Skip to main content

​
Your account

Sign-in is GitHub only. There is no password to set, forget or leak, and no anonymous tunnels — which is deliberate: it’s the abuse stance, and it fits who this is for. Signing in for the first time creates your account and mints your reserved slug.

​
Signing the CLI in

An RFC 8628 device flow — the same pattern gh auth login uses. The CLI prints a code, your browser opens to approve it, and the CLI receives a token. See heymcp login.

​
Your CLI token

​
Rolling it

From your profile page. Rolling revokes every existing token immediately and issues one new one, so:
  • Any machine or CI job using the old token needs the new one.
  • Every open tunnel dies. You’ll need to re-run heymcp share.
Do this if a token has ever appeared in a build log, a screen share, or a committed file.

​
Revoking it on one machine

Revokes server-side and deletes locally. Deleting the config file by hand only does the second half.

​
Notification preferences

Two toggles on your profile, under Email me when:
  • A tool call fails — on by default
  • A new client connects — off by default
These record your preference; email delivery is not switched on yet, so changing them has no visible effect today.

​
Privacy

A session belongs to exactly one account. There is no team model, so nobody else can subscribe to your timeline or read your events. What HeyMCP stores, and for how long, is covered in What is exposed.