Claude Code

Deploy what Claude Code builds, behind sign-in

Updated 17 October 2026

Install the jiayang CLI, add it to Claude Code as an MCP server or plugin, and ask Claude to deploy the project. The app goes live at its own address that only the people you share it with can open, and everything Claude did is in the audit log under your name.

Set it up

First install the CLI and sign in:

jiayang login

Then add the server to Claude Code:

claude mcp add --transport stdio jiayang-cloud -- jiayang mcp

Add --scope project to write it to the project's .mcp.json, for everyone who works on it.

Or install the plugin, which adds the same server and skills that tell Claude how to deploy, share, import an app, schedule jobs, put up previews and more. In a session:

/plugin marketplace add ss2d22/jiayang
/plugin install jiayang-cloud@jiayang-cloud

Use the plugin or the server, not both. The plugin is open source, and it still needs the CLI installed and signed in.

Ask Claude to ship it

Ask in your own words. Each of these maps to a tool the server gives Claude:

When the deploy is done, Claude gets the directory that went up and the address:

Created and deployed acme/hello version 1 from /Users/you/code/hello. It's live at https://hello--acme.jiayang-apps.cloud, for the people it's shared with.

A container's build can take several minutes. deploy_app answers within 45 seconds, and if the deploy is still going, Claude follows it with deploy_status until the app is live or says why it failed. You don't need to change a timeout.

What Claude can do, and what only you can do

Claude works as whoever the CLI is signed in as. It has your permissions and no credential of its own. It can deploy, roll back, share, store secrets, add schedules, and read logs and the audit log. Some things always take a person:

• Opening an app to the internet. A public path is added by a person in the dashboard.
• Adding someone to the workspace.
• Signing in. Claude is told to ask you to run jiayang login, and never to run it itself.
• Agreeing to the terms, paying or changing the plan.
• Reading a secret. A stored value is never returned to anyone.
• Changing who signs in, such as single sign-on or SCIM.

Every tool that changes something is marked that way, so if Claude Code asks before it runs one, it asks you. A deploy runs your project's build on your computer, as you, so only let Claude deploy a directory you would build yourself. The agent guide lists every tool.

Who can open it

Only the people you share it with. Share it with any email address, everyone at your company's domain, or a group. Viewers sign in with a code sent to their address, or with Google or Microsoft, and don't need an account first. Remove someone and they lose access within 60 seconds, open connections included. See Share an app.

How the app knows who's calling

Every request reaches your app through our edge, which adds a signed token saying who is calling. The token lasts 60 seconds and is made out to your app. Our SDKs for Node, Python, Go and Rust check it in one call:

import { requireUser } from "@jiayang-cloud/sdk";

const user = await requireUser(request, env);

When Claude connects, the server tells it to check callers this way, and never to trust X-Jiayang-Email or any other header.

Deploy an MCP server, then connect Claude Code to it

An MCP server you deploy here sits behind the same sign-in. Turn on AI clients for the app, then add it to Claude Code with the app's address:

jiayang app mcp acme/tools on
claude mcp add --transport http tools https://tools--acme.jiayang-apps.cloud/mcp

The first call opens a browser where you sign in and approve Claude Code. From then on it reaches that one app as you, with your role there, and nothing else. See MCP servers behind sign-in.

Questions

Next

• Use with Claude Code, Codex and Cursor, in the docs
• The same for Codex and Cursor
• How we differ from other ways to keep an app private
• Pricing