AI

Everything on ghtier is also published as plain text and JSON, so an AI agent can read it and apply it to your own GitHub organization.

What an agent can read

• /llms.txtStart here. Index of everything below.
• /llms-full.txtThe whole site as one text file.
• /data/index.jsonManifest of the JSON exports.
• /data/permissions.jsonEvery GitHub permission at every level, with one global tier and the reason.
• /data/roles.jsonBuilt-in roles with the permissions they include and their inherited tier.
• /data/scopes.jsonClassic scopes with the permissions they reach, and token types.
• /data/keys-policies.jsonKeys, policies, grants and agents with their tier, attack path and Detect events.
• /data/changes.jsonWhat GitHub added, removed or changed, newest first.
• /data/updates.jsonWhat changed on ghtier itself, newest first.
• /changes.xmlThe same history as an Atom feed.
• /data/findings.jsonStrange findings: where GitHub access works differently than expected, with sources.
• /data/graph.jsonPermissions, roles, attack paths, incidents and fixes as one graph.
• /data/permission-model.jsonGrant mechanisms and the capability crosswalk across token types and roles.
• /data/landscape.jsonThreat landscape: incidents tagged with OWASP CI/CD and NIST SP 800-204D, trends, gaps, control ranking.
• /data/scenarios.jsonReal incidents and the permissions abused.
• /data/checklist.jsonChecklist items with fix steps, plans, Detect events and automated checks.
• /data/assessment.schema.jsonFormat of an assessment result file.
• /data/state-of-github-security.jsonStats behind the state-of-security report.
• /data/tooling.jsonOpen-source security tools: how each works, rating, stars.
• /skills/ghtier-assess/SKILL.mdAgent skill: assess an org and plan fixes.
• /skills/ghtier-assess/assess.mjsThe read-only runner the skill uses.
• /skills/ghtier-assess/SHA256SUMSSHA-256 of the runner, its template and the data it reads, for --pin.
• /skills/ghtier-assess/reportPrintable report template the runner fills in.

Check your own organization

1. Give your agent the skill, or ask it: "Assess my GitHub org with ghtier (ghtier.com/llms.txt)".
2. It runs 23 read-only checks with your own gh login, asks you about the rest, lists who holds Tier 0 and Tier 1 (owners, organization roles, Apps, runners, deploy keys), and writes ghtier-assessment-<org>.json plus a printable ghtier-report-<org>.html.
3. You get a fix plan ordered by effort. Import the file on the Checklist to see the results there.

The checks only send GET requests and never change a setting. Your org data stays on your machine; ghtier has no backend and never sees it.