Hacker ApprovedDepartments

GitHub CLI

Ranked 5 of 86 privilege escalation tools by recommenders

Lets you do most GitHub tasks from the terminal, and coding agents use it for PRs and CI. Main caveat: the telemetry rollout and plaintext credential storage.

Lets you do most GitHub tasks from the terminal, and coding agents use it for PRs and CI. Main caveat: the telemetry rollout and plaintext credential storage.

94 people gave an opinion

recommend it
49
criticize it
45
approval share
52%
Each figure is one person. RecommendsCriticizes

Recommended in 12 of 13 months

  1. November 2025: recommended
  2. December 2025: recommended
  3. January 2026: recommended
  4. February 2026: recommended
  5. March 2026: recommended
  6. April 2026: recommended
  7. May 2026: recommended
  8. June 2026: recommended
  9. July 2026: recommended
  10. August 2026: recommended
  11. September 2026: recommended
  12. October 2026: recommended
  13. November 2026: not recommended (month in progress)

Why it doesn’t carry the badge

  • 49 people recommend itNeeds 10 or more, met.
  • 1 recommender for every criticNeeds 2 to 1 or better, not met.
  • Recommended in 12 of 13 monthsNeeds 4 or more, met.

The same three rules apply to every product, and the badge can’t be bought. How the badge works

What people say about it

The reasons people give, with the number of comments that give each one. Open a reason to read what they said.

Why people recommend it

Each mark is one comment

  • Lets coding agents use it for PRs

    “My agents can now attach screenshots and screen captures to PRs they create directly, without using workarounds or third party services”

    Comment from 1 Sep 2026 in “GitHub CLI: Media in issues, pull requests, and comments”

    “You can use it to auth with GITHUB_TOKEN instead of ssh or http. Which is how my agents get access.”

    Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

    “Combined with the GitHub CLI, this gives agents everything they need to achieve the same result.”

    Comment from 18 Jan 2026 in “Show HN: I built a tool to assist AI agents to know when a PR is good to go”
  • Does most GitHub tasks from terminal

    “gh is insanely powerful, especially if you let your coding agent use it. It’s one of my top tools.”

    Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

    “just about anything I'd want to do on GitHub, I can do straight from the command line”

    Comment from 16 Aug 2026 on Hacker News

    “the GitHub CLI is quite good and helps automate many things in GitHub”

    Comment from 14 Apr 2026 in “GitHub Stacked PRs”
  • Cheaper and better than GitHub MCP

    “the github cli is very robust and does the job of the MCP with a fraction of the token cost”

    Comment from 1 Mar 2026 in “Stop Burning Your Context Window – How We Cut MCP Output by 98% in Claude Code”

    “gh cli and linear mcp is enough for any model to get most of the why context”

    Comment from 11 Mar 2026 in “Levels of Agentic Engineering”

    “Using the gh CLI worked far better than the GitHub MCP.”

    Comment from 10 Feb 2026 in “Show HN: Model Tools Protocol (MTP) – Forget MCP, bash is all you need”
  • Good auth flows

    “You can use it to auth with GITHUB_TOKEN instead of ssh or http. Which is how my agents get access.”

    Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

    “gh and claude code itself have some of the nicest auth flows i've experienced”

    Comment from 17 May 2026 in “MCP Hello Page”

    “the GitHub CLI's Login with HTTPS [4] to do repository push/pull.”

    Comment from 14 Dec 2025 in “Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem”

What people warn about

Each mark is one comment

  • Telemetry collects pseudonymous usage data

    “Reading the justification the main thing they seem to want to know is if gh is being driven by a human or an agent”

    Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

    “restore flags that have been "accidentally" reset and set any new flags that they added for "different" telemetry”

    Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

    “I do not trust Microsoft with any telemetry, I am not invested in helping them improve their product”

    Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”
  • Plaintext OAuth token storage

    “I wouldn't say that's better. Now your .config directory contains a github token that can do more than just repo pull/push”

    Comment from 14 Dec 2025 in “Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem”

    “Make sure the gh cli isn’t storing oauth credentials in plaintext as it can silently do.”

    Comment from 15 Dec 2025 in “Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem”

    “stores a highly privileged OAuth token in plain text in the HOME directory”

    Comment from 28 Nov 2025 in “GitLab discovers widespread NPM supply chain attack”
  • Worry about forced CLI dependence

    “Why does github need a CLI? Some people just seem to want to make their own lives harder...”

    Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

    “I give it five years before the GH CLI is the only way to interact with GitHub repos.”

    Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

    “already it seems to be a pain to deal with some repos on github without using gh”

    Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

Other privilege escalation tools people recommend

The four most recommended other privilege escalation tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.

GitHub CLI compared with 4 alternatives
ProductRecommendCriticizeApprovalMonthsOwnedBadge
fzf78594%12—Approved
jq753369%12—Approved
grep651977%12—Approved
Atuin632472%112 yrs4 ownersApproved
GitHub CLIThis page494552%12——
See all 86 privilege escalation tools, ranked

What people said

40 of the 102 comments that mention it, newest first. Each links to the original comment.

“It is the equivalent of GitHub's `gh` binary that wraps their API for an easier DX than cURL”

RecommendsComment from 22 Oct 2026 in “OpenAI CLI”

“My agents can now attach screenshots and screen captures to PRs they create directly, without using workarounds or third party services”

RecommendsComment from 1 Sep 2026 in “GitHub CLI: Media in issues, pull requests, and comments”

“I have been able to merge and get some things done via command line.”

RecommendsComment from 17 Aug 2026 in “GitHub down again? no PR access”

“just about anything I'd want to do on GitHub, I can do straight from the command line”

RecommendsComment from 16 Aug 2026 on Hacker News

“it knows how to track a running CI workflow efficiently without having to try three different methods”

RecommendsComment from 20 Jun 2026 in “Zero-Touch OAuth for MCP”

“it already knows how to operate the CLIs well”

RecommendsComment from 30 May 2026 in “MCP Is Dead”

“gh and claude code itself have some of the nicest auth flows i've experienced”

RecommendsComment from 17 May 2026 in “MCP Hello Page”

“gh gives everything i need out of the box”

RecommendsComment from 29 Apr 2026 in “Ghostty is leaving GitHub”

“default off with a plain schema would have landed much better than pseudoanonymous by default”

CriticizesComment from 23 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

“I do not trust Microsoft with any telemetry, I am not invested in helping them improve their product”

CriticizesComment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

“Why does github need a CLI? Some people just seem to want to make their own lives harder...”

CriticizesComment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

“They could fix issues prior to a release if they wished to without opt-out client side telemetry.”

CriticizesComment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

“already it seems to be a pain to deal with some repos on github without using gh”

CriticizesComment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

“Reading the justification the main thing they seem to want to know is if gh is being driven by a human or an agent”

CriticizesComment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

“that let's Claude Code associate a feature branch to a pull request”

RecommendsComment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

“they just want to increase tracking by knowing what transit as well to Gitlab, Codeberg and such”

CriticizesComment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

“I give it five years before the GH CLI is the only way to interact with GitHub repos.”

CriticizesComment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

“having the cli made automating (or interacting with agents) github-specific tasks possible”

RecommendsComment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

“one of the most powerful tools you can give a coding agent”

RecommendsComment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

“gh is insanely powerful, especially if you let your coding agent use it. It’s one of my top tools.”

RecommendsComment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

“You can use it to auth with GITHUB_TOKEN instead of ssh or http. Which is how my agents get access.”

RecommendsComment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

“restore flags that have been "accidentally" reset and set any new flags that they added for "different" telemetry”

CriticizesComment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

“I'm curious why corporate development teams always feel the need to spy on their users?”

CriticizesComment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”

“the GitHub CLI has some very useful commands”

RecommendsComment from 14 Apr 2026 in “GitHub Stacked PRs”

“the GitHub CLI is quite good and helps automate many things in GitHub”

RecommendsComment from 14 Apr 2026 in “GitHub Stacked PRs”

“CLI is great because now I can tell my AI agent to do it.”

RecommendsComment from 13 Apr 2026 in “GitHub Stacked PRs”

“Github MCP is 2–3x more expensive to use than CLI.”

RecommendsComment from 23 Mar 2026 in “I benchmarked GitHub CLI, MCP, Tool Search, Code Mode so we know the differences”

“gh cli and linear mcp is enough for any model to get most of the why context”

RecommendsComment from 11 Mar 2026 in “Levels of Agentic Engineering”

“I just do some click here, click there, copy paste and gh cli is ready.”

RecommendsComment from 5 Mar 2026 in “Googleworkspace/CLI”

“Agents know how to use head, tail, jq and so on to only extract the parts it needs.”

RecommendsComment from 1 Mar 2026 in “MCP is dead. Long live the CLI”

“the github cli is very robust and does the job of the MCP with a fraction of the token cost”

RecommendsComment from 1 Mar 2026 in “Stop Burning Your Context Window – How We Cut MCP Output by 98% in Claude Code”

“It gives me a permanent record and makes it easy to reference and close the issue once the PR is ready.”

RecommendsComment from 22 Feb 2026 in “How I use Claude Code: Separation of planning and execution”

“Using the gh CLI worked far better than the GitHub MCP.”

RecommendsComment from 10 Feb 2026 in “Show HN: Model Tools Protocol (MTP) – Forget MCP, bash is all you need”

“is great for interacting with github in the terminal”

RecommendsComment from 1 Feb 2026 in “The Disconnected Git Workflow”

“Combined with the GitHub CLI, this gives agents everything they need to achieve the same result.”

RecommendsComment from 18 Jan 2026 in “Show HN: I built a tool to assist AI agents to know when a PR is good to go”

“Make sure the gh cli isn’t storing oauth credentials in plaintext as it can silently do.”

CriticizesComment from 15 Dec 2025 in “Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem”

“I wouldn't say that's better. Now your .config directory contains a github token that can do more than just repo pull/push”

CriticizesComment from 14 Dec 2025 in “Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem”

“the GitHub CLI's Login with HTTPS [4] to do repository push/pull.”

RecommendsComment from 14 Dec 2025 in “Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem”

“invoking the CLI tool (which is pre-installed on the runners) with "gh release create ..."”

RecommendsComment from 8 Dec 2025 in “GitHub Actions has a package manager, and it might be the worst”

“stores a highly privileged OAuth token in plain text in the HOME directory”

CriticizesComment from 28 Nov 2025 in “GitLab discovers widespread NPM supply chain attack”

Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.