How MCP connections are secured

When you connect Claude, ChatGPT, Codex, Cursor or another assistant to your labs, it gets real power: it can read files, run commands and deploy. This page explains how that connection is built so that power stays yours: scoped to your account, visible to you, and revocable at any time.

To set one up, see Connect an AI assistant or Connect ChatGPT or Claude.

The short version

Encrypted	The assistant talks to https://labs.selfmade.ninja/mcp over HTTPS only
You sign in and approve	Standard OAuth sign-in in your browser, and a consent screen naming the client
No secrets to copy	You never paste a password, token or key anywhere
Same permissions as you	Every call is checked exactly like a click in the dashboard. Never more
Nothing opened on your lab	No SSH port, no agent, no inbound connection to your lab
Every call recorded	You can see what was sent and what came back
Revocable in one click	Disconnect ends the client's access on its next call

How a request travels

A secure path to your lab, with nothing exposed

The assistant never connects to your lab directly, and your lab does not need any open port for it to work. Commands and file operations go through the platform's own control channel:

1. Checked every time. Before each command, the platform re-checks that you are allowed code access to that lab: you own it, your organization owns it, it was shared with you with code access, or you are a platform administrator. The answer is never cached, so revoking a share takes effect on the next call.
2. A one-time permission. The platform issues a permission for that exact command, in that exact lab. It is used once and expires within seconds. It cannot be replayed, and it cannot be pointed at a different lab or at the platform itself.
3. Run inside your container. The command runs inside your lab only. Choosing root means root inside that lab. It is not root on the server, and it cannot reach anyone else's lab.

Compared with giving an assistant your SSH key, this means there is no key to leak, nothing listening on your lab, and every step is permission-checked and recorded.

Signing in: OAuth with your approval

The connection uses OAuth 2.1, the same standard as "Sign in with Google", with the extra protections that standard requires for apps like these (PKCE, and tokens that are only valid for this service).

1. You add the server address to your client.

2. A browser opens and you sign in with the same account you use for Labs, through your usual sign-in provider. The client never sees your password.

3. A consent screen asks whether to allow it:

   Client name is asking to use your labs. If you allow it, it acts as you, with exactly the permissions your account already has.

   It shows Your credentials go to with the exact address the client will receive access at. Check that it is one you recognise.

4. Click Allow access or Deny.

Approve only clients you started yourself

Nobody from Selfmade Ninja will ever ask you to approve this screen. If it appears when you did not just connect a client, click Deny.

Good to know:

• Only client addresses your platform has approved can receive access, such as local desktop clients and the official connector addresses of supported AI apps.
• A client you have already approved reconnects without asking again. A new client always shows the consent screen.
• There is no personal access token or API-key alternative. Browser sign-in is the only way in. A request that tries to carry its own cookie or token is refused.

How long access lasts

Client access	Up to 7 days, then renewed automatically in the background
Your sign-in behind it	Checked on every call. If your account is disabled or your sign-in is revoked at your provider, the next call fails
After you Disconnect	The client's current access stops on its next call and cannot be renewed. It must sign in and be approved again

A connected assistant can also appear under Active sessions as an ordinary browser entry. Logging that entry out, or signing out of the dashboard, does not disconnect the assistant. Use Disconnect.

What the assistant is allowed to do

The assistant acts as you, through the same checks as the dashboard. It has no service account and no special access. What it can do is the overlap of three things:

Check	Decides
Your plan	Which tools exist for you at all
Your roles	Ownership, sharing roles, organization membership
Your limits	Running labs, storage, services, the same as in the dashboard

Tools by plan

Plan	Can
Free	Read: your labs, status, logs and stats, domains, networks, services, storage, history. Manage your devices and SSH keys. Troubleshoot certificates. Plan a build
Pro	Everything above, plus deploy, stop, pause and terminate; run commands and work with files; configure labs, domains, databases and networks; manage organizations; author and share templates
Administrator	Everything above, plus the admin tools for looking up and managing any account

Ask the assistant to run whoami to see your exact tier and how many tools it has. Tools your plan does not include are hidden, and refused if called anyway.

Acting for an organization

The assistant can work on an organization's or department's labs only if you could act as it in the dashboard. The same membership rules decide.

Built-in guard rails

Guard rail	What it does
Confirm before destroying	Deleting a template, transferring ownership and replacing routing need a typed confirmation, and most destructive tools offer a dry run first. Assistants are told to confirm with you before terminating a lab, and a terminated lab goes to Trash for 30 days
Protected paths	Deleting the root or home directory is refused, even through a link
No blind overwrites	With a workspace open, a file that changed since the assistant last read it cannot be overwritten blindly
Rate limits	Commands and file operations are limited per account, with a few running at once, so a runaway assistant cannot flood your lab
Time and size limits	Commands stop after 60 seconds by default (15 minutes at most). Output is capped at 256 KB, file reads at 128 KB, writes at 2 MB
Untrusted content is labelled	Anything written by someone else (log lines, file contents, command output, names) is marked as untrusted data, with hidden characters removed. Assistants are told to report instructions found there, not follow them
No borrowed credentials	Pasting someone's session cookie, GitLab token or access token into a request grants nothing. It is refused
Secrets kept out of errors	Credentials are removed from error messages sent back to the assistant
Assessments are off-limits	Quizzes, Code Arena, learning modules, roadmaps, discussions, clans, clubs, events, challenge-lab content, leaderboards and grading cannot be reached through MCP at all, by anyone, including administrators. See What AI assistants cannot do

Prompt injection is still possible

An assistant can be misled by text it reads, such as a web page, a file or a log. The labels above help, but do not replace your judgement. Start with read-only requests, approve changes step by step, and check the history. See a safe way to make changes.

Everything is recorded

Every tool call that does something, and every refused call, is recorded with the client, the tool, the target, and what was sent and returned. Reading your own history is not recorded.

• MCP → Activity in the dashboard shows the last 30 days. Click a call to see exactly what happened.
• Deploys and stops made through MCP also appear on the lab's own Activity timeline, marked via MCP.
• Only you can read your history in the dashboard. Other users cannot, and neither can administrators from the MCP page.
• The assistant can read it too: ask "What did you do in my labs today?" (the my_history tool).

See History and safety.

See and revoke connected clients

Account Settings → Security → MCP clients lists every client connected to your account:

• Live: used within the last 15 minutes.
• Idle: not used recently, but still able to act.
• Last used and first seen.
• Disconnect: revokes it immediately.

Tidy up

Disconnect clients you no longer use. An idle client still holds a working sign-in until you do.

Checklist for safe use

• Connect only to https://labs.selfmade.ninja/mcp (or your own platform's /mcp address).
• Approve only clients you started yourself, at an address you recognise.
• Never paste passwords, SSH or WireGuard private keys, or tokens into a chat.
• Start read-only; approve changes step by step; verify afterwards.
• Give shared users code access only when they truly need it. Their assistants get it too.
• Review MCP → Activity now and then, and Disconnect old clients.

Next steps

• Roles and permissions
• Connect an AI assistant
• History and safety