diff --git a/.travis.yml b/.travis.yml
new file mode 100644
index 0000000..d59881c
--- /dev/null
+++ b/.travis.yml
@@ -0,0 +1,6 @@
+language: node_js
+sudo: false
+node_js:
+  - "4"
+  - "5"
+  - "6"
\ No newline at end of file
diff --git a/exec-git.js b/exec-git.js
deleted file mode 100644
index 1bd6edf..0000000
--- a/exec-git.js
+++ /dev/null
@@ -1,66 +0,0 @@
-var Promise = require('bluebird').Promise;
-var exec = require('child_process').exec;
-var os = require('os');
-
-function Pool(count) {
-  this.count = count;
-  this.queue = [];
-  this.promises = new Array(count);
-}
-
-/* Run the function immediately. */
-function run(pool, idx, executionFunction) {
-  var p = Promise.resolve()
-    .then(executionFunction)
-    .then(function() {
-      delete pool.promises[idx];
-      var next = pool.queue.pop();
-      if (next)
-        pool.execute(next);
-    });
-  pool.promises[idx] = p;
-  return p;
-}
-
-/* Defer function to run once all running and queued functions have run. */
-function enqueue(pool, executeFunction) {
-  return new Promise(function(resolve) {
-    pool.queue.push(function() {
-      return Promise.resolve().then(executeFunction).then(resolve);
-    });
-  });
-}
-
-/* Take a function to execute within pool, and return promise delivering the functions
- * result immediately once it is run. */
-Pool.prototype.execute = function(executionFunction) {
-  var idx = -1;
-
-  for (var i=0; i<this.count; i++)
-    if (!this.promises[i])
-      idx = i;
-
-  if (idx !== -1)
-    return run(this, idx, executionFunction);
-  else
-    return enqueue(this, executionFunction);
-};
-
-if (process.platform === 'win32') {
-  var gitPool = new Pool(Math.min(os.cpus().length, 2));
-  module.exports = function(command, execOpt, callback) {
-    return gitPool.execute(function() {
-      return new Promise(function(resolve){
-        exec('git ' + command, execOpt, function(err, stdout, stderr){
-          callback(err, stdout, stderr);
-          resolve();
-        });
-      });
-    });
-  };
-}
-else {
-  module.exports = function(command, execOpt, callback) {
-    exec('git ' + command, execOpt, callback);
-  };
-}
diff --git a/github.js b/github.js
index decab50..0a57af6 100644
--- a/github.js
+++ b/github.js
@@ -13,11 +13,10 @@ var zlib = require('zlib');
 
 var semver = require('semver');
 
-var which = require('which');
-
 function extend(dest, src) {
   for (var key in src) {
-    dest[key] = src[key]
+    if (typeof dest[key] === 'object') extend(dest[key], src[key]);
+    else dest[key] = src[key];
   }
 
   return dest;
@@ -28,7 +27,7 @@ try {
 }
 catch(e) {}
 
-var execGit = require('./exec-git');
+var lsRemote = require('./ls-remote');
 
 function createRemoteStrings(auth, hostname) {
   var authString = auth.username ? (encodeURIComponent(auth.username) + ':' + encodeURIComponent(auth.password) + '@') : '';
@@ -82,15 +81,6 @@ function isGithubToken(token) {
 }
 
 var GithubLocation = function(options, ui) {
-
-  // ensure git is installed
-  try {
-    which.sync('git');
-  }
-  catch(ex) {
-    throw 'Git not installed. You can install git from `http://git-scm.com/downloads`.';
-  }
-
   this.name = options.name;
 
   this.max_repo_size = (options.maxRepoSize || 0) * 1024 * 1024;
@@ -112,22 +102,13 @@ var GithubLocation = function(options, ui) {
 
   this.ui = ui;
 
-  this.execOpt = {
-    cwd: options.tmpDir,
-    timeout: options.timeout * 1000,
-    killSignal: 'SIGKILL',
-    maxBuffer: this.max_repo_size || 2 * 1024 * 1024,
-    env: extend({}, process.env)
-  };
-
   this.defaultRequestOptions = {
+    headers: {
+      'User-Agent': 'jspm'
+    },
     strictSSL: 'strictSSL' in options ? options.strictSSL : true
   };
 
-  if (!this.defaultRequestOptions.strictSSL) {
-    this.execOpt.env.GIT_SSL_NO_VERIFY = '1'
-  }
-
   var self = this, envMap = {
     ca: 'GIT_SSL_CAINFO',
     cert: 'GIT_SSL_CERT',
@@ -137,7 +118,6 @@ var GithubLocation = function(options, ui) {
   ['ca', 'cert', 'key'].forEach(function(key) {
     if (key in options) {
       var path = expandTilde(options[key]);
-      self.execOpt.env[envMap[key]] = path;
       self.defaultRequestOptions[key] = fs.readFileSync(path, 'ascii');
     }
   });
@@ -302,16 +282,15 @@ GithubLocation.prototype = {
     return new Promise(function(resolve, reject) {
       request(extend({
         uri: remoteString + repo + authSuffix,
-        headers: {
-          'User-Agent': 'jspm'
-        },
         followRedirect: false
-      }, self.defaultRequestOptions
-      ))
+      }, self.defaultRequestOptions))
       .on('response', function(res) {
         // redirect
-        if (res.statusCode == 301)
-          resolve({ redirect: self.name + ':' + res.headers.location.split('/').splice(3).join('/') });
+        if (res.statusCode == 301) {
+          // strip access token
+          var path = require('url').parse(res.headers.location).pathname;
+          resolve({ redirect: self.name + ':' + path.substr(1) });
+        }
 
         if (res.statusCode == 401)
           reject('Invalid authentication details.\n' +
@@ -338,56 +317,124 @@ GithubLocation.prototype = {
   // { versions: { versionhash } }
   // { notfound: true }
   lookup: function(repo) {
-    var execOpt = this.execOpt;
+    var self = this;
     var remoteString = this.remoteString;
-    return new Promise(function(resolve, reject) {
-      execGit('ls-remote ' + remoteString.replace(/(['"()])/g, '\\\$1') + repo + '.git refs/tags/* refs/heads/*', execOpt, function(err, stdout, stderr) {
-        if (err) {
-          if (err.toString().indexOf('not found') == -1) {
-            var error = new Error(stderr);
-            error.hideStack = true;
-            error.retriable = true;
-            reject(error);
-          }
+
+    return Promise.resolve()
+    .then(function() {
+      if (self.auth && self.auth.token) {
+        // use API to get branches/tags
+        return Promise.all(['tags', 'heads'].map(function(type) {
+          return asp(request)(extend({
+            uri: self.apiRemoteString + 'repos/' + repo + '/git/refs/' + type + self.authSuffix,
+            headers: {
+              'Accept': 'application/vnd.github.v3.raw'
+            }
+          }, self.defaultRequestOptions));
+        })).then(function(responses) {
+          var tagRes = responses[0];
+          var headRes = responses[1];
+
+          var refs = [];
+
+          // there should always be heads
+          if (headRes.statusCode != 200)
+            throw { statusCode: headRes.statusCode, headers: headRes.headers, api: true };
           else
-            resolve({ notfound: true });
-        }
+            refs = refs.concat(JSON.parse(headRes.body));
+
+          // tag response can be 404, i.e. no tags
+          if (tagRes.statusCode == 200)
+            refs = refs.concat(JSON.parse(tagRes.body));
+          else if (tagRes.statusCode != 404)
+            throw { statusCode: tagRes.statusCode, headers: tagRes.headers, api: true };
 
-        versions = {};
-        var refs = stdout.split('\n');
-        for (var i = 0; i < refs.length; i++) {
-          if (!refs[i])
-            continue;
+          return refs.map(function(obj) {
+            return { sha: obj.object.sha, name: obj.ref };
+          });
+        });
+      } else {
+        // fallback to git-based approach
+        return false;
+      }
+    })
+    .catch(function(e) {
+      if (e.headers && e.headers['x-ratelimit-remaining'] == '0') {
+        if (!apiWarned) {
+          ui.log('API ratelimit reached, falling back to slower git protocol');
+          apiWarned = true;
+        }
+        // fallback to git-based approach
+        return false;
+      } else {
+        throw e;
+      }
+    })
+    .then(function(refs) {
+      // API response
+      if (refs) return refs;
+
+      // no API auth or API auth is rate-limited, use git
+      return lsRemote(extend({
+        url: remoteString + repo + '.git'
+      }, self.defaultRequestOptions));
+    })
+    .then(function(refs) {
+      var versions = {};
+      refs.forEach(function(ref) {
+        var version;
+        var versionObj = { hash: ref.sha, meta: {} };
+        if (ref.name.substr(0, 11) == 'refs/heads/') {
+          version = ref.name.substr(11);
+          versionObj.stable = false;
+        }
 
-          var hash = refs[i].substr(0, refs[i].indexOf('\t'));
-          var refName = refs[i].substr(hash.length + 1);
-          var version;
-          var versionObj = { hash: hash, meta: {} };
+        else if (ref.name.substr(0, 10) == 'refs/tags/') {
+          if (ref.name.substr(ref.name.length - 3, 3) == '^{}')
+            version = ref.name.substr(10, ref.name.length - 13);
+          else
+            version = ref.name.substr(10);
 
-          if (refName.substr(0, 11) == 'refs/heads/') {
-            version = refName.substr(11);
-            versionObj.stable = false;
+          if (version.substr(0, 1) == 'v' && semver.valid(version.substr(1))) {
+            version = version.substr(1);
+            // note when we remove a "v" which versions we need to add it back to
+            // to work out the tag version again
+            versionObj.meta.vPrefix = true;
           }
+        }
 
-          else if (refName.substr(0, 10) == 'refs/tags/') {
-            if (refName.substr(refName.length - 3, 3) == '^{}')
-              version = refName.substr(10, refName.length - 13);
-            else
-              version = refName.substr(10);
-
-            if (version.substr(0, 1) == 'v' && semver.valid(version.substr(1))) {
-              version = version.substr(1);
-              // note when we remove a "v" which versions we need to add it back to
-              // to work out the tag version again
-              versionObj.meta.vPrefix = true;
-            }
-          }
+        versions[version] = versionObj;
+      });
 
-          versions[version] = versionObj;
+      return { versions: versions };
+    })
+    .catch(function(error) {
+      if (error.statusCode) {
+        var headerSuffix = '\n' + JSON.stringify(error.headers, null, 2); 
+
+        if (error.statusCode == 406 || error.statusCode == 401) {
+          if (error.api) {
+            // TODO: replace this with the api failure response code from below
+            error = new Error('api says invalid auth: ' + error.statusCode + headerSuffix);
+          }
+          else {
+            error = new Error('Invalid authentication details.\n' +
+            'Run %jspm registry config ' + self.name + '% to reconfigure the credentials, or update them in your ~/.netrc file.');
+          }
         }
+        else if (error.statusCode == 404)
+          return { notfound: true };
+        else
+          error = new Error('invalid status code: ' + error.statusCode + headerSuffix);
+      }
 
-        resolve({ versions: versions });
-      });
+      if (typeof error == 'string') {
+        error = new Error(error);
+      }
+
+      error.retriable = true;
+      error.hideStack = true;
+      throw error;
     });
   },
 
@@ -400,17 +447,16 @@ GithubLocation.prototype = {
     var self = this;
     var ui = this.ui;
 
-    return asp(request)({
+    return asp(request)(extend({
       uri: this.apiRemoteString + 'repos/' + repo + '/contents/package.json' + this.authSuffix,
       headers: {
-        'User-Agent': 'jspm',
         'Accept': 'application/vnd.github.v3.raw'
       },
       qs: {
         ref: version
-      },
-      strictSSL: this.defaultRequestOptions.strictSSL
-    }).then(function(res) {
+      }
+    }, self.defaultRequestOptions))
+    .then(function(res) {
       // API auth failure warnings
       function apiFailWarn(reason, showAuthCommand) {
         if (apiWarned)
@@ -534,7 +580,6 @@ GithubLocation.prototype = {
     if (meta.vPrefix)
       version = 'v' + version;
 
-    var execOpt = this.execOpt;
     var max_repo_size = this.max_repo_size;
     var remoteString = this.remoteString;
     var authSuffix = this.authSuffix;
@@ -543,11 +588,10 @@ GithubLocation.prototype = {
 
     // Download from the git archive
     return new Promise(function(resolve, reject) {
-      request({
+      request(extend({
         uri: remoteString + repo + '/archive/' + version + '.tar.gz' + authSuffix,
-        headers: { 'accept': 'application/octet-stream' },
-        strictSSL: self.defaultRequestOptions.strictSSL
-      })
+        headers: { 'accept': 'application/octet-stream' }
+      }, self.defaultRequestOptions))
       .on('response', function(pkgRes) {
         if (pkgRes.statusCode != 200)
           return reject('Bad response code ' + pkgRes.statusCode);
diff --git a/ls-remote.js b/ls-remote.js
new file mode 100644
index 0000000..3594c28
--- /dev/null
+++ b/ls-remote.js
@@ -0,0 +1,69 @@
+var asp = require('bluebird').Promise.promisify;
+var request = asp(require('request'));
+
+module.exports = function(opts) {
+  return Promise.resolve()
+  .then(function() {
+    opts.encoding = null;
+    opts.url += '/info/refs?service=git-upload-pack';
+
+    return request(opts)
+  })
+  .then(function(response) {
+    if (response.statusCode != 200) throw { statusCode: response.statusCode, headers: response.headers };
+    // per the specification, content-type must be this
+    if (response.headers['content-type'] != 'application/x-git-upload-pack-advertisement')  throw { statusCode: 500, headers: response.statusCode };
+
+    var body = response.body;
+    var lines = [];
+    var pos = 0;
+    while (pos < body.length) {
+      // read 4 bytes and parse line length in hex
+      var lineLength = parseInt(body.toString('utf8', pos, pos + 4), 16);
+      // if line isn't blank, read it, otherwise read the next line
+      if (lineLength != 0) {
+        var line = body.toString('utf8', pos + 4, pos += lineLength);
+        lines.push(line.trim());
+      } else pos += 4;
+    }
+
+    // verify the first line is git-upload-pack
+    if( lines.shift() != '# service=git-upload-pack') throw { statusCode: 500, headers: response.headers };
+
+    // verify the second line is the HEAD
+    // e.g. 21d0a9aa00806bb7f67ef5cd98c876aa20e4d803 HEAD\u0000multi_ack thin-pack [...]
+    if (lines.shift().substr(41, 4) != 'HEAD') throw { statusCode: 500, headers: response.headers };
+
+    // parse the remaining lines
+    var refs = lines.map(function(line) {
+      return {
+        sha: line.substr(0, 40),
+        name: line.substr(41)
+      };
+    });
+
+    return refs;
+  });
+}
+
+// for reference:
+/*
+  smart_reply     =  PKT-LINE("# service=$servicename" LF)
+         ref_list
+         "0000"
+  ref_list        =  empty_list / non_empty_list
+
+  empty_list      =  PKT-LINE(zero-id SP "capabilities^{}" NUL cap-list LF)
+
+  non_empty_list  =  PKT-LINE(obj-id SP name NUL cap_list LF)
+         *ref_record
+
+  cap-list        =  capability *(SP capability)
+  capability      =  1*(LC_ALPHA / DIGIT / "-" / "_")
+  LC_ALPHA        =  %x61-7A
+
+  ref_record      =  any_ref / peeled_ref
+  any_ref         =  PKT-LINE(obj-id SP name LF)
+  peeled_ref      =  PKT-LINE(obj-id SP name LF)
+         PKT-LINE(obj-id SP name "^{}" LF
+*/
\ No newline at end of file
diff --git a/package.json b/package.json
index f0d13df..a6ad3bb 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,7 @@
   "description": "jspm GitHub endpoint",
   "main": "github.js",
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "test": "mocha"
   },
   "repository": {
     "type": "git",
@@ -19,16 +19,15 @@
     "expand-tilde": "^1.2.0",
     "bluebird": "^3.0.5",
     "graceful-fs": "^4.1.3",
-    "mkdirp": "~0.5.0",
+    "mkdirp": "^0.5.0",
     "netrc": "^0.1.3",
-    "request": "~2.53.0",
-    "rimraf": "~2.3.2",
+    "request": "^2.53.0",
+    "rimraf": "^2.3.2",
     "semver": "^5.0.1",
-    "tar-fs": "^1.13.0",
-    "which": "^1.0.9"
+    "tar-fs": "^1.13.0"
   },
   "homepage": "https://github.com/jspm/github",
   "devDependencies": {
-    "mocha": "~2.2.4"
+    "mocha": "^2.2.4"
   }
 }
diff --git a/test/mocha.opts b/test/mocha.opts
index 7b826c8..46191c0 100644
--- a/test/mocha.opts
+++ b/test/mocha.opts
@@ -1,4 +1,3 @@
 --require test/setup.js
---reporter dot
 --ui tdd
 --timeout 120000
diff --git a/test/pool.js b/test/pool.js
deleted file mode 100644
index e5aa3f5..0000000
--- a/test/pool.js
+++ /dev/null
@@ -1,35 +0,0 @@
-var Pool = require('../pool');
-var exec = require('child_process').exec;
-
-test('Controls concurrency', function(done) {
-  var pool = new Pool(5);
-
-  var count = 0;
-  var counts = [];
-  function f() {
-    return new Promise(function(resolve) {
-      count++;
-      counts.push(count);
-      exec('sleep 0.01', function() {
-        count--;
-        resolve();
-      });
-    });
-  }
-  var calls = [];
-  for (var i=0; i<100; i++)
-    calls[i] = pool.execute(f);
-
-  Promise.all(calls)
-  .then(function() {
-    var i;
-    // burn in, number running == number executed
-    for (i=0; i<5; i++)
-      assert.equal(counts[i],i + 1);
-    // maxed out, number running == pool max
-    for (i=4; i<100; i++)
-      assert.equal(counts[i], 5);
-  })
-  .then(done)
-  .catch(done);
-});
diff --git a/test/setup.js b/test/setup.js
index 4883550..8ee950b 100644
--- a/test/setup.js
+++ b/test/setup.js
@@ -1,2 +1,2 @@
-global.Promise = require('rsvp').Promise;
+global.Promise = require('bluebird');
 global.assert = require('assert');
diff --git a/test/test.js b/test/test.js
new file mode 100644
index 0000000..8dac109
--- /dev/null
+++ b/test/test.js
@@ -0,0 +1,49 @@
+var githubRegistry = require('../github');
+
+testSuits('Github', '');
+if (process.env.token)
+  testSuits('Github with token auth', process.env.token);
+if (process.env.ghuser)
+  testSuits('Github with user:token auth', new Buffer(process.env.ghuser + ':' + process.env.token).toString('base64'));
+
+function testSuits(name, auth) {
+  suite(name, function() {
+    var github = new githubRegistry({
+      baseDir: '.',
+      log: true,
+      tmpDir: '.',
+      auth: auth,
+      name: 'github'
+    });
+
+    suite('locate', function() {
+      test('jspm/github', function() {
+        return github.locate('jspm/github', 'jspm/github exists');
+      });
+
+      test('6to5/6to5', function() {
+        return github.locate('6to5/6to5').then(function(result) {
+          assert(result.redirect, 'has redirect');
+          assert.equal(result.redirect, 'github:babel/babel', 'redirect points to babel/babel');
+        });
+      });
+
+      test('jspm/thisdoesnotexist', function() {
+        return github.locate('jspm/thisdoesnotexist').then(function() {
+          // todo: this should throw if using the api
+          // assert(false);
+        });
+      });
+    });
+
+    suite('lookup', function() {
+      test('jspm/github@0.13.16', function() {
+        var tag = '0.13.16';
+        var sha = '21d0a9aa00806bb7f67ef5cd98c876aa20e4d803';
+        return github.lookup('jspm/github').then(function(result) {
+          assert(result.versions[tag].hash === sha);
+        });
+      });
+    });
+  });
+}
\ No newline at end of file