Connect GitHub Enterprise Server.
Connect selected repos on your GitHub Enterprise Server through a GitHub App you create on that server. Perfloop reads their code and opens pull requests for approved changes. You review and merge them.
GitHub Enterprise Server is off by default for a workspace. To turn it on, email hello@perfloop.ai. The reply gives a workspace Admin the connect step.
Access you need
- contents · read & writeReads code from the repos you select and pushes branches for approved changes.
- pull requests · read & writeOpens and updates an approved pull request, reads its conversation, comments, and replies to review comments.
- issues · read & writeReads pull-request comments and reacts to the ones it handles. Opens an issue when your repo requires one before a pull request.
- checks · statuses · readReads CI conclusions and commit status.
- metadata · readMandatory for every GitHub App. Reads repo names and metadata.
Perfloop cannot approve or merge a pull request, deploy, or change repository settings. Keep your default branch protected and your review and CI requirements in place.
PR review
With PR review on, Perfloop posts a comment-only review on pull requests opened or committed to after you turn it on. The review lists unproven Hypotheses tied to the changed code, with comments on the changed lines. Perfloop does not review its own pull requests or pull requests from forks.
PR review is off by default and available on request: email hello@perfloop.ai. An Admin then turns it on per repo in Setup → Automatic work: set PR review to On, then select Save. See Autonomy and limits for what a review costs and how to work a finding.
Setup
1 · create the App
On your server, create a GitHub App with the permissions above. Leave its webhook inactive; Perfloop receives no events from your server. Generate a private key and keep it in a secret store. Install the App on the repos Perfloop may use.
2 · run the relay
Perfloop reaches your server only through the relay inside your network. Add a code-host relay upstream whose URL is your server's HTTPS origin, including a non-default port.
If your server uses a private certificate authority, have its public root CA certificates in PEM format ready. Perfloop checks the server's hostname and certificate; there is no option to turn TLS verification off.
3 · connect
For the connect step, have these ready: the server URL, the App ID, the installation ID, the App private key, the relay upstream's name, any root CA certificates, and the numeric IDs of the repos to select. Perfloop checks the App, its installation and access to every selected repo before it saves the connection. Never send the private key by email, in a chat or in an MCP call.
4 · choose the work
Automatic work is controlled in Setup → Automatic work. With Pull requests set to Ask, a proven change waits for your decision in Inbox before Perfloop opens its pull request. See Autonomy and limits.
Data Perfloop reads and keeps
Perfloop reads selected source code, repo metadata, and pull-request changes, checks and conversation. It keeps the system model, Cases and their proof, and the connection details needed to use those repos. The App private key is stored encrypted and is not given to coding agents or sandboxes.
Selected code can enter model context through OpenAI under zero-data-retention terms. Perfloop does not use your code to train models. See Security for data handling.
Change the key or repo selection
To rotate the private key or change the repos, the Admin reconnects with the current key and the complete repo list. The new list replaces the previous selection. A reconnect keeps the server, App and installation. Delete a replaced key in the App's settings on your server.
Remove access
When the Admin disconnects, Perfloop stops reading and writing through that connection. Open pull requests stay on your server. Uninstall the App or delete its private key on your server to remove its access there too.
Disconnecting does not delete records or proof already stored by Perfloop. Deleting the workspace removes its stored data. A disconnected connection needs a fresh connect before use again.
Security questions: security@perfloop.ai