MCP server

What it is & installing it

Muster runs an MCP server exposing your projects, tasks, worktrees, diffs, database connections, hosts and issue trackers, so the agent acts on what you actually have and you stop pasting schemas back and forth.

The server is a separate process speaking JSON-RPC over stdio; it reads the same database and the same settings as the app.

Which agents Muster can wire it into

Muster writes the MCP config itself — into a repository's agent config or an agent's global config, in one step — for nine of the built-in CLIs: Claude Code, Codex, Cursor Agent, Gemini CLI, OpenCode, Amp, Qwen Code, Kimi CLI and GitHub Copilot CLI. Those are the CLIs with a config dialect Muster knows, so the file it writes is the file the CLI reads.

For the rest it refuses to write anything and names the file you must edit by hand — Goose's ~/.config/goose/config.yaml, Continue CLI's ~/.continue/config.yaml, Kiro CLI's ~/.kiro/settings/mcp.json, Rovo Dev's ~/.rovodev/mcp.json, Cline's, Droid's, Kilo Code's, Mistral Vibe's, oh-my-pi's, and the Claude-shaped file Auggie wants handed to it with --mcp-config. For Aider, Grok CLI, GLM CLI, Pi and the Shell Agent no MCP config location is known, so it says that instead of guessing. Writing a file the CLI never opens would look like success and behave like nothing.

The same rule gates per-task injection: an agent Muster cannot write a config for is launched without one rather than with a dead file.

Tool reference

Two enforcement shapes appear below, and the difference matters:

• Gated calls are refused outright when the grant is missing.
• Filtered listings always succeed and return only the rows you may see. An agent cannot distinguish "this database does not exist" from "you may not see it", which is deliberate.

What "read-only" actually rejects

Stricter than most people expect, and deliberately so — it is an allowlist, not a list of banned verbs:

• Only nine leading keywords are read: select, with, explain, show, pragma, describe, desc, values, table. Anything else — including COPY, CALL, DO, or a statement whose first token cannot be parsed — counts as a write.
• Multiple statements are refused outright, even two harmless ones: SELECT 1; SELECT 2 does not run. A single trailing semicolon is fine.
• A WITH or EXPLAIN statement is additionally scanned across its entire text — string literals included — for write keywords. That means EXPLAIN SELECT * FROM audit WHERE op = 'delete' is classified as a write, because the word appears at all. A false positive here costs a refusal; a false negative would cost your data.

Mongo and Redis are classified by their own per-command allowlists rather than by SQL keywords, and for those two the classification is the enforcement.

Other behaviours worth knowing

• A tool you lack the capability for returns a normal response carrying isError: true and the missing slug — not a JSON-RPC error. Only an unknown tool name is a protocol error.
• limit is silently clamped to 1–1000 rather than rejected. timeout has no ceiling — wait as long as the work takes; a clamped wait would come back as reached: false, which reads exactly like the task having failed. muster_wait_task defaults to just 30 seconds when you omit it, so pass a real timeout when orchestrating.

Agents orchestrating agents

muster_spawn_task creates a task and queues it to actually run, which is what makes a coordinating agent possible: a main agent hands work to several others and blocks on muster_wait_task until each reaches a state.

1. main agent → muster_spawn_task(project, "migrate the schema")   → task A queued
2. main agent → muster_spawn_task(project, "update the client")    → task B queued
3. main agent → muster_wait_task(A, needs_review, timeout=3600)
4. main agent → muster_get_diff(A) → reviews → muster_open_pr(A)

Waits may be long — up to a day — because real agent work is. Spawned tasks are real tasks in the app: they appear in the sidebar, get their own worktree and panes, and a human can take over at any point.