Sharing & Access Control

Roles

vibe-coded.ai uses a role-based permission system with four levels:

Role	Can do
Owner	Everything. Delete the vibe, manage billing.
Admin	Everything a Writer can do. Managing access and settings stays with the Owner.
Writer	Create, edit, and delete data. Use the vibe's tools and API.
Viewer	Read-only access. Can see data but not modify it.

Each role inherits all permissions from the roles below it. Today an Admin has the same abilities as a Writer: only the Owner can share the vibe, change its settings, or manage its secrets and storage.

Working on someone else's vibe

If a vibe is shared with you, connect your Claude Code to it with vibe connect <owner>/<slug>, for example vibe connect alice/recipe-box. That creates a token for that one vibe and adds it to Claude Code (--print shows the command instead of running it). It acts with your current role: as a viewer you can read, and as a writer or admin you can change records. If the owner removes your access, the token stops working on its next call. vibe connect <owner>/<slug> --revoke removes the connection from your machine. In claude.ai or Claude Desktop, add the vibe's /mcp address as a connector and sign in with your own account.

Your CLI login works only on vibes you own. On anyone else's vibe it's refused, with a pointer to vibe connect <owner>/<slug>. Building and publishing a shared vibe stays with its owner. As the owner, you manage a collaborator through their access: change their role or remove them.

Sharing with people

To share a vibe with someone:

1. Go to your account dashboard
2. Find the vibe you want to share and click Share
3. Enter the person's email address
4. Choose a role (Viewer, Writer, or Admin)
5. Click Grant Access

The person needs a vibe-coded.ai account with that email address first. If they don't have one, sharing fails with “User not found”; ask them to sign up, then share again.

Sharing with AI clients

When an AI client connects to a private or access-controlled vibe via MCP, it authenticates through OAuth as you (or as the collaborator who signed in) and gets that account's role — the OAuth scopes shown on the consent screen don't filter tools. Public and unlisted vibes whose interaction policy is “Anyone can read; only invited people can edit” or “Anyone” also accept MCP callers with no account, who run tools read-only. Any caller allowed onto the vibe sees every tool; Viewers and anonymous callers run them read-only, while Writers, Admins and the Owner can write.

See OAuth for MCP for the full authentication flow.

Public vs private vibes

By default, vibes are private — only you and explicitly granted collaborators can access them.

Public vibes are accessible to anyone with the URL. Who can use a public or unlisted vibe's tools is set by its interaction policy, in the vibe's settings on the account page:

• “Anyone can read; only invited people can edit” (public_read): anyone can open the vibe and call every tool read-only, on the page and over MCP, with no account. Writes are refused and secrets stay hidden. The owner and people you invite as writer or admin can edit. Use it for reference servers, catalogues and lookups.
• “Anyone” (public): anyone can call every tool on the vibe's page with write access, signed in or not. Over MCP, callers without an account are read-only. Use it only for things strangers should add to, like a guestbook, and keep update and delete tools out of it.
• “Signed-in users” (authenticated) and “Invite only” (invite_only, the default for new vibes): visitors have to sign in, and invite only admits just the people you invite.

Read-only mode blocks storage writes, but a tool that sends email or calls a webhook still runs, so guard those tools yourself. If you switch an older vibe to “Anyone can read; only invited people can edit”, run vibe preview and vibe publish once so the rebuilt vibe enforces it.

Shared vibe passwords are no longer supported. To limit a vibe to specific people, keep it private, use the invite_only interaction policy, and grant each collaborator access.

Managing collaborators

From the Share dialog on your account dashboard, you can:

• View all collaborators and their current roles
• Revoke access by clicking the remove button next to a collaborator

Revoking access takes effect immediately. The person will lose access to the vibe's data and tools on their next request.