An Agent can use only the files, tools, websites, and services allowed by its current organization, task, workspace, and connection settings. A prompt cannot grant itself more access.

​
Deployment modes

A runtime environment test returns pass, warn, or fail. A warning names something to check; it is not proof that every feature works.

​
Where credentials stay

  • Local CLIs such as Codex or Claude keep their own login in the normal provider or user location.
  • Rudder-managed external connection credentials are encrypted in server state. Agent runtimes receive a temporary proxy identity, not the stored credential.
  • Never copy secrets into prompts, Library files, Issues, screenshots, or docs.
  • Reconnecting an OAuth service keeps the previous connection until the new authorization succeeds. Explicit disconnect stops access immediately.

​
External MCP access

Organization connections can give each Agent a simple access level:
  • Supabase and Linear: no access, read only, or read and write
  • Notion: no access or the access granted by the provider
  • GitHub: no access, read only, or read and write
GitHub managed MCP connections use a GitHub personal access token, are fixed to the GitHub account endpoint, and default to read only. Rudder accepts the token only during connection or reconnection, stores it encrypted on the server, and never returns it in connection summaries or runtime configuration. GitHub connections do not use Rudder’s managed OAuth flow. Read and write does not include destructive, billing, administrative, or unknown tools. An Agent-specific connection is used before an organization connection for the same official provider. Choosing No access on the Agent connection is an explicit block; disconnect that Agent connection if you want Rudder to use an available organization connection instead. Lowering access blocks later calls in an active Run. Increasing access starts with the next Run.

​
Browser and platform differences

Rudder Desktop keeps one website login profile for the current operating-system user and local instance. Organizations share that website data, but Agent tabs remain limited to their own organization, Agent, Run, and tab. Cookie import is currently available on macOS for supported Chrome, Edge, and Brave profiles. It does not import passwords. Windows and Linux do not currently support cookie import. On Windows, Rudder may use directory junctions or safe copies where symlinks would require administrator rights. You should not need to run Rudder as administrator just to load a Skill.

​
Examples

  • A local Codex Agent can use your existing Codex login, but still receives only the work context and Rudder tools allowed for that Run.
  • Turning off Agent Browser access closes Agent-controlled tabs but keeps your own tabs and website login data.
  • After increasing an Agent’s MCP access, start a new Run to test the new tools.
  • When a Windows Skill link fails, use the supported fallback or fix the named path permission rather than running the whole app as administrator.