Private repo access

Configure credentials so that agentregistry can read manifests and clone source code from private GitHub or GitLab repositories.

You can configure Solo Enterprise for agentregistry with your GitHub or GitLab credentials so that you can add an agent or MCP server to the registry catalog that is hosted in a private repository. These credentials are used as follows:

Manifest pre-fetch: When you fill in the repository URL in the UI’s registration form, the registry controller fetches the agent.yaml or server.yaml manifest directly from the repository to pre-populate form fields. Without the proper credentials, private repos return a 404 and the form cannot be pre-filled.
Retrieve source code at deploy time: When you deploy an artifact to an agentic runtime, such as AWS Bedrock AgentCore, the registry clones the code in the private repository and builds and packages the source code so that it can run in the selected runtime.

Step 1: Create credentials

Create your GitHub or GitLab credentials to accesss private repositories. The permissions that you require vary depending on the type of credential that you set up.

Create a GitHub Personal Access Token (PAT). The required permissions depend on the token type.

Token type	Required permissions
Classic PAT	`repo` scope
Fine-grained PAT	Resource owner: The private repo owner. Repository access: Scope to only the repositories that you plan to use. Repository permissions: `Contents: Read`, note that `Metadata: Read` is automatically required.

Save the PAT in an environment variable.
```
export PAT=<github-pat>
```

Create a GitLab Personal Access Token (PAT). The required permissions depend on the token type.
Note: GitLab deploy tokens are not supported. Deploy tokens can authenticate a git clone but cannot access the GitLab REST API, which Solo Enterprise for agentregistry uses during the manifest pre-fetch. Use a Personal Access Token instead.
Token type Required permissions
Classic PAT read_repository scope
Fine-grained PAT Code: Download permission. Note that Code: Read is not sufficient.
Save the PAT in an environment variable.
```
export PAT=<github-pat>
```

Token type	Required permissions
Classic PAT	`read_repository` scope
Fine-grained PAT	`Code: Download` permission. Note that `Code: Read` is not sufficient.

Step 2: Configure credentials

Credentials are configured once at the Helm chart level and automatically applied for all agents and MCP servers in the registry. You have the option to put the credentials into the Helm chart directly or save them in a Kubernetes secret.

Option 1: Inline values

Pass the credentials directly as Helm values. The chart creates and manages a Kubernetes secret for you. This option is mutually exclusive with providing the credentials via an existing Kubernetes secret by using the global.git.secretRef Helm field.

Get the current values of your Helm installation.

helm get values agentregistry -n agentregistry-system -o yaml > agentregistry.yaml

Upgrade the Solo Enterprise for agentregistry installation to add your GitHub credentials. Do not set the global.git.username field. GitHub uses the token as the username.

helm upgrade --install agentregistry \
  oci://us-docker.pkg.dev/solo-public/agentregistry-enterprise/helm/agentregistry-enterprise \
  --namespace agentregistry-system \
  --version 2026.7.0 \
  --reuse-values \
  --set global.git.token=$PAT

Verify that the agentregistry-enterprise-git secret was created for you.

kubectl get secret agentregistry-enterprise-git -n agentregistry-system -o yaml

Get the current values of your Helm installation.

helm get values agentregistry -n agentregistry-system -o yaml > agentregistry.yaml

Upgrade the Solo Enterprise for agentregistry installation to add your GitLab credentials. GitLab requires both a username and a token. Set global.git.username to oauth2.

helm upgrade --install agentregistry \
  oci://us-docker.pkg.dev/solo-public/agentregistry-enterprise/helm/agentregistry-enterprise \
  --namespace agentregistry-system \
  --version 2026.7.0 \
  --reuse-values \
  --set global.git.username=oauth2 \
  --set global.git.token=$PAT

Verify that the agentregistry-enterprise-git secret was created for you.

kubectl get secret agentregistry-enterprise-git -n agentregistry-system -o yaml

Option 2: Reference an existing Secret

If you prefer to manage the Kubernetes secret yourself, such as with Vault, reference the secret in your Helm installation. This option is mutually exclusive with providing the credentials inline via the global.git.token Helm field.

Create a Secret with the required keys in the same namespace that Solo Enterprise for agentregistry is installed in.

kubectl create secret generic git-credentials \
  --namespace agentregistry-system \
  --from-literal=GIT_TOKEN=$PAT

kubectl create secret generic git-credentials \
  --namespace agentregistry-system \
  --from-literal=GIT_TOKEN=$PAT \
  --from-literal=GIT_USERNAME=oauth2

Reference the secret name and key in your Helm values.

helm upgrade --install agentregistry \
  oci://us-docker.pkg.dev/solo-public/agentregistry-enterprise/helm/agentregistry-enterprise \
  --namespace agentregistry-system \
  --version 2026.7.0 \
  --reuse-values \
  --set global.git.secretRef.name=git-credentials \
  --set global.git.secretRef.key=GIT_TOKEN

helm upgrade --install agentregistry \
  oci://us-docker.pkg.dev/solo-public/agentregistry-enterprise/helm/agentregistry-enterprise \
  --namespace agentregistry-system \
  --version 2026.7.0 \
  --reuse-values \
  --set global.git.secretRef.name=git-credentials \
  --set global.git.secretRef.key=GIT_TOKEN \
  --set global.git.secretRef.usernameKey=GIT_USERNAME

Next steps

Store agent source code Push your agent source code to a GitHub or GitLab repository and reference it in the registry. Store MCP server source code Push your MCP server source code to a GitHub or GitLab repository and reference it in the registry.

Artifact approval