GitHub Enterprise Server (GHES) Integration

Overview

The GHES integration enables Monte Carlo's MC Prevent suite on self-hosted GitHub Enterprise Server instances:

1. Prevent bad data changes before they reach production using the PR Agent — Monte Carlo's automated pull request risk assessments.
2. Enforce a merge gate using the CI Agent in GitHub Actions or CircleCI.

Note: The GHES integration currently supports the PR Agent and CI Agent only. PR overlays on incident charts and pull request history on the asset page are not yet available for GHES. These capabilities are supported on github.com only.

---

Step 1 — Allow Monte Carlo's outbound IPs

Monte Carlo needs to reach your GHES instance over HTTPS. Add Monte Carlo's SaaS public IP addresses to your network-layer allowlist (security group, firewall, WAF, or corporate VPN).

You can find your account's outbound IPs at **Account → Account Information → Networking ** under SaaS public IP addresses.

Important: Add these IPs at the network layer — not only the GHES application-level IP allowlist. Both layers must permit the traffic.

---

Step 2 — Register a GitHub App on your GHES instance

In GHES, go to Organization settings → Developer settings → GitHub Apps → New GitHub App.

App settings

You must also create a webhook secret. GitHub recommends you choose a random string of text with high entropy. One option to generate this secret is running a command like this:

python3 -c "import secrets; print(secrets.token_urlsafe(32))"

Enter that as the webhook secret and save it for reference in step 3.

Repository permissions

Subscribe to events

• pull_request
• issue_comment

Where can this App be installed?

• Only on this account — if Monte Carlo will only run on this GHES organization.
• Any account — if you'll install on multiple organizations within the same GHES instance.
  

Make the App public

GHES rejects installs of private Apps unless the installing user is the same one who registered the App. To allow others to install it, toggle Make this GitHub App public in Developer Settings → Advanced → Danger zone.

"Public" in this context means installable within your GHES instance — it is not exposed to github.com or the public internet.

After creating the App

From the App settings page, note these values — you'll need them in Step 3:

• App ID (numeric)
• Client ID (format: Iv1.xxxxxxxx)
• Client Secret — generate a new one from the App settings page
• Private Key — generate and download the .pem file
• App Name — the URL slug (e.g., acme-mc from https://<your-ghes-host>/github-apps/acme-mc)
• Webhook Secret — the value you set above

---

Step 3 — Connect Monte Carlo to your GitHub App

In Monte Carlo, go to Settings → Integrations → GitHub and select GitHub Enterprise Server.

Fill in the form with the values from Step 2:

Click Submit. Monte Carlo redirects you to your GHES App install page. Select the organization and approve the installation. You'll be redirected back to Monte Carlo and the integration will appear in your integrations list.

---

Step 4 — Configure the integration in Monte Carlo

After connecting, two configuration steps in Monte Carlo are required before the PR Agent will function. Both are in Settings → Integrations → GitHub → (your org) → Edit connection.

Enable the PR Agent for specific repos

The PR Agent will not post on any pull request until you add repos to its allowlist.

1. Open the Settings tab in the Edit connection drawer.
2. Under Enable PR Agent for these repos, add each repository you want the PR Agent to review.

If the allowlist is empty, the PR Agent will not comment on any PR — even mc review comments will have no effect.

Configure dbt project remote URLs

This step is required for the PR Agent to identify which Monte Carlo-monitored tables are affected by a pull request. Monte Carlo uses these mappings to correlate file changes in your GHES repos with monitored data assets. Without them, the PR Agent's blast-radius analysis, downstream lineage impact, and asset criticality scoring will not reflect the actual tables changed.

1. Open the Configure dbt Projects tab in the Edit connection drawer.
2. For each dbt project, enter:

dbt Cloud users: If your dbt Cloud integration is on data collector v14050 or later, this mapping is populated automatically and no manual input is needed.

---

Step 5 — Verify

Create a new pull request in any repository where the App is installed. The Monte Carlo bot should post a PR Risk assessment comment, and an MC Prevent: PR Risk Rubric check run should appear on the PR.

It must be a new or re-opened PR after the integration is configured.

---

PR Agent and CI Agent

Once connected, the GHES integration supports the same PR Agent and CI Agent capabilities documented on the GitHub integration page :

• PR Agent — automatically reviews pull requests and posts a risk assessment comment.
• CI Agent — optional CI pipeline step (GitHub Actions or CircleCI) that enforces a merge gate based on the PR Agent's risk tier.

For full configuration details — including repo allowlists, risk factor weights, and gate policies — see the GitHub integration documentation .

CI Agent on GHES

Depending on your GHES organization's settings, you may be able to use the mc-prevent-action GitHub Action directly. If your organization restricts third-party Actions, copy the action.yml into your own repository and reference it from there.

---

Troubleshooting

---

Limitations

• MC only collects PRs that merged after the integration setup time. Historical PRs are not available.
• The PR Agent does not automatically re-run on every new commit. After pushing a fix, comment mc review to request a fresh assessment for the new head commit.
• PR overlays on incident charts and pull request history on the asset page are not yet supported for GHES. These features are available on github.com only.
• Organizations using IP allowlists in GHES must also add Monte Carlo's SaaS public IP addresses to the GHES application-level allowlist in addition to the network layer.