> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stardeck.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Tools & Permissions
> What Claude can do through the gateway, and how your org role's permissions control it.
When you connect Claude Code to a project, the gateway uses **your** permissions on that project — the same access the in-product project agent has for you. There is no separate gateway role to pick. Which tools appear follows your org role (or the org's project agent-profile default). See [Members & Roles](/members-and-roles).
## What your permissions unlock
| Tool group | Requires on your role… | Notes |
| ----------------------------------- | ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------- |
| **Project tasks** | Always available | Read and manage this project's tasks |
| **Project memory** | Always available | Read and write persistent memory |
| **Data store** | Data store read access | Read *and* write tools (list, query, schema, mutations, create branches). Writes target the connection's configured agent branch. |
| **Cross-app** | Skills execution access | Call other apps' GET and non-GET endpoints (full access when registered) |
| **Blueprint updates** | Repo access | Check for and record Blueprint updates for this app |
| **Skills** | Skills execution access | Discover Stardeck skills and SDK docs |
| **App roles & permissions — read** | App roles & permissions read access | Inspect deployment permissions, roles, org-member access policy, and org-role grants |
| **App roles & permissions — write** | App roles & permissions write access | Configure deployment auth and project-specific org-role grants |
Project tasks and memory are always available. Everything else follows the matching permission on your role.
## The tool groups
### Project tasks
Read and manage the project's task list — the same persistent work items you see on the project dashboard. Claude can list tasks, create new ones, update status, and remove them.
### Project memory
Read and write the project's persistent memory: notes and context that survive across sessions, scoped to this project.
### Data store
List the project's data stores, inspect their schema, run queries, and **generate TypeScript types** from a store's live schema so the types in your checkout match the real database.
With data store read access, Claude also gets **write** tools over the gateway — the same as the in-product project agent: schema changes, data mutations, and **creating a data-store branch** (an independent copy of the store's tables and rows; see [Branches and environment routing](/data-stores/connecting#branches-and-environment-routing)) to experiment without touching another branch's data. Writes still target the connection's configured agent branch.
### Cross-app
Call endpoints on your other apps through the platform's [cross-app communication](/cross-app/overview). With skills execution access, the project gateway exposes both GET and non-GET calls — data store write access is not an additional requirement.
This differs from the [org-level AI Integrations gateway](/ai-integrations/tools), where OAuth read vs read & write scope controls GET vs non-GET.
### Blueprint updates
When your role grants **repo access**, Claude can check whether this Blueprint-derived app has a newer published version (`get_blueprint_update`) and record a completed merge (`complete_blueprint_update`). The tools prepare an exact fetch ref, walk through a local git merge, and verify the result on the server before updating the baseline. See [Update from a Blueprint](/local-claude-code/blueprint-updates) for the end-to-end workflow.
### Skills
Discover Stardeck **skills** — focused guides for building on the platform. Claude can load design skills (UI, dashboards, i18n, and more) as content directly, and for SDK skills (auth, email, payments, data store, …) it gets a pointer to read that package's `SKILL.md` from your checkout's `node_modules`. Available with skills execution access.
### App roles & permissions
Read and configure an app's full roles and permissions model: deployment permissions, deployment roles, role-permission assignments, default sign-up role, organization-member access policy, and which deployment permissions each organization role holds for this app. Read access requires the app roles & permissions read permission; writes additionally require the write permission.
SDK skill pointers only resolve once the `@stardeck-customer-apps/*` packages are installed in
`node_modules`. Those packages come from GitHub Packages, which requires a token to install — see
[Installing dependencies](/local-claude-code/connect#installing-dependencies).
## Branches and production data
Data store writes resolve to the connection's configured agent branch — the same branch the in-product agent uses, not necessarily a throwaway one.
Treat write access carefully. If a data store's agent branch points at production data, a write
through the gateway changes production. Prefer a least-privilege role, and only connect when you
specifically need data store access.
## Security model
The connection has two independent gates:
* **Who can connect** — the person authorizing must be a member of the organization that owns the project. A token issued for one organization can't reach another organization's projects.
* **What Claude can do** — *your* permissions on the project (same resolution as the project agent). The token decides who connects; your role decides what they can do once connected.
On top of that:
* **Off by default** — the gateway is disabled per project until you turn it on.
* **No stored secret** — authorization happens in your browser; the `.mcp.json` in your repo holds only the project URL.
* **Audited** — every call through the gateway is logged and tagged so it's distinguishable from in-product agent activity.
* **Client-side prompts** — Claude Code's own permission prompts add a final confirmation before tools run on your machine.
## Next steps
Enable the gateway and connect your local Claude Code
Create and configure the roles that control your access
How your app's data stores work
How your apps call each other's endpoints