Sign-in, permissions and disconnecting
How an MCP client signs in to iyedy, the three permissions you approve, what the client can then reach, and how to take the access back.
On this page
An MCP client never gets your password. Claude, ChatGPT and the coding assistants (Codex, VS Code with GitHub Copilot, Zed, Cursor, Gemini CLI) sign in through iyedy's own sign-in service with OAuth; other clients use a personal access token you create for them. Either way, the client acts as you, with the permissions you approved, and you can take the access back.
How Claude, ChatGPT and the coding assistants sign in
When Claude, ChatGPT or a coding assistant connects for the first time, your browser opens iyedy's sign-in page on auth.iyedy.com. You sign in as you do in the app (e-mail and password, Google, or your organisation's single sign-on), then an access page says which app wants to use your iyedy account and lists what it will be able to do. Allow sends you back to the app; Deny ends there.
The sign-in uses OAuth 2.0 with PKCE. iyedy knows two Claude apps, Claude (claude.ai, Claude Desktop, the mobile apps) and Claude Code, and ChatGPT. For ChatGPT, the access page also names the application, ChatGPT, and its site, chatgpt.com. iyedy also knows five coding assistants: Codex, VS Code with GitHub Copilot, Zed, Cursor and Gemini CLI (Connect a coding assistant). For Codex, VS Code and Zed, the access page names the application and its site (chatgpt.com, vscode.dev, zed.dev); Cursor and Gemini CLI use iyedy's client IDs cursor and gemini-cli. iyedy refuses clients that register themselves on the fly, which is why other MCP clients use a token instead.
The three permissions
| On the access page | Scope | What it opens |
|---|---|---|
| Read your iyedy diagrams: models, views, versions and findings | cartouche.read |
the reading tools and the checks |
| Search elements and analyse impact across your iyedy diagrams | cartouche.graph |
search across diagrams and impact analysis |
| Preview changes and submit proposals that a person reviews in iyedy | cartouche.propose |
previews, proposals and their withdrawal |
ChatGPT also asks to see your e-mail address and to keep access while you are away (offline access), so that it renews its access without asking you again. Codex, VS Code, Cursor and Gemini CLI also ask to keep access while you are away; Zed does not, and asks you to sign in again when your iyedy session ends. None of these permissions lets a client edit, delete or share a diagram. A client that calls a tool without its permission is asked to connect again and approve it. Over MCP, the scope that writes diagrams through the API, cartouche.write, is never honoured.
What the client reaches
- Your account, nothing more. The same workspaces, diagrams and roles as you. A diagram you cannot open is “not found” for the client too.
- Under the ceiling. Confidential on a personal workspace, Internal in Team and Enterprise. A diagram above it is never listed, found by a search or reached by an impact analysis. Restricted diagrams are never sent.
- Without secrets. Values that look like secrets are replaced before they leave iyedy.
- Under the organisation's policy. In Team and Enterprise, MCP is off until support turns it on, the organisation may allow only some clients, and enforced single sign-on applies to members.
What Claude or ChatGPT does with what it reads is covered by your Claude or ChatGPT account's terms. iyedy does not use your diagrams to train AI models.
How long access lasts
Each access token lives 5 minutes for claude.ai, Claude Desktop and the mobile apps, and 15 minutes for Claude Code added with --client-id claude-code; among the coding assistants, 5 minutes for VS Code and Zed, and 15 minutes for Codex, Cursor and Gemini CLI; the client renews it in the background, and each renewal replaces the previous one. For clients that keep access while you are away, the connection stays alive as long as it is used at least once every 30 days. After that, the client asks you to sign in again. Zed follows your iyedy session instead: about 30 minutes without use, 12 hours at most, longer if you ticked Remember me.
A personal access token lives as long as you chose when it was made, from 1 to 365 days.
What iyedy records
In an organisation, every tool call that reads or proposes is recorded in the organisation's audit log, with the tool, the client, the permissions and the result; so is a call the policy refuses, with the reason. Diagram text and tokens are never recorded. Listing your own workspaces is not recorded.
Take the access back
- In the client. Disconnect iyedy in the client's connector settings; in ChatGPT, under Settings, then Plugins; for a coding assistant, see the Disconnect section of its guide (Connect a coding assistant). In Claude Code:
$ claude mcp logout iyedy- On iyedy's side. There is no screen for this yet: write to support@iyedy.com. Support removes the client's access, which also ends its renewals; an access token already issued stays valid for the rest of its lifetime (5 or 15 minutes).
- For a personal access token, revoke the token: see Create and manage API tokens. It stops working on the next request.
What this means for you
Approve the access only when you started the sign-in yourself, from the client you expect, on auth.iyedy.com. Give a token only the scopes its job needs. And if you lose a device or suspect a client, disconnect it in the client and write to support.
Was this page helpful?Your answer is anonymous and counts only if you accepted measurement.
What went wrong?
Don't write personal data.