Git in Muppy in two minutes¶

The problem¶

A git token left on a server is readable by anyone with a shell there: a colleague, a script, an AI agent working on the box. It stays there for as long as the box lives. Revoking it means finding every box that carries it.

What Muppy does instead¶

No token is written on the box. Git asks a credential helper, the helper asks Muppy, and Muppy serves the token for that one operation only if a person authorized it, for a short window. A push always asks. A read served by a read-only token limited to that repository asks nothing at all.

So the box never holds a credential, an agent on the box has nothing to steal, and revoking a token is done in one place: the vault.

What you set up¶

For	Token	What it does
A Dev box — required	One read-write, account-wide PAT per forge, flagged Default for this server	Everything: clone, pull and push, each one released by an approval you give at the moment it happens. Nothing else is needed
A Dev box — optional, per repository	A read-only token limited to that repository, the repository listed under Repositories	Comfort: reads on that repository stop asking you. Pushes still do. Worth it once you pull the same repository every day
A Test, Staging or Production box — required	The same kind of read-only, repository-limited token	It is written on the box, because nobody is there to approve anything. It can read that one repository and nothing else, so leaving it there costs little

A push is never served without an approval, whatever tokens you hold.

What a day looks like¶

muppy-git-login <your-muppy-login>   # once per box: names who you are, sets git user.name and user.email, grants nothing
git pull                             # served, or asks you once for a read window
git push                             # blocks, you approve it in Muppy, it goes through
muppy-git-status                     # what this box can do right now, and with what
muppy-git-logout                     # when you leave the box to someone else

Where to go next¶

Git workflows in Muppy — the model, and what your provider lets Muppy check.
Git Tokens — every kind of token, and how the Create App Server wizard picks one.
Your forge: GitLab, GitHub, Forgejo / Codeberg, Azure DevOps.
Read-only token policy — the switch that makes the read-write fallback a refusal.