Connect GitHub.

Install the Perfloop GitHub App on the repos you choose. Perfloop reads your code and opens pull requests for approved changes. You review and merge them.

Write access lets Perfloop push a branch and open a pull request. It never merges or pushes to your default branch.

Access you need

• contents · read & write Reads code from the repos you select. Selected code, including private code, can enter model context through OpenAI, Anthropic Claude on Google Cloud Vertex AI, or Fireworks AI. No model provider is used without zero-data-retention terms confirmed first. Perfloop does not use your code to train models. Where enabled, Research and security work can use Fireworks AI.

• pull requests · read & write Perfloop can open and update an approved PR, comment, submit comment-only reviews, reply to review comments, and request reviewers. It cannot merge, approve, request changes, close a PR, or change draft state.

• checks · issues · statuses · read Reads CI conclusions, commit status, and PR conversation. GitHub exposes ordinary PR comments through its issue-comment permission.

• administration · read Lets the App read repository settings. It cannot change them.

• metadata · read Mandatory for every GitHub App. Reads repo names and metadata.

Not requested: Actions, secrets, members, deployments, or organization-level permissions. The App private key never enters a sandbox.

If Perfloop pushes its branches to a fork you own, you control GitHub Actions on that fork. Your GitHub settings decide which workflows can run there.

PR review

PR review is off by default. An Admin turns it on per repo in Setup → Automatic work: set PR review to On, then select Save. See Autonomy and limits for what a review costs and how to act on a finding.

Once PR review is on, Perfloop posts a comment-only review each time a pull request is opened or gets new commits. The review lists hypotheses: possible problems in the changed code that are not yet proven. Perfloop does not review its own pull requests.

For a PR from a branch in the same repo, the automatic review also measures the change. Perfloop runs workloads that exercise the changed code, such as the repo's benchmarks. It runs them on the PR's base commit and on its head commit, and compares the results. For a PR from a fork, the automatic review reads the code but does not run it.

A member can also ask their coding agent to measure any PR in a selected repo, even when PR review is off for the repo. The agent calls the submitDiff tool with measure: true and gets the measurements with the review.

For a PR from a fork, the agent first asks the member who requested the review to approve running that exact commit. It then passes that commit's SHA as approvedHead. Perfloop does not run fork code until the member approves. The measurements cover only the workloads Perfloop ran. They do not replace your CI checks or your team's review before merge.

Setup

1 · select your repos

From Perfloop Setup, install the GitHub App. Choose Only select repositories and select the repos you want to connect. Back in Setup, select the repos for Perfloop to work on, then Save selection. Perfloop works only on the repos you save there. You can change the App's list later in its installation settings.

2 · check branch protection

In each repo, check the rules for your default branch. Require a pull request and review before merge. Keep your existing CI checks required.

3 · review the installation

Open Settings → GitHub Apps → Perfloop in GitHub to check the selected repos and permissions. Your organization's audit log records the app's activity.

Remove access

Uninstall the app, or remove repos from the installation. GitHub then blocks access to those resources. This does not delete records or artifacts already stored by Perfloop; deleting the workspace removes them.

Security questions: security@perfloop.ai