@muxoai/platform 1.3.0 → 1.3.2

package/plugins/muxo/skills/muxo/SKILL.md

@@ -1,25 +1,103 @@
 ---
 name: muxo
-description: Route governed Muxo work between the hosted MCP-backed app and the local Muxo CLI. Use when a user wants to read or act on external SaaS services (GitHub, Gmail, Slack, Notion, Linear, Jira, HubSpot), run zero-OAuth Instant tools (web search, scrape, DNS, Hacker News), provision cloud infrastructure (Neon Postgres, Turso SQLite, Supabase, Cloudflare, Vercel, Prisma), recover a missing OAuth connection via handoff, recall workspace context from Supermemory v5, or verify Ed25519-signed Microsoft Agent Governance receipts.
+description: Route governed Muxo work through the hosted Muxo MCP server (`https://api.muxo.ai/mcp`), the live Muxo HTTP API (`https://api.muxo.ai`), or the local Muxo CLI. Use when a user wants to read or act on external SaaS services via Composio Connected Apps (GitHub, Gmail, Slack, Notion, Linear, Jira, HubSpot, Google Calendar, Google Drive, Discord, Airtable, Salesforce, and 1,000+ apps), complete OAuth handoff (`start_connection`, `wait_for_connection`, `connection_status`), provision live cloud infrastructure via Stripe Projects (`resource.*` for Turso SQLite, Neon Postgres, Supabase, Upstash Redis, Cloudflare Workers, Vercel, Prisma, Clerk, WorkOS, PlanetScale, ClickHouse, Chroma, E2B, Browserbase, Resend, Sentry, PostHog, Datadog, Railway, Fly.io), manage Stripe credits & subscriptions (`billing.*`), run zero-OAuth Instant tools (`instant.*` for web search, scrape, crawl, SEO audit, DNS, Hacker News), recall workspace context from Muxo Workspace Memory, or verify cryptographic execution receipts.
 ---
 
 # Muxo
 
-Choose a surface from the capabilities available in the current task, then keep the workflow on that surface unless the task itself requires the other one.
+Choose the execution surface available in the current session, and NEVER check for the `muxo` CLI first when running inside ChatGPT web/app.
 
-## Choose the surface
+## Choose the surface (Priority Order)
 
-1. In a terminal, Codex, Claude Code, or Droid environment, prefer the local Muxo CLI (`muxo`) for Muxo work, especially when pulling `.env` credentials (`muxo env pull`), scripting workflows, or running interactive OAuth handoffs (`muxo link <provider> --wait`). If `muxo` is missing, explain how to install or sign in (`muxo login`) before choosing it; do not install software without user approval. Read [references/cli.md](references/cli.md) before using that surface.
-2. In ChatGPT web/app or another environment without a usable terminal, use callable, authorized hosted Muxo MCP tools. Read [references/mcp.md](references/mcp.md) before using that surface.
-3. If both surfaces are available in a terminal environment, use the CLI unless the user explicitly requests the hosted MCP surface or the required capability exists only there.
-4. If neither surface is available, explain both setup paths: authorize or enable the hosted Muxo MCP server (`POST /mcp` or autonomous signup at `POST /api/v1/agents/signup`), or sign in to the CLI (`muxo login`).
+1. **Hosted Muxo MCP Tools (ChatGPT web/app & Codex primary path)**:
+   - Look directly in your available MCP tools for `search_tools`, `inspect_tool`, `plan_action`, `execute_read`, `execute_write`, `execute_provisioning`, `execute_financial`, `execute_admin`, `execute_destructive`, `get_profile`, `get_organization`, `start_connection`, `wait_for_connection`, `connection_status`, or `get_receipt` (they may be prefixed with `muxo` or your connector name).
+   - If these MCP tools are present in the session, call them directly! Do NOT run bash commands to check if `muxo` CLI is installed first. Read [references/mcp.md](references/mcp.md).
+2. **Direct HTTPS API / JSON-RPC Fallback (when inside ChatGPT/sandbox with `curl` or Python/fetch access, and MCP tools are not bound in the session)**:
+   - If the user installed the skill without connecting the MCP server at `https://chatgpt.com/plugins`, you can STILL execute every Muxo tool live over HTTPS against `https://api.muxo.ai/mcp` or `https://api.muxo.ai/api/v1/do`!
+   - Works for **Zero-OAuth Instant Tools (`instant.*`)**, **Composio Connected Apps & OAuth Handoff (`app.*`, `start_connection`, `wait_for_connection`)**, and **Stripe Projects Cloud Provisioning & Billing (`resource.*`, `billing.*`)**.
+   - Example one-shot JSON-RPC calls over HTTPS:
+     ```bash
+     # 1) Zero-OAuth Instant Tool (e.g. SEO Audit or Multi-Page Web Crawl)
+     curl -s -X POST https://api.muxo.ai/mcp -H "Content-Type: application/json" \
+       -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"plan_action","arguments":{"tool_slug":"instant.seo.audit","input":{"url":"https://muxo.ai"},"reason":"Audit technical SEO"}}}'
+     curl -s -X POST https://api.muxo.ai/mcp -H "Content-Type: application/json" \
+       -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"execute_read","arguments":{"plan_id":"<PLAN_ID>"}}}'
 
-Do not tell a user in ChatGPT web/app or another hosted-only environment to install the CLI before using callable hosted MCP tools.
+     # 2) Composio Connected Apps & External User OAuth Handoff (GitHub, Gmail, Slack, Notion, Linear, etc.)
+     curl -s -X POST https://api.muxo.ai/mcp -H "Content-Type: application/json" \
+       -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"start_connection","arguments":{"provider":"gmail"}}}'
+     # Share connection.redirectUrl with the user, then verify connection status:
+     curl -s -X POST https://api.muxo.ai/mcp -H "Content-Type: application/json" \
+       -d '{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"wait_for_connection","arguments":{"provider":"gmail"}}}'
 
-## Execute safely across Muxo's 4 pillars
+     # 3) Stripe Projects Cloud Infrastructure Provisioning (Turso, Neon, Supabase, Upstash, Cloudflare, Vercel, etc.)
+     curl -s -X POST https://api.muxo.ai/mcp -H "Content-Type: application/json" \
+       -d '{"jsonrpc":"2.0","id":5,"method":"tools/call","params":{"name":"plan_action","arguments":{"tool_slug":"resource.turso.database","input":{"resource_name":"agent-db","plan":"free"},"reason":"Provision Turso SQLite DB"}}}'
+     curl -s -X POST https://api.muxo.ai/mcp -H "Content-Type: application/json" \
+       -d '{"jsonrpc":"2.0","id":6,"method":"tools/call","params":{"name":"execute_provisioning","arguments":{"plan_id":"<PLAN_ID>"}}}'
+     ```
+3. **Local Muxo CLI (`muxo`, requires Node.js 22+)**:
+   - Use ONLY in a local developer terminal, Codex CLI, Claude Code, or Droid environment when pulling `.env` credentials (`muxo env pull`) or running local scripts. CLI signup (`muxo login --signup`) and local MCP (`muxo mcp`) connect to the hosted workspace at `https://api.muxo.ai`. Read [references/cli.md](references/cli.md).
+4. **Enabling Native Harness & MCP Connections**:
+   - **ChatGPT**:
+     1. Open **Plugins → + → Add custom MCP server** (at `https://chatgpt.com/plugins`).
+     2. Enter Server URL: `https://api.muxo.ai/mcp` (Authentication: **No authentication** for Instant tools, or **OAuth** for Connected Apps; OAuth client registration can use CIMD or DCR).
+     3. Select **Create as a plugin**, then invoke `@Muxo` in ChatGPT (**Work** tab or chat composer).
+   - **Claude Code Marketplace (`muxo@muxo`)**:
+     `claude plugin marketplace add https://api.muxo.ai/.claude-plugin/marketplace.json && claude plugin install muxo@muxo`
+   - **OpenAI Codex**:
+     Add a Git repository or local marketplace directory containing `.agents/plugins/marketplace.json` and enable `[plugins."muxo@muxo"]` in `.codex/config.toml`, or configure `[mcp_servers.muxo]` (`url = "https://api.muxo.ai/mcp"`) in `~/.codex/config.toml`.
+   - **Claude Desktop**:
+     Configure hosted MCP via **Settings → Connectors → Add custom connector** (`https://api.muxo.ai/mcp`), or configure the local stdio server (`npx -y @muxoai/cli@latest mcp`, requires Node.js 22+) in `claude_desktop_config.json`.
 
-- **Discover & Inspect**: For an unknown capability across Instant Tools (`instant.*`), Connected Apps (`app.*`), or Cloud Infrastructure (`resource.*`), discover the tool first (`search_tools` / `muxo search`), inspect its schema (`inspect_tool` / `muxo inspect`), and then plan it.
-- **External User OAuth Handoff**: When `plan_action` returns `authHandoff.required: true` (or a tool reports a missing connection), present `authHandoff.redirectUrl` to the user, poll `wait_for_connection` (or `muxo wait <provider>`), and resume the original plan once `status === "active"`.
-- **Single-Execution & Governance**: Every mutation or provisioning call creates a governed `plan_*` evaluated by Microsoft Agent Governance (`McpSecurityScanner ──► PolicyEngine ──► AgentIdentity Ed25519 DID ──► DecisionRecord`). Execute each confirmed plan exactly once on its matching risk lane (`execute_read`, `execute_write`, `execute_admin`, `execute_financial`, `execute_provisioning`, `execute_destructive`).
-- **Uncertain Write Boundary**: After a timeout or unclear write/provisioning result, check `get_run` or `get_receipt` before doing anything else. Never automatically retry an uncertain write through the other surface.
-- **Secret Custody**: Provisioned infrastructure credentials are encrypted in the Muxo AES-256-GCM Vault and redacted from Supermemory v5. Never expose raw tokens, connection secrets, or authentication material in chat responses.
+## Fast-Path Slugs & Workflows across Muxo's 4 Pillars
+
+### 1. Zero-OAuth Instant Tools (`composio_instant` → `execute_read`)
+- Technical SEO Audit: `instant.seo.audit` — `{"url": "https://muxo.ai"}`
+- Multi-Page Web Crawl: `instant.web.crawl` — `{"url": "https://muxo.ai", "maxPages": 5}`
+- Web Page Scrape: `instant.web.scrape` — `{"url": "https://muxo.ai"}`
+- Live Web Search: `instant.web.search` — `{"query": "..."}`
+- DNS Lookup: `instant.dns.lookup` — `{"domain": "muxo.ai", "type": "A"}`
+- GitHub Repo Intel: `instant.github.repo_intel` — `{"owner": "openai", "repo": "openai-node"}`
+- Hacker News Top Stories: `instant.hackernews.top_stories` — `{"limit": 5}`
+
+### 2. Composio Connected Apps & OAuth Handoff (`composio_sdk` → `execute_read` / `execute_write`)
+Supports 1,000+ SaaS toolkits dynamically via `search_tools({ query: "...", lane: "composio_sdk", toolkit: "<app>" })` or any `app.<provider>.<action>` slug:
+- **Gmail**: `app.gmail.fetch_emails` (`{"query": "is:inbox", "max_results": 5}`, `execute_read`), `app.gmail.send_email` (`{"recipient_email": "...", "subject": "...", "body": "..."}`, `execute_write`)
+- **GitHub**: `app.github.list_issues` (`{"owner": "...", "repo": "..."}`, `execute_read`), `app.github.create_issue` (`{"owner": "...", "repo": "...", "title": "...", "body": "..."}`, `execute_write`)
+- **Slack**: `app.slack.send_message` (`{"channel": "#general", "text": "..."}`, `execute_write`)
+- **Notion**: `app.notion.search_pages` (`{"query": "..."}`, `execute_read`)
+- **Linear**: `app.linear.create_issue` (`{"team_id": "ENG", "title": "..."}`, `execute_write`)
+- **Google Calendar**: `app.googlecalendar.list_events` (`{"calendar_id": "primary"}`, `execute_read`)
+- **Jira**: `app.jira.create_issue` (`{"project_key": "ENG", "summary": "..."}`, `execute_write`)
+- **HubSpot**: `app.hubspot.search_contacts` (`{"query": "..."}`, `execute_read`)
+- **Discord**: `app.discord.send_message` (`{"channel_id": "...", "content": "..."}`, `execute_write`)
+- **Google Drive**: `app.googledrive.search_files` (`{"query": "..."}`, `execute_read`)
+- **Airtable**: `app.airtable.list_records` (`{"base_id": "...", "table_name": "..."}`, `execute_read`)
+- **Salesforce**: `app.salesforce.query_records` (`{"soql": "SELECT Id, Name FROM Account LIMIT 5"}`, `execute_read`)
+- **External User OAuth Handoff**:
+  1. Call `plan_action` for the `app.*` tool (or call `start_connection({ provider: "<provider>" })` directly).
+  2. When `authHandoff.required: true` is returned, present `authHandoff.redirectUrl` (or `connection.redirectUrl`) to the user so they can authorize in their browser.
+  3. Poll `wait_for_connection({ provider: "<provider>" })` (or `connection_status({ provider: "<provider>" })`) until `ready: true` (`status === "active"`).
+  4. Resume the original `plan.id` with `execute_read` or `execute_write`.
+
+### 3. Stripe Projects Cloud Infrastructure Provisioning (`stripe_projects` → `execute_provisioning`)
+Provision live cloud databases, caches, auth, sandboxes, and hosting through Muxo's Stripe Projects catalog; connection strings and API keys are automatically encrypted in the AES-256-GCM Muxo Vault (`envVarKeys`):
+- **Databases & Data**: `resource.turso.database`, `resource.neon.postgres`, `resource.supabase.project`, `resource.upstash.redis`, `resource.prisma.database`, `resource.planetscale.postgresql`, `resource.clickhouse.clickhouse`, `resource.chroma.database`
+- **Cloud Hosting & Edge**: `resource.cloudflare.worker`, `resource.vercel.project`, `resource.railway.hosting`, `resource.flyio.app`, `resource.render.static_site`, `resource.netlify.project`, `resource.herenow.hosting`
+- **Auth & Identity**: `resource.clerk.auth`, `resource.workos.auth`, `resource.auth0.client`
+- **AI, Search, Browser & Sandboxes**: `resource.e2b.sandboxes`, `resource.daytona.sandbox`, `resource.browserbase.project`, `resource.steel.browser`, `resource.exa.search`, `resource.firecrawl.api`, `resource.perplexity.api`, `resource.openrouter.api`, `resource.supermemory.memory`, `resource.elevenlabs.tts`
+- **Email, Comms, Observability & Commerce**: `resource.resend.email`, `resource.agentmail.api`, `resource.agentphone.number`, `resource.twilio.email`, `resource.sentry.project`, `resource.posthog.analytics`, `resource.datadog.observability`, `resource.inngest.app`, `resource.cloudinary.media`, `resource.shopify.store`, `resource.spaceship.domain`
+- **Lifecycle Management**: `resource.projects.status` (`execute_read`), `resource.projects.rotate_credentials` (`execute_provisioning`), `resource.projects.deprovision` (`execute_destructive`)
+- Standard input: `{"resource_name": "my-service", "plan": "free"}` → `plan_action` → `execute_provisioning`.
+
+### 4. Stripe Billing, Credits & Subscriptions (`stripe_billing` → `execute_financial`)
+- Top Up Prepaid Credits: `billing.credits.topup` — `{"credits": 1000}` (`execute_financial`)
+- Upgrade to Starter Plan ($29/mo, 10,000 actions/mo + 1,000 bonus credits): `billing.subscription.upgrade` — `{"tier": "starter"}` (`execute_financial`)
+- Create Stripe Checkout Session URL: `billing.checkout.create` — `{"kind": "credit_topup", "credits": 1000}` (`execute_financial`)
+
+## Safety & Secret Custody
+
+- **Single-Execution & Safety Guardrails**: Every mutation or provisioning call creates a governed `plan_*` evaluated against workspace safety rules. Execute each confirmed plan exactly once on its matching risk lane (`execute_read`, `execute_write`, `execute_admin`, `execute_financial`, `execute_provisioning`, `execute_destructive`).
+- **Uncertain Write Boundary**: After a timeout or unclear write/provisioning result, check `get_run` or `get_receipt` before doing anything else.
+- **Secret Custody**: Provisioned infrastructure credentials are encrypted in the Muxo AES-256-GCM Vault and redacted from Workspace Memory. Never expose raw tokens or connection secrets in chat responses.

package/plugins/muxo/skills/muxo/agents/openai.yaml

@@ -0,0 +1,12 @@
+interface:
+  display_name: "Muxo"
+  short_description: "Governed SaaS, Instant Web/SEO tools, Cloud Infrastructure, and Workspace Memory"
+  default_prompt: "Audit https://muxo.ai for technical SEO and crawl its top pages."
+
+dependencies:
+  tools:
+    - type: "mcp"
+      value: "muxo"
+      description: "Muxo Governed Execution, Instant Web/SEO Tools, Connected Apps, and Cloud Infrastructure MCP Server"
+      transport: "streamable_http"
+      url: "https://api.muxo.ai/mcp"

package/plugins/muxo/skills/muxo/references/cli.md

@@ -1,6 +1,8 @@
 # Local Muxo CLI
 
-Prefer this path in terminal, Codex, Claude Code, and Droid environments when the `muxo` command is available. It supports governed SaaS actions (`app.*`), zero-OAuth Instant tools (`instant.*`), live cloud infrastructure provisioning (`resource.*`), interactive OAuth handoffs, and local `.env` credential pulls.
+> **Requirement:** `@muxoai/cli` requires **Node.js 22+** (`node >= 22.0.0`).
+
+Prefer this path in terminal, Codex, Claude Code, and Droid environments when the `muxo` command is available. By default, `muxo login --signup` and `muxo mcp` connect to the live hosted workspace at `https://api.muxo.ai`. It supports governed SaaS actions (`app.*`), zero-OAuth Instant tools (`instant.*`), live cloud infrastructure provisioning (`resource.*`), interactive browser OAuth handoffs, and local `.env` credential pulls.
 
 ## Workflow
 
@@ -47,7 +49,7 @@ Prefer this path in terminal, Codex, Claude Code, and Droid environments when th
    muxo env pull --out .env.muxo
    ```
 
-6. **Recall Supermemory v5 context & verify Ed25519 governance receipts**:
+6. **Recall Workspace Memory & verify execution audit records**:
    ```bash
    muxo memory "database provisioning"
    muxo governance

package/plugins/muxo/skills/muxo/references/mcp.md

@@ -1,21 +1,27 @@
 # Hosted Muxo MCP App
 
-Use this path in ChatGPT web/app, when no usable terminal exists, or when the user explicitly requests the hosted MCP surface. The runtime's tool descriptions and schemas are the source of truth.
+Use this path in ChatGPT web/app, when no usable terminal exists, or when the user explicitly requests the hosted MCP surface (`https://api.muxo.ai/mcp`). The runtime's tool descriptions and schemas are the source of truth.
 
-## Workflow
+## Workflow across all 4 Pillars
 
-1. **Context & Memory Recall**: Call `get_run_context({ query })` when workspace facts, prior execution history (Supermemory v5), provisioned resources, or Microsoft Agent Governance status are relevant to the task.
+1. **Context & Memory Recall**:
+   - Call `get_run_context({ query })` when workspace facts, prior execution history, provisioned resources, or workspace safety status are relevant to the task.
 2. **Discovery & Schema Inspection**:
-   - Call `search_tools({ query, lane })` across `composio_instant` (`instant.*`), `composio_sdk` (`app.*`), or `stripe_projects` (`resource.*`).
+   - Call `search_tools({ query, lane, toolkit })` across:
+     - **Instant Tools (`lane: "composio_instant"`)**: `instant.seo.audit`, `instant.web.crawl`, `instant.web.scrape`, `instant.web.search`, `instant.dns.lookup`, `instant.github.repo_intel`, `instant.hackernews.top_stories`
+     - **Composio Connected Apps (`lane: "composio_sdk"`)**: 1,000+ SaaS apps (`app.github.*`, `app.gmail.*`, `app.slack.*`, `app.notion.*`, `app.linear.*`, `app.googlecalendar.*`, `app.jira.*`, `app.hubspot.*`, `app.discord.*`, `app.googledrive.*`, `app.airtable.*`, `app.salesforce.*`, plus live Composio `/api/v3/tools` search)
+     - **Stripe Projects Cloud Infrastructure (`lane: "stripe_projects"`)**: 36+ infrastructure providers (`resource.turso.database`, `resource.neon.postgres`, `resource.supabase.project`, `resource.upstash.redis`, `resource.cloudflare.worker`, `resource.vercel.project`, `resource.prisma.database`, `resource.clerk.auth`, `resource.workos.auth`, `resource.auth0.client`, `resource.planetscale.postgresql`, `resource.clickhouse.clickhouse`, `resource.chroma.database`, `resource.e2b.sandboxes`, `resource.daytona.sandbox`, `resource.browserbase.project`, `resource.steel.browser`, `resource.exa.search`, `resource.firecrawl.api`, `resource.perplexity.api`, `resource.openrouter.api`, `resource.supermemory.memory`, `resource.resend.email`, `resource.sentry.project`, `resource.posthog.analytics`, `resource.datadog.observability`, `resource.inngest.app`, `resource.railway.hosting`, `resource.flyio.app`, `resource.render.static_site`, `resource.netlify.project`, `resource.herenow.hosting`, `resource.cloudinary.media`, `resource.elevenlabs.tts`, `resource.agentmail.api`, `resource.agentphone.number`, `resource.twilio.email`, `resource.shopify.store`, `resource.spaceship.domain`)
+     - **Stripe Billing (`lane: "stripe_billing"`)**: `billing.credits.topup`, `billing.subscription.upgrade`, `billing.checkout.create`
    - Call `inspect_tool({ tool_slug })` to inspect the JSON input schema, `riskLevel`, and `creditCost`.
 3. **Governed Planning**:
-   - Call `plan_action({ tool_slug, input, reason })` to evaluate policy, scan for prompt injection (`McpSecurityScanner`), sign an Ed25519 `DecisionRecord`, and receive `plan.id`.
-4. **External User OAuth Handoff & Recovery**:
+   - Call `plan_action({ tool_slug, input, reason })` to evaluate workspace safety policy, scan inputs, recall workspace context, and receive `plan.id`.
+4. **External User OAuth Handoff & Recovery (`composio_sdk` / `app.*`)**:
    - If `plan_action` returns `authHandoff.required: true` (or a connection is missing), share `authHandoff.redirectUrl` (or call `start_connection({ provider })`) so the user can authorize in their browser.
-   - Poll `wait_for_connection({ provider, timeout_seconds: 15 })` until `connected: true` (`status: "active"`), then resume the original `plan.id`.
-5. **Risk-Scoped Execution & Receipts**:
+   - Poll `wait_for_connection({ provider, timeout_seconds: 15 })` or `connection_status({ provider })` until `connected: true` (`status: "active"`), then resume the original `plan.id`.
+5. **Risk-Scoped Execution & Audit Verification**:
    - Call the matching execution tool (`execute_read`, `execute_write`, `execute_admin`, `execute_financial`, `execute_provisioning`, or `execute_destructive`) with `{ plan_id }`.
-   - Call `get_receipt({ receipt_id })` to verify the dual HMAC-SHA256 + Ed25519 cryptographic receipt when audit proof is needed.
+   - For Stripe Projects provisioning (`execute_provisioning`), connection secrets are automatically saved in the encrypted Muxo Vault and returned by key name in `envVarKeys`.
+   - Call `get_receipt({ receipt_id })` to verify the cryptographic execution receipt when proof is needed.
 
 ## Failure boundaries
 

package/plugins/muxo/skills/setup/SKILL.md

@@ -11,11 +11,17 @@ Welcome to **Muxo** — the unified execution, cloud provisioning, contextual me
 
 1. If you are in **ChatGPT** or **Codex** with the hosted Muxo MCP server (`https://api.muxo.ai/mcp`) enabled:
    - Call `get_profile` and `get_organization` to confirm your workspace ID, credit balance (`fundingMode: "muxo_funded"`), and active governance policy.
-2. If you are in a terminal environment and prefer the local CLI:
+2. If you are in a terminal environment and prefer the local CLI (requires **Node.js 22+**):
    ```bash
    npx -y @muxoai/cli@latest login --signup --name "my-agent"
    muxo whoami
    ```
+   This CLI-first signup calls `POST https://api.muxo.ai/api/v1/agents/signup` to provision a hosted workspace, 250 starter credits, and `mk_live_*` API key in `~/.muxo/config.json`.
+3. Harness-specific setup:
+   - **Claude Code**: `claude plugin marketplace add https://api.muxo.ai/.claude-plugin/marketplace.json && claude plugin install muxo@muxo`
+   - **OpenAI Codex**: Add a Git repository or local marketplace directory containing `.agents/plugins/marketplace.json`, or configure `[mcp_servers.muxo]` (`url = "https://api.muxo.ai/mcp"`) in `~/.codex/config.toml`.
+   - **Claude Desktop**: Use **Settings → Connectors → Add custom connector** (`https://api.muxo.ai/mcp`) for hosted MCP, or configure `npx -y @muxoai/cli@latest mcp` in `claude_desktop_config.json` for the local stdio server.
+   - **ChatGPT**: Open **Plugins → + → Add custom MCP server** and enter `https://api.muxo.ai/mcp` (OAuth registration supports CIMD or DCR).
 
 ## Step 2: Connect your first SaaS app or run an Instant tool
 
@@ -24,5 +30,5 @@ Welcome to **Muxo** — the unified execution, cloud provisioning, contextual me
 - **Connected Apps (`app.*`)** use automatic OAuth handoff:
   - Plan any action (e.g., `app.github.create_issue` or `app.gmail.fetch_emails`) via `plan_action`.
   - If the app is not connected yet, `plan_action` returns `authHandoff.redirectUrl`. Open that link to authorize, then call `wait_for_connection({ provider })` to resume.
-- **Cloud Infrastructure (`resource.*`)** provisions live databases and services via Stripe Projects:
+- **Cloud Infrastructure (`resource.*`)** provisions live databases and services through Muxo Cloud Infrastructure:
   - Provision Turso SQLite (`resource.turso.database`), Neon Postgres (`resource.neon.postgres`), Supabase (`resource.supabase.project`), or Upstash Redis (`resource.upstash.redis`) and pull encrypted `.env` credentials via `muxo env pull`.

package/plugins/muxo/skills/setup/agents/openai.yaml

@@ -0,0 +1,12 @@
+interface:
+  display_name: "Muxo Setup"
+  short_description: "Guided onboarding and connection verification for Muxo in ChatGPT and Codex"
+  default_prompt: "Check my Muxo profile and organization status."
+
+dependencies:
+  tools:
+    - type: "mcp"
+      value: "muxo"
+      description: "Muxo Governed Execution, Instant Web/SEO Tools, Connected Apps, and Cloud Infrastructure MCP Server"
+      transport: "streamable_http"
+      url: "https://api.muxo.ai/mcp"