@muxoai/sdk 1.4.4 → 1.4.5

package/.agents/plugins/marketplace.json

@@ -6,7 +6,7 @@
   "plugins": [
     {
       "name": "muxo",
-      "version": "1.4.4",
+      "version": "1.4.5",
       "description": "Governed execution across 1,000+ Connected Apps, Instant Tools (search, scrape, crawl, SEO audit), Cloud Infrastructure provisioning, Workspace Memory recall, and cryptographic execution receipts.",
       "source": {
         "source": "local",

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
   },
   "metadata": {
     "description": "Official Muxo plugin marketplace for governed execution across Connected Apps, Instant Tools, Cloud Infrastructure, and Workspace Memory.",
-    "version": "1.4.4"
+    "version": "1.4.5"
   },
   "plugins": [
     {
@@ -19,7 +19,7 @@
       },
       "strict": false,
       "description": "Governed execution across 1,000+ Connected Apps, Instant Tools (search, scrape, crawl, SEO audit), Cloud Infrastructure provisioning, Workspace Memory recall, and verifiable audit records.",
-      "version": "1.4.4",
+      "version": "1.4.5",
       "category": "Productivity",
       "skills": [
         "./plugins/muxo/skills/muxo",

package/README.md

@@ -2,7 +2,7 @@
 
 > **Let your AI agents take action across business apps, with approvals, spending controls, and proof of what happened.**
 
-Muxo (`v1.4.4`) is the governed action, workflow automation, cloud provisioning, and business-receipt platform for AI agents and B2B SaaS teams. Before any external write or provisioning action runs, Muxo shows **what changes**, **who is affected**, **the estimated USD cost (`$X.XX` alongside credits or `$0.00` BYOK)**, and **which guardrail triggered approval**. After execution, Muxo issues both a **business-facing receipt** (*what changed, who authorized it, what succeeded, what remains unresolved, and exact USD/credit cost*) and a **cryptographic Ed25519 + SHA-256 audit receipt**.
+Muxo (`v1.4.5`) is the governed action, workflow automation, cloud provisioning, and business-receipt platform for AI agents and B2B SaaS teams. Before any external write or provisioning action runs, Muxo shows **what changes**, **who is affected**, **the estimated USD cost (`$X.XX` alongside credits or `$0.00` BYOK)**, and **which guardrail triggered approval**. After execution, Muxo issues both a **business-facing receipt** (*what changed, who authorized it, what succeeded, what remains unresolved, and exact USD/credit cost*) and a **cryptographic Ed25519 + SHA-256 audit receipt**.
 
 Customers and their agents interact exclusively with **Muxo** — either via tested workflow packs, structured tool slugs, or free-form **Natural Language** (`muxo do`, `POST /api/v1/do`, `client.do()`, and MCP `plan_action`).
 
@@ -121,6 +121,16 @@ Muxo ships a portable OpenAI Plugin (`plugins/muxo/plugin.json` & `plugins/muxo/
 
 ## Architecture & Source Layout
 
+### Domain skills and workspace gateways
+
+Tool inspection and action planning include a `domainSkill` hint when a matching playbook exists. Read its provider pitfalls and required execution lane before planning:
+
+- List skills: `GET /api/v1/skills` or MCP `get_run_context({ action: "skills", provider: "github", category: "app_automation" })`.
+- Read a skill: MCP `get_run_context({ action: "get_skill", slug: "github-automation" })`, `muxo://skills/github-automation`, or `GET /skills/github-automation/SKILL.md`.
+- Reconcile an existing run without replaying it: `get_run_context({ action: "reconcile_run", run_id: "<original-run-id>" })`. Reconciliation reports available run and receipt evidence; it does not guarantee an external effect.
+
+For Composio BYOK, `POST /api/v1/byok` accepts an optional `mcpGatewayUrl` alongside the privately supplied key. Only HTTPS `connect.composio.dev` and `mcp.composio.dev` URLs without embedded credentials, query parameters, or fragments are accepted. Key rotation preserves the workspace gateway; deleting the Composio key removes it. Configure it in the console's BYOK form or through the API. Skills and gateways never grant OAuth consent, approval, or execution authority.
+
 | File / Directory | Responsibility |
 | --- | --- |
 | `ARCHITECTURE.md` | Internal engineering blueprint, Keep/Adopt/Drop ecosystem matrix, and Stripe Projects analysis |

package/dist/composio-catalog.d.ts

@@ -250,6 +250,7 @@ export interface ComposioMcpGatewayResult {
     data: Record<string, unknown> | null;
     error?: string;
 }
+export declare function normalizeComposioByokGatewayUrl(value: string): string;
 export declare function canUseComposioMcpGatewayForExecution(opts: {
     apiKey?: string | null;
     gatewayUrl?: string | null;

package/dist/composio-catalog.js

@@ -1892,6 +1892,18 @@ export function renderDefaultHostedSiteHtml(params) {
 </body>
 </html>`;
 }
+export function normalizeComposioByokGatewayUrl(value) {
+    try {
+        const url = new URL(value.trim());
+        if (url.protocol === "https:" &&
+            ["connect.composio.dev", "mcp.composio.dev"].includes(url.hostname) &&
+            !url.port && !url.username && !url.password && !url.search && !url.hash) {
+            return url.href;
+        }
+    }
+    catch { }
+    throw new Error("MCP gateway must be an HTTPS Composio URL without credentials, query parameters, or fragments.");
+}
 export function canUseComposioMcpGatewayForExecution(opts) {
     const key = String(opts.apiKey || "").trim();
     if (!key)

package/dist/engine.d.ts

@@ -1,4 +1,5 @@
 import type { MuxoConfig } from "./config.js";
+import { type MuxoDomainSkillHint } from "./skills-catalog.js";
 import { exportTemporalEventHistory, type DurableWorkflow } from "./durable-workflow.js";
 import { type CommercialPlaybookDefinition, type CommercialRoiReport, type CompiledPolicyAsCodeBundle, type HarnessConfigurationBundle, type OtelTraceExportBundle, type PolicyAsCodeEvaluationResult, type RunReconciliationReport } from "./oss-suite.js";
 import { type NaturalLanguageResolution } from "./nl.js";
@@ -126,6 +127,7 @@ export declare class MuxoEngine {
             instructions: string;
         };
         humanHandoff?: HumanHandoff;
+        domainSkill?: MuxoDomainSkillHint;
         llmGuidance: LlmGuidance;
         nextStep: string;
     }>;

package/dist/engine.js

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 import { isStripeProjectsExclusiveProvider, normalizeStripeProjectsProviderSlug, wrapMuxoConnectUrl, } from "./composio-catalog.js";
+import { getProviderSkillHint } from "./skills-catalog.js";
 import { APPROVED_PLAN_STATUSES, approvalRequiredError, buildApprovalHumanHandoff, buildApprovalUrl, buildOAuthHumanHandoff, clampWaitSeconds, looksLikeToolSlug, unknownToolError, } from "./mcp-schema.js";
 import { completeCloudProvisioningWorkflow, createCloudProvisioningWorkflow, exportTemporalEventHistory, normalizeWorkflowTarget, rollbackDurableWorkflow as runSagaRollbackOnWorkflow, signalDurableWorkflow as sendSignalToWorkflow, workflowNotFoundError, } from "./durable-workflow.js";
 import { buildMemoryKnowledgeGraph } from "./memory-graph.js";
@@ -174,21 +175,30 @@ export class MuxoEngine {
     // 4. inspect_tool
     async inspectTool(slug) {
         const normalized = slug.trim();
+        const withSkillHint = (tool) => {
+            const hint = getProviderSkillHint(tool.providerSlug || tool.slug, this.config.baseUrl);
+            return hint
+                ? {
+                    ...tool,
+                    domainSkill: hint,
+                }
+                : tool;
+        };
         const billing = this.stripeBilling
             .listTools()
             .find((t) => t.slug.toLowerCase() === normalized.toLowerCase() ||
             t.upstreamSlug.toLowerCase() === normalized.toLowerCase());
         if (billing)
-            return billing;
+            return withSkillHint(billing);
         const instant = this.composioInstant.inspectTool(normalized);
         if (instant)
-            return instant;
+            return withSkillHint(instant);
         const proj = this.stripeProjects.inspectTool(normalized);
         if (proj)
-            return proj;
+            return withSkillHint(proj);
         const sdk = await this.composioSdk.inspectTool(normalized);
         if (sdk)
-            return sdk;
+            return withSkillHint(sdk);
         throw unknownToolError(normalized);
     }
     // 5. connection_status
@@ -692,6 +702,8 @@ export class MuxoEngine {
                 ? this.buildApprovalHandoff(plan)
                 : undefined;
         const llmGuidance = this.buildPlanLlmGuidance(plan, authHandoff);
+        const domainSkill = getProviderSkillHint(tool.providerSlug || tool.slug, this.config.baseUrl) ||
+            undefined;
         return {
             plan,
             tool,
@@ -699,6 +711,7 @@ export class MuxoEngine {
             memoryContext,
             ...(authHandoff ? { authHandoff } : {}),
             ...(humanHandoff ? { humanHandoff } : {}),
+            ...(domainSkill ? { domainSkill } : {}),
             llmGuidance,
             nextStep,
         };
@@ -1347,6 +1360,9 @@ export class MuxoEngine {
                     input: plan.input,
                     connectedAccountId: activeConnId,
                     composioApiKey: composioByok,
+                    mcpGatewayUrl: composioByok
+                        ? this.store.getByokMcpGatewayUrl(ctx.workspace.id)
+                        : null,
                 });
             }
             else if (plan.lane === "stripe_projects") {

package/dist/mcp-schema.js

@@ -1103,6 +1103,9 @@ export const MUXO_MCP_TOOLS = [
                         "workflow_history",
                         "configure_harness",
                         "harness_presets",
+                        "reconcile_run",
+                        "skills",
+                        "get_skill",
                         "kill_switch",
                         "governance_status",
                         "scan_context",
@@ -1110,7 +1113,7 @@ export const MUXO_MCP_TOOLS = [
                         "switch_workspace",
                         "onboard_team",
                     ],
-                    description: "Control-plane operation (or omit action and pass any plain-English prompt): 'inspect' (default), 'remember' (save fact/preference), 'recall' (list memories), 'forget' (delete matching memories), 'memory_graph' (Graphiti bi-temporal entity/relationship lineage with optional as_of time-travel & focal_entity 2-hop BFS), 'set_guardrail' (apply plain-English or structured parameter_rules guardrail), 'reset_guardrails' (restore default safe guardrails), 'check_policy' (dry-run evaluate tool_slug + input against policy and parameter guardrails before planning), 'cedar_policy' (compile/evaluate AWS Cedar & OPA Rego policy-as-code), 'otel_traces' (export W3C OpenTelemetry GenAI/MCP spans & Langfuse batch), 'roi_analytics' (FinOps & BYOK unit-economics ROI report), 'playbooks' / 'create_playbook' / 'run_playbook' (list, author custom, or execute multi-step Temporal Saga playbooks), 'rollback_workflow' / 'signal_workflow' / 'workflow_history' (Temporal workflow lifecycle; accepts workflow_id='latest'), 'configure_harness' / 'harness_presets' (apply turnkey harness presets like startup-builder, strict-production, read-only-auditor, finops-byok-zero-cost and generate ready-to-paste harness config blocks), 'kill_switch' (pause/resume agent execution), 'governance_status' (Microsoft 9-module status + LLM policy brief), 'scan_context' (OWASP ASI-06 check), 'list_workspaces', 'switch_workspace', or 'onboard_team'",
+                    description: "Control-plane operation (or omit action and pass any plain-English prompt): 'inspect' (default), 'remember' (save fact/preference), 'recall' (list memories), 'forget' (delete matching memories), 'memory_graph' (Graphiti bi-temporal entity/relationship lineage with optional as_of time-travel & focal_entity 2-hop BFS), 'set_guardrail' (apply plain-English or structured parameter_rules guardrail), 'reset_guardrails' (restore default safe guardrails), 'check_policy' (dry-run evaluate tool_slug + input against policy and parameter guardrails before planning), 'cedar_policy' (compile/evaluate AWS Cedar & OPA Rego policy-as-code), 'otel_traces' (export W3C OpenTelemetry GenAI/MCP spans & Langfuse batch), 'roi_analytics' (FinOps & BYOK unit-economics ROI report), 'playbooks' / 'create_playbook' / 'run_playbook' (list, author custom, or execute multi-step Temporal Saga playbooks), 'rollback_workflow' / 'signal_workflow' / 'workflow_history' (Temporal workflow lifecycle; accepts workflow_id='latest'), 'configure_harness' / 'harness_presets' (apply turnkey harness presets like startup-builder, strict-production, read-only-auditor, finops-byok-zero-cost and generate ready-to-paste harness config blocks), 'reconcile_run' (verify run state, receipt signature, and upstream side-effect alignment), 'skills' / 'get_skill' (list or fetch governed domain & workflow SKILL.md playbooks), 'kill_switch' (pause/resume agent execution), 'governance_status' (Microsoft 9-module status + LLM policy brief), 'scan_context' (OWASP ASI-06 check), 'list_workspaces', 'switch_workspace', or 'onboard_team'",
                 },
                 prompt: {
                     type: "string",
@@ -1221,7 +1224,16 @@ export const MUXO_MCP_TOOLS = [
                 },
                 slug: {
                     type: "string",
-                    description: "Optional playbook slug or natural-language name when action='run_playbook' (e.g. 'fullstack-cloud-bootstrap', 'competitor-seo-growth-brief', 'incident-containment-audit', 'customer-release-readiness')",
+                    description: "Playbook slug when action='run_playbook', or domain/workflow skill slug when action='get_skill' (e.g. 'github-automation', 'supabase-provisioning')",
+                },
+                provider: {
+                    type: "string",
+                    description: "Provider slug to filter action='skills' or select a provider's skill with action='get_skill'",
+                },
+                category: {
+                    type: "string",
+                    enum: ["governance", "app_automation", "cloud_infrastructure", "workflow"],
+                    description: "Category filter when action='skills'",
                 },
                 workflow_id: {
                     type: "string",

package/dist/mcp.js

@@ -340,6 +340,42 @@ export async function dispatchMcpToolCall(engine, ctx, toolName, args = {}) {
                     prompt: prompt || null,
                 });
             }
+            if (action === "reconcile_run") {
+                const runId = String(args.run_id || args.runId || args.slug || query || prompt || "latest").trim();
+                return engine.reconcileRun(ctx, runId);
+            }
+            if (action === "skills") {
+                const skills = listMuxoSkills({
+                    category: args.category ? String(args.category) : undefined,
+                    provider: args.provider ? String(args.provider) : undefined,
+                    query: query || prompt || undefined,
+                }, engine.config.baseUrl);
+                return {
+                    ok: true,
+                    action: "skills",
+                    count: skills.length,
+                    skills,
+                };
+            }
+            if (action === "get_skill" || action === "skill") {
+                const skillSlug = String(args.slug ||
+                    args.skill_slug ||
+                    args.skillSlug ||
+                    args.provider ||
+                    query ||
+                    prompt ||
+                    "github-automation").trim();
+                const skill = getMuxoSkill(skillSlug, engine.config.baseUrl);
+                if (!skill) {
+                    throw new Error(`Skill '${skillSlug}' not found in Muxo catalog.`);
+                }
+                return {
+                    ok: true,
+                    action: "get_skill",
+                    skill,
+                    markdown: renderMuxoSkillMarkdown(skill.slug, engine.config.baseUrl),
+                };
+            }
             if (action === "governance_status") {
                 return engine.getGovernanceOverview(ctx);
             }

package/dist/oss-suite.js

@@ -451,7 +451,7 @@ export function buildOtelTraceExport(params) {
                     { key: "service.name", value: { stringValue: "muxo-agent-runtime" } },
                     {
                         key: "service.version",
-                        value: { stringValue: params.version || "1.4.4" },
+                        value: { stringValue: params.version || "1.4.5" },
                     },
                     {
                         key: "muxo.workspace.id",
@@ -467,7 +467,7 @@ export function buildOtelTraceExport(params) {
                 {
                     scope: {
                         name: "@muxoai/otel-genai-mcp-tracer",
-                        version: params.version || "1.4.4",
+                        version: params.version || "1.4.5",
                     },
                     spans,
                 },

package/dist/server.js

@@ -120,6 +120,7 @@ Set or inspect them via MCP \`get_run_context({ action: "set_guardrail", prompt:
   - \`muxo://governance/policy\` — Active guardrails, kill-switch status, trust score, and \`llmPolicyBrief\`
   - \`muxo://context\` — Live workspace context, active guardrails, provisioned resources, and \`llmSystemPrompt\`
   - \`muxo://memory/graph\` — Active Supermemory defaults and bi-temporal knowledge graph facts
+  - \`muxo://skills\` & \`muxo://skills/{skillSlug}\` — Governed domain & workflow skills catalog (140+ app, cloud provisioning, and multi-app workflow \`SKILL.md\` playbooks)
 - **MCP Prompts (\`prompts/list\` & \`prompts/get\`)**:
   - \`context\` — Inject workspace memory, active defaults, and guardrail summary
   - \`policy_guardrails\` — Inject the active \`llmSystemDirective\`, risk-lane matrix, and optional dry-run policy simulation for \`tool_slug\`
@@ -719,7 +720,10 @@ export function createMuxoServer(customConfig) {
                         },
                         "/api/v1/byok/{provider}": { delete: { summary: "Delete a BYOK provider key from the vault" } },
                         "/api/v1/tools": { get: { summary: "Search unified catalogue across instant.*, app.*, and resource.*" } },
-                        "/api/v1/tools/{slug}": { get: { summary: "Inspect tool schema, risk level, credit cost, and LLM context URL" } },
+                        "/api/v1/tools/{slug}": { get: { summary: "Inspect tool schema, risk level, credit cost, domainSkill pitfalls, and LLM context URL" } },
+                        "/api/v1/skills": { get: { summary: "List governed domain, cloud provisioning, and multi-app workflow skills" } },
+                        "/api/v1/skills/{slug}": { get: { summary: "Inspect governed domain or workflow skill definition and SKILL.md markdown" } },
+                        "/skills/{slug}/SKILL.md": { get: { summary: "Download governed SKILL.md markdown bundle for any app, cloud provider, or workflow" } },
                         "/api/v1/connections": {
                             get: { summary: "List connected OAuth accounts and cloud providers" },
                             post: { summary: "Start managed OAuth connection handoff" },
@@ -854,7 +858,7 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
             }
             if (pathname === "/llms.txt" && req.method === "GET") {
                 res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
-                res.end(`# Muxo\n> Unified agent execution across Connected Apps, Instant Tools, Cloud Infrastructure, Workspace Memory, and Safety Guardrails.\n\n- Skill Document: ${config.baseUrl}/skill.md\n- Auth Guide: ${config.baseUrl}/auth.md\n- OpenAPI 3.1 Spec: ${config.baseUrl}/api/openapi.json\n- MCP Endpoint: ${config.baseUrl}/mcp\n- OAuth Callback Handoff: ${config.baseUrl}/oauth/callback\n- Plugin Marketplace (Codex/OpenAI): ${config.baseUrl}/.agents/plugins/marketplace.json\n- Plugin Marketplace (Claude/Droid): ${config.baseUrl}/.claude-plugin/marketplace.json\n- Console (app.muxo.ai): ${config.baseUrl}/\n- Landing & Provider Canvas (muxo.ai): ${config.baseUrl}/landing\n- Documentation (docs.muxo.ai): ${config.docsUrl}\n\n## Agent-Native Policy, Context & Governance Interface\n- MCP Control Plane (\`get_run_context\`): \`action: "recall" | "remember" | "forget" | "set_guardrail" | "reset_guardrails" | "check_policy" | "governance_status" | "kill_switch" | "scan_context"\`\n- Strict /v1 Organization Brief: \`get_organization({ company_context: { required: false } })\` returns accepted workspace policy facts + learned defaults in \`company_context.packet\`\n- Dry-Run Policy Simulator: \`POST ${config.baseUrl}/api/v1/guardrails/check\` (\`{ "tool_slug": "...", "input": { ... } }\`) or MCP \`get_run_context({ action: "check_policy", tool_slug, input })\`\n- Guardrails & Policy Brief: \`GET/POST ${config.baseUrl}/api/v1/guardrails\`, \`POST ${config.baseUrl}/api/v1/guardrails/reset\`, \`GET ${config.baseUrl}/api/v1/governance\` (includes \`llmPolicyBrief\`)\n- MCP Resources: \`muxo://policy/brief\`, \`muxo://governance/policy\`, \`muxo://context\`, \`muxo://memory/graph\`\n- MCP Prompts: \`context\`, \`policy_guardrails\`, \`governed_execution\`, \`security_audit\`\n`);
+                res.end(`# Muxo\n> Unified agent execution across Connected Apps, Instant Tools, Cloud Infrastructure, Workspace Memory, and Safety Guardrails.\n\n- Skill Document: ${config.baseUrl}/skill.md\n- Domain & Workflow Skills Catalog: ${config.baseUrl}/api/v1/skills (or ${config.baseUrl}/skills/<slug>/SKILL.md)\n- Auth Guide: ${config.baseUrl}/auth.md\n- OpenAPI 3.1 Spec: ${config.baseUrl}/api/openapi.json\n- MCP Endpoint: ${config.baseUrl}/mcp\n- OAuth Callback Handoff: ${config.baseUrl}/oauth/callback\n- Plugin Marketplace (Codex/OpenAI): ${config.baseUrl}/.agents/plugins/marketplace.json\n- Plugin Marketplace (Claude/Droid): ${config.baseUrl}/.claude-plugin/marketplace.json\n- Console (app.muxo.ai): ${config.baseUrl}/\n- Landing & Provider Canvas (muxo.ai): ${config.baseUrl}/landing\n- Documentation (docs.muxo.ai): ${config.docsUrl}\n\n## Agent-Native Policy, Context & Governance Interface\n- MCP Control Plane (\`get_run_context\`): \`action: "recall" | "remember" | "forget" | "set_guardrail" | "reset_guardrails" | "check_policy" | "governance_status" | "kill_switch" | "scan_context" | "skills" | "get_skill" | "reconcile_run"\`\n- Strict /v1 Organization Brief: \`get_organization({ company_context: { required: false } })\` returns accepted workspace policy facts + learned defaults in \`company_context.packet\`\n- Dry-Run Policy Simulator: \`POST ${config.baseUrl}/api/v1/guardrails/check\` (\`{ "tool_slug": "...", "input": { ... } }\`) or MCP \`get_run_context({ action: "check_policy", tool_slug, input })\`\n- Guardrails & Policy Brief: \`GET/POST ${config.baseUrl}/api/v1/guardrails\`, \`POST ${config.baseUrl}/api/v1/guardrails/reset\`, \`GET ${config.baseUrl}/api/v1/governance\` (includes \`llmPolicyBrief\`)\n- MCP Resources: \`muxo://policy/brief\`, \`muxo://governance/policy\`, \`muxo://context\`, \`muxo://memory/graph\`, \`muxo://skills\`, \`muxo://skills/{skillSlug}\`\n- MCP Prompts: \`context\`, \`policy_guardrails\`, \`governed_execution\`, \`security_audit\`\n`);
                 return;
             }
             // Serve Installable Muxo Plugin Manifests & Metadata (Portable OpenAI Agent Plugins + Codex + Claude + Cursor)
@@ -3086,8 +3090,11 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
             }
             if (pathname === "/api/v1/byok" && req.method === "POST") {
                 const body = JSON.parse((await readBody(req)) || "{}");
-                const provider = String(body.provider || "").trim();
-                const secretKey = String(body.secretKey || body.apiKey || body.key || "").trim();
+                const provider = String(body.providerSlug || body.provider_slug || body.provider || "").trim();
+                const secretKey = String(body.secretKey || body.secret_key || body.apiKey || body.api_key || body.key || "").trim();
+                const mcpGatewayUrl = body.mcpGatewayUrl || body.mcp_gateway_url
+                    ? String(body.mcpGatewayUrl || body.mcp_gateway_url).trim()
+                    : null;
                 if (!provider || !secretKey) {
                     sendJson(res, 400, {
                         ok: false,
@@ -3095,7 +3102,9 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                     });
                     return;
                 }
-                const record = store.setByokKey(ctx.workspace.id, provider, secretKey);
+                const record = store.setByokKey(ctx.workspace.id, provider, secretKey, {
+                    mcpGatewayUrl,
+                });
                 sendJson(res, 201, {
                     ok: true,
                     key: record,

package/dist/skills-catalog.js

@@ -641,6 +641,43 @@ function buildCatalogSkills(baseUrl = "https://api.muxo.ai") {
             sourceRepo: "ComposioHQ/awesome-claude-skills (transpiled for Muxo Governed MCP)",
         });
     }
+    // 4. Ensure all curated PROVIDER_SKILL_OVERRIDES are registered even if not in ENTERPRISE_TOOLKITS_CATALOG
+    const DISPLAY_NAMES = {
+        metaads: "Meta Ads",
+        googleads: "Google Ads",
+        google_analytics: "Google Analytics (GA4)",
+        discord: "Discord",
+        airtable: "Airtable",
+        figma: "Figma",
+        zendesk: "Zendesk",
+        asana: "Asana",
+        posthog: "PostHog",
+        sentry: "Sentry",
+    };
+    for (const [prov, override] of Object.entries(PROVIDER_SKILL_OVERRIDES)) {
+        if (isStripeProjectsExclusiveProvider(prov))
+            continue;
+        const slug = `${prov}-automation`;
+        if (seenSlugs.has(slug))
+            continue;
+        const displayName = DISPLAY_NAMES[prov] || prov.charAt(0).toUpperCase() + prov.slice(1);
+        addSkill({
+            slug,
+            name: slug,
+            title: `${displayName} Governed Automation Skill`,
+            description: `Automate ${displayName} workflows through Muxo MCP (${mcpServerUrl}) with managed OAuth connections, Cedar/OPA parameter guardrails, and signed execution receipts.`,
+            category: "app_automation",
+            lane: "composio_sdk",
+            providerSlug: prov,
+            providerName: displayName,
+            requiresMcp: ["muxo"],
+            mcpServerUrl,
+            recommendedTools: override.recommendedTools,
+            workflowSteps: override.workflowSteps,
+            pitfalls: override.pitfalls,
+            sourceRepo: "ComposioHQ/awesome-claude-skills (transpiled for Muxo Governed MCP)",
+        });
+    }
     return skills;
 }
 export function listMuxoSkills(filter, baseUrl = "https://api.muxo.ai") {
@@ -671,8 +708,10 @@ export function getMuxoSkill(slug, baseUrl = "https://api.muxo.ai") {
     if (!clean)
         return null;
     const all = buildCatalogSkills(baseUrl);
-    return (all.find((s) => s.slug.toLowerCase() === clean ||
-        s.providerSlug.toLowerCase() === clean) || null);
+    return (all.find((s) => s.slug.toLowerCase() === clean) ||
+        all.find((s) => s.category !== "workflow" && s.providerSlug.toLowerCase() === clean) ||
+        all.find((s) => s.providerSlug.toLowerCase() === clean) ||
+        null);
 }
 export function renderMuxoSkillMarkdown(slug, baseUrl = "https://api.muxo.ai") {
     const skill = getMuxoSkill(slug, baseUrl);

package/dist/store.d.ts

@@ -178,7 +178,10 @@ export declare class MuxoStore {
         category: "llm" | "supplier";
         envVarName: string;
     };
-    setByokKey(workspaceId: string, providerInput: string, secretKey: string): ByokKeyRecord;
+    setByokKey(workspaceId: string, providerInput: string, secretKey: string, options?: {
+        mcpGatewayUrl?: string | null;
+    }): ByokKeyRecord;
+    getByokMcpGatewayUrl(workspaceId: string): string | null;
     getByokKey(workspaceId: string, providerInput: string): string | null;
     deleteByokKey(workspaceId: string, providerInput: string): boolean;
     listByokKeys(workspaceId: string): ByokKeyRecord[];

package/dist/store.js

@@ -1,5 +1,6 @@
 import { DatabaseSync } from "node:sqlite";
 import crypto from "node:crypto";
+import { normalizeComposioByokGatewayUrl } from "./composio-catalog.js";
 export const BYOK_PROVIDER_CATALOG = {
     openai: { category: "llm", envVarName: "OPENAI_API_KEY", label: "OpenAI (GPT-4o / o3-mini)" },
     anthropic: { category: "llm", envVarName: "ANTHROPIC_API_KEY", label: "Anthropic (Claude 3.7 Sonnet)" },
@@ -1204,7 +1205,7 @@ export class MuxoStore {
             envVarName,
         };
     }
-    setByokKey(workspaceId, providerInput, secretKey) {
+    setByokKey(workspaceId, providerInput, secretKey, options) {
         const trimmed = secretKey.trim();
         if (!trimmed) {
             throw new Error("BYOK secretKey must not be empty");
@@ -1214,7 +1215,17 @@ export class MuxoStore {
         const keyPreview = trimmed.length <= 8
             ? `${trimmed.slice(0, 2)}***`
             : `${trimmed.slice(0, 6)}...${trimmed.slice(-4)}`;
-        const encryptedHex = this.encryptSecrets(workspaceId, { [envVarName]: trimmed });
+        if (options?.mcpGatewayUrl && provider !== "composio") {
+            throw new Error("MCP gateway URLs are only supported for Composio BYOK.");
+        }
+        const cleanGatewayUrl = options?.mcpGatewayUrl
+            ? normalizeComposioByokGatewayUrl(options.mcpGatewayUrl)
+            : provider === "composio" ? this.getByokMcpGatewayUrl(workspaceId) || "" : "";
+        const secretPayload = {
+            [envVarName]: trimmed,
+            ...(cleanGatewayUrl ? { COMPOSIO_MCP_GATEWAY_URL: cleanGatewayUrl } : {}),
+        };
+        const encryptedHex = this.encryptSecrets(workspaceId, secretPayload);
         this.db
             .prepare(`INSERT INTO byok_keys (
           workspace_id, provider, category, env_var_name, key_preview, encrypted_secret_hex, updated_at
@@ -1233,9 +1244,19 @@ export class MuxoStore {
             envVarName,
             keyPreview,
             configured: true,
+            ...(cleanGatewayUrl ? { mcpGatewayUrl: cleanGatewayUrl } : {}),
             updatedAt: now,
         };
     }
+    getByokMcpGatewayUrl(workspaceId) {
+        const row = this.db
+            .prepare("SELECT encrypted_secret_hex FROM byok_keys WHERE workspace_id = ? AND provider = 'composio'")
+            .get(workspaceId);
+        if (!row)
+            return null;
+        const dec = this.decryptSecrets(workspaceId, row.encrypted_secret_hex);
+        return dec.COMPOSIO_MCP_GATEWAY_URL || null;
+    }
     getByokKey(workspaceId, providerInput) {
         const { provider, envVarName } = this.normalizeByokProvider(providerInput);
         const row = this.db
@@ -1255,11 +1276,23 @@ export class MuxoStore {
     }
     listByokKeys(workspaceId) {
         const rows = this.db
-            .prepare("SELECT provider, category, env_var_name, key_preview, updated_at FROM byok_keys WHERE workspace_id = ? ORDER BY updated_at DESC")
+            .prepare("SELECT provider, category, env_var_name, key_preview, encrypted_secret_hex, updated_at FROM byok_keys WHERE workspace_id = ? ORDER BY updated_at DESC")
             .all(workspaceId);
         const configuredMap = new Map();
         for (const r of rows) {
             const p = String(r.provider);
+            let mcpGatewayUrl;
+            if (p === "composio" && r.encrypted_secret_hex) {
+                try {
+                    const dec = this.decryptSecrets(workspaceId, String(r.encrypted_secret_hex));
+                    if (dec.COMPOSIO_MCP_GATEWAY_URL) {
+                        mcpGatewayUrl = dec.COMPOSIO_MCP_GATEWAY_URL;
+                    }
+                }
+                catch {
+                    // ignore
+                }
+            }
             configuredMap.set(p, {
                 provider: p,
                 providerSlug: p,
@@ -1267,6 +1300,7 @@ export class MuxoStore {
                 envVarName: String(r.env_var_name),
                 keyPreview: String(r.key_preview),
                 configured: true,
+                ...(mcpGatewayUrl ? { mcpGatewayUrl } : {}),
                 updatedAt: String(r.updated_at),
             });
         }

package/dist/types.d.ts

@@ -184,6 +184,7 @@ export interface MuxoTool {
     llmContextUrl?: string;
     providerUrl?: string;
     metadata?: Record<string, unknown>;
+    domainSkill?: Record<string, unknown>;
 }
 export type ToolDescriptor = MuxoTool;
 export interface ConnectionRecord {

package/dist/ui/console-html.js

@@ -2003,9 +2003,12 @@ async function loadByokKeys() {
 async function saveByokKeyFromUi() {
   var provider = byId('byok-provider-select').value;
   var secretKey = byId('byok-key-input').value.trim();
+  var gwInput = byId('byok-gateway-input');
+  var mcpGatewayUrl = provider === 'composio' && gwInput && gwInput.value ? gwInput.value.trim() : undefined;
   if (!secretKey) { showToast('Paste a key first'); byId('byok-key-input').focus(); return; }
-  await post('/api/v1/byok', { provider: provider, secretKey: secretKey, apiKey: secretKey });
+  await post('/api/v1/byok', { provider: provider, secretKey: secretKey, apiKey: secretKey, mcpGatewayUrl: mcpGatewayUrl });
   byId('byok-key-input').value = '';
+  if (gwInput) gwInput.value = '';
   showToast('Saved your ' + provider + ' key. It is encrypted in your vault.');
   await loadByokKeys();
 }
@@ -2365,6 +2368,13 @@ function init() {
   onSubmit('policy-form', savePolicy);
   onSubmit('scan-form', scanContextFromUi);
   onSubmit('byok-form', saveByokKeyFromUi);
+  var byokSelect = byId('byok-provider-select');
+  if (byokSelect) {
+    byokSelect.addEventListener('change', function () {
+      var gwField = byId('byok-gateway-field');
+      if (gwField) gwField.hidden = byokSelect.value !== 'composio';
+    });
+  }
   onSubmit('join-workspace-form', joinWorkspaceFromForm);
   onSubmit('create-workspace-form', createWorkspaceFromForm);
   onSubmit('team-onboard-form', onboardTeamFromForm);
@@ -2761,6 +2771,7 @@ export function renderConsoleHtml() {
                 </select>
               </label>
               <label class="field"><span>Key</span><input id="byok-key-input" type="password" placeholder="Paste the key" autocomplete="off" /></label>
+              <label class="field" id="byok-gateway-field" hidden><span>MCP Gateway URL (optional)</span><input id="byok-gateway-input" type="url" placeholder="https://connect.composio.dev/mcp" autocomplete="off" /></label>
               <button class="btn btn-primary" type="submit" style="min-height:40px">Save key</button>
             </form>
             <div class="table-wrap">

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const MUXO_VERSION = "1.4.4";
+export declare const MUXO_VERSION = "1.4.5";

package/dist/version.js

@@ -1 +1 @@
-export const MUXO_VERSION = "1.4.4";
+export const MUXO_VERSION = "1.4.5";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@muxoai/sdk",
-  "version": "1.4.4",
-  "description": "Muxo — Unified Execution, Provisioning & Governance Platform over Composio, Stripe Projects, Microsoft Agent Governance & Supermemory",
+  "version": "1.4.5",
+  "description": "Muxo \u2014 Unified Execution, Provisioning & Governance Platform over Composio, Stripe Projects, Microsoft Agent Governance & Supermemory",
   "private": false,
   "license": "MIT",
   "homepage": "https://muxo.ai",

package/plugins/muxo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "muxo",
-  "version": "1.4.4",
+  "version": "1.4.5",
   "description": "Governed agent execution across 1,000+ Connected Apps (managed OAuth handoff), Instant Tools (search, scrape, crawl, SEO audit), live Cloud Infrastructure provisioning, Workspace Memory recall, and verifiable audit records.",
   "author": {
     "name": "Muxo AI LLC",
@@ -8,7 +8,7 @@
     "url": "https://muxo.ai"
   },
   "homepage": "https://muxo.ai",
-  "repository": "https://github.com/muxo-ai/muxo",
+  "repository": "https://github.com/Muxoai/muxo3",
   "license": "MIT",
   "skills": "./skills/",
   "hooks": "./hooks/hooks.json",

package/plugins/muxo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "muxo",
-  "version": "1.4.4",
+  "version": "1.4.5",
   "description": "Your agent decides what to do — Muxo governs, provisions, remembers, and executes it. Unified access to 1,000+ Connected Apps (managed OAuth handoff), Instant Tools (search, scrape, crawl, SEO audit), live Cloud Infrastructure provisioning (Postgres, Redis, SQLite, Storage), Workspace Memory recall, and verifiable audit records.",
   "author": {
     "name": "Muxo AI LLC",
@@ -8,7 +8,7 @@
     "url": "https://muxo.ai"
   },
   "homepage": "https://muxo.ai",
-  "repository": "https://github.com/muxo-ai/muxo",
+  "repository": "https://github.com/Muxoai/muxo3",
   "license": "MIT",
   "keywords": [
     "muxo",
@@ -33,7 +33,7 @@
     "com.openai": {
       "onboardingSkill": "./skills/setup/SKILL.md",
       "publication": {
-        "release_notes": "Muxo v1.4.4: Unified governed execution across 1,000+ Connected Apps, Instant web/SEO tools, 94 Stripe Projects Cloud Infrastructure services, MCP 2026-07-28 compliance, and Workspace Memory."
+        "release_notes": "Muxo v1.4.5: Unified governed execution across 1,000+ Connected Apps, Instant web/SEO tools, 94 Stripe Projects Cloud Infrastructure services, MCP 2026-07-28 compliance, and Workspace Memory."
       }
     }
   },

package/plugins/muxo/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "muxo",
   "description": "Your agent decides what to do — Muxo governs, provisions, remembers, and executes it. Connect and operate 1,000+ external apps via managed OAuth, zero-auth Instant Tools (web search, scrape, crawl, SEO audit, remote workbench), live Cloud Infrastructure provisioning (Stripe Projects), and Workspace Memory from Cursor.",
-  "version": "1.4.4",
+  "version": "1.4.5",
   "mcpServers": "../mcp.json",
   "skills": "../skills/",
   "author": {
@@ -10,7 +10,7 @@
     "url": "https://muxo.ai"
   },
   "homepage": "https://muxo.ai",
-  "repository": "https://github.com/muxo-ai/muxo",
+  "repository": "https://github.com/Muxoai/muxo3",
   "license": "MIT",
   "keywords": [
     "muxo",

package/plugins/muxo/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "muxo",
-  "version": "1.4.4",
+  "version": "1.4.5",
   "description": "Your agent decides what to do — Muxo governs, provisions, remembers, and executes it. Unified access to 1,000+ Connected Apps (managed OAuth handoff), Instant Tools (search, scrape, crawl, SEO audit), live Cloud Infrastructure provisioning (Postgres, Redis, SQLite, Storage), Workspace Memory recall, and verifiable audit records.",
   "author": {
     "name": "Muxo AI LLC",
@@ -9,7 +9,7 @@
     "url": "https://muxo.ai"
   },
   "homepage": "https://muxo.ai",
-  "repository": "https://github.com/muxo-ai/muxo",
+  "repository": "https://github.com/Muxoai/muxo3",
   "license": "MIT",
   "keywords": [
     "muxo",
@@ -109,7 +109,7 @@
         "commerce_description": "This plugin does not sell retail products or process consumer checkout inside ChatGPT."
       },
       "publication": {
-        "release_notes": "Muxo v1.4.4: Unified governed execution across 1,000+ Connected Apps, Instant web/SEO tools, 94 Stripe Projects Cloud Infrastructure services, MCP 2026-07-28 compliance, and Workspace Memory."
+        "release_notes": "Muxo v1.4.5: Unified governed execution across 1,000+ Connected Apps, Instant web/SEO tools, 94 Stripe Projects Cloud Infrastructure services, MCP 2026-07-28 compliance, and Workspace Memory."
       }
     }
   }