Security & Permissions

# Security & Permissions

OAuth authorization

Claude Connect uses SPECTRALE’s MCP OAuth Authorization Server (Auth Code + PKCE). Humans authenticate with SPECTRALE; Claude receives MCP-bound tokens scoped to authorized projects and tools.

Claude Connect vs Directory read-only

• Claude Connectors Directory read-only profile remains unchanged: hosted Claude Directory connections stay inspection-only.
• Claude Connect profile is a separate staging product grant (product=claude_connect) that permits controlled discovery/version creation while still forbidding infrastructure Deploy and Interact.

Discovery creates persistent SPECTRALE records. Those tools are annotated as not readOnlyHint: true.

Source access

• Private GitHub repositories require explicit authorization in SPECTRALE.
• Provider credentials never appear in MCP tool responses.
• Cross-organization access is denied.

Isolation

Limits are enforced at the SPECTRALE organization / billing-account level. Multiple Claude connections share the same Claude Connect allowance. Creating additional agents cannot bypass Free or Pro quotas.

Revocation

Revoke Agent Gateway connections or MCP credentials in SPECTRALE to stop further Claude Connect access. Historical architecture versions remain owned by the organization according to retention policy.