Security and privacy

A connected AI app works on your Chartnaut account as you, with the permissions you approved and nothing more. This page covers what it can see, what it never sees, and how the connection is protected from someone else using it.

What the app sees

Everything a tool returns goes into your conversation with that app, and is kept by Claude, ChatGPT, Cursor or Codex under their own terms, like anything you paste into a chat. With the permissions you approve, that can be:

• Your own scripts, with their source when the app asks for it.

• What your runs produced: an indicator's values, a definition's events, a study's results, a run's console lines and errors.

• The events your definitions have stored from running over history.

• The library: names, descriptions and settings of scripts you can run, including other people's public ones.

• Your username, plan, usage against each cap, and the connection's own name, permissions and expiry.

• The scripting reference and the list of instruments with the dates your plan reaches.

What it never sees

• Your password or your Chartnaut session. You sign in on Chartnaut's own page. The app receives a token that works on the API only.

• Other people's source. Community scripts can be described and run, never read.

• Market data. No tool returns candles or tape, only what a script produced from them.

• The rest of your account. There is no tool for your trades, broker accounts, journal, playbooks, charts, drawings or billing, and no API endpoint for them either.

• Your API keys. No tool lists or returns a key.

What it can change

Three tools change your account, and nothing else can:

No tool deletes a script, a version or events. A save never overwrites a change made elsewhere: it names the version it started from and is refused with version_conflict if the script moved on. Tools that change nothing carry MCP's read-only mark, so an app can run them without asking you, and these three carry none.

Text from other people

Other people write the names, descriptions, tags and categories of their public scripts, and a model reading them could be steered by instructions hidden inside. So Chartnaut never hands that text over as it is. It comes back inside a field called untrusted_author_text, with a note telling the model it was written by another user and is data, never instructions. The server's own instructions to every app say the same. Your own scripts and Chartnaut's built-ins are returned as they are.

Output limits

A tool result is at most 40 KB of text, so one answer cannot flood the model's context. Lists come in pages, long results shrink their page size to fit and say so, and anything else over 40 KB is cut with a note saying what was cut. Source code is never cut: a script too large to return comes back without code, so a model cannot save over it from a partial copy. Output limits

The sign-in

• You approve on Chartnaut's page. The consent page shows the app's name and the address the approval returns to. The name is whatever the app registered, so check the address: it is where access to your account goes. The consent page

• Return addresses are restricted. An app can register an https address, http on your own computer (localhost or a loopback address, any port), or its own app link, such as cursor://. Links that would run or read something in the browser, such as javascript:, data: and file:, are refused.

• A request is short-lived. It lasts 10 minutes and can be answered once. The code it produces lasts 60 seconds and works once.

• The code is useless on its own. Every sign-in uses PKCE: the app keeps a secret it never sends through the browser, and the code only works with it. Chartnaut checks that secret before it uses the code up, so someone who intercepts a code cannot spend it and lock the real app out.

• A replayed code ends everything it issued. If a code is used a second time, the tokens from its first use are revoked.

• Guessing is throttled. Registering an app is limited to 20 an hour per IP address, starting a sign-in and getting tokens to 60 a minute, and 30 failed token checks in a minute block that IP address for a minute.

Tokens and replay

The app holds two tokens. The access token works for 1 hour. The refresh token gets a new pair and lasts 30 days, restarted at every refresh, so a connection you use stays signed in and one you leave for 30 days lapses.

Each refresh token works once. The moment the app swaps it, it ends, and the app has to store the new one. If the old one comes back more than 30 seconds later, either the app or someone who copied it is using a stale copy, and there is no telling which. Chartnaut ends the whole connection, every token it issued stops working, and you have to click Allow again. Within those 30 seconds a repeat gets another fresh pair, because an app refreshing from two windows at once, or retrying after a timeout, does exactly that.

Chartnaut stores codes and tokens only as SHA-256 hashes, so its database holds nothing an attacker could present as a token.

Where requests can come from

A web page you visit cannot use your connection. The MCP server refuses any request a browser sends from a site other than claude.ai, chatgpt.com, Chartnaut's own sites, or localhost for local tools such as the MCP Inspector, with 403 forbidden. That also stops DNS rebinding, where a hostile page reaches a server under a borrowed name: the browser still says which site the request came from. Requests with no browser origin, from desktop apps, servers and scripts, are accepted, and they still need a valid token.

Your plan

Connecting needs Starter or above. If your plan moves to Free, your connections stay, but every call is refused with plan_limit until you upgrade, and they work again within a minute of upgrading without connecting again. You can still see and disconnect them on Free.

What Chartnaut keeps, and how to remove it

Disconnect ends the connection and every token it issued at once; the app's next call gets 401. An app connected with an API key is cut off by revoking the key under API keys on the same page. Disconnect an app