Peractor in your chat apps
Drive Peractor from Claude, ChatGPT, Codex, or Claude Code — doing only what you allow, and never more than you can.
People who work with coding agents already live in a chat window. Peractor plugs into all of them: say "run the Linear task about the login bug through the review workflow" in your own chat, and it happens.
Peractor is a remote MCP server, the open protocol those apps speak, so anything that speaks MCP can connect. Claude, ChatGPT, Codex, and Claude Code are simply the ones people use.
Connect one
In Claude Code, one command registers Peractor (self-hosting? use your own address):
claude mcp add --transport http peractor https://peractor.com/mcpIn Claude, ChatGPT, or Codex, add a connector or MCP server pointing at the same address. The first use opens your browser: sign in to Peractor, pick the organization the chat should act on, and approve. If you belong to several organizations, connect once per organization.
Read the domain on the consent screen. A
connecting app reports its own name and logo, and those can be faked. The
domain is the one thing it cannot fake. Approve
claude.ai or chatgpt.com, not a
look-alike.
What you let it do
The consent screen asks what the app may do. It starts on Do work; pick another of the three presets, or choose each permission under Advanced:
| Preset | Lets the chat |
|---|---|
| Read only | See your projects, their files, runs and tasks, and the audit log, as far as you can — and change nothing. |
| Do work | Everything Read only does, and start runs, write tasks and plans, edit files and make branches, without managing anything. With it the chat can also answer your runs' mid-run questions, cancel or restart your own runs, approve or send back a gate whose rules name you, and propose a memory entry. |
| Everything I can do | Everything you can do in the organization, managing it included. |
Advanced lists every permission on the same shelves as the role editor, so you can tick exactly the ones an app needs — Do work plus Manage workflows, say, to let it change workflows too. Chat is in no preset but Everything I can do: an app reads or writes your conversations only with Chat through apps ticked, and beside Read only it only reads them.
Whatever you tick, the chat acts as you, and does only what you can do yourself at the time of each call. Ticking a permission you don't hold gives it nothing, and when you lose one, every app you connected loses it too. A Read only connection changes nothing at all — not even your own notifications or dashboards — whatever a task description tells the model to do. An app sees only the tools its permissions let it use.
A project you can't see isn't there for the chat either: asking for it, or for anything in it, comes back as not found, as if it didn't exist. So does a folder or file closed to you, and a change it would make there is refused. A run that worked with one is only its row to the chat: it can't read what the run did, or answer or approve it. Starting a run, the chat can include the restricted folders you can open. See Private projects & access.
Configuration changes are shown before they land
Starting a run appears in the chat as a tool call you confirm, and you can cancel the run if you change your mind. Configuration is stricter. Changing a workflow, an instruction, a trigger or another setting takes the permission it takes in the app — Manage workflows for a workflow, Manage automations for a trigger — so the app needs Everything I can do, or that permission ticked under Advanced. The change is staged into a plan, the chat shows you the actual file diff rather than a summary of it, and only "yes, apply it" applies exactly the plan you read. If anything changed after you looked, the apply refuses and you review again.
Manage and revoke
Settings → Connected apps — on the web and in the desktop app — lists every chat you have connected: which app, what it may do (Read only, Do work, Everything I can do, or Custom for a choice made under Advanced), and when it was last used. Disconnect cuts it off immediately, and the next use starts a fresh consent — which is also how you change what an app may do. Connections refresh themselves while in use and expire on their own after 90 days unused.
Chat apps and API keys are different things. A connected chat acts as a person — only what they ticked, and never more than they may do — granted per organization through a browser consent. An API key is a service credential for systems — CI, Zapier, your own backend — with permissions of its own, chosen by someone with Manage API keys, and tied to nobody's sign-in. Automations get keys; humans in chats get this.