Granting and checking access
Development reference · View source
:mcp opens MCP permissions, selecting an existing granted identity when
available. An explicit :mcp codex always selects that identity. The overlay
shows the exact workspace, identity, whether access is enabled or not yet
granted, whether it is remembered, and how many readers are connected. A
connected reader identifies a local connection, not a verified agent process.
:context-access remains an alias for existing configurations.
| Key | Permission or action |
|---|---|
1 | Read: every buffer (unsaved text included), selection and pane, every terminal’s screen, history, number and title, and the agent channel |
2 | Write: edit and append to buffers, type into terminals and press Enter there; also turns on Read |
r | Remember this exact workspace’s grant |
n | Next known identity; discards unapplied choices |
x | Revoke the selected identity immediately |
Ctrl-u / Ctrl-d, Ctrl-b / Ctrl-f or PgUp / PgDn, gg / ge or Home / End | Scroll longer reviews by half or whole screens, or to the first or last line |
Tab then Enter | Select Apply permissions and apply |
Esc | Close without applying |
Both permissions start off for an identity this workspace has not decided about. Turning Read off also turns Write off. The remembered checkbox reflects the current grant when reopened. Without it, the grant lasts until the owning editor or persistent host exits. Applying a change renews the connections of agents already running under that identity, so they rediscover their targets; they do not need restarting, and the workspace keeps its address.
Granting, changing, and revoking need physical input from the active Runyte frontend, apart from the defaults in your configuration described under Default grants . Repeated input, pasted text, macros, and MCP clients cannot change access.
Write is for a job, not for good. With Write, an agent can type into every
terminal in the workspace, including shells and other agents’ prompts, and
press Enter there, which can run a command or answer another agent’s approval
dialog. Runyte makes this visible and guards the Enter (see Terminal
writes
), but it does not
second-guess what the agent decides to type. Turn Write on for the work that
needs it and off again when that is done; :mcp, 2, Tab and Enter take it
away without touching Read. Text an agent reads elsewhere is untrusted, and
could try to steer what it types.
A grant remembered by an earlier release, under the old numbered permissions, is read as Read only if it included both terminal reads and editor reads, and as a revocation otherwise, so it never grants more than it did; it is never read as Write. An earlier release cannot read a grant remembered by this one and then ignores every remembered grant in that workspace until it is applied again or revoked there.
The server works with ide-mode and mux-mode workspaces on Linux, macOS, and Windows. Detached hosts support reads and buffer edits; terminal writes and Enter need an attached native frontend.