@muxoai/platform 1.2.2 → 1.2.3

package/.agents/plugins/marketplace.json

@@ -0,0 +1,22 @@
+{
+  "name": "muxo",
+  "interface": {
+    "displayName": "Muxo Plugins"
+  },
+  "plugins": [
+    {
+      "name": "muxo",
+      "version": "1.2.3",
+      "description": "Governed execution across 1,000+ Connected Apps, Instant Tools (search, scrape, crawl, SEO audit), Cloud Infrastructure provisioning, Supermemory v5 recall, and Microsoft Agent Governance Ed25519 receipts.",
+      "source": {
+        "source": "local",
+        "path": "./plugins/muxo"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_USE"
+      },
+      "category": "Productivity"
+    }
+  ]
+}

package/.claude-plugin/marketplace.json

@@ -0,0 +1,17 @@
+{
+  "name": "muxo",
+  "owner": {
+    "name": "Muxo",
+    "email": "founders@muxo.ai",
+    "url": "https://muxo.ai"
+  },
+  "plugins": [
+    {
+      "name": "muxo",
+      "source": "./plugins/muxo",
+      "description": "Governed execution across 1,000+ Connected Apps, Instant Tools (search, scrape, crawl, SEO audit), Cloud Infrastructure provisioning, Supermemory v5 recall, and Microsoft Agent Governance Ed25519 receipts.",
+      "version": "1.2.3",
+      "category": "Productivity"
+    }
+  ]
+}

package/.codex/config.toml

@@ -0,0 +1,5 @@
+# OpenAI Codex Local Plugin Configuration for Muxo
+# Reference: https://developers.openai.com/plugins/build/plugins
+
+[plugins."muxo@muxo"]
+enabled = true

package/README.md

@@ -1,54 +1,74 @@
-# Muxo (`@muxoai/platform`)
+# Muxo (`@muxoai/platform` / `@muxoai/cli` / `@muxoai/sdk`)
 
-Muxo is a unified execution, cloud infrastructure provisioning, contextual memory, and cryptographic governance platform for AI agents and applications. Customers and their agents interact exclusively with **Muxo** — never with underlying tool or cloud infrastructure providers directly.
+Muxo (`v1.2.3`) is the unified execution, cloud infrastructure provisioning, contextual memory, and cryptographic governance platform for AI agents and applications. Customers and their agents interact exclusively with **Muxo** — never with underlying tool or cloud infrastructure providers directly.
 
-See [`ARCHITECTURE.md`](./ARCHITECTURE.md) for the complete internal engineering blueprint, open-source ecosystem Keep/Adopt/Drop matrix, and root-cause analysis of how `muxo3` resolves `muxo2`'s Cloudflare isolate/container failure modes.
+See [`ARCHITECTURE.md`](./ARCHITECTURE.md) for the complete internal engineering blueprint, open-source ecosystem Keep/Adopt/Drop matrix, and 4-pillar architecture.
 
-Under the hood, Muxo unifies **four core pillars** behind one 18-operation MCP contract, REST API, CLI, and Web Console:
+Under the hood, Muxo unifies **four core pillars** behind one **19-operation MCP contract**, OpenAI Plugin (`agent-plugins.org/1.0.0`), REST API, CLI (`@muxoai/cli`), TypeScript SDK (`@muxoai/sdk`), and Web Console (`https://app.muxo.ai`):
 
-1. **Composio Connected Apps (`app.*`) & Instant (`instant.*`)** — Managed OAuth SaaS integrations (`app.github.*`, `app.gmail.*`, `app.slack.*`, `app.notion.*`, `app.linear.*`), zero-OAuth instant capabilities (`instant.web.search`, `instant.web.scrape`, `instant.hackernews.top_stories`, `instant.github.repo_intel`, `instant.dns.lookup`), plus **Autonomous 2-Call Agent Signup & Claim** (`POST /api/v1/agents/signup` + `POST /api/v1/agents/claim`).
-2. **Stripe Projects Cloud Infrastructure (`resource.*`) + Stripe Billing** — Governed cloud resource provisioning across 60+ providers (`Neon`, `Supabase`, `Turso`, `Cloudflare`, `Vercel`, `Railway`, `Render`, `Prisma`, `PostHog`, etc.) with automatic `PLAN_REQUIRED` companion plan resolution, AES-256-GCM encrypted secret custody (`muxo env pull`), and live Stripe Checkout (`$29/mo Starter` & `$10 / +1,000 Credits`).
+1. **Composio Connected Apps (`app.*`) & Instant (`instant.*`)** — Managed OAuth SaaS integrations (`app.github.*`, `app.gmail.*`, `app.slack.*`, `app.notion.*`, `app.linear.*`) with live browser OAuth handoff (`wait_for_connection`), zero-OAuth instant capabilities (`instant.web.search`, `instant.web.scrape`, `instant.web.crawl`, `instant.seo.audit`, `instant.hackernews.top_stories`, `instant.github.repo_intel`, `instant.dns.lookup`, `instant.composio.workbench`), plus **Autonomous 2-Call Agent Signup & Claim** (`POST /api/v1/agents/signup` + `POST /api/v1/agents/claim`).
+2. **Stripe Projects Cloud Infrastructure (`resource.*`) + Merchant-of-Record Billing (`muxo_funded`)** — Governed cloud resource provisioning across 60+ providers (`Turso`, `Neon`, `Supabase`, `Cloudflare`, `Vercel`, `Upstash`, `Resend`, `Railway`, `Render`, etc.) with automatic companion plan resolution, AES-256-GCM encrypted secret custody (`muxo env pull`), and unified credit settlement where users purchase Muxo credits and Muxo settles supplier costs from its master accounts.
 3. **Supermemory v5 Contextual Brain (`/ns/muxo-v5-*`)** — Isolated per-workspace long-term static facts, dynamic session context, and hybrid semantic search recalled before every tool plan (`plan_action` & `get_run_context`), with strict secret redaction before memory ingestion.
-4. **Microsoft Agent Governance Toolkit (`@microsoft/agent-governance-sdk` v5.0.0)** — Every planned and executed operation passes through `Agent ──► McpSecurityScanner ──► PolicyEngine ──► AgentIdentity (Ed25519 DID) ──► AuditLogger (SHA-256 chain) ──► DecisionRecord`.
+4. **Microsoft Agent Governance Toolkit (`@microsoft/agent-governance-sdk` v5.0.0)** — Every planned and executed operation passes through `Agent ──► McpSecurityScanner ──► PolicyEngine ──► AgentIdentity (Ed25519 DID) ──► AuditLogger (SHA-256 chain) ──► DecisionRecord` and produces an HMAC-SHA256 verifiable receipt.
 
 ---
 
-## Quickstart
+## Install & Quickstart (External Users & Agents)
 
 ```bash
-# 1. Build TypeScript
-npm run build
+# 1. Install the Muxo CLI or run directly via npx
+npm install -g @muxoai/cli@latest
 
-# 2. Run the 9-Suite Live E2E Verification
-npm test
+# 2. Zero-browser autonomous signup (creates ~/.muxo/config.json with mk_live_* key + 250 starter credits)
+muxo login --signup --name "my-agent"
 
-# 3. Start the Muxo Server + app.muxo.ai Console (/) + muxo.ai Canvas (/landing) + MCP (/mcp)
-npm start
+# 3. Verify workspace, governance DID, and credit balance
+muxo whoami
 
-# 4. Use the Muxo CLI
-npm run cli -- whoami
-npm run cli -- search postgres
-npm run cli -- exec instant.hackernews.top_stories --input '{"limit":3}'
-npm run cli -- env pull --out .env.muxo
+# 4. Run zero-OAuth Instant Tools (Crawl, SEO Audit, DNS, Web Search)
+muxo exec instant.seo.audit --input '{"url":"https://muxo.ai","keywords":["muxo","agent","governance"]}'
+muxo exec instant.web.crawl --input '{"url":"https://muxo.ai","maxPages":3}'
+
+# 5. Connect an OAuth SaaS App (Gmail, GitHub, Slack, Notion, Linear)
+muxo link gmail --wait
+
+# 6. Provision Live Cloud Infrastructure (Turso, Neon, Supabase, Upstash) & Pull Encrypted Secrets
+muxo provision turso --input '{"database_name":"my-agent-db"}' --approve
+muxo env pull --out .env.muxo
 ```
 
+## Official OpenAI Plugin & MCP Server (`https://api.muxo.ai/mcp`)
+
+Muxo ships a portable OpenAI Plugin (`plugins/muxo/plugin.json` & `plugins/muxo/mcp.json`) and Streamable HTTP MCP Server compliant with [OpenAI Plugins](https://developers.openai.com/plugins/build/plugins) and [OpenAI MCP Server](https://developers.openai.com/plugins/build/mcp-server) specifications:
+
+- **Streamable HTTP MCP Endpoint**: `https://api.muxo.ai/mcp` (and `https://app.muxo.ai/mcp`)
+- **Local Stdio MCP Command**: `npx -y @muxoai/cli@latest mcp`
+- **OAuth 2.1 Discovery & DCR/PKCE**:
+  - `https://api.muxo.ai/.well-known/oauth-protected-resource/mcp` (RFC 9728)
+  - `https://api.muxo.ai/.well-known/oauth-authorization-server` (RFC 8414)
+  - `POST https://api.muxo.ai/oauth/register` (Dynamic Client Registration)
+  - `GET https://api.muxo.ai/oauth/authorize` & `POST https://api.muxo.ai/oauth/token` (PKCE `S256`)
+- **SEP-2640 Skills Import Extension (`io.modelcontextprotocol/skills`)**: `skills/list`, `skills/get`, and `resources/read` serving `skill://muxo/muxo/SKILL.md` and `skill://muxo/setup/SKILL.md` with `sha256` integrity digests.
+- **Tool Annotations & Multi-Account Profile**: All 19 tools include `title` and `annotations` (`readOnlyHint`, `destructiveHint`, `openWorldHint`), plus `_meta["openai/profile"]: true` on `get_profile` and Company Knowledge `search`/`fetch` compatibility.
+
 ## Architecture & Source Layout
 
 | File / Directory | Responsibility |
 | --- | --- |
 | `ARCHITECTURE.md` | Internal engineering blueprint, Keep/Adopt/Drop ecosystem matrix, and Stripe Projects analysis |
+| `plugins/muxo/` | Official OpenAI & Claude Agent Plugin (`plugin.json`, `mcp.json`, `.codex-plugin/`, `.claude-plugin/`, `skills/muxo/`, `skills/setup/`) |
 | `src/config.ts` | Environment & AES-256-GCM vault key derivation |
-| `src/types.ts` | Core domain, Governance `DecisionRecord`, Supermemory `MemoryContextSummary`, & 18-tool MCP types |
-| `src/store.ts` | SQLite (`node:sqlite`) store, AES-256-GCM secret vault, credit ledger, memories, agent claims, and HMAC-SHA256 receipt chain |
+| `src/types.ts` | Core domain, Governance `DecisionRecord`, `SupplierSettlement`, Supermemory `MemoryContextSummary`, & 19-tool MCP types |
+| `src/store.ts` | SQLite (`node:sqlite`) store, AES-256-GCM secret vault, credit/settlement ledger, memories, agent claims, and HMAC-SHA256 receipt chain |
 | `src/providers/composio-sdk.ts` | Live Composio v3 Connected Apps adapter (catalog search, OAuth sessions/links, tool execution) |
-| `src/providers/composio-instant.ts` | Live Composio Instant zero-setup adapter |
+| `src/providers/composio-instant.ts` | Live Composio Instant adapter (`search`, `scrape`, `crawl`, `seo.audit`, `hackernews`, `github.repo_intel`, `dns.lookup`, `workbench`) |
 | `src/providers/stripe-projects.ts` | Live Stripe Projects CLI bridge (`status`, `catalog`, `add`, `rotate`, `remove`, `env --pull`) |
 | `src/providers/stripe-billing.ts` | Live Stripe Checkout billing (`$29/mo Starter Plan` & `$10 / +1,000 Credits Pack`) |
 | `src/providers/microsoft-governance.ts` | Microsoft Agent Governance Toolkit v5.0.0 (`McpSecurityScanner`, `PolicyEngine`, `AgentIdentity` Ed25519 DID, `AuditLogger`) |
 | `src/providers/supermemory.ts` | Supermemory v5 Contextual Brain (`profile`, hybrid `search`, secret-redacted `add`, `delete`) |
-| `src/engine.ts` | Unified Governance, Memory & Execution Engine implementing all 18 canonical MCP operations |
-| `src/mcp.ts` | JSON-RPC 2.0 MCP Server (Streamable HTTP `/mcp` + stdio `muxo mcp`) |
-| `src/server.ts` | HTTP Gateway (`/api/v1/*`, `/mcp`, `/skill.md`, `/llms.txt`, `/landing`, `/claim/:slug`, `/health`, and `/`) |
-| `src/ui/console-html.ts` | `app.muxo.ai` Operator Console UI + `/landing` (`muxo.ai` Provider Canvas) |
-| `web/` | Standalone `muxo.ai` Astro marketing & interactive provider catalog site |
-| `vendor/microsoft-governance/` | Vendored `@microsoft/agent-governance-sdk` v5.0.0 |
+| `src/engine.ts` | Unified Governance, Memory & Execution Engine implementing all 19 canonical MCP operations |
+| `src/mcp.ts` | JSON-RPC 2.0 MCP Server (Streamable HTTP `/mcp` + stdio `muxo mcp` + SEP-2640 skills + Company Knowledge `search`/`fetch`) |
+| `src/server.ts` | HTTP Gateway (`/api/v1/*`, `/mcp`, `/oauth/*`, `/.well-known/*`, `/plugins/*`, `/skill.md`, `/llms.txt`, `/landing`, `/claim/:slug`, `/health`, and `/`) |
+| `src/sdk.ts` | Zero-dependency TypeScript & Node.js SDK (`MuxoClient`) |
+| `worker/index.ts` | Cloudflare Worker edge gateway serving `https://app.muxo.ai` and `https://api.muxo.ai` |
+| `web/` | Standalone `https://muxo.ai` Astro marketing & interactive provider catalog site |

package/dist/cli.js

@@ -64,8 +64,8 @@ async function runCli() {
     const cmd = positional[0] || "help";
     if (flags.version || flags.v || cmd === "version") {
         console.log(flags.json
-            ? JSON.stringify({ ok: true, name: "@muxoai/cli", version: "1.2.2" }, null, 2)
-            : "1.2.2");
+            ? JSON.stringify({ ok: true, name: "@muxoai/cli", version: "1.2.3" }, null, 2)
+            : "1.2.3");
         return;
     }
     const savedCliConfig = readCliAuthConfig();
@@ -209,7 +209,7 @@ async function runCli() {
     if (cmd === "harness") {
         console.log(JSON.stringify({
             ok: true,
-            version: "1.2.2",
+            version: "1.2.3",
             passed: 7,
             total: 7,
             workspaceId: ctx.workspace.id,

package/dist/engine.js

@@ -26,6 +26,9 @@ export class MuxoEngine {
     // 1. get_profile
     getProfile(ctx) {
         return {
+            id: ctx.user.id,
+            name: ctx.user.name,
+            email: ctx.user.email,
             user: ctx.user,
             actorId: ctx.actorId,
             authType: ctx.authType,
@@ -555,6 +558,27 @@ export class MuxoEngine {
         if (execDecisionRecord.verdict === "deny") {
             throw new Error(`Microsoft Agent Governance denied execution of plan '${plan.id}': ${execDecisionRecord.reason}`);
         }
+        let activeConnId = null;
+        if (plan.lane === "composio_sdk" && tool.requiresAuth) {
+            let connections = this.store.listConnections(ctx.workspace.id);
+            let activeConn = connections.find((c) => c.lane === "composio_sdk" &&
+                c.providerSlug === tool.providerSlug &&
+                c.status === "active");
+            if (!activeConn) {
+                await this.waitForConnection(ctx, {
+                    provider: tool.providerSlug,
+                    timeoutSeconds: 0,
+                }).catch(() => { });
+                connections = this.store.listConnections(ctx.workspace.id);
+                activeConn = connections.find((c) => c.lane === "composio_sdk" &&
+                    c.providerSlug === tool.providerSlug &&
+                    c.status === "active");
+            }
+            if (!activeConn) {
+                throw new Error(`No active OAuth connection for ${tool.providerSlug}. Complete OAuth handoff and call wait_for_connection({ provider: "${tool.providerSlug}" }) before executing plan '${plan.id}'.`);
+            }
+            activeConnId = activeConn.externalAccountId;
+        }
         const run = this.store.createRun(plan, ctx.actorId);
         const startedMs = Date.now();
         try {
@@ -567,25 +591,11 @@ export class MuxoEngine {
                 });
             }
             else if (plan.lane === "composio_sdk") {
-                let connections = this.store.listConnections(ctx.workspace.id);
-                let activeConn = connections.find((c) => c.lane === "composio_sdk" &&
-                    c.providerSlug === tool.providerSlug &&
-                    c.status === "active");
-                if (!activeConn) {
-                    await this.waitForConnection(ctx, {
-                        provider: tool.providerSlug,
-                        timeoutSeconds: 0,
-                    }).catch(() => { });
-                    connections = this.store.listConnections(ctx.workspace.id);
-                    activeConn = connections.find((c) => c.lane === "composio_sdk" &&
-                        c.providerSlug === tool.providerSlug &&
-                        c.status === "active");
-                }
                 output = await this.composioSdk.executeTool({
                     workspaceId: ctx.workspace.id,
                     tool,
                     input: plan.input,
-                    connectedAccountId: activeConn?.externalAccountId || null,
+                    connectedAccountId: activeConnId,
                 });
             }
             else if (plan.lane === "stripe_projects") {

package/dist/mcp.d.ts

@@ -1,9 +1,45 @@
 import type { ExecutionContext, MuxoEngine } from "./engine.js";
+export interface McpToolAnnotations {
+    readOnlyHint: boolean;
+    destructiveHint: boolean;
+    openWorldHint: boolean;
+}
 export interface McpToolDefinition {
     name: string;
+    title: string;
     description: string;
     inputSchema: Record<string, unknown>;
+    outputSchema?: Record<string, unknown>;
+    annotations: McpToolAnnotations;
+    _meta?: Record<string, unknown>;
 }
+/**
+ * Concise server instructions (<512 chars) per OpenAI Plugin MCP Server specification:
+ * https://developers.openai.com/plugins/build/mcp-server
+ */
+export declare const MUXO_MCP_SERVER_INSTRUCTIONS = "Muxo governs SaaS actions (Composio app.*), Instant tools (instant.*), Cloud Infrastructure (Stripe Projects resource.*), Supermemory v5 recall, and Microsoft Agent Governance Ed25519 receipts. Workflow: 1) search_tools & inspect_tool. 2) plan_action to get a plan_*. 3) If authHandoff.required is true, show redirectUrl and call wait_for_connection. 4) Execute via the matching risk tool (execute_read/write/admin/financial/provisioning/destructive). 5) Verify via get_receipt.";
 export declare const MUXO_MCP_TOOLS: McpToolDefinition[];
+/**
+ * OpenAI Company Knowledge standard `search` and `fetch` tool definitions
+ * per https://developers.openai.com/plugins/build/mcp-server#company-knowledge-compatibility
+ */
+export declare const OPENAI_COMPANY_KNOWLEDGE_TOOLS: McpToolDefinition[];
+export interface McpSkillFileEntry {
+    path: string;
+    uri: string;
+    size: number;
+    digest: string;
+    mimeType: string;
+    content: string;
+}
+export interface McpSkillBundle {
+    name: string;
+    description: string;
+    uri: string;
+    version: string;
+    frontmatter: Record<string, string>;
+    files: McpSkillFileEntry[];
+}
+export declare function getMuxoMcpSkills(): McpSkillBundle[];
 export declare function dispatchMcpToolCall(engine: MuxoEngine, ctx: ExecutionContext, toolName: string, args?: Record<string, unknown>): Promise<unknown>;
 export declare function handleJsonRpcMcpRequest(engine: MuxoEngine, ctx: ExecutionContext, rpc: Record<string, unknown>): Promise<Record<string, unknown> | null>;