GitHub CLI
Ranked 5 of 86 privilege escalation tools by recommenders
Lets you do most GitHub tasks from the terminal, and coding agents use it for PRs and CI. Main caveat: the telemetry rollout and plaintext credential storage.
Lets you do most GitHub tasks from the terminal, and coding agents use it for PRs and CI. Main caveat: the telemetry rollout and plaintext credential storage.
94 people gave an opinion
- recommend it
- 49
- criticize it
- 45
- approval share
- 52%
Recommended in 12 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 49 people recommend itNeeds 10 or more, met.
- 1 recommender for every criticNeeds 2 to 1 or better, not met.
- Recommended in 12 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Lets coding agents use it for PRs
“My agents can now attach screenshots and screen captures to PRs they create directly, without using workarounds or third party services”
Comment from 1 Sep 2026 in “GitHub CLI: Media in issues, pull requests, and comments” “You can use it to auth with GITHUB_TOKEN instead of ssh or http. Which is how my agents get access.”
Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry” “Combined with the GitHub CLI, this gives agents everything they need to achieve the same result.”
Comment from 18 Jan 2026 in “Show HN: I built a tool to assist AI agents to know when a PR is good to go” - Comment from 8 Dec 2025 in “GitHub Actions has a package manager, and it might be the worst”
- Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”
- Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”
- Comment from 13 Apr 2026 in “GitHub Stacked PRs”
- Comment from 30 May 2026 in “MCP Is Dead”
Does most GitHub tasks from terminal
“gh is insanely powerful, especially if you let your coding agent use it. It’s one of my top tools.”
Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry” “just about anything I'd want to do on GitHub, I can do straight from the command line”
Comment from 16 Aug 2026 on Hacker News “the GitHub CLI is quite good and helps automate many things in GitHub”
Comment from 14 Apr 2026 in “GitHub Stacked PRs” - Comment from 17 Aug 2026 in “GitHub down again? no PR access”
- Comment from 1 Feb 2026 in “The Disconnected Git Workflow”
- Comment from 14 Apr 2026 in “GitHub Stacked PRs”
- Comment from 29 Apr 2026 in “Ghostty is leaving GitHub”
Cheaper and better than GitHub MCP
“the github cli is very robust and does the job of the MCP with a fraction of the token cost”
Comment from 1 Mar 2026 in “Stop Burning Your Context Window – How We Cut MCP Output by 98% in Claude Code” “gh cli and linear mcp is enough for any model to get most of the why context”
Comment from 11 Mar 2026 in “Levels of Agentic Engineering” “Using the gh CLI worked far better than the GitHub MCP.”
Comment from 10 Feb 2026 in “Show HN: Model Tools Protocol (MTP) – Forget MCP, bash is all you need” - Comment from 23 Mar 2026 in “I benchmarked GitHub CLI, MCP, Tool Search, Code Mode so we know the differences”
Good auth flows
“You can use it to auth with GITHUB_TOKEN instead of ssh or http. Which is how my agents get access.”
Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry” “gh and claude code itself have some of the nicest auth flows i've experienced”
Comment from 17 May 2026 in “MCP Hello Page” “the GitHub CLI's Login with HTTPS [4] to do repository push/pull.”
Comment from 14 Dec 2025 in “Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem”
What people warn about
Each mark is one comment
Telemetry collects pseudonymous usage data
“Reading the justification the main thing they seem to want to know is if gh is being driven by a human or an agent”
Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry” “restore flags that have been "accidentally" reset and set any new flags that they added for "different" telemetry”
Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry” “I do not trust Microsoft with any telemetry, I am not invested in helping them improve their product”
Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry” - Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”
- Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”
- Comment from 23 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”
- Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”
Plaintext OAuth token storage
“I wouldn't say that's better. Now your .config directory contains a github token that can do more than just repo pull/push”
Comment from 14 Dec 2025 in “Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem” “Make sure the gh cli isn’t storing oauth credentials in plaintext as it can silently do.”
Comment from 15 Dec 2025 in “Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem” “stores a highly privileged OAuth token in plain text in the HOME directory”
Comment from 28 Nov 2025 in “GitLab discovers widespread NPM supply chain attack” Worry about forced CLI dependence
“Why does github need a CLI? Some people just seem to want to make their own lives harder...”
Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry” “I give it five years before the GH CLI is the only way to interact with GitHub repos.”
Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry” “already it seems to be a pain to deal with some repos on github without using gh”
Comment from 22 Apr 2026 in “GitHub CLI now collects pseudoanonymous telemetry”
Other privilege escalation tools people recommend
The four most recommended other privilege escalation tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
See all 86 privilege escalation tools, rankedWhat people said
40 of the 102 comments that mention it, newest first. Each links to the original comment.
“It is the equivalent of GitHub's `gh` binary that wraps their API for an easier DX than cURL”
“My agents can now attach screenshots and screen captures to PRs they create directly, without using workarounds or third party services”
“I have been able to merge and get some things done via command line.”
“just about anything I'd want to do on GitHub, I can do straight from the command line”
“it knows how to track a running CI workflow efficiently without having to try three different methods”
“it already knows how to operate the CLIs well”
“gh and claude code itself have some of the nicest auth flows i've experienced”
“gh gives everything i need out of the box”
“default off with a plain schema would have landed much better than pseudoanonymous by default”
“I do not trust Microsoft with any telemetry, I am not invested in helping them improve their product”
“Why does github need a CLI? Some people just seem to want to make their own lives harder...”
“They could fix issues prior to a release if they wished to without opt-out client side telemetry.”
“already it seems to be a pain to deal with some repos on github without using gh”
“Reading the justification the main thing they seem to want to know is if gh is being driven by a human or an agent”
“that let's Claude Code associate a feature branch to a pull request”
“they just want to increase tracking by knowing what transit as well to Gitlab, Codeberg and such”
“I give it five years before the GH CLI is the only way to interact with GitHub repos.”
“having the cli made automating (or interacting with agents) github-specific tasks possible”
“one of the most powerful tools you can give a coding agent”
“gh is insanely powerful, especially if you let your coding agent use it. It’s one of my top tools.”
“You can use it to auth with GITHUB_TOKEN instead of ssh or http. Which is how my agents get access.”
“restore flags that have been "accidentally" reset and set any new flags that they added for "different" telemetry”
“I'm curious why corporate development teams always feel the need to spy on their users?”
“the GitHub CLI has some very useful commands”
“the GitHub CLI is quite good and helps automate many things in GitHub”
“CLI is great because now I can tell my AI agent to do it.”
“Github MCP is 2–3x more expensive to use than CLI.”
“gh cli and linear mcp is enough for any model to get most of the why context”
“I just do some click here, click there, copy paste and gh cli is ready.”
“Agents know how to use head, tail, jq and so on to only extract the parts it needs.”
“the github cli is very robust and does the job of the MCP with a fraction of the token cost”
“It gives me a permanent record and makes it easy to reference and close the issue once the PR is ready.”
“Using the gh CLI worked far better than the GitHub MCP.”
“is great for interacting with github in the terminal”
“Combined with the GitHub CLI, this gives agents everything they need to achieve the same result.”
“Make sure the gh cli isn’t storing oauth credentials in plaintext as it can silently do.”
“I wouldn't say that's better. Now your .config directory contains a github token that can do more than just repo pull/push”
“the GitHub CLI's Login with HTTPS [4] to do repository push/pull.”
“invoking the CLI tool (which is pre-installed on the runners) with "gh release create ..."”
“stores a highly privileged OAuth token in plain text in the HOME directory”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.