claude-did-this/claude-hub: Self-Hosted Claude Code Bot for GitHub

claude-did-this/claude-hub: Self-Hosted Claude Code Bot for GitHub

Developers managing active repositories face a familiar bottleneck: pull requests sit waiting for review, issues accumulate unanswered technical questions, and CI failures demand immediate attention. The context switching between coding and repository maintenance eats productive hours. claude-did-this/claude-hub addresses this directly by deploying Claude Code as an autonomous GitHub bot—mention it in any issue or PR, and it analyzes your codebase, implements features, reviews code, and monitors CI pipelines without human intervention.

What is claude-did-this/claude-hub?

claude-did-this/claude-hub is a webhook service that connects Claude Code to GitHub repositories through a self-hosted microservice architecture. Built in TypeScript and distributed under the MIT license, the project has attracted 482 stars and 44 forks since its last commit on October 27, 2025. It enables developers to create their own GitHub bot account and configure it to respond to @mentions in issues and pull requests with autonomous AI-powered assistance.

The tool occupies a specific niche in the developer tooling landscape: unlike managed GitHub Apps, it requires self-hosting and container infrastructure, giving teams full control over authentication methods, execution environments, and security boundaries. This design prioritizes flexibility over convenience—users bring their own Claude authentication (via Max subscription, direct API key, or AWS^{↗ Bright Coding Blog} Bedrock) and manage their own bot identity.

The project's relevance stems from a concrete capability gap. Existing AI coding assistants typically operate in IDE-integrated or chat-based modes; claude-did-this/claude-hub extends this to asynchronous, repository-native workflows where Claude can work for hours autonomously, handling complete feature implementations from requirements through merge.

Key Features

Autonomous Development Workflows define the core value proposition. The bot implements complete features from requirements to production-ready code, conducts security and performance-focused code reviews, manages full PR lifecycles (branch creation, commits, pushes, merges), and actively monitors CI/CD pipelines—waiting for builds, analyzing failures, and applying fixes iteratively.

Multi-Hour Autonomous Operation distinguishes this from simpler automation tools. Claude maintains context across long-running tasks, preserves project state, resolves dependency blockers by waiting for external processes, and adapts solutions based on automated feedback loops. The architecture supports checkpoint and resume functionality for extended operations.

Execution Security Through Container Isolation ensures each request runs in a fresh Docker^{↗ Bright Coding Blog} container with operation-specific permission profiles. Auto-tagging receives minimal permissions (read access plus GitHub tools); PR reviews get standard permissions with automated merge capabilities; feature development containers receive full code editing, testing, and CI monitoring access.

Performance Architecture includes parallel Jest test execution, conditional Docker builds triggered only on code changes, repository caching for sub-second response times, and advanced build profiling with timing metrics. The system optimizes for repeated operations on the same codebase.

Enterprise Security Controls cover webhook signature verification via HMAC-SHA256, AWS IAM role-based authentication, pre-commit credential scanning, container isolation with minimal permissions, and fine-grained GitHub token scoping. An authorized users allowlist restricts bot access to specified GitHub usernames.

Use Cases

Autonomous Feature Implementation suits teams with backlog items that have clear requirements but lack immediate developer bandwidth. A product manager or tech lead can @mention the bot in an issue with implementation instructions; Claude clones the repository, analyzes existing patterns, codes the feature, runs tests, and opens a PR for final human review.

Security-Focused Code Review addresses the common problem of security expertise scarcity. The bot analyzes pull requests for vulnerabilities, performance anti-patterns, and best practice deviations—providing comprehensive feedback without waiting for a senior engineer's availability. This proves especially valuable for teams without dedicated security reviewers.

CI Failure Resolution eliminates the interrupt-driven workflow of build breakage. When tests fail or CI pipelines break, developers can @mention the bot with the failure context. Claude examines logs, identifies root causes, implements fixes, and monitors subsequent builds until green—operating across the full cycle without manual handoffs.

Repository Onboarding and Documentation leverages Claude's ability to analyze entire repository structures. New team members can ask technical questions via issues, receiving context-aware explanations that reference actual codebase patterns rather than static documentation that drifts out of date.

Automated Issue Triage through content analysis auto-labels new issues based on their content, reducing manual categorization overhead for maintainers of busy repositories.

Installation & Setup

The project provides a 10-minute quick start using Cloudflare Tunnel, requiring no domain or complex infrastructure.

Step 1: Clone and configure

git clone https://github.com/claude-did-this/claude-hub.git
cd claude-hub
cp .env.quickstart .env
nano .env  # Add your GitHub token and bot details

This creates a local copy of the service and prepares environment configuration. The .env.quickstart template provides sensible defaults; editing with nano (or your preferred editor) adds your specific GitHub token and bot account username.

Step 2: Authenticate Claude

./scripts/setup/setup-claude-interactive.sh

This interactive script configures Claude authentication using your existing Claude.ai Max subscription (5x or 20x plans required; Claude Pro does not include Claude Code access). The script captures authentication state for containerized execution.

Step 3: Start the service

docker compose up -d

The -d flag runs containers in detached mode. The service exposes port 3002 by default for webhook reception.

Step 4: Create a tunnel

cloudflared tunnel --url http://localhost:3002

Cloudflare Tunnel provides a public HTTPS endpoint without DNS configuration. The quickstart guide contains detailed webhook setup instructions for configuring this URL in your GitHub repository settings.

For production deployment, the service requires additional environment configuration including BOT_USERNAME, GITHUB_WEBHOOK_SECRET, GITHUB_TOKEN (fine-grained PAT from your bot account), and one of three Claude authentication methods: setup container (personal/development), direct Anthropic API key (production/team), or AWS Bedrock (enterprise).

Real Code Examples

The README documents direct API access for creating asynchronous Claude sessions outside of GitHub webhooks:

# Create a new session
curl -X POST http://localhost:3002/api/webhooks/claude \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer your-webhook-secret" \
  -d '{
    "type": "session.create",
    "session": {
      "type": "implementation",
      "project": {
        "repository": "owner/repo",
        "requirements": "Analyze security vulnerabilities"
      }
    }
  }'

This endpoint initiates an autonomous implementation session with explicit project scope. The type: "implementation" parameter signals a full development workflow rather than review or analysis. The webhook secret serves dual purpose: GitHub signature verification and API bearer authentication.

Session status polling follows a matching pattern:

# Check session status
curl -X POST http://localhost:3002/api/webhooks/claude \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer your-webhook-secret" \
  -d '{
    "type": "session.get",
    "sessionId": "session-id-from-create"
  }'

The API uses POST for all operations with action specified in the request body—a design choice that simplifies client implementation at the cost of HTTP method semantics.

The CLI tool provides repository-scoped invocation:

# Basic usage
./cli/claude-webhook myrepo "Review the authentication flow"

# PR review with branch specification
./cli/claude-webhook owner/repo "Review this PR" -p -b feature-branch

# Target specific issue
./cli/claude-webhook myrepo "Fix this bug" -i 42

The -p flag enables PR mode; -b specifies target branch; -i references issue number. These flags map to the container execution profiles that determine available tools and permissions.

Advanced Usage & Best Practices

Authentication Method Selection significantly impacts cost and reliability. The setup container approach leverages existing Claude Max subscriptions, avoiding per-token API fees but introducing dependency on session-based authentication that may require periodic refresh. Direct API keys provide predictable pricing and stability for production workloads. AWS Bedrock suits organizations with existing AWS commitments and compliance requirements around data residency.

Container Lifetime Tuning balances autonomy against resource consumption. The default 2-hour timeout (CONTAINER_LIFETIME_MS=7200000) accommodates complex features but may over-allocate for simple reviews. Monitor actual task durations and adjust accordingly.

Repository Caching Strategy improves response times for repeated operations. Configure REPO_CACHE_DIR and REPO_CACHE_MAX_AGE_MS based on your repository's commit frequency—aggressive caching helps stable codebases; minimal caching suits rapidly evolving projects.

Security Hardening should extend beyond documented controls. The authorized users allowlist (AUTHORIZED_USERS) provides coarse access control; consider supplementing with GitHub organization membership checks for team deployments. Rotate webhook secrets and PATs on a defined schedule.

Comparison with Alternatives

code-did-this/claude-hub trades managed convenience for execution depth. Copilot Workspace offers tighter GitHub integration but lacks the autonomous CI monitoring and multi-hour operation capabilities. CodeRabbit provides faster setup but less flexibility in execution environment and tool access. AutoCodeRover shares the self-hosted model but focuses on narrower issue-resolution workflows without the full PR lifecycle management.

FAQ

What GitHub plan do I need for the bot account? Any free GitHub account works; the bot needs repository collaborator access, not organization features.

Does Claude Pro work with this? No. Claude Code requires Claude Max (5x or 20x plans) for the setup container authentication method.

Can I run this without Docker? The documentation specifies Docker Compose for deployment; container isolation is architecturally integral.

What happens if a task exceeds the container timeout? The task terminates; adjust CONTAINER_LIFETIME_MS or break work into smaller issues.

Is the license actually MIT? The README displays an MIT badge, though the repository stats note "License: Not specified"—verify the LICENSE file directly.

How do I restrict who can trigger the bot? Use the AUTHORIZED_USERS environment variable with comma-separated GitHub usernames.

Can the bot merge to protected branches? Yes, with appropriate GitHub token permissions and branch protection rules configured for the bot account.

Conclusion

claude-did-this/claude-hub serves a specific developer profile: teams with operational maturity to self-host infrastructure, existing Claude Code access, and workflows where autonomous execution justifies setup complexity over managed alternatives. The 482-star project delivers genuine capability—multi-hour autonomous development, CI-aware iteration, and container-isolated security—at the cost of requiring your own bot account, authentication management, and Docker infrastructure.

It's best suited for maintainers of active repositories who spend significant time on code review, issue triage, and CI failure resolution; less appropriate for casual users wanting immediate setup or teams without DevOps^{↗ Bright Coding Blog} bandwidth. The TypeScript codebase, comprehensive documentation, and active CI pipeline suggest maintained quality, though the "License: Not specified" discrepancy warrants verification before production deployment.

Ready to deploy your own autonomous GitHub bot? Start with the 10-minute quickstart guide and explore the repository at https://github.com/claude-did-this/claude-hub.