GitHub Enterprise Server (GHES) support lets your org run web sessions, automated code reviews, and plugin marketplaces against your self-managed GitHub instance. Admin does the setup once. Developers use their normal git workflow after that.
Available for Team and Enterprise plans only.
Step 1: Admin connects the GHES instance
Go to claude.ai/admin-settings/claude-code and find the GitHub Enterprise Server section.
- Click Connect.
- Enter a display name and your GHES hostname (for example
github.yourcompany.com). - If your GHES uses a self-signed or private CA, paste the CA certificate in the optional field.
- Click Continue to GitHub Enterprise. Your browser redirects to your GHES instance with a pre-filled app manifest.
- Review the configuration and click Create GitHub App. GHES redirects back to Claude with credentials stored automatically.
- From the GitHub App page on your GHES instance, install the app on the repositories or organizations you want Claude to access.
If the redirect flow is blocked by your network, click Add manually instead and create the GitHub App yourself with the required permissions.
Required GitHub App permissions
The manifest sets these exact permissions. If you create manually, all are required:
| Permission | Access |
|---|---|
| Contents | Read and write |
| Pull requests | Read and write |
| Issues | Read and write |
| Checks | Read and write |
| Actions | Read |
| Repository hooks | Read and write |
| Metadata | Read (required by GitHub for all apps) |
Required webhook events: pull_request, issue_comment, pull_request_review_comment, pull_request_review, check_run.
Missing any of these will silently break specific features. A missing Checks permission breaks Code Review; a missing Repository hooks permission breaks contribution metrics.
Step 2: Developers use their normal workflow
No developer-side configuration needed after admin setup. Claude Code detects the GHES hostname automatically from the git remote.
git clone [email protected]:platform/api-service.git
cd api-service
claude --remote "Add retry logic to the payment webhook handler"The session runs on Anthropic infrastructure, clones your repo from GHES, and pushes changes back to a branch. Monitor at claude.ai/code.
To pull a web session into your local terminal:
claude --teleportTeleport verifies you’re in a checkout of the same GHES repository before fetching the branch and session history.
Step 3: Plugin marketplaces on GHES
The owner/repo shorthand always resolves to github.com. For GHES-hosted marketplaces, use the full git URL:
/plugin marketplace add [email protected]:platform/claude-plugins.git
# or HTTPS:
/plugin marketplace add https://github.yourcompany.com/platform/claude-plugins.gitTo allowlist GHES marketplaces in managed settings so developers can add them without being blocked by policy:
{
"strictKnownMarketplaces": [
{
"source": "hostPattern",
"hostPattern": "^github\\.yourcompany\\.com$"
}
]
}To pre-register a marketplace for all developers:
{
"extraKnownMarketplaces": {
"internal-tools": {
"source": {
"source": "git",
"url": "[email protected]:platform/claude-plugins.git"
}
}
}
}Feature compatibility
| Feature | Works with GHES? | Notes |
|---|---|---|
| Web sessions | Yes | Same as github.com |
| Code Review | Yes | Same automated PR reviews |
| Teleport | Yes | Requires matching local GHES checkout |
| Plugin marketplaces | Yes | Must use full git URLs |
| GitHub Actions | Yes | Manual workflow setup; no /install-github-app |
| GitHub MCP server | No | Does not work with GHES |
The GitHub MCP server is a hard limitation. Use the gh CLI configured for your GHES host instead:
gh auth login --hostname github.yourcompany.comAfter that, Claude can use gh commands in sessions to interact with your GHES instance.
Network requirements
Your GHES instance must be reachable from Anthropic infrastructure so Claude can clone repositories and post review comments. If your GHES is behind a firewall, allowlist the Anthropic API IP addresses for inbound connections.
Footguns
/install-github-app only works for github.com. For GHES, use the admin setup flow at claude.ai. Developers who try /install-github-app in a GHES checkout get a confusing error because the command always targets github.com. If you also want GitHub Actions workflows on GHES, adapt the example workflow manually from the anthropics/claude-code-action repo.
The redirect flow can fail on internal networks. If your network blocks external redirects from GHES back to claude.ai, the guided flow breaks silently. Use Add manually and enter credentials directly. This is common in air-gapped or heavily proxied environments.
CA certificate must cover all GHES subdomains you use. If your GHES instance uses a private CA and you have multiple subdomain-based hosts (for example git.yourcompany.com and ghes-api.yourcompany.com), the CA certificate must cover all of them. A partial cert causes TLS failures on API calls even when the main UI works.
The GitHub App must be installed on repos, not just created. Creating the app in the admin console is step one. Without installing it on the target repositories or organization, sessions will fail to clone with a permissions error. Developers should verify installation before reporting a connection problem.
Outdated GHES versions may lack required webhook events. The check_run webhook event required for Code Review was added in GHES 3.3. If your GHES is older, Code Review silently does not work.
When NOT to set up GHES integration
- You use GitHub Enterprise Cloud (not Server). GHES integration is for self-hosted instances. GitHub Enterprise Cloud users follow the github.com setup flow.
- Your GHES instance cannot be reached from Anthropic infrastructure and you cannot open firewall rules. Web sessions require outbound GHES access from Anthropic’s IPs.
- You only need local CLI sessions with GHES repos. The GHES integration is specifically for web sessions, code review, and remote workflows. Local
claudesessions work with any git remote without admin setup.