.

    pricing_decidability: Ready: tested 20 Aug

    Method public-http-semantic-assessment 2026-08-20

    Can an agent find the exact service and its stable entrypoints?

    supported: fresh

    The exact service and stable evaluation or access entrypoints are publicly discoverable.

    The GitHub REST API documentation is publicly discoverable and provides overview, getting started, authentication, and endpoint guides.

    service_discovery: Ready: tested 20 Aug

    Method public-http-semantic-assessment 2026-08-20

    Are verified structured discovery artifacts available?

    missing: unknown

    Current admissible evidence does not resolve this finding.

    structured_evaluation_discovery: Unknown

    Can an agent retrieve and understand the applicable commitment terms?

    supported: fresh

    Applicable terms are stable, readable, retrievable, and materially complete.

    The GitHub Terms of Service are retrievable and set out the general commitment terms, definitions, and rules governing the use of the Service.

    terms_access: Ready: tested 20 Aug

    Method public-http-semantic-assessment 2026-08-20

    Does the vendor deliberately describe access for web agents?

    missing: unknown

    Current admissible evidence does not resolve this finding.

    verified_web_agent_access: Unknown

    What would improve this stage

    • State every material eligibility condition and required input explicitly.
  2. 02

    Sign up

    Ready

    A stable canonical route begins the required access bootstrap.

    Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.

    Evidence and actions5 signals

    Can an agent operate the access controls and safe handoffs deterministically?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    The retained registration capture returned a 403 response requiring JS and ad blocker adjustments, leaving access control operability unresolved.

    access_control_operability: Unknown: tested 20 Aug

    Method bounded-headless-semantic-assessment 2026-08-20

    Is there a stable route to begin obtaining service access?

    supported: fresh

    A stable canonical route begins the required access bootstrap.

    First-party documentation explicitly directs users to https://github.com/signup to begin personal account registration.

    access_entrypoint_stability: Ready: tested 20 Aug

    Method bounded-headless-semantic-assessment 2026-08-20

    Can an agent obtain scoped, revocable authority for this service?

    supported: fresh

    Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.

    GitHub documentation provides explicit mechanisms for obtaining fine-grained personal access tokens and OAuth tokens with specific permissions and explicit revocation options.

    delegated_identity_access: Ready: tested 20 Aug

    Method public-http-semantic-assessment 2026-08-20

    Can required phone verification be completed through a supported boundary?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    Retained evidence does not state whether phone verification is required or how phone verification is handled during signup.

    phone_verification_compatible: Unknown: tested 20 Aug

    Method bounded-headless-semantic-assessment 2026-08-20

  3. 03

    Pay

    Ready

    Charge or no-charge status, currency, recurrence, and material conditions are disclosed.

    A documented direct purchase path reaches paid access without a vendor decision point.

    Evidence and actions4 signals

    Can an agent construct checkout, hand off approval safely, and resume?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    The retained evidence describes UI navigation steps for upgrading an account plan, but does not provide evidence for deterministic API or web flow construction, approval handoff, and resumption required for checkout operability.

    checkout_operability: Unknown: tested 20 Aug

    Method public-http-semantic-assessment 2026-08-20

    Is the exact commercial commitment disclosed before authorization?

    supported: fresh

    Charge or no-charge status, currency, recurrence, and material conditions are disclosed.

    GitHub discloses the pricing structure (Free at $0 USD per month) and documents the commercial commitment conditions, including immediate prorated billing for upgrades/added seats and cycle-end effective dates for downgrades.

    commitment_disclosure: Ready: tested 20 Aug

    Method public-http-semantic-assessment 2026-08-20

    Can payment be authorized within scoped agent or explicit human authority?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    The documentation describes selecting payment methods (credit card or PayPal) and submitting upgrade forms, but does not establish scoped agent delegation or explicit human-confirmed authorization rails with receipts.

    payment_authorization: Unknown: tested 20 Aug

    Method public-http-semantic-assessment 2026-08-20

    Is a direct self-service path to paid access documented?

    supported: fresh

    A documented direct purchase path reaches paid access without a vendor decision point.

    GitHub explicitly documents a direct, self-service path to upgrade personal or organization accounts under Billing and licensing settings without requiring vendor sales interaction or vendor approval.

    self_service_purchase: Ready: tested 20 Aug

    Method public-http-semantic-assessment 2026-08-20

  4. 04

    Provision

    Limited

    Delivery needs additional human transfer or has weak scope or lifecycle semantics.

    Provisioning is machine-triggerable or follows deterministically from an allowed handoff.

    A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.

    Evidence and actions3 signals

    Can usable access material be delivered securely to an authorized agent?

    supported: fresh

    Delivery needs additional human transfer or has weak scope or lifecycle semantics.

    GitHub REST API documentation describes creating personal access tokens and obtaining client IDs/secrets from the developer settings page. Because credentials or access tokens involve manual dashboard steps or authorization flows, access material delivery relies on manual human creation or transfer constraints.

    access_material_delivery: Limited: tested 20 Aug

    Method public-http-semantic-assessment 2026-08-20

    Can an agent determine successful provisioning completion and reconcile asynchronous failure?

    supported: fresh

    A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.

    Documentation for REST API repository endpoints shows synchronous endpoints returning a 201 Created HTTP response status code with the created repository schema upon successful execution.

    provisioning_completion: Ready: tested 20 Aug

    Method public-http-semantic-assessment 2026-08-20

    Can provisioning be initiated within supported agent authority?

    supported: fresh

    Provisioning is machine-triggerable or follows deterministically from an allowed handoff.

    Repository creation can be triggered directly via HTTP POST requests to API endpoints like `/orgs/{org}/repos` or `/user/repos` using bearer token authorization.

    provisioning_operability: Ready: tested 20 Aug

    Method public-http-semantic-assessment 2026-08-20

    What would improve this stage

    • Deliver scoped access material through a secure documented machine-usable flow.
  5. 05

    Operate

    Limited

    Safe failure handling is documented only partially.

    Only part of the credential lifecycle is agent-operable.

    Every essential target has a stable documented agent-usable interface alternative.

    Request-time authentication is documented and usable under scoped agent authority.

    Essential operations have stable readable request, response, and effect semantics.

    Evidence and actions6 signals

    Is an agent-native protocol interface verified against the essential targets?

    missing: unknown

    Current admissible evidence does not resolve this finding.

    agent_protocol_interface: Unknown

    Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?

    supported: fresh

    Only part of the credential lifecycle is agent-operable.

    Documentation shows user access tokens can be refreshed using a refresh token and revoked by users. Third parties can also submit revocation requests for leaked tokens via the credential revocation API. Full agent-operable lifecycle and recovery are not completely established.

    credential_lifecycle: Limited: tested 20 Aug

    Method public-http-semantic-assessment 2026-08-20

    Can an agent handle applicable failure modes safely?

    supported: fresh

    Safe failure handling is documented only partially.

    Documentation explicitly covers rate limit errors (403 Forbidden, 429 Too Many Requests), header-based retry guidance (retry-after, x-ratelimit-remaining, x-ratelimit-reset), exponential backoff recommendations, and API request timeout limits (10 seconds). Full cancellation, idempotency, and state reconciliation semantics are not completely established.

    failure_contract: Limited: tested 20 Aug

    Method public-http-semantic-assessment 2026-08-20

    Can an agent authenticate service operations with scoped authority?

    supported: fresh

    Request-time authentication is documented and usable under scoped agent authority.

    API operations support authenticated requests with scoped authority using Bearer tokens sent in the Authorization header.

    operation_authentication: Ready: tested 20 Aug

    Method public-http-semantic-assessment 2026-08-20

    Are essential operation inputs, outputs, and effects stable and decidable?

    supported: fresh

    Essential operations have stable readable request, response, and effect semantics.

    Request and response schemas, parameters, rate limit response headers, status codes, and error header expectations (such as X-Accepted-GitHub-Permissions) are documented across all essential endpoints and troubleshooting guides.

    operation_contract: Ready: tested 20 Aug

    • repository-api

    Method public-http-semantic-assessment 2026-08-20

    Can an agent perform every essential assessment target through a usable interface?

    supported: fresh

    Every essential target has a stable documented agent-usable interface alternative.

    Machine-operable interfaces are documented and accessible across rate limits, repository operations, REST API overview, and troubleshooting targets.

    target_interface_access: Ready: tested 20 Aug

    • repository-api

    Method public-http-semantic-assessment 2026-08-20

    What would improve this stage

    • Document applicable structured errors, retry, cancellation, and reconciliation semantics.
    • Provide scoped expiry, rotation, revocation, compromise, and recovery operations.

What works

  • Sign up: A stable canonical route begins the required access bootstrap.
  • Pay: Charge or no-charge status, currency, recurrence, and material conditions are disclosed.

What blocks agents

  • Evaluate: Only some material eligibility conditions are decidable before commitment.
  • Provision: Delivery needs additional human transfer or has weak scope or lifecycle semantics.
  • Operate: Safe failure handling is documented only partially.

Startup offers

GitHub on the startup-offers board

catalog record →

Improve the report

Correct it, rerun it, or improve the funnel.

Report outdated evidenceRequest reassessmentClaim this record
Profile
arp_01kzf0m4x9v5n7pd3j2gc8q1fk
Projection
sha256:3882c657abb37b5f45540c7ab7e6be96d111d939cab03d72e6235fac6c771647
Policy
service-use-2026-08-20-public-evidence-r9 · sha256:57bf95fd6d0fe6fe9173a68b60e8d8dc2179b357c88ff4349675a72d0e1d4139

Every request carries these exact identifiers.How report cards are assessed →View the exact declaration