Monitor GitHub from an island on your Mac
Monitor GitHub for what needs you, not everything that moves. Reviews, failed Actions runs, releases and security alerts, on github.com or GitHub Enterprise.
What CoIsland watches in GitHub
Each monitor kind brings its own query and its own card in the island.
-
Issues and pull requests
Any GitHub search, as you type it on github.com. Each new match alerts once.
-
Review requests
Pull requests waiting on you or on your team.
-
Failed workflow runs
GitHub Actions runs that fail, by repository, branch, workflow, event or actor.
-
New releases
Releases your repositories publish. Drafts never count.
-
Security alerts
Open Dependabot, code scanning and secret scanning alerts, by severity.
How to monitor GitHub without the notification noise
GitHub subscribes you to every thread you open, comment on, are assigned to or are mentioned in, and to the repositories you watch. A CoIsland monitor works the other way round: you name the one thing that needs you, and only a new match reaches an island on your Mac.
Each monitor is a query, a check interval and an alert rule. It checks every 15 minutes by default, and anywhere from every 30 seconds to every 30 days. The first check records what already matches and stays quiet. After that it alerts on each item it has not seen, or once when the count crosses a number you set. Test runs the query once and shows what matches, without saving or alerting.
Issues and pull requests
Paste any search you would type on github.com. CoIsland sends it to GitHub’s search API with advanced search on, so OR and parentheses work on github.com, and alerts once per new issue or pull request. An issue that is edited or gets a comment stays the same item, so it does not alert again.
repo:acme/api is:issue is:open label:bug
is:open mentions:@me
repo:acme/api is:pr is:open -author:@meOnly a result of 100 matches or fewer is compared. Above that, the monitor asks you to narrow the search instead of guessing what is new.
Pull request review requests
The same search, limited to pull requests: CoIsland adds is:pr for you. Watch requests made to you directly, or to your team:
user-review-requested:@me is:open -is:draft
team-review-requested:acme/platform is:openA pull request leaves the result once you review it. If its author asks you again, it alerts again.
GitHub Actions failure alerts
Failed workflow runs has fields instead of a search box: repositories, status, branch, event, workflow and actor. It reads the runs of the last 7 days with the status you pick, Failure unless you choose Timed out, Cancelled or another GitHub status. A re-run that fails again is a new attempt, so it alerts again.
repo:acme/api branch:main workflow:deploy.yml
The guide to GitHub Actions failure notifications on Mac compares this with GitHub’s email and chat notifications.
New releases
Name one repository or several, and choose whether pre-releases count. The monitor reads releases published in the last 30 days. Drafts never count, so a release alerts when it is published.
repo:apple/swift-nio -is:prereleaseDependabot, code scanning and secret scanning alerts
Security alerts takes repositories or whole organizations, the tools to ask and the severities to keep, and reads open alerts only. Dependabot and code scanning are on by default. Secret scanning needs admin access, so you turn it on yourself.
org:acme severity:critical,high
repo:acme/api tool:dependabot,secret-scanning
Forms, text and files
Edit as Text shows the query the fields write, and Edit as Form goes back when the fields can show it. Every monitor is saved as a .sql file in ~/.coisland/watches. Its settings, kind among them, are comment lines above the query, so your monitors can live in git:
-- name: Failed deploys on main
-- kind: github.workflow-runs
-- connector: acme_github
-- every: 15m
-- alert: new-rows
-- sound: Glass
repo:acme/api branch:main workflow:deploy.ymlFrom the island to an agent
A monitor’s card in the island lists each new item by its title, with a line such as acme/api #412 · Open · octocat. Click it to open the alert: each item fetched live from GitHub, with its labels, body and newest comments for an issue, branch, commit and duration for a run, and package, patched version and advisory for a Dependabot alert.
At the foot of the card, Claude Code, Codex and Cortex Code are one click away. The agent opens in a terminal under the alert, and its first message is the whole alert: facts, query, items and activity. It finds the cause, fixes what is safe and asks you before anything destructive. CoIsland starts Claude Code and Codex in their auto modes, as the agents page explains:
claude --permission-mode auto
codex -c approvals_reviewer="auto_review" -c approval_policy="on-request" -c sandbox_mode="workspace-write"
GitHub token permissions and GitHub Enterprise
The connector signs in with a fine-grained personal access token: one resource owner, the repositories to watch, and read-only permissions. Give it only what your monitors use:
| Monitor kind | Repository permission, read-only |
|---|---|
| Issues and pull requests, review requests | Issues, Pull requests |
| Failed workflow runs | Actions |
| New releases | Contents |
| Security alerts | Dependabot alerts, Code scanning alerts, Secret scanning alerts |
Classic tokens (ghp_) work too. An organization can require approval of fine-grained tokens, and GitHub answers org: security alerts only to organization owners and security managers.
The Host field takes github.com, your GitHub Enterprise Server host (API at https://HOST/api/v3) or your SUBDOMAIN.ghe.com address (API at api.SUBDOMAIN.ghe.com). Test connector shows the account the token belongs to and, when GitHub sends it, its expiry.
The token stays in the macOS Keychain and goes only to your GitHub API, over https. There is no CoIsland server. When GitHub refuses a check, the monitor says why: a missing permission, a token to authorize for single sign-on, or a renamed repository.
Step by step: Connect GitHub. Coming from GitHub’s inbox? Read the GitHub notifications alternative. For reviews and CI next to Jira, see CoIsland for engineering, or browse every connector.
Connect it in three steps
-
Create a fine-grained token with read-only access to the repositories to watch.
-
In Settings › Connectors, add GitHub with your host and the token, then Test connector.
-
Pick a monitor kind, fill in its fields or its search, and say when it alerts.
Built for GitHub
- github.com, GitHub Enterprise Server and GHE.com.
- Read-only permissions, only the ones your monitors use.
- The token stays in the macOS Keychain and goes only to your GitHub API.
- The first check is a baseline, so old items never flood you.
- Every monitor is a plain .sql file in ~/.coisland/watches.
Then hand it to an agent
A click on the alert opens the agent in a terminal under it, with the whole alert as its first message.
-
Claude Code
Anthropic's coding agent, in its own CLI.
-
Codex
OpenAI's coding agent, in its own CLI.
-
Cortex Code
Snowflake's coding agent, in its own CLI.
GitHub questions
How do I get GitHub notifications on my Mac without the inbox?
Create a monitor for each thing you care about, such as review requests, failed runs on main or critical security alerts. CoIsland checks it on its schedule and shows only new matches in the island. It does not read your GitHub notifications, so you can keep both.
Which permissions does the GitHub token need?
Read-only repository permissions for what you watch. Issues and Pull requests for searches and review requests, Actions for failed runs, Contents for releases, and Dependabot alerts, Code scanning alerts or Secret scanning alerts for security alerts. Classic tokens work too.
Can CoIsland alert me when a GitHub Actions workflow fails?
Yes. A Failed workflow runs monitor lists the runs of the last 7 days with the status you pick, Failure by default, for the repositories, branch, workflow, event or actor you name. Each new failure alerts once, and a re-run that fails again alerts again.
Does it work with GitHub Enterprise Server and GHE.com?
Yes. Enter your GitHub Enterprise Server host, whose API is at https://HOST/api/v3, or your SUBDOMAIN.ghe.com address, instead of github.com. The host must answer over https.
Can I see Dependabot, code scanning and secret scanning alerts?
Yes, open ones, for repositories or whole organizations, filtered by severity. Secret scanning is off until you turn it on, because GitHub's API returns those alerts only to administrators. CoIsland never asks GitHub for the secret itself.
Why does my GitHub search say more than 100 items match?
A search is compared only when it matches 100 items or fewer, so a busy search cannot make old items look new. Narrow it with repo:, label: or is:open. A count rule with a threshold under 100 still works, since the count is known to be over 100.
Does CoIsland send my GitHub data to a server?
No. There is no CoIsland server and no CoIsland account. Each check is a request from your Mac to your GitHub host, and the token stays in the macOS Keychain.
Other connectors
-
Gmail
Hear about the emails that matter, not every email. Unread mail, chosen senders, labels, Drive comments and invitations reach an island on your Mac, and nothing is marked read.
-
Calendar
The calendars Calendar.app already shows (iCloud, Google, Exchange, subscriptions), or a calendar's secret ICS feed, in an island on your Mac. A countdown to your next meeting, a warning before it starts with one click to join, and news of invitations and changes.
-
Dock badges
One watch over every app that badges its Dock icon. Slack, Microsoft Teams, Outlook, Mail, Messages, Discord, WhatsApp or any other app tells the island when its count goes up, with no account or token for any of them.
-
Apple Mail
Every account Mail already has, iCloud, Exchange, Gmail or any IMAP, in an island on your Mac. New unread mail in your inboxes, or only from the people and domains you pick, with no password given to CoIsland.
-
Vercel
Watch Vercel deployments, stuck builds and project domains. A failed build reaches an island on your Mac with its error, and the alert shows the failing step and the end of the build log.
-
GitLab
Watch GitLab on gitlab.com or a self-managed instance. A review request, a failed pipeline or a new to-do reaches an island on your Mac, and the alert shows the merge request with its description and comments, or the jobs that failed.
-
Cloudflare
Watch Cloudflare Pages deployments, Worker errors and your zones. A failed build reaches an island on your Mac with its failing step, and the alert shows the end of the build log.
-
Render
Watch the deploys of your Render services and whether they are suspended. A failed deploy reaches an island on your Mac with its commit, and a suspended service says who suspended it.
-
Docker
Know when a container on your Mac crashes, runs out of memory or can't start. The alert carries its last 30 log lines, and an agent you hand it to gets them too.
-
Local dev
See when two programs listen on the same port, a local server stops answering, or a process takes more memory or CPU than it should. Everything is read on this Mac, and nothing is sent anywhere.
-
Jira
Monitor Jira with the JQL you already write. New matches, status changes, comments, SLAs near a breach and sprint scope reach an island on your Mac, from Jira Cloud or Data Center.
-
Linear
Monitor Linear with its own issue filters. New matches, status changes, issues in triage, SLAs at risk, your mentions and projects going off track reach an island on your Mac.
-
Confluence
Monitor Confluence Cloud without the email digest. Mentions, page edits, new comments, your tasks and any CQL reach an island on your Mac, signed in with the same API token as Jira.
-
Asana
Know what landed on your plate and what is late. Tasks assigned to you, due dates, new tasks in a project and comments on your tasks reach an island on your Mac, read with your own Asana token.
-
ClickUp
Know what is yours and what is late. Tasks assigned to you, their status and due dates, and new tasks in a list reach an island on your Mac, read with your own ClickUp token.
-
Todoist
Know what is due before it is late. Tasks due today or overdue, new tasks in a project, or any filter you already use reach an island on your Mac, read with your own Todoist token.
-
Notion
Know when a Notion row lands on you, a page you care about changes, or someone comments. Read with your own personal access token, straight from your Mac.
-
Shortcut
Know when a story lands on you, moves to review, or an iteration is about to end with work still open. Read with your own Shortcut API token.
-
Airtable
Know when a record starts matching a formula, or someone edits one, without keeping the base open. Read with a personal access token scoped to the bases you pick.
-
Reminders
The reminders Reminders.app already has, iCloud or Exchange, in an island on your Mac. A warning before one is due, another when it is overdue, and news when someone adds to a list you share.
-
Sentry
Monitor Sentry with the searches you already write. New errors, regressions, issues assigned to you, failing crons, sites down and new releases reach an island on your Mac, from sentry.io or your own Sentry.
-
PagerDuty
Know at a glance whether you have to move. Incidents assigned to you, your teams' incidents and your on-call shifts reach an island on your Mac, read with your own PagerDuty token.
-
Datadog
Know when a Datadog monitor fires without living in the dashboard. Monitors in alert, incidents and metric thresholds reach an island on your Mac, read with your own application key.
-
New Relic
Run the NRQL you already trust, and see New Relic's alert issues the moment they open, in an island on your Mac, with your own User key.
-
Langfuse
Your LLM app fails, overspends or gets a thumbs down, and the island says so. Langfuse's errors, cost, latency and scores reach your Mac, read with a project's key pair on Langfuse Cloud or your own Langfuse.
-
Snowflake
Monitor Snowflake with read-only SQL. A failed task, a row that breaks a rule or a sudden spike reaches an island on your Mac, and Cortex Code, Claude Code or Codex can take it from there.
-
Databricks
Monitor Databricks from an island on your Mac. A failed job run, a failed pipeline update or a triggered SQL alert reaches you for free, and read-only SQL on a warehouse watches the data itself.
-
dbt
Monitor dbt from an island on your Mac. A job run that fails, a run that takes too long or a source that goes stale reaches you, with the failing step's log one click away.
-
PostHog
Monitor PostHog from an island on your Mac. A HogQL query that finds something, an insight crossing a number or an exception seen for the first time reaches you without opening a dashboard.
-
Supabase
Monitor Supabase from an island on your Mac. A paused or unhealthy project, a new security lint or a row your SQL finds reaches you, with nothing but a personal access token.
-
PostgreSQL
Monitor PostgreSQL from an island on your Mac. A read-only query checks your database on a schedule, and each new row it finds reaches you once.
-
MySQL
Monitor MySQL and MariaDB from an island on your Mac. A read-only query checks your database on a schedule, and each new row it finds reaches you once.
-
ClickHouse
Monitor ClickHouse from an island on your Mac. A read-only query, or a health check on the system tables, runs on a schedule, and each new problem reaches you once.
-
HTTP / JSON
Point CoIsland at any address. A JSON value that changes or crosses a threshold, a new element of a JSON list, or a page that goes down or starts saying "In stock" reaches an island on your Mac.
-
RSS / Atom
Watch any feed. A new GitHub release, a new post on a blog, or a Hacker News story that says your keyword reaches an island on your Mac, with the article one click away.
-
Status pages
Know when a service you depend on is down before your users tell you. Incidents, their updates, components going down and the page's overall status reach an island on your Mac.
-
Shell command
Run a command or a script on your Mac on a schedule. A new line it prints, a new object in its JSON, or a failure reaches the island once.
-
Stripe
Watch failed payments, disputes, subscriptions, payouts and your balance with a read-only restricted key. A declined card reaches an island on your Mac with the amount, the customer and the bank's reason.
Work with AI. Stay in control.
CoIsland Community is free, for good. Lifetime from $29, paid once. Native for Apple Silicon, macOS 14 and later.