GitHub
Install the GitHub App and agents react to pull requests, pushes, and issues, and answer @ellipsis mentions in any thread. Each session gets a token minted for it, narrowed to the repositories and permissions named in YAML, so nothing in the sandbox can exceed what you granted.
An agent declares one event surface and the filters that scope it: a pull request opened against your default branch that touches migrations, a push to a release branch, an issue with a given label. Work starts the moment the event fires.
Mention @ellipsis in a pull request or issue comment and an agent picks the thread up as its prompt. Replies continue the same conversation with no repeat mention, so a review comment becomes a fix without anyone leaving the pull request.
No agent runs on a developer's credentials. Each sandbox gets its own installation token that lives an hour and dies at teardown, narrowed to the repositories and permission scopes the config names. GitHub mints it with that scope, so the limit holds even against a prompt injection.