INTEGRATIONS

Security and privacy

MCP access is bound to an OAuth client, user, scopes and resource audience. Opening a preview does not publish a private project.

Check /mcp for this deployment's connection status. Widget and download capabilities depend on the client; authenticated ChatGPT host acceptance is still pending.

Consent and token safety

The authorization flow uses PKCE and exact registered redirects. Approve only scopes you understand; never share bearer tokens, client secrets or private project links in prompts.

Disconnect

Manage connected apps from Settings. Revoking a connection blocks its tokens but does not delete your projects or your website login session.

Manage connected apps

Destructive changes

Deletion requires explicit confirmation in the client. Scene writes remain subject to owner checks, current plan, revision and request-key validation. Billing actions are outside the MCP tool set.