Skip to main content
When you connect Claude Code to a project, you choose a role under “Claude operates as”. That role is the access control for the whole connection — its permissions decide which tools Claude gets and whether each one can write. Give the connection the least access that gets the work done.

​
What the role unlocks

Tool groupAvailable when the role grants…Notes
Project tasksAlways availableRead and manage this project’s tasks
Project memoryAlways availableRead and write persistent memory
Data store — readData store read accessList stores, inspect schema, run queries
Data store — writeData store write accessSchema changes and data mutations
Cross-app — readSkills execution accessCall other apps’ read (GET) endpoints
Cross-app — writeSkills execution and data store write accessCall other apps’ write endpoints
SkillsSkills execution accessDiscover Stardeck skills and SDK docs
With no role selected, Claude only gets project tasks and memory. Everything else requires a role with the matching permission.

​
The tool groups

​
Project tasks

Read and manage the project’s task list — the same persistent work items you see on the project dashboard. Claude can list tasks, create new ones, update status, and remove them.

​
Project memory

Read and write the project’s persistent memory: notes and context that survive across sessions, scoped to this project.

​
Data store

List the project’s data stores, inspect their schema, and run queries. If the role also grants write access, Claude can make schema changes and modify data.

​
Cross-app

Call endpoints on your other apps through the platform’s cross-app communication. Read endpoints are available with skills execution access; calling write endpoints additionally requires data store write access.

​
Skills

Discover Stardeck skills — focused guides for building on the platform. Claude can load design skills (UI, dashboards, i18n, and more) as content directly, and for SDK skills (auth, email, payments, data store, …) it gets a pointer to read that package’s SKILL.md from your checkout’s node_modules. Available with skills execution access.
SDK skill pointers only resolve once the @stardeck-customer-apps/* packages are installed in node_modules. Those packages come from GitHub Packages, which requires a token to install — see Installing dependencies.

​
Branches and production data

Data store writes resolve to the connection’s configured agent branch — the same branch the in-product agent uses, not necessarily a throwaway one.
Treat write access carefully. If a data store’s agent branch points at production data, a write through the gateway changes production. Prefer a least-privilege role, and only grant data store write access when you specifically need it.

​
Security model

The connection has two independent gates:
  • Who can connect — the person authorizing must be a member of the organization that owns the project. A token issued for one organization can’t reach another organization’s projects.
  • What Claude can do — the role you select. The token decides who connects; the role decides what they can do once connected.
On top of that:
  • Off by default — the gateway is disabled per project until you turn it on.
  • No stored secret — authorization happens in your browser; the .mcp.json in your repo holds only the project URL.
  • Audited — every call through the gateway is logged and tagged so it’s distinguishable from in-product agent activity.
  • Client-side prompts — Claude Code’s own permission prompts add a final confirmation before tools run on your machine.

​
Next steps

Connect Claude Code

Enable the gateway and connect your local Claude Code

Members & Roles

Create and configure the role Claude operates as

Data Stores

How your app’s data stores work

Cross-App Communication

How your apps call each other’s endpoints