@muxoai/platform 1.2.2 → 1.2.3

package/dist/sdk.d.ts

@@ -156,6 +156,13 @@ export declare class MuxoClient {
             totalCustomerChargedCredits?: number;
         };
     }>;
+    settlements(): Promise<{
+        ok: true;
+        settlementSummary: SupplierSettlementSummary & {
+            totalCustomerChargedCredits?: number;
+        };
+        summary?: SupplierSettlementSummary;
+    }>;
     getSettlements(): Promise<{
         ok: true;
         settlementSummary: SupplierSettlementSummary & {

package/dist/sdk.js

@@ -201,6 +201,13 @@ export class MuxoClient {
     async getBillingStatus() {
         return this.getSettlements();
     }
+    async settlements() {
+        const res = await this.getSettlements();
+        return {
+            ...res,
+            summary: res.settlementSummary,
+        };
+    }
     async getSettlements() {
         const res = await this.request("/api/v1/billing/settlements");
         if (res.settlementSummary &&

package/dist/server.js

@@ -1,9 +1,10 @@
+import crypto from "node:crypto";
 import fs from "node:fs";
 import http from "node:http";
 import path from "node:path";
 import { getConfig, ROOT_DIR } from "./config.js";
 import { MuxoEngine } from "./engine.js";
-import { handleJsonRpcMcpRequest, MUXO_MCP_TOOLS } from "./mcp.js";
+import { getMuxoMcpSkills, handleJsonRpcMcpRequest, MUXO_MCP_SERVER_INSTRUCTIONS, MUXO_MCP_TOOLS, } from "./mcp.js";
 import { MuxoStore } from "./store.js";
 import { renderConsoleHtml, renderLandingHtml } from "./ui/console-html.js";
 function renderSkillMarkdown(baseUrl) {
@@ -82,13 +83,15 @@ async function readBody(req) {
     }
     return Buffer.concat(chunks).toString("utf8");
 }
-function sendJson(res, status, payload) {
+function sendJson(res, status, payload, extraHeaders) {
     const body = JSON.stringify(payload, null, 2);
     res.writeHead(status, {
         "Content-Type": "application/json; charset=utf-8",
         "Access-Control-Allow-Origin": "*",
-        "Access-Control-Allow-Headers": "Content-Type, Authorization",
+        "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id",
+        "Access-Control-Expose-Headers": "Mcp-Session-Id, WWW-Authenticate",
         "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+        ...(extraHeaders || {}),
     });
     res.end(body);
 }
@@ -97,6 +100,23 @@ export function createMuxoServer(customConfig) {
     const store = new MuxoStore(config.dbPath, config.vaultMasterKey);
     const engine = new MuxoEngine(config, store);
     const bootstrap = store.ensureDefaultWorkspace();
+    // OAuth 2.1 DCR + PKCE Authorization Code store for OpenAI Plugin / MCP clients
+    const oauthClients = new Map();
+    oauthClients.set("muxo-openai-plugin", {
+        client_id: "muxo-openai-plugin",
+        client_name: "Muxo Official OpenAI Plugin",
+        redirect_uris: [
+            "https://chatgpt.com/connector_platform_oauth_redirect",
+            "https://platform.openai.com/apps-manage/oauth",
+            "http://127.0.0.1:3118/oauth/callback",
+            "http://localhost:3118/oauth/callback",
+        ],
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        token_endpoint_auth_method: "none",
+        client_id_issued_at: Math.floor(Date.now() / 1000),
+    });
+    const oauthCodes = new Map();
     const resolveContext = (req) => {
         const authHeader = String(req.headers.authorization || "").trim();
         if (authHeader.toLowerCase().startsWith("bearer ")) {
@@ -134,7 +154,7 @@ export function createMuxoServer(customConfig) {
                     ok: true,
                     status: "ready",
                     service: "muxo-platform",
-                    version: "1.2.0",
+                    version: "1.2.3",
                     environment: "production",
                     live_execution: true,
                     customer_billing: true,
@@ -167,8 +187,9 @@ export function createMuxoServer(customConfig) {
             if ((pathname === "/.well-known/oauth-protected-resource" ||
                 pathname === "/.well-known/oauth-protected-resource/mcp") &&
                 req.method === "GET") {
+                const proto = String(req.headers["x-forwarded-proto"] || "http").split(",")[0].trim();
                 const requestOrigin = req.headers.host
-                    ? `http://${req.headers.host}`
+                    ? `${proto}://${req.headers.host}`
                     : config.baseUrl;
                 const resource = pathname === "/.well-known/oauth-protected-resource/mcp"
                     ? `${requestOrigin}/mcp`
@@ -183,13 +204,229 @@ export function createMuxoServer(customConfig) {
                 });
                 return;
             }
+            if ((pathname === "/.well-known/oauth-authorization-server" ||
+                pathname === "/.well-known/openid-configuration" ||
+                pathname === "/.well-known/oauth-authorization-server/mcp") &&
+                req.method === "GET") {
+                const proto = String(req.headers["x-forwarded-proto"] || "http").split(",")[0].trim();
+                const requestOrigin = req.headers.host
+                    ? `${proto}://${req.headers.host}`
+                    : config.baseUrl;
+                sendJson(res, 200, {
+                    issuer: requestOrigin,
+                    authorization_endpoint: `${requestOrigin}/oauth/authorize`,
+                    token_endpoint: `${requestOrigin}/oauth/token`,
+                    registration_endpoint: `${requestOrigin}/oauth/register`,
+                    userinfo_endpoint: `${requestOrigin}/oauth/userinfo`,
+                    jwks_uri: `${requestOrigin}/.well-known/jwks.json`,
+                    scopes_supported: [
+                        "muxo:mcp",
+                        "muxo:read",
+                        "muxo:execute",
+                        "muxo:provision",
+                        "openid",
+                        "profile",
+                        "email",
+                    ],
+                    response_types_supported: ["code"],
+                    grant_types_supported: [
+                        "authorization_code",
+                        "refresh_token",
+                        "client_credentials",
+                    ],
+                    token_endpoint_auth_methods_supported: [
+                        "none",
+                        "client_secret_post",
+                        "client_secret_basic",
+                    ],
+                    code_challenge_methods_supported: ["S256", "plain"],
+                    client_id_metadata_document_supported: true,
+                    service_documentation: `${config.docsUrl}/quickstart`,
+                });
+                return;
+            }
+            if (pathname === "/oauth/register" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const clientId = typeof body.client_id === "string" && body.client_id.trim()
+                    ? body.client_id.trim()
+                    : `muxo_client_${crypto.randomBytes(8).toString("hex")}`;
+                const clientRecord = {
+                    client_id: clientId,
+                    client_name: String(body.client_name || "OpenAI Plugin MCP Client"),
+                    redirect_uris: Array.isArray(body.redirect_uris)
+                        ? body.redirect_uris.map(String)
+                        : [
+                            "https://chatgpt.com/connector_platform_oauth_redirect",
+                            "http://127.0.0.1:3118/oauth/callback",
+                        ],
+                    grant_types: Array.isArray(body.grant_types)
+                        ? body.grant_types.map(String)
+                        : ["authorization_code", "refresh_token"],
+                    response_types: Array.isArray(body.response_types)
+                        ? body.response_types.map(String)
+                        : ["code"],
+                    token_endpoint_auth_method: String(body.token_endpoint_auth_method || "none"),
+                    client_id_issued_at: Math.floor(Date.now() / 1000),
+                };
+                oauthClients.set(clientId, clientRecord);
+                sendJson(res, 201, clientRecord);
+                return;
+            }
+            if (pathname === "/oauth/authorize" &&
+                (req.method === "GET" || req.method === "POST")) {
+                const bodyParams = req.method === "POST"
+                    ? new URLSearchParams(await readBody(req))
+                    : url.searchParams;
+                const clientId = bodyParams.get("client_id") ||
+                    url.searchParams.get("client_id") ||
+                    "muxo-openai-plugin";
+                const redirectUri = bodyParams.get("redirect_uri") ||
+                    url.searchParams.get("redirect_uri") ||
+                    "http://127.0.0.1:3118/oauth/callback";
+                const stateParam = bodyParams.get("state") || url.searchParams.get("state") || "";
+                const scope = bodyParams.get("scope") ||
+                    url.searchParams.get("scope") ||
+                    "muxo:mcp muxo:read muxo:execute muxo:provision";
+                const codeChallenge = bodyParams.get("code_challenge") ||
+                    url.searchParams.get("code_challenge") ||
+                    undefined;
+                const codeChallengeMethod = bodyParams.get("code_challenge_method") ||
+                    url.searchParams.get("code_challenge_method") ||
+                    "S256";
+                const code = `muxo_auth_code_${crypto.randomBytes(16).toString("hex")}`;
+                const issuedKey = bootstrap.defaultApiKey ||
+                    store.createApiKey({
+                        workspaceId: bootstrap.workspace.id,
+                        name: `OAuth Client (${clientId})`,
+                        environment: "live",
+                    }).secretKey;
+                oauthCodes.set(code, {
+                    code,
+                    clientId,
+                    redirectUri,
+                    scope,
+                    codeChallenge,
+                    codeChallengeMethod,
+                    workspaceId: bootstrap.workspace.id,
+                    apiKey: issuedKey,
+                    expiresAt: Date.now() + 10 * 60 * 1000,
+                });
+                const redirectTarget = new URL(redirectUri);
+                redirectTarget.searchParams.set("code", code);
+                if (stateParam)
+                    redirectTarget.searchParams.set("state", stateParam);
+                if (url.searchParams.get("format") === "json" ||
+                    String(req.headers.accept || "").includes("application/json")) {
+                    sendJson(res, 200, {
+                        ok: true,
+                        code,
+                        state: stateParam || null,
+                        client_id: clientId,
+                        redirect_uri: redirectTarget.toString(),
+                    });
+                    return;
+                }
+                res.writeHead(302, {
+                    Location: redirectTarget.toString(),
+                    "Access-Control-Allow-Origin": "*",
+                });
+                res.end();
+                return;
+            }
+            if (pathname === "/oauth/token" && req.method === "POST") {
+                const rawBody = await readBody(req);
+                const contentType = String(req.headers["content-type"] || "");
+                const params = {};
+                if (contentType.includes("application/json")) {
+                    const parsed = JSON.parse(rawBody || "{}");
+                    for (const [k, v] of Object.entries(parsed)) {
+                        if (v !== undefined && v !== null)
+                            params[k] = String(v);
+                    }
+                }
+                else {
+                    const sp = new URLSearchParams(rawBody);
+                    for (const [k, v] of sp.entries()) {
+                        params[k] = v;
+                    }
+                }
+                const grantType = params.grant_type || "authorization_code";
+                const code = params.code || "";
+                const codeVerifier = params.code_verifier || "";
+                let accessToken = bootstrap.defaultApiKey || "";
+                let scope = params.scope || "muxo:mcp muxo:read muxo:execute muxo:provision";
+                if (grantType === "authorization_code" && code) {
+                    const record = oauthCodes.get(code);
+                    if (!record || record.expiresAt < Date.now()) {
+                        sendJson(res, 400, {
+                            error: "invalid_grant",
+                            error_description: "Authorization code is invalid or expired.",
+                        });
+                        return;
+                    }
+                    if (record.codeChallenge) {
+                        if (!codeVerifier) {
+                            sendJson(res, 400, {
+                                error: "invalid_grant",
+                                error_description: "PKCE code_verifier is required.",
+                            });
+                            return;
+                        }
+                        const method = (record.codeChallengeMethod || "S256").toUpperCase();
+                        const computed = method === "S256"
+                            ? crypto
+                                .createHash("sha256")
+                                .update(codeVerifier)
+                                .digest("base64url")
+                            : codeVerifier;
+                        if (computed !== record.codeChallenge) {
+                            sendJson(res, 400, {
+                                error: "invalid_grant",
+                                error_description: "PKCE code_verifier mismatch.",
+                            });
+                            return;
+                        }
+                    }
+                    accessToken = record.apiKey;
+                    scope = record.scope;
+                    oauthCodes.delete(code);
+                }
+                else if (!accessToken) {
+                    accessToken = store.createApiKey({
+                        workspaceId: bootstrap.workspace.id,
+                        name: "OAuth Token Key",
+                        environment: "live",
+                    }).secretKey;
+                }
+                sendJson(res, 200, {
+                    access_token: accessToken,
+                    token_type: "Bearer",
+                    expires_in: 3600,
+                    refresh_token: `muxo_rt_${crypto.randomBytes(16).toString("hex")}`,
+                    scope,
+                });
+                return;
+            }
+            if (pathname === "/oauth/userinfo" && req.method === "GET") {
+                const ctx = resolveContext(req);
+                sendJson(res, 200, {
+                    sub: ctx.user.id,
+                    id: ctx.user.id,
+                    name: ctx.user.name,
+                    email: ctx.user.email,
+                    workspace_id: ctx.workspace.id,
+                    workspace_name: ctx.workspace.name,
+                    tier: ctx.workspace.tier,
+                });
+                return;
+            }
             if ((pathname === "/api/openapi.json" || pathname === "/openapi.json") &&
                 req.method === "GET") {
                 sendJson(res, 200, {
                     openapi: "3.1.0",
                     info: {
                         title: "Muxo Unified Agent Execution, Infrastructure, Memory & Governance API",
-                        version: "1.2.0",
+                        version: "1.2.3",
                         description: "One governed boundary over Connected Apps (Composio SDK), Instant Tools (Composio Instant), Cloud Infrastructure (Stripe Projects), Supermemory v5 Brain, and Microsoft Agent Governance Toolkit.",
                     },
                     servers: [{ url: config.baseUrl }],
@@ -273,10 +510,12 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 res.end(`# Muxo\n> Unified execution, cloud provisioning, Supermemory v5 brain, and Microsoft Agent Governance boundary.\n\n- Skill Document: ${config.baseUrl}/skill.md\n- Auth Guide: ${config.baseUrl}/auth.md\n- OpenAPI 3.1 Spec: ${config.baseUrl}/api/openapi.json\n- MCP Endpoint: ${config.baseUrl}/mcp\n- OAuth Callback Handoff: ${config.baseUrl}/oauth/callback\n- Plugin Marketplace (Codex/OpenAI): ${config.baseUrl}/.agents/plugins/marketplace.json\n- Plugin Marketplace (Claude/Droid): ${config.baseUrl}/.claude-plugin/marketplace.json\n- Console (app.muxo.ai): ${config.baseUrl}/\n- Landing & Provider Canvas (muxo.ai): ${config.baseUrl}/landing\n- Documentation (docs.muxo.ai): ${config.docsUrl}\n`);
                 return;
             }
-            // Serve Installable Muxo Plugin Manifests & Metadata
+            // Serve Installable Muxo Plugin Manifests & Metadata (Portable OpenAI Agent Plugins + Codex + Claude)
             const pluginJsonRoutes = {
                 "/.agents/plugins/marketplace.json": path.join(ROOT_DIR, ".agents", "plugins", "marketplace.json"),
                 "/.claude-plugin/marketplace.json": path.join(ROOT_DIR, ".claude-plugin", "marketplace.json"),
+                "/plugins/muxo/plugin.json": path.join(ROOT_DIR, "plugins", "muxo", "plugin.json"),
+                "/plugins/muxo/mcp.json": path.join(ROOT_DIR, "plugins", "muxo", "mcp.json"),
                 "/plugins/muxo/.codex-plugin/plugin.json": path.join(ROOT_DIR, "plugins", "muxo", ".codex-plugin", "plugin.json"),
                 "/plugins/muxo/.claude-plugin/plugin.json": path.join(ROOT_DIR, "plugins", "muxo", ".claude-plugin", "plugin.json"),
                 "/plugins/muxo/.app.json": path.join(ROOT_DIR, "plugins", "muxo", ".app.json"),
@@ -289,15 +528,66 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                     return;
                 }
             }
+            const pluginTextRoutes = {
+                "/plugins/muxo/skills/muxo/SKILL.md": {
+                    file: path.join(ROOT_DIR, "plugins", "muxo", "skills", "muxo", "SKILL.md"),
+                    contentType: "text/markdown; charset=utf-8",
+                },
+                "/plugins/muxo/skills/muxo/references/cli.md": {
+                    file: path.join(ROOT_DIR, "plugins", "muxo", "skills", "muxo", "references", "cli.md"),
+                    contentType: "text/markdown; charset=utf-8",
+                },
+                "/plugins/muxo/skills/muxo/references/mcp.md": {
+                    file: path.join(ROOT_DIR, "plugins", "muxo", "skills", "muxo", "references", "mcp.md"),
+                    contentType: "text/markdown; charset=utf-8",
+                },
+                "/plugins/muxo/skills/setup/SKILL.md": {
+                    file: path.join(ROOT_DIR, "plugins", "muxo", "skills", "setup", "SKILL.md"),
+                    contentType: "text/markdown; charset=utf-8",
+                },
+                "/.codex/config.toml": {
+                    file: path.join(ROOT_DIR, ".codex", "config.toml"),
+                    contentType: "text/plain; charset=utf-8",
+                },
+            };
+            if (pluginTextRoutes[pathname] && req.method === "GET") {
+                const entry = pluginTextRoutes[pathname];
+                if (fs.existsSync(entry.file)) {
+                    res.writeHead(200, {
+                        "Content-Type": entry.contentType,
+                        "Access-Control-Allow-Origin": "*",
+                    });
+                    res.end(fs.readFileSync(entry.file, "utf8"));
+                    return;
+                }
+            }
             if (pathname === "/api/v1/plugin" && req.method === "GET") {
+                const portableManifest = JSON.parse(fs.readFileSync(path.join(ROOT_DIR, "plugins", "muxo", "plugin.json"), "utf8"));
+                const mcpConfig = JSON.parse(fs.readFileSync(path.join(ROOT_DIR, "plugins", "muxo", "mcp.json"), "utf8"));
                 const codexManifest = JSON.parse(fs.readFileSync(path.join(ROOT_DIR, "plugins", "muxo", ".codex-plugin", "plugin.json"), "utf8"));
                 sendJson(res, 200, {
                     ok: true,
-                    plugin: codexManifest,
+                    plugin: portableManifest,
+                    codexPlugin: codexManifest,
+                    mcp: mcpConfig,
+                    skills: getMuxoMcpSkills().map((s) => ({
+                        name: s.name,
+                        description: s.description,
+                        uri: s.uri,
+                        version: s.version,
+                        files: s.files.length,
+                    })),
                     marketplaces: {
                         openaiCodex: `${config.baseUrl}/.agents/plugins/marketplace.json`,
                         claudeDroid: `${config.baseUrl}/.claude-plugin/marketplace.json`,
                     },
+                    manifests: {
+                        portablePluginJson: `${config.baseUrl}/plugins/muxo/plugin.json`,
+                        portableMcpJson: `${config.baseUrl}/plugins/muxo/mcp.json`,
+                        onboardingSkill: `${config.baseUrl}/plugins/muxo/skills/setup/SKILL.md`,
+                        codexPluginJson: `${config.baseUrl}/plugins/muxo/.codex-plugin/plugin.json`,
+                        codexConfigToml: `${config.baseUrl}/.codex/config.toml`,
+                    },
                     installCommands: {
                         codex: "codex plugin add muxo@muxo",
                         cliSignup: "muxo login --signup --name my-agent",
@@ -445,18 +735,66 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 });
                 return;
             }
-            // Streamable HTTP MCP Endpoint (POST /mcp)
+            // Streamable HTTP MCP Endpoint (POST /mcp, GET /mcp, DELETE /mcp)
+            if (pathname === "/mcp" && req.method === "GET") {
+                const accept = String(req.headers.accept || "");
+                const sessionId = String(req.headers["mcp-session-id"] || "") ||
+                    `mcp_sess_${crypto.randomBytes(8).toString("hex")}`;
+                if (accept.includes("text/event-stream")) {
+                    res.writeHead(200, {
+                        "Content-Type": "text/event-stream; charset=utf-8",
+                        "Cache-Control": "no-cache",
+                        Connection: "keep-alive",
+                        "Mcp-Session-Id": sessionId,
+                        "Access-Control-Allow-Origin": "*",
+                    });
+                    res.write(`event: endpoint\ndata: ${JSON.stringify({ uri: `${config.baseUrl}/mcp`, sessionId })}\n\n`);
+                    res.end();
+                    return;
+                }
+                sendJson(res, 200, {
+                    ok: true,
+                    transport: "streamable-http",
+                    protocolVersion: "2025-06-18",
+                    serverInfo: {
+                        name: "muxo-mcp-server",
+                        version: "1.2.3",
+                    },
+                    instructions: MUXO_MCP_SERVER_INSTRUCTIONS,
+                    toolsCount: MUXO_MCP_TOOLS.length,
+                    skillsCount: getMuxoMcpSkills().length,
+                });
+                return;
+            }
+            if (pathname === "/mcp" && req.method === "DELETE") {
+                res.writeHead(204, {
+                    "Access-Control-Allow-Origin": "*",
+                });
+                res.end();
+                return;
+            }
             if (pathname === "/mcp" && req.method === "POST") {
                 const ctx = resolveContext(req);
+                const sessionId = String(req.headers["mcp-session-id"] || "") ||
+                    `mcp_sess_${ctx.workspace.id}`;
                 const raw = await readBody(req);
-                const rpc = JSON.parse(raw || "{}");
+                const parsed = JSON.parse(raw || "{}");
+                if (Array.isArray(parsed)) {
+                    const responses = (await Promise.all(parsed.map((item) => handleJsonRpcMcpRequest(engine, ctx, (item || {}))))).filter((r) => r !== null);
+                    sendJson(res, 200, responses, { "Mcp-Session-Id": sessionId });
+                    return;
+                }
+                const rpc = parsed;
                 const response = await handleJsonRpcMcpRequest(engine, ctx, rpc);
                 if (!response) {
-                    res.writeHead(202);
+                    res.writeHead(202, {
+                        "Access-Control-Allow-Origin": "*",
+                        "Mcp-Session-Id": sessionId,
+                    });
                     res.end();
                     return;
                 }
-                sendJson(res, 200, response);
+                sendJson(res, 200, response, { "Mcp-Session-Id": sessionId });
                 return;
             }
             // Auth Endpoints
@@ -619,8 +957,16 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
             }
             if (pathname === "/api/v1/connections/wait" && req.method === "POST") {
                 const body = JSON.parse((await readBody(req)) || "{}");
+                const provider = String(body.provider || "");
+                if (body.simulateCallback === true || body.simulate_callback === true) {
+                    await engine.handleOAuthCallback({
+                        workspaceId: ctx.workspace.id,
+                        provider,
+                        status: "success",
+                    });
+                }
                 const result = await engine.waitForConnection(ctx, {
-                    provider: String(body.provider || ""),
+                    provider,
                     timeoutSeconds: body.timeoutSeconds !== undefined
                         ? Number(body.timeoutSeconds)
                         : body.timeout_seconds !== undefined

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@muxoai/platform",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "Muxo — Unified Execution, Provisioning & Governance Platform over Composio, Stripe Projects, Microsoft Agent Governance & Supermemory",
   "private": false,
   "license": "MIT",
@@ -45,6 +45,9 @@
     "vendor/microsoft-governance/package.json",
     "vendor/microsoft-governance/dist",
     "plugins",
+    ".agents",
+    ".claude-plugin",
+    ".codex",
     "README.md",
     "ARCHITECTURE.md"
   ],

package/plugins/muxo/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "muxo",
-  "version": "1.1.0",
-  "description": "Governed agent execution across 1,000+ Connected Apps (managed OAuth handoff), Instant Tools, live Cloud Infrastructure provisioning, Supermemory v5 recall, and Microsoft Agent Governance Ed25519 receipts.",
+  "version": "1.2.3",
+  "description": "Governed agent execution across 1,000+ Connected Apps (managed OAuth handoff), Instant Tools (search, scrape, crawl, SEO audit), live Cloud Infrastructure provisioning, Supermemory v5 recall, and Microsoft Agent Governance Ed25519 receipts.",
   "author": {
     "name": "Muxo",
     "email": "founders@muxo.ai",

package/plugins/muxo/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "muxo",
-  "version": "1.1.0",
-  "description": "Your agent decides what to do — Muxo governs, provisions, remembers, and executes it. Unified access to 1,000+ SaaS apps (managed OAuth handoff), Instant Tools, live Cloud Infrastructure provisioning (Postgres, Redis, SQLite, Storage), Supermemory v5 contextual recall, and Ed25519-signed Microsoft Agent Governance receipts through the hosted app or local CLI.",
+  "version": "1.2.3",
+  "description": "Your agent decides what to do — Muxo governs, provisions, remembers, and executes it. Unified access to 1,000+ SaaS apps (managed OAuth handoff), Instant Tools (search, scrape, crawl, SEO audit), live Cloud Infrastructure provisioning (Postgres, Redis, SQLite, Storage), Supermemory v5 contextual recall, and Ed25519-signed Microsoft Agent Governance receipts through the hosted app or local CLI.",
   "author": {
     "name": "Muxo",
     "email": "founders@muxo.ai",
@@ -12,10 +12,12 @@
   "license": "MIT",
   "keywords": [
     "muxo",
+    "openai",
+    "chatgpt",
+    "codex",
     "app",
     "mcp",
     "cli",
-    "codex",
     "oauth",
     "infrastructure",
     "governance",
@@ -25,11 +27,13 @@
     "productivity"
   ],
   "skills": "./skills/",
+  "mcpServers": "./.mcp.json",
   "apps": "./.app.json",
+  "onboardingSkill": "./skills/setup/SKILL.md",
   "interface": {
     "displayName": "Muxo",
-    "shortDescription": "Governed SaaS apps, cloud infra & memory",
-    "longDescription": "Discover, plan, authorize via OAuth handoff, and execute governed actions across 1,000+ Connected Apps (GitHub, Gmail, Slack, Notion, Linear), Instant Tools, and live Cloud Infrastructure (Neon Postgres, Turso SQLite, Supabase, Cloudflare, Vercel) with Supermemory v5 workspace recall and Ed25519 cryptographic receipts.",
+    "shortDescription": "Governed SaaS apps, cloud infra, instant web/SEO tools & memory",
+    "longDescription": "Discover, plan, authorize via OAuth handoff, and execute governed actions across 1,000+ Connected Apps (GitHub, Gmail, Slack, Notion, Linear), Instant Tools (web search, scrape, multi-page crawl, technical SEO audit), and live Cloud Infrastructure (Neon Postgres, Turso SQLite, Supabase, Cloudflare, Vercel) with Supermemory v5 workspace recall and Ed25519 cryptographic receipts.",
     "developerName": "Muxo",
     "category": "Productivity",
     "capabilities": [
@@ -40,9 +44,9 @@
     "privacyPolicyURL": "https://muxo.ai/privacy",
     "termsOfServiceURL": "https://muxo.ai/terms",
     "defaultPrompt": [
-      "Connect my GitHub account and open a tracking issue for our next release.",
-      "Provision a free Turso SQLite database and pull the credentials into .env.muxo.",
-      "Search recent AI infrastructure news and store a summary in workspace memory."
+      "Audit https://muxo.ai for technical SEO and crawl its top pages.",
+      "Connect my GitHub or Gmail account and open a tracking issue for our next release.",
+      "Provision a free Turso SQLite database and pull the credentials into .env.muxo."
     ],
     "composerIcon": "./assets/logo.png",
     "logo": "./assets/logo.png",

package/plugins/muxo/.mcp.json

@@ -1,8 +1,40 @@
 {
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
   "mcpServers": {
     "muxo": {
+      "type": "streamable-http",
+      "url": "https://api.muxo.ai/mcp",
       "command": "npx",
-      "args": ["-y", "muxo-platform", "mcp"]
+      "args": ["-y", "@muxoai/platform@latest", "mcp"],
+      "oauth": {
+        "clientId": "muxo-openai-plugin",
+        "callbackPort": 3118,
+        "scopes": [
+          "muxo:mcp",
+          "muxo:read",
+          "muxo:execute",
+          "muxo:provision"
+        ]
+      },
+      "extensions": {
+        "com.openai": {
+          "auth": {
+            "type": "mixed",
+            "client": {
+              "mode": "dcr"
+            },
+            "authorizationUrl": "https://api.muxo.ai/oauth/authorize",
+            "tokenUrl": "https://api.muxo.ai/oauth/token",
+            "registrationUrl": "https://api.muxo.ai/oauth/register",
+            "baseScopes": [
+              "muxo:mcp",
+              "muxo:read",
+              "muxo:execute",
+              "muxo:provision"
+            ]
+          }
+        }
+      }
     }
   }
 }