Skip to content

Connect PortEden to Muse Code

Muse Code, Meta's terminal coding agent, supports MCP servers over the streamable_http transport. This guide adds PortEden to Muse Code's settings file so the agent can securely reach your email, calendar, drive, and task tools, with every request passing through your PortEden access rules, redaction, and audit log.

Tip

Muse Code's sandbox covers shell commands, not MCP traffic (Meta's docs state MCP tools run outside the sandbox). PortEden supplies that missing layer server-side: the token Muse Code holds is scoped, and every sub-agent the session spawns inherits the same scope.

Prerequisites

  • Muse Code installed and authenticated (curl -fsSL https://dev.meta.ai/install.sh | bash, then muse login). Muse Code runs on macOS and Linux; Windows requires WSL2.
  • A PortEden account, sign up or sign in at my.porteden.com
  • At least one service connected inside PortEden (Gmail, Outlook, Google Calendar, Drive, etc.), or connect it during the auth flow

Step 1: Open the Muse Code Settings File

Muse Code reads user settings from ~/.config/muse/settings.json. Create the file if it does not exist. It must declare "schema_version": 1 or Muse Code refuses to start with a malformed settings file error.

mkdir -p ~/.config/muse
$EDITOR ~/.config/muse/settings.json

Step 2: Add a PortEden MCP Server

Add the PortEden endpoint for the capability you want under mcp_servers, using the streamable_http transport. For example, email:

~/.config/muse/settings.json
{
"schema_version": 1,
"mcp_servers": {
"email": {
"transport": "streamable_http",
"url": "https://mcp.porteden.com/email",
"mode": "optional"
}
}
}

Restart Muse Code. On the first tool call the server requires authentication: complete the PortEden sign-in when it opens (sign up in the same flow if you have no account). PortEden then issues a scoped access token for this connection, and you never paste raw Google or Microsoft credentials anywhere.

Note

Muse Code is a young beta. If your build does not open a browser sign-in for remote MCP servers, create an Access Token at my.porteden.com (scope it to the one capability) and pass it as a header instead: "headers": { "Authorization": "Bearer pe_your_token" }. The scoping, redaction, and audit behavior is identical either way.

Tip

"mode": "optional" lets Muse Code keep working with a warning when the server is unreachable. The default, required, aborts the run instead, which is rarely what you want for a data connector in a coding session.

Step 3: Add More Connections

Each PortEden capability is its own MCP server with its own endpoint and its own scoped token. Add only the ones your workflows need:

ConnectionEndpoint URLWhat It Covers
Emailhttps://mcp.porteden.com/emailGmail and M365 email
Calendarhttps://mcp.porteden.com/calendarGoogle Calendar and Outlook Calendar
Drivehttps://mcp.porteden.com/driveGoogle Drive files and folders
Google Docshttps://mcp.porteden.com/google-docsSearch, read, and edit Docs
Google Sheetshttps://mcp.porteden.com/google-sheetsRead, write, and append to Sheets
Taskshttps://mcp.porteden.com/tasksMonday, Linear, Asana, Jira, Notion

A combined config with several servers:

~/.config/muse/settings.json
{
"schema_version": 1,
"mcp_servers": {
"email": {
"transport": "streamable_http",
"url": "https://mcp.porteden.com/email",
"mode": "optional"
},
"calendar": {
"transport": "streamable_http",
"url": "https://mcp.porteden.com/calendar",
"mode": "optional"
},
"drive": {
"transport": "streamable_http",
"url": "https://mcp.porteden.com/drive",
"mode": "optional"
}
}
}

Step 4: Test the Connection

Start a Muse Code session in any repository and try a low-risk read prompt for each connection you added:

Email"Show me my unread emails from today, subjects only."
Calendar"What meetings do I have this week?"
Drive"Find the API design doc and give me the file name and link."
Docs"Read the release-plan doc and summarize the open decisions."
Sheets"Show me the first 10 rows of the test-accounts sheet."
Tasks"List the open items assigned to me on the Product board."

If Muse Code responds with data from the connected service, the connection is working. To see the tools it discovered, ask it to "list every tool available from the email server with a one-line description each." Then check the audit trail at my.porteden.com to confirm the calls were logged.

A Note on Sub-Agents

Muse Code fans large jobs out to parallel sub-agents (up to 16) in isolated git worktrees. Worktree isolation protects your working copy; it does not partition data access. Every sub-agent uses the session's MCP connections, so the PortEden token's scope is the effective boundary for the whole fleet. Keep coding-agent tokens read-only by default, and use access rules (contacts, labels, time windows) to shrink what any child can pull into context.

Managing Permissions

The access token Muse Code receives inherits the permissions you configure at my.porteden.com. You can:

  • Restrict Muse Code to read-only access (no sending, no deleting)
  • Limit access to specific providers or accounts
  • Block contacts, domains, or labels from AI access
  • Set time windows (e.g., only see emails from the last 30 days)
  • Require confirm-before-write on send and delete actions
  • Revoke the token at any time, takes effect on the next call

See Permissions and Access Rules for full details.

Troubleshooting

Muse Code fails at startup with "malformed settings file"

The settings file is missing "schema_version": 1 or contains invalid JSON. Validate with jq . ~/.config/muse/settings.json and add the schema_version key at the top level.

The run aborts saying an MCP server is unavailable

The server's mode defaults to required, which aborts when the server cannot be reached. Set "mode": "optional" and check the URL (exactly https://mcp.porteden.com/email, no trailing slash).

Config validation fails on the server entry

For streamable_http servers only url and headers are valid; a framing field fails validation, and command/args belong to stdio servers only.

"Permission denied" on a specific action

The token doesn't allow the action Muse Code attempted (a read-only token cannot send, a blocked label denies matching messages). Check the token at my.porteden.com , adjust, and retry; changes apply on the next call.

Connection works but then stops

If you revoked the token, re-authenticate on the next tool call (or update the header if you used a static token). If the underlying Google/Microsoft connection needs re-consent, PortEden shows a Needs reauth badge under Connections.