Play · MSPs and resellers
Approved skills for every client
One GitHub App gives each clienta repository, with no tokens to rotate.
Connect your GitHub App in the partner portal once; Waxell signs in as the app and, on every sync, gets a short-lived credential that can reach only the assigned client's repository. Each client's claude.ai syncs its own repository, and your clients never need GitHub accounts.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF
Who
An MSP running Claude for a dozen clients, each with its own approved set of skills and plugins and its own claude.ai organization.
What happened
The personal access token behind one client's marketplace expired with the engineer who created it, and that client's approvals stopped syncing for a week.
What's at stake
A token per client tied to a person's GitHub account, a repository a client could point somewhere else, and one client's claude.ai connected with access that can see other clients' repositories.
- 01Enforce
Create the app under your organization. Connect it once.
Create the GitHub App under an organization you own, not a personal account, with Contents set to Read and write, the webhook off, and every other permission at No access. Note the App ID and generate a private key. In the partner portal, switch to Operations and open Claude marketplaces; enter the GitHub host (github.com, your GHE.com host, or your Enterprise Server), the App ID and the key, and click Connect app. Waxell proves the App ID and key belong together before saving; the key is stored encrypted with your partner workspace's own key, never shown again, and the page shows its fingerprint so you can match it to GitHub.
Contents: Read and write · App ID and private key · /msp/claude-marketplaces · key fingerprint, never shown again
- 02Enforce
Assign each client its repository. Waxell narrows the credential.
For each client, create a private repository initialized with a README, install the app with access to only that repository, then click Refresh and Assign on the client's row. Waxell checks it can push, makes the first commit, and from then on every approval or revoke in that client's workspace is committed within seconds. The client workspace sees Managed by your partner name and cannot point at another repository. On github.com, give each client its own organization, because the Claude app installs once per organization with one repository list; on GHE.com or Enterprise Server, keep one organization and create one read-only Claude app per client with access to only that client's repository.
one organization per client on github.com · one Claude app per client on GHE.com or Enterprise Server · Managed by your partner name · commits within seconds
- 03Prove
Every connect, assignment and change lands in both audit logs.
Each client's claude.ai Owner connects the repository and sets Default access, which starts at Not available until they change it. From Claude marketplaces you can Change a client's repository, Unassign it, Replace key after generating a new one in GitHub, or Disconnect the app; the client's own admins keep Sync now and Pause and Resume. Every connect, assignment and change is recorded in your audit log and in the client's, and each repository's history says what was approved or revoked and by whom.
Change · Unassign · Replace key · Disconnect · your audit log and the client's · repository history
- Connect app · Northgate Waxell Marketplaces · github.compartner portal · claude marketplaces · App ID and key verified · fingerprint recordedallow
- approve release-notes plugin · commit to northgate-acme/claude-pluginsclient acme · govern · skills & plugins · credential narrowed to the assigned repositoryallow
- point workspace at northgate-acme/claude-pluginsclient globex · admin k.ramos · Managed by Northgate · client cannot change the repositoryblock
- Default access set to Available to installclient acme · claude.ai owner · marketplace synced · 6 pluginsallow
Illustrative entries in the shape the product writes them.
Products in this play
No. The repositories live in your GitHub, under your sign-in and provisioning. Each client's claude.ai connects to its own repository with a read-only connection, and the client workspace in Waxell shows Managed by your partner name.
Run this play this week.
Free for your first agents and devices, live in about thirty seconds. Or walk through it with someone who has run it before.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF