Supported providers #
Norma connects to your source code through one of three providers: GitHub and Bitbucket (GitLab coming soon). You authorise the provider once per workspace; after that, any repository you have access to can be added.
| Provider | Status | Auth method | Notes |
|---|---|---|---|
| GitHub | ✅ Generally available | OAuth (GitHub App) | Supports public and private repos |
| Bitbucket | ✅ Generally available | OAuth | Bitbucket Cloud only (self-hosted: see below) |
| GitLab | Coming soon | — | GitLab repositories already in Norma continue to display and scan, but new GitLab connections are not yet available from the UI. |
What Norma can see #
When you authorise a provider, Norma requests read access to the repositories you select. We:
- Read your repository contents to run scans.
- Do not push, commit, or modify your code in any way.
- Do not store your code beyond the duration of a scan. Clones are deleted as soon as the scan finishes.
You can revoke access at any time from the provider’s own settings (e.g. GitHub → Settings → Applications) or from MCP Connections inside Norma.
How to connect a provider #
- Open Repositories in the sidebar.
- Click + Add Repository in the top right.
- Choose your provider — Connect GitHub or Connect Bitbucket.
- You’ll be redirected to the provider’s authorisation screen. Approve the requested permissions.
- Back in Norma, pick which repositories to add. (You can add more later from the same screen.)
Self-hosted Git #
Self-hosted instances (GitHub Enterprise Server, GitLab self-managed, Bitbucket Server) are not yet supported. If you need this, get in touch — it’s on the roadmap.
Re-authorising #
If you change a repository’s permissions on the provider side, Norma may lose access. To restore it:
- Open Repositories in the sidebar.
- Click Sync Repositories in the top right.
- Select Sync repositories.
- Norma will re-sync your repository list automatically.
Related #
- Supported languages — what gets scanned once a repo is connected.
