# Letting a coding agent deploy safely AI agent deploy safely with one scoped token. Claude Code deploy permissions, Codex deploy permissions, and MCP server API token scope. Canonical URL: https://unbroker.cloud/blog/coding-agent-deploy-safely Published: 2026-10-27 Reviewed: 2026-10-27 Author: Unbroker ## The short answer The risk is the credential, not the agent. A read token for one organization can inspect the project. It cannot create or change anything until you issue a broader token. AI agent deploy safely means that token, a named organization, project, and service, and a deployment that reaches a terminal state. Unbroker is the example. The same split applies when you deploy Claude Code, [Codex](https://unbroker.cloud/deploy/codex), or [Cursor](https://unbroker.cloud/deploy/cursor). The Claude Code page is [Deploy with Claude Code](https://unbroker.cloud/deploy/claude-code). ## What a coding agent actually does when it deploys It runs `ubctl`, the same CLI you would run in a terminal. It does not host the application. Claude Code deploy permissions and Codex deploy permissions are the token scope plus your role in that organization. Installing `ubctl-ops` does not create an account, issue a token, or deploy on its own. [Install the skill](https://docs.unbroker.cloud/guides/install-agent-skill) after `ubctl login`, then read [coding agents](https://unbroker.cloud/agents). Claude Code uses `/ubctl-ops`. Codex uses `$ubctl-ops`. ## Start read-only Start with a read token and a task that only lists projects. A read token is enough to inspect. It cannot create or change resources. The install guide's first prompt asks for the active organization and its projects, and says not to create or modify anything. Check that `ubctl whoami` names that organization. On MCP, a read token can connect and list tools, and a write call returns a read-only error. The [MCP server API token scope](https://docs.unbroker.cloud/integrations/mcp) is that same read or read/write scope. ## One token per agent, per organization Each API token belongs to exactly one organization, the organization selected in Cloud when the token is created. A token for one organization cannot access another. Create a separate token for each agent, in that organization, so you can revoke one client without touching the others. Cloud shows the secret once. `ubctl login` stores it locally with owner-only file permissions. Do not use `ubctl login --token` on a shared computer: the value can remain in shell history. For Codex MCP, the config stores the environment variable name, not the token value. Owners and admins enable MCP per organization in Settings, then Integrations, at `https://api.unbroker.cloud/mcp`. See the [MCP docs](https://docs.unbroker.cloud/integrations/mcp) and the [MCP changelog](https://unbroker.cloud/changelog/2026-10-15-mcp-and-live-dashboard). ## Keep secrets out of the conversation Put secret values in Cloud. Tell the agent which keys the service needs, and do not paste the values into chat, a repository, a screenshot, or an issue. MCP service inspection never returns credentials or environment variable values. Each variable has a scope of All, Production, or Preview, and a scoped value overrides All for that environment. A preview can point at a test key without reading the production value. That behavior is in [environment-scoped variables](https://unbroker.cloud/changelog/2026-10-06-environment-scoped-variables). ## Guardrails before a production change Name the organization, the project, and the service, and wait until the deployment finishes. A queued deployment is not a completed release. Coding agent production access comes after the read-only pass. Pull request previews require Pro, and closing the pull request removes that preview. Say whether the agent may create resources. Creating a service does not deploy it, and creating resources or running a service can incur charges. The documented wait is `ubctl apps deploy --wait`, which returns a failure exit code when the deployment fails. The prompt is in [Deploy an application with Claude Code](https://docs.unbroker.cloud/guides/deploy-with-claude-code). [NIST describes least privilege](https://csrc.nist.gov/glossary/term/least_privilege/) as restricting access to the minimum necessary for the task. ## When the deploy goes wrong Read the deployment log and the runtime logs, and correct that cause before you retry. A rollback is another deployment, and it does not run the pre-deploy command again. `ubctl apps rollback` promotes a previous deployment. It shows progress and logs, it can be cancelled, and it appears in history. It does not rebuild the commit, and it does not restore a database or a volume. Because pre-deploy is skipped, keep migrations backward compatible. The CLI also exposes service metrics. A manual one-off command or job run records who launched it and which service it belongs to. The command text stays on that run, not in the organization-wide activity feed. See [audited commands](https://unbroker.cloud/changelog/2026-10-08-audited-commands). ## Checklist before the agent deploys Finish this list before the token can change production. The list is the guardrail. It does not replace the deployment log. 1. Create the token while the right organization is selected in Cloud. 2. Use read scope until `ubctl whoami` and the project list match. 3. Issue one token for this agent, and a different token for every other organization. 4. Keep the secret out of the prompt, the repository, and shell history. 5. Name the organization, project, and service in the task. 6. Enter secret values in Cloud. Give the agent key names only. 7. Wait for a terminal state. Do not treat queued as live. 8. Use a Pro pull request preview, with Preview-scoped variables, before production. 9. If you roll back, expect a deployment that skips pre-deploy. Keep migrations backward compatible. ## FAQ ### Is it safe to let Claude Code or Codex deploy my app? It is safe only to the limit of the token you gave that agent. A read token can list and inspect. A read/write token can create and change resources, and those changes can incur charges. Start with the [read-only install task](https://docs.unbroker.cloud/guides/install-agent-skill). ### What permissions does a coding agent need? Inspection needs a read token. Creating, deploying, or changing a resource needs read/write scope and the organization permissions for that action. The skill does not add permissions of its own. [API tokens](https://docs.unbroker.cloud/cli/get-started) belong to one organization. ### Should I give my AI agent a production API token? Not for the first task. Use a read token, confirm the organization with ubctl whoami, and use a preview before production. Coding agent production access can wait until the target project and service are named. ### How do I stop an AI agent from seeing my secrets? Enter secret values in Cloud and give the agent the key names only. Do not paste tokens or variable values into the chat, the repo, or a screenshot. MCP service inspection does not return credentials or environment variable values. ### Can I revoke an agent's access without breaking other integrations? Yes, if that agent has its own token. Revoke that token in API Tokens. Other tokens keep working, and disabling MCP for the organization blocks MCP without revoking tokens or REST access. ### What if the deploy fails, can I roll back? Yes. ubctl apps rollback promotes a previous deployment. It is a real deployment, with progress and logs, and it does not run the pre-deploy command again. It does not rebuild the commit, and it does not restore a database or a volume. ### Does Claude Code host my app? No. Claude Code runs ubctl. Hosting, the build, and the public URL are Unbroker Cloud Apps. The same is true for Codex and for Cursor when they call the same API. ## Related reading - [Deploy with Claude Code](https://unbroker.cloud/deploy/claude-code) - [Deploy with Codex](https://unbroker.cloud/deploy/codex) - [Deploy an app built with Cursor](https://unbroker.cloud/deploy/cursor) - [Coding agents](https://unbroker.cloud/agents) - [MCP server changelog](https://unbroker.cloud/changelog/2026-10-15-mcp-and-live-dashboard)