@muxoai/platform 1.3.0 → 1.3.2

package/dist/mcp.js

@@ -2,11 +2,19 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { ROOT_DIR } from "./config.js";
+import { MUXO_VERSION } from "./version.js";
+const DEFAULT_TOOL_SECURITY_SCHEMES = [
+    { type: "noauth" },
+    {
+        type: "oauth2",
+        scopes: ["muxo:mcp", "muxo:read", "muxo:execute", "muxo:provision"],
+    },
+];
 /**
  * Concise server instructions (<512 chars) per OpenAI Plugin MCP Server specification:
  * https://developers.openai.com/plugins/build/mcp-server
  */
-export const MUXO_MCP_SERVER_INSTRUCTIONS = "Muxo governs SaaS actions (Composio app.*), Instant tools (instant.*), Cloud Infrastructure (Stripe Projects resource.*), Supermemory v5 recall, and Microsoft Agent Governance Ed25519 receipts. Workflow: 1) search_tools & inspect_tool. 2) plan_action to get a plan_*. 3) If authHandoff.required is true, show redirectUrl and call wait_for_connection. 4) Execute via the matching risk tool (execute_read/write/admin/financial/provisioning/destructive). 5) Verify via get_receipt.";
+export const MUXO_MCP_SERVER_INSTRUCTIONS = "Muxo governs SaaS actions (Connected Apps: app.*), Instant tools (instant.*), Cloud Infrastructure (resource.*), Workspace Memory recall, and verifiable audit records. Workflow: 1) search_tools & inspect_tool. 2) plan_action to get a plan_*. 3) If authHandoff.required is true, show redirectUrl and call wait_for_connection. 4) Execute via the matching risk tool (execute_read/write/admin/financial/provisioning/destructive). 5) Verify via get_receipt.";
 export const MUXO_MCP_TOOLS = [
     {
         name: "get_profile",
@@ -18,17 +26,59 @@ export const MUXO_MCP_TOOLS = [
             additionalProperties: false,
         },
         outputSchema: {
+            $schema: "https://json-schema.org/draft/2020-12/schema",
             type: "object",
             properties: {
-                id: { type: "string", description: "Unique user identifier" },
-                name: { type: "string", description: "Display name" },
-                email: { type: "string", description: "Email address" },
-                workspaceId: { type: "string", description: "Active workspace ID" },
-                workspaceName: { type: "string", description: "Active workspace name" },
-                tier: { type: "string", description: "Workspace subscription tier" },
+                id: {
+                    type: "string",
+                    minLength: 1,
+                    pattern: "\\S",
+                    description: "Unique identifier for the user.",
+                },
+                name: {
+                    type: "string",
+                    description: "Full name of the user.",
+                },
+                email: {
+                    type: "string",
+                    description: "Email address of the user.",
+                },
+                nickname: {
+                    type: "string",
+                    description: "Handle or username of the user.",
+                },
+                workspaceId: {
+                    type: "string",
+                    description: "Active workspace ID.",
+                },
+                workspaceName: {
+                    type: "string",
+                    description: "Active workspace name.",
+                },
+                tier: {
+                    type: "string",
+                    description: "Workspace subscription tier.",
+                },
+                authType: {
+                    type: "string",
+                    description: "Authentication type (session or api_key).",
+                },
+                actorId: {
+                    type: "string",
+                    description: "Actor identifier.",
+                },
+                user: {
+                    type: "object",
+                    description: "User profile record.",
+                },
             },
             required: ["id"],
+            additionalProperties: false,
         },
+        securitySchemes: [
+            { type: "noauth" },
+            { type: "oauth2", scopes: ["muxo:read"] },
+        ],
         annotations: {
             readOnlyHint: true,
             destructiveHint: false,
@@ -56,7 +106,7 @@ export const MUXO_MCP_TOOLS = [
     {
         name: "search_tools",
         title: "Search Unified Tool Catalog",
-        description: "Search the unified Muxo catalog across Connected Apps (Composio SDK: app.*), Instant Tools (Composio Instant: instant.*), and Cloud Infrastructure (Stripe Projects: resource.*).",
+        description: "Search the unified Muxo catalog across Connected Apps (app.*), Instant Tools (instant.*), and Cloud Infrastructure (resource.*).",
         inputSchema: {
             type: "object",
             properties: {
@@ -114,7 +164,7 @@ export const MUXO_MCP_TOOLS = [
     {
         name: "connection_status",
         title: "Check Connection Status",
-        description: "Check connection status across Composio OAuth apps, Instant wallet, and linked Stripe Projects cloud providers.",
+        description: "Check connection status across Connected Apps, Instant Tools, and linked Cloud Infrastructure providers.",
         inputSchema: {
             type: "object",
             properties: {
@@ -125,7 +175,7 @@ export const MUXO_MCP_TOOLS = [
                 sync_live: {
                     type: "boolean",
                     default: true,
-                    description: "Whether to sync live status from upstream Composio and Stripe Projects",
+                    description: "Whether to sync live connection status from upstream providers",
                 },
             },
             additionalProperties: false,
@@ -139,7 +189,7 @@ export const MUXO_MCP_TOOLS = [
     {
         name: "start_connection",
         title: "Start OAuth Connection Handoff",
-        description: "Initiate a managed OAuth connection handoff for a Connected App (Composio) or link a cloud provider (Stripe Projects).",
+        description: "Initiate a managed OAuth connection handoff for a Connected App or link a Cloud Infrastructure provider.",
         inputSchema: {
             type: "object",
             required: ["provider"],
@@ -195,7 +245,7 @@ export const MUXO_MCP_TOOLS = [
     {
         name: "plan_action",
         title: "Create Governed Action Plan",
-        description: "Create a governed execution plan (plan_*) for any tool, billing operation, or infrastructure provisioning operation. Accepts either an exact tool_slug (e.g. 'instant.seo.audit', 'billing.credits.topup', 'resource.turso.database') or a natural-language instruction (e.g. 'audit seo for https://muxo.ai'). Evaluates workspace policy, risk level, Supermemory v5 recall, Ed25519 signature, BYOK vs Muxo-funded mode, and credit balance.",
+        description: "Create a governed execution plan (plan_*) for any tool, billing operation, or infrastructure provisioning operation. Accepts either an exact tool_slug (e.g. 'instant.seo.audit', 'billing.credits.topup', 'resource.turso.database') or a natural-language instruction (e.g. 'audit seo for https://muxo.ai'). Evaluates workspace policy, risk level, Workspace Memory recall, safety guardrails, BYOK vs Muxo-funded mode, and credit balance.",
         inputSchema: {
             type: "object",
             required: ["tool_slug"],
@@ -526,6 +576,8 @@ description: Guided onboarding skill for setting up the Muxo plugin in OpenAI Ch
 
 Call \`get_profile\` and \`get_organization\` to verify your workspace connection, or run \`npx -y @muxoai/cli@latest login --signup\` in a terminal.
 `);
+    const muxoOpenaiYaml = readSkillFileOrDefault("muxo/agents/openai.yaml", `interface:\n  display_name: "Muxo"\n  short_description: "Governed SaaS, Instant Web/SEO tools, Cloud Infrastructure, and Workspace Memory"\n  default_prompt: "Audit https://muxo.ai for technical SEO and crawl its top pages."\n\ndependencies:\n  tools:\n    - type: "mcp"\n      value: "muxo"\n      description: "Muxo Governed Execution, Instant Web/SEO Tools, Connected Apps, and Cloud Infrastructure MCP Server"\n      transport: "streamable_http"\n      url: "https://api.muxo.ai/mcp"\n`);
+    const setupOpenaiYaml = readSkillFileOrDefault("setup/agents/openai.yaml", `interface:\n  display_name: "Muxo Setup"\n  short_description: "Guided onboarding and connection verification for Muxo in ChatGPT and Codex"\n  default_prompt: "Check my Muxo profile and organization status."\n\ndependencies:\n  tools:\n    - type: "mcp"\n      value: "muxo"\n      description: "Muxo Governed Execution, Instant Web/SEO Tools, Connected Apps, and Cloud Infrastructure MCP Server"\n      transport: "streamable_http"\n      url: "https://api.muxo.ai/mcp"\n`);
     const muxoFm = parseFrontmatter(muxoSkillMd);
     const setupFm = parseFrontmatter(setupSkillMd);
     const muxoFiles = [
@@ -537,6 +589,14 @@ Call \`get_profile\` and \`get_organization\` to verify your workspace connectio
             mimeType: "text/markdown",
             content: muxoSkillMd,
         },
+        {
+            path: "agents/openai.yaml",
+            uri: "skill://muxo/muxo/agents/openai.yaml",
+            size: Buffer.byteLength(muxoOpenaiYaml, "utf8"),
+            digest: sha256Digest(muxoOpenaiYaml),
+            mimeType: "application/yaml",
+            content: muxoOpenaiYaml,
+        },
         {
             path: "references/cli.md",
             uri: "skill://muxo/muxo/references/cli.md",
@@ -563,6 +623,14 @@ Call \`get_profile\` and \`get_organization\` to verify your workspace connectio
             mimeType: "text/markdown",
             content: setupSkillMd,
         },
+        {
+            path: "agents/openai.yaml",
+            uri: "skill://muxo/setup/agents/openai.yaml",
+            size: Buffer.byteLength(setupOpenaiYaml, "utf8"),
+            digest: sha256Digest(setupOpenaiYaml),
+            mimeType: "application/yaml",
+            content: setupOpenaiYaml,
+        },
     ];
     const muxoName = muxoFm.name || "muxo";
     const muxoDesc = muxoFm.description ||
@@ -746,7 +814,7 @@ export async function handleJsonRpcMcpRequest(engine, ctx, rpc) {
                     instructions: MUXO_MCP_SERVER_INSTRUCTIONS,
                     serverInfo: {
                         name: "muxo-mcp-server",
-                        version: "1.3.0",
+                        version: MUXO_VERSION,
                     },
                     capabilities: {
                         tools: { listChanged: false },
@@ -766,7 +834,10 @@ export async function handleJsonRpcMcpRequest(engine, ctx, rpc) {
                 jsonrpc: "2.0",
                 id,
                 result: {
-                    tools: MUXO_MCP_TOOLS,
+                    tools: MUXO_MCP_TOOLS.map((t) => ({
+                        ...t,
+                        securitySchemes: t.securitySchemes || DEFAULT_TOOL_SECURITY_SCHEMES,
+                    })),
                 },
             };
         }
@@ -795,9 +866,14 @@ export async function handleJsonRpcMcpRequest(engine, ctx, rpc) {
         // SEP-2640 Skills Import Extension (`io.modelcontextprotocol/skills`)
         if (method === "skills/list") {
             const skills = getMuxoMcpSkills().map((s) => ({
+                uri: s.uri,
+                frontmatter: s.frontmatter,
+                resources: s.files.map((f) => ({
+                    uri: f.uri,
+                    digest: f.digest,
+                })),
                 name: s.name,
                 description: s.description,
-                uri: s.uri,
                 version: s.version,
                 digest: s.files[0]?.digest || "",
                 files: s.files.length,
@@ -809,30 +885,39 @@ export async function handleJsonRpcMcpRequest(engine, ctx, rpc) {
             };
         }
         if (method === "skills/get") {
+            const requestedUri = String(params.uri || "").trim();
             const requestedName = String(params.name || "muxo").trim();
-            const skill = getMuxoMcpSkills().find((s) => s.name === requestedName);
+            const skill = getMuxoMcpSkills().find((s) => s.uri === requestedUri || s.name === requestedName);
             if (!skill) {
                 return {
                     jsonrpc: "2.0",
                     id,
                     error: {
                         code: -32602,
-                        message: `Skill not found: ${requestedName}`,
+                        message: `Skill not found: ${requestedUri || requestedName}`,
                     },
                 };
             }
+            const resources = skill.files.map((f) => ({
+                uri: f.uri,
+                digest: f.digest,
+            }));
             return {
                 jsonrpc: "2.0",
                 id,
                 result: {
                     skill: {
+                        uri: skill.uri,
+                        frontmatter: skill.frontmatter,
+                        resources,
                         name: skill.name,
                         description: skill.description,
-                        uri: skill.uri,
                         version: skill.version,
                         digest: skill.files[0]?.digest || "",
                     },
+                    uri: skill.uri,
                     frontmatter: skill.frontmatter,
+                    resources,
                     files: skill.files.map((f) => ({
                         path: f.path,
                         uri: f.uri,
@@ -894,17 +979,19 @@ export async function handleJsonRpcMcpRequest(engine, ctx, rpc) {
         };
     }
     catch (err) {
+        const errPayload = {
+            ok: false,
+            error: String(err?.message || err || "MCP tool execution failed"),
+        };
         return {
             jsonrpc: "2.0",
             id,
             result: {
+                structuredContent: errPayload,
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({
-                            ok: false,
-                            error: String(err?.message || err || "MCP tool execution failed"),
-                        }, null, 2),
+                        text: JSON.stringify(errPayload, null, 2),
                     },
                 ],
                 isError: true,

package/dist/nl.js

@@ -80,23 +80,39 @@ export function extractParametersFromNaturalLanguage(prompt, tool, explicitInput
             input.numResults = extractNumberAfterKeyword(text, ["results", "limit", "top"], 5);
         }
     }
-    else if (slug === "instant.code.execute") {
-        if (!input.language) {
+    else if (slug === "instant.code.execute" || slug === "instant.composio.workbench") {
+        if (!input.language && slug === "instant.code.execute") {
             input.language = /\b(javascript|js|node|typescript|ts)\b/i.test(text)
                 ? "javascript"
                 : "python";
         }
-        if (!input.code) {
-            const codeBlock = text.match(/```(?:\w+)?\n([\s\S]*?)```/);
-            if (codeBlock) {
-                input.code = codeBlock[1].trim();
+        const codeBlock = text.match(/```(?:\w+)?\n([\s\S]*?)```/);
+        const inlineCode = text.match(/`([^`]+)`/);
+        const extractedCode = codeBlock
+            ? codeBlock[1].trim()
+            : inlineCode
+                ? inlineCode[1].trim()
+                : text;
+        if (slug === "instant.composio.workbench") {
+            if (!input.code_to_execute) {
+                input.code_to_execute = String(input.code || extractedCode);
             }
-            else {
-                const inlineCode = text.match(/`([^`]+)`/);
-                if (inlineCode)
-                    input.code = inlineCode[1].trim();
+            if (!input.thought) {
+                input.thought = `Natural language workbench execution: ${text.slice(0, 80)}`;
             }
         }
+        else if (!input.code) {
+            input.code = extractedCode;
+        }
+    }
+    else if (slug === "instant.github.repo_intel") {
+        const repoMatch = text.match(/\b([a-zA-Z0-9_.-]+)\/([a-zA-Z0-9_.-]+)\b/);
+        if (repoMatch && !repoMatch[0].includes(".ai") && !repoMatch[0].includes(".com")) {
+            if (!input.owner)
+                input.owner = repoMatch[1];
+            if (!input.repo)
+                input.repo = repoMatch[2];
+        }
     }
     else if (slug.startsWith("resource.")) {
         if (!input.resource_name && !input.name) {
@@ -235,13 +251,19 @@ function scoreToolForPrompt(prompt, tool) {
         if (slug === "instant.web.scrape")
             score += 110;
     }
-    if (/\b(search\s+the\s+web|web\s+search|search\s+for|look\s+up|find\s+news|exa|google)\b/i.test(q)) {
+    const isExplicitWebSearch = /\b(search\s+(?:the\s+)?web|web\s+search|search\s+online|search\s+(?:for|about)|look\s+up|find\s+(?:news|info|information|articles)|exa|google)\b/i.test(q);
+    const hasProvisionVerb = /\b(provision|create|deploy|spin\s+up|setup|set\s+up|add\s+resource|new\s+db|new\s+database|database|db)\b/i.test(q);
+    if (isExplicitWebSearch) {
         if (slug === "instant.web.search")
-            score += 105;
+            score += 155;
+    }
+    if (/\b(run\s+python|execute\s+code|run\s+script|sandbox|workbench|calculate|e2b)\b/i.test(q)) {
+        if (slug === "instant.code.execute" || slug === "instant.composio.workbench")
+            score += 125;
     }
-    if (/\b(run\s+python|execute\s+code|run\s+script|sandbox|calculate|e2b)\b/i.test(q)) {
-        if (slug === "instant.code.execute")
-            score += 105;
+    if (/\b(repo\s+intel|github\s+repo|inspect\s+repo|repository\s+intel|stars\s+and\s+forks)\b/i.test(q)) {
+        if (slug === "instant.github.repo_intel")
+            score += 135;
     }
     if (/\b(top\s*up|add\s+credits|buy\s+credits|refill\s+credits|more\s+credits|\d+\s+credits)\b/i.test(q)) {
         if (slug === "billing.credits.topup")
@@ -255,27 +277,29 @@ function scoreToolForPrompt(prompt, tool) {
         if (slug === "billing.checkout.create")
             score += 125;
     }
-    if (/\b(turso|libsql|sqlite\s+database|sqlite\s+db)\b/i.test(q)) {
-        if (slug.startsWith("resource.turso."))
-            score += 120;
-        if (slug.includes("database"))
-            score += 15;
-    }
-    if (/\b(neon|postgres|postgresql|pg\s+database)\b/i.test(q)) {
-        if (slug.startsWith("resource.neon."))
-            score += 120;
-    }
-    if (/\b(upstash|redis|cache\s+store|kv\s+store)\b/i.test(q)) {
-        if (slug.startsWith("resource.upstash."))
-            score += 120;
-    }
-    if (/\b(supabase)\b/i.test(q)) {
-        if (slug.startsWith("resource.supabase."))
-            score += 120;
-    }
-    if (/\b(mongodb|mongo)\b/i.test(q)) {
-        if (slug.startsWith("resource.mongodb."))
-            score += 120;
+    if (!isExplicitWebSearch || hasProvisionVerb) {
+        if (/\b(turso|libsql|sqlite\s+database|sqlite\s+db)\b/i.test(q)) {
+            if (slug.startsWith("resource.turso."))
+                score += 120;
+            if (slug.includes("database"))
+                score += 15;
+        }
+        if (/\b(neon|postgres|postgresql|pg\s+database)\b/i.test(q)) {
+            if (slug.startsWith("resource.neon."))
+                score += 120;
+        }
+        if (/\b(upstash|redis|cache\s+store|kv\s+store)\b/i.test(q)) {
+            if (slug.startsWith("resource.upstash."))
+                score += 120;
+        }
+        if (/\b(supabase)\b/i.test(q)) {
+            if (slug.startsWith("resource.supabase."))
+                score += 120;
+        }
+        if (/\b(mongodb|mongo)\b/i.test(q)) {
+            if (slug.startsWith("resource.mongodb."))
+                score += 120;
+        }
     }
     if (/\b(hacker\s*news|hn\s+stories|top\s+stories)\b/i.test(q)) {
         if (slug === "instant.hackernews.top_stories")

package/dist/policy.d.ts

@@ -0,0 +1,9 @@
+import type { GovernancePolicy } from "./types.js";
+export declare class PolicyValidationError extends Error {
+}
+/**
+ * Validates a client-supplied policy patch. Kill-switch fields are rejected so
+ * that pausing and resuming always goes through /api/v1/governance/kill-switch,
+ * which records the trust-score penalty and audit entry.
+ */
+export declare function sanitizePolicyPatch(body: unknown): Partial<GovernancePolicy>;

package/dist/policy.js

@@ -0,0 +1,73 @@
+const RISK_LEVELS = [
+    "read",
+    "write",
+    "admin",
+    "financial",
+    "provisioning",
+    "destructive",
+];
+export class PolicyValidationError extends Error {
+}
+/**
+ * Validates a client-supplied policy patch. Kill-switch fields are rejected so
+ * that pausing and resuming always goes through /api/v1/governance/kill-switch,
+ * which records the trust-score penalty and audit entry.
+ */
+export function sanitizePolicyPatch(body) {
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+        throw new PolicyValidationError("Policy update must be a JSON object");
+    }
+    const input = body;
+    if ("killSwitchActive" in input || "killSwitchReason" in input) {
+        throw new PolicyValidationError("Use POST /api/v1/governance/kill-switch to pause or resume agents");
+    }
+    const patch = {};
+    if (input.mode !== undefined) {
+        if (input.mode !== "monitor" && input.mode !== "enforce") {
+            throw new PolicyValidationError('mode must be "monitor" or "enforce"');
+        }
+        patch.mode = input.mode;
+    }
+    if (input.requireApprovalFor !== undefined) {
+        if (!Array.isArray(input.requireApprovalFor) ||
+            !input.requireApprovalFor.every((r) => RISK_LEVELS.includes(r))) {
+            throw new PolicyValidationError(`requireApprovalFor must be a list of: ${RISK_LEVELS.join(", ")}`);
+        }
+        patch.requireApprovalFor = [...new Set(input.requireApprovalFor)];
+    }
+    if (input.executionRing !== undefined) {
+        const ring = Number(input.executionRing);
+        if (![0, 1, 2, 3].includes(ring)) {
+            throw new PolicyValidationError("executionRing must be 0, 1, 2, or 3");
+        }
+        patch.executionRing = ring;
+    }
+    if (input.maxCreditsPerRun !== undefined) {
+        const max = Number(input.maxCreditsPerRun);
+        if (!Number.isFinite(max) || max < 0) {
+            throw new PolicyValidationError("maxCreditsPerRun must be a non-negative number");
+        }
+        patch.maxCreditsPerRun = max;
+    }
+    for (const key of ["allowInstantWallet", "allowProvisioning", "blockDestructiveSql"]) {
+        if (input[key] !== undefined) {
+            if (typeof input[key] !== "boolean") {
+                throw new PolicyValidationError(`${key} must be true or false`);
+            }
+            patch[key] = input[key];
+        }
+    }
+    if (input.blockedToolSlugs !== undefined) {
+        if (!Array.isArray(input.blockedToolSlugs) ||
+            !input.blockedToolSlugs.every((s) => typeof s === "string" && s.trim())) {
+            throw new PolicyValidationError("blockedToolSlugs must be a list of tool slugs");
+        }
+        patch.blockedToolSlugs = [
+            ...new Set(input.blockedToolSlugs.map((s) => s.trim())),
+        ];
+    }
+    if (Object.keys(patch).length === 0) {
+        throw new PolicyValidationError("No supported policy fields in request");
+    }
+    return patch;
+}

package/dist/providers/composio-instant.d.ts

@@ -10,5 +10,9 @@ export declare class ComposioInstantAdapter {
         workspaceId: string;
         tool: MuxoTool;
         input: Record<string, unknown>;
+        composioApiKey?: string | null;
+        exaApiKey?: string | null;
+        firecrawlApiKey?: string | null;
+        masterWalletDepleted?: boolean;
     }): Promise<Record<string, unknown>>;
 }