muster
Launch, inspect, and control contained coding agents (Claude Code, Codex, OpenCode) as reachable sessions or one-shot tasks.
run — Start an agent with a required runtime and prompt as a
session(returns a reachable address) ortask(captures output, no peer address). Configure cwd/project, containment vialevel,sandbox, andpermissions, identity, MCP servers, OpenCode plugins, model, host/terminal, TTL, idle timeout, and idempotentrequestKey.list — List Muster-owned sessions and tasks, optionally filtered by
kind, including host capabilities.stop — Stop a Muster-owned run by durable id or unambiguous peer name.
output — Read the captured output of a task run by id.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@musterRun a Codex session to review the authentication flow"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Muster
Launch coding agents on your machine, under containment you chose, and get back an address you can actually reach.
Muster starts Claude Code, Codex and OpenCode sessions on your behalf. You say what the agent may do; Muster arranges it, verifies the session is genuinely alive, and hands you a durable address for it. If a session never becomes reachable, you get a diagnosis naming what stopped it — not a process that looks fine and isn't.
It is the launching half of a small family: Muster starts agents, tincan lets them message each other, birddog watches what they do.
What it's for
Running more than one agent, deliberately. One session reviewing while another builds; a task that runs once and captures its output; an agent launched under a separate account so its work never touches your own configuration. Muster is the part that makes those launches repeatable, contained and addressable instead of a terminal tab you have to remember.
A session returns an address only after its runtime is reachable. A task
runs once, captures output, and never advertises a peer address.
Related MCP server: LightsOut
What makes it different
Containment is two separate questions, and both are answered. Whether the agent stops to ask you, and what it may touch — the second enforced by the OS, not by asking nicely. Every launch records which of the two it actually got.
A session is only reported ready when it is reachable. Muster asks each runtime in its own language — a session record, an RPC call, an HTTP endpoint — and does not confuse "the process started" with "the agent is listening".
It refuses instead of guessing. An unrecognised flag, a contradictory pair of options, an identity belonging to a different runtime: all errors, before anything is started. Nothing half-launched is left behind.
Other machines can ask, within limits you set. An enrolled caller launches inside a profile's ceiling — the directories it may use, the strongest containment it may request. Configuration is the grant; the request never widens it.
Every claim here was measured. Runtime behaviour is established by driving the real programs and recording what they did — see Verification. Where a finding later proved wrong, the correction is in the release notes rather than quietly edited away.
Claude requires a directory already trusted by the operator, or
--options auto-approve-path. The automated suite uses fake runtimes, not real
models; behaviour against real ones is verified by hand and recorded in
RELEASE_NOTES.md.
Quick start
# Allow the install scripts: muster's postinstall builds node-pty, and npm
# skips install scripts by default — silently, so the pty host fails later.
npm install -g --allow-scripts=@brutalsystems/muster,node-pty @brutalsystems/muster
# A session: an agent you can reach, addressed once it is genuinely alive.
muster run claude --prompt 'Review this project' --cwd . --level work
# A task: runs once, captures output, advertises nothing.
muster run codex --kind task --prompt 'Summarise the failing tests' --level read
muster output <id>
# What is running, and stopping it.
muster list --format human
muster stop <id>--level names a containment pair. read can look but not change; work can
edit its working directory, except muster's own home (~/.muster); open
removes the sandbox and needs allow_dangerous_flags in config.
Level | The agent asks before acting | What it may touch |
| always | nothing on disk |
| no | its cwd, except |
| no | everything |
Claude asks to trust a directory the first time. That is a one-time review you
do yourself — or --options auto-approve-path, which records it for you after
checking the directory ships no hooks. See
Claude workspace trust.
Requirements
Node 22.12+ (tested on 24.16), and a POSIX host with ps and lsof.
Terminals use tmux or node-pty. The OS sandbox is seatbelt, so kernel-enforced
containment is macOS only; everywhere else enforcement reports what was
actually applied rather than pretending.
Then whichever agents you mean to launch, installed and logged in. Verified against Claude Code 2.1.274, Codex 0.155.1 and OpenCode 1.18.31 or newer — a newer OpenCode must keep the CLI and loopback HTTP API Muster uses. What that verification covers is in Verification.
Documentation
hosts, terminals, lifetimes, repeated requests | |
containment, config file, remote callers | |
running as a named account | |
the one-time dialog, and the two gates behind it | |
output formats, runtime pass-through | |
tools for launched agents, and Muster's own MCP server | |
what is tested, what is checked by hand |
Keeping it up to date
Publishing a release does not touch an installed copy: muster --version keeps
reporting the old version until you update it.
npm update -g @brutalsystems/musterIf which muster resolves to a version-manager shim (for example
~/.asdf/shims/muster), run that update under the Node the shim resolves to and
reshim afterwards — asdf reshim nodejs — or the shim keeps pointing at the old
binary.
An MCP server starts once at session startup, so an agent session that already has Muster loaded keeps running the old binary until that session restarts. Updating on disk is not enough; restart the session too.
Build and run locally
npm run check is the local gate: it builds, runs the suite, then packs and
verifies the tarball — the same scripts/check-tarball.mjs the CI packing job
runs, so the two cannot disagree about what "verified" means. npm test alone
does not pack anything, so tarball drift is green locally and red on push.
It is not everything CI does: CI additionally runs the suite across the Node
version matrix, and the contract suite runs only on release. Passing check is
necessary rather than sufficient.
Beyond the runtime requirements above, building needs TypeScript 5. The terminal interface itself is platform-neutral; the macOS Terminal driver is an unavailable v1 stub.
npm ci
npm run build
node dist/muster.js run codex --prompt 'Review the authentication flow'
node dist/muster.js run claude --prompt 'Summarize the project' --host tmux
node dist/muster.js run opencode --prompt 'Review this project'
node dist/muster.js run opencode --prompt 'Build a plan' -- --model local-provider/qwen3-30b
node dist/muster.js run codex --kind task --prompt 'Explain the test layout'
node dist/muster.js run opencode --kind task --prompt 'Summarize the tests'
node dist/muster.js list
node dist/muster.js list --format human
node dist/muster.js list --kind task
node dist/muster.js output RUN_ID
node dist/muster.js stop THREAD_OR_SESSION_OR_RUN_ID--prompt is required and cannot be blank. --cwd defaults to the current
working directory. --kind defaults to session. All commands except output
emit JSON; output prints the captured task output. stop also accepts an
unambiguous peer name or canonical address, refusing ambiguity with candidates.
Use the durable ID to stop a session whose runtime has renamed it.
License and releases
MIT © 2026 BrutalSystems. See LICENSE. Vendored Tin Can code retains source attribution and its MIT notice.
Publishing is tag-driven and runs in GitHub Actions over OIDC trusted
publishing, with no stored npm token. A bare git push publishes nothing; a
version tag is what triggers publish.yml. That workflow validates a RELEASE_NOTES.md section for
the version being published, so write the notes under ## Unreleased as you do
the work and commit them normally. Cutting the release is then one command:
git commit -am "<the change, including its notes under ## Unreleased>"
npm version patch -m "%s — <what changed>"npm version runs the version hook, which stamps ## Unreleased into
## <version> — <date> and stages it, then bumps, commits and tags; the
postversion hook pushes the commit and tag together. If there is no
## Unreleased section, or it is empty, the stamp refuses — before a tag
exists, rather than in CI after one has been pushed.
RELEASING.md covers versioning, package inspection, publication, and release notes in full. Changes to the shared address format require an explicit contract update; Muster never independently fixes the frozen naming behavior.
Available Tools
5 toolslistA
List Muster-owned sessions and tasks, including host capabilities.
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It describes the action as non-mutating ('List'), which implies a read-only operation, but it does not explicitly state there are no side effects, nor does it mention authentication requirements, pagination, or output format. 'Including host capabilities' hints at extra data, but no details are given. This is adequate for a simple list tool but not richly transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the primary purpose ('List Muster-owned sessions and tasks') before adding the secondary detail about host capabilities. It contains no filler or repetition, and its brevity is appropriate for a tool with only one optional parameter.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (one optional enum parameter, no output schema, no annotations), the description covers the main purpose but leaves gaps: it does not explain the 'kind' parameter's effect, nor does it describe the return structure. The phrase 'including host capabilities' suggests extra output but is undefined. For a simple list tool, this is moderately complete but not fully self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description does not explain the 'kind' parameter at all. The schema provides an optional enum of 'session' or 'task', but with 0% schema description coverage, the description should clarify how this parameter filters results. The overview says 'sessions and tasks' but not that 'kind' selects between them. This is a meaningful gap, as the parameter's role is left entirely to inference from the schema's enum values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the operation: 'List Muster-owned sessions and tasks'. It uses a specific verb ('List') and names the resource, which distinguishes it from siblings like 'run', 'stop', and 'output'. The additional 'including host capabilities' makes the scope more specific without confusing the core purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: the agent should call this when it needs to enumerate existing sessions/tasks. However, it does not explicitly state when to use it over alternatives (e.g., before running or stopping), nor does it describe when not to use it. There is no mention of prerequisites or routing to siblings, leaving the agent to infer the use case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
outputC
Read captured output from a task run.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It only says 'Read', implying a non-mutating operation, but does not state whether the task must be finished, whether it blocks, what happens if the id is invalid, or what the output format is. The description is too sparse to convey essential behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence, which is concise, but it is under-specified. It lacks essential context that should be present given the absence of annotations and parameter descriptions. The brevity works against the agent rather than aiding it, so it is not appropriately sized for the tool's needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one parameter, no annotations, and no output schema, the description is severely incomplete. It does not explain what the 'id' is, what 'captured output' means, how to obtain the output, or what the response will look like. An agent cannot reliably invoke this tool correctly based on the provided definition.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has a single required parameter 'id' with no description, and schema coverage is 0%. The description does not explain what 'id' refers to (presumably a task run ID) or how to obtain it. The agent has no information about the parameter's meaning, format, or constraints beyond a minLength of 1.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Read' and the resource 'captured output from a task run', which distinguishes it from sibling tools like run, list, and stop. However, it is slightly vague about what 'captured output' includes (e.g., stdout, stderr, logs), so it does not fully specify the resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives such as list or run. It does not mention prerequisites like the task needing to be completed, nor does it contrast with siblings. The agent is left to infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
runB
Launch an instructed agent. Sessions return only when reachable; tasks return a non-messageable run handle.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | ||
| mcp | No | Configured MCP server names. Omit for session defaults; [] disables all. Tasks have no defaults. | |
| ttl | No | Stop this tmux session the given duration after launch regardless of activity, as 90s/30m/4h, or 'off'. Off by default. | |
| args | No | ||
| host | No | ||
| kind | No | session | |
| open | No | Open the tmux session in a terminal viewer (macOS only). | |
| level | No | A spelling of a legal permissions/sandbox pair: read is deny + read-only, work is auto + workspace-write, open is bypass + full-access. Naming a level and either flag is an error. | |
| model | No | Model for the launch. A bare model id for claude and codex; PROVIDER/MODEL for opencode, where it overrides the configured [opencode] model. Recorded on the run and reported by `list`. | |
| title | No | Terminal title for this tmux session, shown by any terminal attached to it. Defaults to the session's name and runtime once it is reachable; the agent's own title is shown instead only with [session] title_from_agent. Control characters are stripped and it is capped at 100 characters. Refused for tasks and for pty or macos-terminal hosts. | |
| plugin | No | Configured OpenCode plugin names. Omit for session defaults; [] disables all. OpenCode only. | |
| prompt | Yes | ||
| options | No | Muster-side launch options. auto-approve-path records the launch directory as trusted in the profile the agent will use, so its one-time dialog does not block the launch; refused for a runtime with no trust gate, and refused if the directory ships hooks or MCP servers. accept-bypass-warning accepts Claude's one-time Bypass Permissions warning for a bypass launch (level open); refused for other runtimes and without bypass permissions. Not expressible remotely. | |
| project | No | A project named in config.toml, used instead of cwd. Naming both is an error. | |
| runtime | Yes | ||
| sandbox | No | Defaults to config (read-only). Full access requires config authorization. | |
| identity | No | A named identity created by `muster setup-identity`; the agent runs as that account instead of inheriting the ambient environment. A non-local requester is bounded by its profile's identities. | |
| terminal | No | Viewer app; requires open. Auto uses Terminal.app. | |
| requestKey | No | Caller-owned identity for this launch. Repeating it returns the launch it already produced instead of starting another; repeating it with different parameters is refused. | |
| idleTimeout | No | Stop this tmux session after the given inactivity, as 90s/30m/4h, or 'off'. Off by default. Refused for tasks and for pty or macos-terminal hosts, which do not outlive their parent. | |
| permissions | No | Defaults to config (deny). Auto requires workspace-write; bypass requires authorized full-access. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose one important trait: sessions only return when reachable and tasks yield a non-messageable handle. That is genuinely useful blocking/return semantics, but it says nothing about permissions, sandbox bypass, or refusal conditions that dominate this tool's risk profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the action and followed by the mode-dependent outcome. Every sentence earns its place, though the brevity is stark against a 21-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 21-parameter launch tool with no annotations and no output schema, the description is far too thin. It omits auth/prerequisite context, safety-relevant launch semantics, and any return-structure detail beyond the single task-handle note.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 71%, so the schema documents most parameters in detail. The description adds meaning only for the session/task outcome, not for any named parameter, so it neither compensates heavily nor repeats the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ("Launch an instructed agent") and clarifies the two operating modes it produces. It is clearly the launching tool versus siblings like list/output/stop, though it does not explicitly name or contrast against them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not guidance for the 21 parameters. The session-vs-task return distinction implies how the kind choice behaves, but prerequisites and exclusions are left to the schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
stopA
Stop a Muster-owned run by durable id or unambiguous peer name.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full responsibility for behavioral disclosure. It only says 'Stop,' implying a mutating action, but does not disclose whether stopping is irreversible, what happens to the run's output, permission requirements, or idempotency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. Every part contributes: the action, the resource scope, and the accepted identifier forms.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and the description covers the action and parameter semantics, so an agent can likely invoke it correctly. However, with no annotations and no output schema, it omits behavioral consequences and does not mention how to obtain the id or name, despite the sibling list tool existing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has one required string id with no description (0% coverage). The description adds crucial meaning by explaining that id can be a durable id or an unambiguous peer name, which is not derivable from the schema. It does not define the formats, but it compensates well for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific verb ('Stop') and names the exact resource ('Muster-owned run'), plus the identifier forms accepted. It is clearly distinct from siblings run, list, and output.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is for stopping an existing Muster-owned run and even states how to identify it, but it does not explicitly mention when not to use it or direct the agent to list for finding ids. Usage context is clear but alternatives are left implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
titleB
Retitle a running tmux session by durable id or unambiguous peer name, from outside its agent.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| title | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It conveys that this mutates a running session's title, but says nothing about failure behavior, ambiguity resolution, whether the title must be unique, or what response to expect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted words; the resource and accepted identifier forms come first.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description is thin. It omits error/ambiguity behavior, session-existence requirements, and confirmation of the applied title, which an agent needs before invoking.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It does add one useful fact: id may be a durable id or an unambiguous peer name. But it gives no format, length, or validity guidance for either id or title, leaving half the parameter meaning unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (retitle) and resource (a running tmux session), and identifies the identifiers accepted. It does not explicitly contrast with siblings like run or stop, but the mutation of session metadata is distinct enough to identify.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'from outside its agent' implies the calling context (an external caller, not the session's own agent), which is useful guidance. However, it never states when to retitle versus other operations, or prerequisites such as the session needing to exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v1.2.0- Changed
run3 fields changed- changed
Input schema / properties / idleTimeout / descriptionPrevious value: -"Stop this tmux session after the given inactivity, as 90s/30m/4h, or 'off'. Defaults to 30m. Refused for tasks and for pty or macos-terminal hosts, which do not outlive their parent."New value: +"Stop this tmux session after the given inactivity, as 90s/30m/4h, or 'off'. Off by default. Refused for tasks and for pty or macos-terminal hosts, which do not outlive their parent." - added
Input schema / properties / optionsAdded value: +{ + "description": "Muster-side launch options. auto-approve-path records the launch directory as trusted in the profile the agent will use, so its one-time dialog does not block the launch; refused for a runtime with no trust gate, and refused if the directory ships hooks or MCP servers. accept-bypass-warning accepts Claude's one-time Bypass Permissions warning for a bypass launch (level open); refused for other runtimes and without bypass permissions. Not expressible remotely.", + "items": { + "enum": [ + "auto-approve-path", + "accept-bypass-warning" + ], + "type": "string" + }, + "type": "array" +} - added
Input schema / properties / titleAdded value: +{ + "description": "Terminal title for this tmux session, shown by any terminal attached to it. Defaults to the session's name and runtime once it is reachable; the agent's own title is shown instead only with [session] title_from_agent. Control characters are stripped and it is capped at 100 characters. Refused for tasks and for pty or macos-terminal hosts.", + "type": "string" +}
- Added
title
1 tool update
v0.9.1- Changed
run2 fields changed- added
Input schema / properties / idleTimeoutAdded value: +{ + "description": "Stop this tmux session after the given inactivity, as 90s/30m/4h, or 'off'. Defaults to 30m. Refused for tasks and for pty or macos-terminal hosts, which do not outlive their parent.", + "type": "string" +} - added
Input schema / properties / ttlAdded value: +{ + "description": "Stop this tmux session the given duration after launch regardless of activity, as 90s/30m/4h, or 'off'. Off by default.", + "type": "string" +}
1 tool update
v0.7.21- Changed
run1 field changed- changed
Input schema / properties / model / descriptionPrevious value: -"PROVIDER/MODEL, overriding the configured [opencode] model. OpenCode only."New value: +"Model for the launch. A bare model id for claude and codex; PROVIDER/MODEL for opencode, where it overrides the configured [opencode] model. Recorded on the run and reported by `list`."
1 tool update
v0.7.14- Changed
run6 fields changed- added
Input schema / properties / identityAdded value: +{ + "description": "A named identity created by `muster setup-identity`; the agent runs as that account instead of inheriting the ambient environment. A non-local requester is bounded by its profile's identities.", + "pattern": "^[a-zA-Z0-9_-]+$", + "type": "string" +} - added
Input schema / properties / levelAdded value: +{ + "description": "A spelling of a legal permissions/sandbox pair: read is deny + read-only, work is auto + workspace-write, open is bypass + full-access. Naming a level and either flag is an error.", + "enum": [ + "read", + "work", + "open" + ], + "type": "string" +} - added
Input schema / properties / modelAdded value: +{ + "description": "PROVIDER/MODEL, overriding the configured [opencode] model. OpenCode only.", + "minLength": 1, + "type": "string" +} - added
Input schema / properties / pluginAdded value: +{ + "description": "Configured OpenCode plugin names. Omit for session defaults; [] disables all. OpenCode only.", + "items": { + "pattern": "^[a-zA-Z0-9_-]+$", + "type": "string" + }, + "type": "array" +} - added
Input schema / properties / projectAdded value: +{ + "description": "A project named in config.toml, used instead of cwd. Naming both is an error.", + "pattern": "^[a-zA-Z0-9_-]+$", + "type": "string" +} - added
Input schema / properties / requestKeyAdded value: +{ + "description": "Caller-owned identity for this launch. Repeating it returns the launch it already produced instead of starting another; repeating it with different parameters is refused.", + "maxLength": 200, + "minLength": 1, + "type": "string" +}
1 tool update
v0.7.8- Changed
run4 fields changed- added
Input schema / properties / mcpAdded value: +{ + "description": "Configured MCP server names. Omit for session defaults; [] disables all. Tasks have no defaults.", + "items": { + "pattern": "^[a-zA-Z0-9_-]+$", + "type": "string" + }, + "type": "array" +} - added
Input schema / properties / openAdded value: +{ + "description": "Open the tmux session in a terminal viewer (macOS only).", + "type": "boolean" +} - changed
Input schema / properties / runtime / enumPrevious value: -[ - "codex", - "claude" -]New value: +[ + "codex", + "claude", + "opencode" +] - added
Input schema / properties / terminalAdded value: +{ + "description": "Viewer app; requires open. Auto uses Terminal.app.", + "enum": [ + "auto", + "terminal", + "iterm2", + "ghostty" + ], + "type": "string" +}
4 tool updates
v0.3.0- First observed
list - First observed
output - First observed
run - First observed
stop
TDQS
Scored across 5 tools
Each tool targets a distinct lifecycle action: run launches, list enumerates, output reads, title renames, and stop terminates. Overlap is minimal, with output and list only differing by scope.
All tool names are lowercase single-word commands (run, title, list, output, stop), giving a consistent imperative style. No mixed conventions or prefixes/suffixes are present.
Five tools is compact and appropriate for a session/task orchestration server, covering launch, inspection, output retrieval, naming, and termination without redundancy. No obvious over- or under-scoping.
The surface covers the core lifecycle: launch (run), list/inspect (list), read output (output), rename (title), and stop. It may lack a direct message/send tool for interacting with reachable sessions, but core operations are present.
Maintenance
Related MCP Connectors
A paid remote MCP for OpenAI Codex agent coordination MCP, built to return verdicts, receipts, usage
Hosted MCP memory and agent control plane for durable conversations, jobs, and operations.
Scoped agent execution. Server-side credentials, policy, budgets and verifiable receipts.
Execution control plane for agents: capabilities, durable jobs, budgets, receipts, and BYOK.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables MCP clients to spawn and control Codex CLI and Claude Code sessions on the host machine, with session management and filesystem access.4MIT
- FlicenseNot gradedqualityAmaintenanceAgent orchestration system that runs coding-agent sessions (Claude Code, Codex) with policy mediation and exposes tools via MCP.-
- FlicenseNot gradedqualityAmaintenanceMCP server for programmatic lifecycle management of Claude Code sessions, supporting list, create, read, send, fork, wait, and interrupt operations.1 npm1-
- FlicenseNot gradedqualityBmaintenanceEnables MCP hosts like Claude Code and Codex to spawn, manage, and interact with persistent, reusable Pi coding-agent sessions, supporting task dispatch, status checks, and session lifecycle control.2 npm-