Agents reach your data through a gate, not a promise.
Muster runs an MCP server that exposes your databases, tasks, hosts, diffs and issues to the agent working the task. What any given agent can actually do is decided by capability grants you scope, layer, and can revoke mid-run.
Scoped to a name, not a category
A grant is never “databases” — it’s this database, this host, this project, this worktree. An agent that only needs the staging schema never holds a path to prod.
Layers that can only take away
Grants layer global → project → task, and the layers intersect: a narrower layer can only ever remove access, never add it back. Editing a layer forks it clone-on-write, so tuning one task’s policy doesn’t mutate the project default it started from.
Re-resolved on every request
Permissions are not a snapshot taken at spawn. They are re-resolved on every request, so revoking a grant reaches the agent that is already running — mid-task, mid-conversation. Tightening a policy is an action, not a restart.
Ask mode: the agent parks, you decide
Set a grant to Ask and the call pauses for your decision in the app: the prompt waits 45 seconds inside the MCP client’s 60-second window, with a 16-prompt queue so a burst of requests lines up instead of failing. A reply that arrives late or in the wrong shape is treated as a refusal — ambiguity never defaults to allow.
Read-only by default, structurally
A new agent gets read capabilities and never db_write. Write tools need both the capability grant and an explicit allow_write on the individual query. And the SQL side is enforced structurally, not by hoping the statement looks harmless: driver-level query_only on Postgres, MySQL and SQLite, and a command allowlist on MongoDB and Redis.
An audit trail you can actually read
Every granted, denied and asked call lands in a full audit trail, visible in Settings. When you want to know what an agent touched last night, the answer is a list, not a guess.
Your own MCP servers, on a leash
Muster’s built-in server isn’t the only one an agent can use. Settings manages a catalogue of external MCP servers — command, args, environment — with secrets held as keychain references rather than literals in the config, and per-agent overrides that decide which servers and capabilities each agent actually gets.
More in safety & control.
See it on your own repo.
$39 once, per device. A perpetual license, no subscription, nothing that renews. Your code, data and credentials never touch our servers.
Rather try it first? Start the 7-day trial — card up front, $0 charged today, and cancelling before day 7 means you pay nothing. The key appears on screen, ready to paste into Muster.