Skip to content
Muse Code × Google Drive 5 min setup

Secure Muse Code Google Drive Connection with PortEden

This guide gives Meta's Muse Code coding agent scoped Google Drive access with PortEden as the data firewall. You add one MCP server entry to ~/.config/muse/settings.json, sign in, and Muse Code can search and read the folders you explicitly allow. Drive starts block-all: nothing is visible until you add a Drive Rule, and every tool call is recorded in the PortEden audit log.

Image needed

Diagram showing Google Drive connecting to PortEden, with PortEden labeled RULES AUDIT SCOPE, then forwarding to Muse Code in a terminal window

File:
public/images/guides/muse-code/muse-code-google-drive-cover.png
Spec:
1200x630. Google Drive icon on the left, PortEden shield in the middle labeled RULES / AUDIT / SCOPE, terminal window with the Muse Code prompt on the right, arrows left to right.
Used as:
Guide cover + OpenGraph image

In short

  • Add one MCP server to ~/.config/muse/settings.json: transport streamable_http, URL https://mcp.porteden.com/drive
  • Restart Muse Code and authenticate to PortEden on the first drive tool call.
  • Drive is block-all by default. Add Drive Rules in PortEden for the folders Muse Code may see (specs, runbooks, design docs).
  • Verify with a search prompt. Destructive file operations stay behind confirm-before-write.

What you get

When the connection is live, Muse Code can find and read the documents coding work actually depends on: API specs, architecture docs, runbooks, test plans. Every tool call, from the lead agent or any parallel sub-agent, routes through PortEden, which applies:

Block-all by default

No folder is visible until you allow it with a Drive Rule. Board decks, HR folders, and client files stay invisible unless you decide otherwise.

Per-action permissions

Search, read, export, create, move, and delete are separate scopes. Destructive operations keep confirm-before-write on.

Redaction on file content

Sensitive identifiers inside allowed documents are stripped or tokenized before content reaches Meta's model.

Audit trail

Every tool call from Muse Code is logged centrally: the requested action, the decision (allow, redact, or block), and the response shape returned. SIEM-exportable.

Prerequisites

  • Muse Code (beta) installed and authenticated: curl -fsSL https://dev.meta.ai/install.sh | bash, then muse login. macOS and Linux; on Windows use WSL2.
  • A Google account with the Drive folders you want Muse Code to use.

No PortEden account yet? That is fine.

When the PortEden sign-in opens on Muse Code's first drive tool call (Step 2), you can sign up with Google one-click or with email in the same flow.

Step 1: Add the PortEden MCP server to settings.json

1
Open (or create) the settings file:
mkdir -p ~/.config/muse 
$EDITOR ~/.config/muse/settings.json
2
Add the drive server entry. If the file is new, this is the whole file:
~/.config/muse/settings.json
{ 
  "schema_version": 1, 
  "mcp_servers": { 
    "drive": { 
      "transport": "streamable_http", 
      "url": "https://mcp.porteden.com/drive", 
      "mode": "optional" 
    } 
  } 
}
3
Save the file and restart Muse Code so it picks up the new server. Continue to Step 2.

schema_version is mandatory

Muse Code refuses to start with a malformed settings file error if "schema_version": 1 is missing. "mode": "optional" keeps an unreachable server from aborting your coding run.

Step 2: Sign in to PortEden

1
Trigger a first call from a Muse Code session, for example: "List the tools available from the drive server." The PortEden sign-in opens in your browser.
2
Sign in, or sign up in the same flow. Approve the connection request. PortEden creates a scoped Access Token for this Muse Code connection automatically.

Beta build not opening a sign-in?

If your Muse Code build does not run a browser sign-in for remote MCP servers, create an Access Token at my.porteden.com (scoped to drive only) and pass it in the server entry: "headers": { "Authorization": "Bearer pe_your_token" }.

Step 3: Connect Drive and add Drive Rules

If your PortEden account does not have Google Drive connected yet, complete Google's OAuth consent when prompted. Then, unlike email and calendar, there is one deliberate extra step: Drive starts block-all, so you allow folders explicitly.

1
Open my.porteden.com and go to Drive Rules.
2
Add an Allow rule for each folder Muse Code should see, for example Engineering/Specs and Engineering/Runbooks. Rules apply to the folder and its children.
3
Leave everything else blocked. A search from Muse Code simply never returns files outside the allowed folders.

Why block-all is the right default here

Drive is where the highest-blast-radius documents live: board decks, offer letters, customer contracts. A coding agent needs a handful of engineering folders, so PortEden makes you name them instead of subtracting from everything.

Step 4: Verify the connection

Try one of these

Find the API design doc in the specs folder and give me its name and link.
List the files in the runbooks folder, names and modified dates only.
Search the allowed folders for documents mentioning "rate limiting".
Read the deployment runbook and summarize the rollback procedure.
  • Muse Code finds files inside allowed folders and nothing outside them.
  • The PortEden audit log at my.porteden.com shows the request with a green allow decision.

Empty results are usually the rules working

If a search comes back empty, the file most likely lives outside the allowed folders. That is the firewall doing its job; add a rule if the folder genuinely belongs in scope.

Step 5: Tighten what Muse Code can do (optional)

Adjust the token from my.porteden.com under Access Tokens. Every sub-agent Muse Code spawns uses this same token and the same Drive Rules.

Permission presets for a coding agent

Pick the action set that matches what you want Muse Code to do

PresetWhat Muse Code can doWhat it cannot do
search_read (recommended)Search, read, and export files in allowed foldersCreate, move, rename, or delete anything
read_and_createRead plus upload new files into allowed foldersModify or delete existing files
full_driveAll file operations inside allowed folders, with confirmation on destructive onesSee anything outside the Drive Rules

Recommended rules for a Muse Code token

  • Allow narrowly: name the two or three engineering folders the agent needs; resist allowing a root folder.
  • Stay read-only: a coding agent that needs to publish a doc can hand you the content to save instead.
  • Confirm before write: keep on for delete, move, and overwrite if you enable write at all.
  • Redaction: leave on; specs rarely need the customer names that sometimes appear in them.

Suggested prompts for everyday use

Implement

"Read the payments API spec and implement the client against it. Quote the sections you rely on."

Runbook

"Open the incident runbook and walk me through the rollback steps for the search service."

Search

"Find every doc in the specs folder that mentions the v2 auth flow, names and links only."

Cross-check

"Compare the architecture doc against the current repo structure and list the drift."

Test plan

"Read the QA test plan and generate the missing test cases as code stubs."

Docs

"Summarize what changed between the two most recent versions of the design doc."

Troubleshooting and error handling

Match the message you see to the entries below. For settings-file and auth errors, the full troubleshooting table in the Gmail guide applies to any PortEden connection in Muse Code.

EMPTY_RESULTS

Searches return nothing

Symptoms

  • Muse Code reports no files found for queries that should match.
  • Audit log shows allow decisions with empty result sets.

Checks

  • Drive starts block-all. Check Drive Rules in PortEden and add an Allow rule for the folder the files live in.
  • Rules apply to a folder and its children; a sibling folder needs its own rule.

Debug prompt for Muse Code

List the folders you can currently see through the drive server, then tell me which query returned empty.
PERMISSION_DENIED

403 Permission denied on a file operation

Symptoms

  • Muse Code says it lacks permission, or returns an accessInfo string explaining the rejection.

Checks

  • The action attempted may not be enabled (search_read cannot create or delete).
  • The target file may live outside the allowed folders.
  • Adjust the token or rules, save, then retry. Changes apply on the next request.

Debug prompt for Muse Code

Show me the full accessInfo field from the last error response, then summarize which permission or folder rule blocked the call.
SETTINGS_MALFORMED

Muse Code fails at startup after editing settings.json

Symptoms

  • Every muse command fails with "malformed settings file".

Checks

  • Validate the JSON: jq . ~/.config/muse/settings.json
  • Confirm "schema_version": 1 is present at the top level.

Debug prompt for Muse Code

Not applicable, this one fails before a session starts. Fix the JSON and rerun muse.
CONNECTION_DROPPED

Google returned reauth required

Symptoms

  • Calls were working, then all drive tools start failing.
  • Audit log shows a provider_reauth_required entry.

Checks

  • Open Connections in PortEden. Google Drive will show a yellow Needs reauth badge.
  • Click Reconnect and complete the Google OAuth flow again.

Debug prompt for Muse Code

Quote the last provider_reauth_required error from PortEden and tell me which provider needs to be reconnected.

Security best practices

✓

Remember the fleet. Every parallel sub-agent shares this connection; the Drive Rules bound all of them.

✓

Allow folders, never the Drive root. Name the two or three engineering folders the agent needs.

✓

Stay read-only until a workflow proves it needs to write, and keep confirm-before-write on destructive operations.

✓

One token per AI client. Do not reuse a token across Muse Code, Claude, and ChatGPT.

✓

Keep redaction on. Meta's contributor API tier documents training rights on submitted data; redacted fields never reach the model on any tier.

✓

Review the audit log weekly and revoke tokens promptly when an experiment ends.

FAQ

Why does Muse Code see nothing in Drive after connecting?

By design. PortEden's Drive capability starts block-all: no folder is visible until you add a Drive Rule allowing it. Add a rule for the folder your specs or docs live in and the next query will find them.

Can Muse Code delete or overwrite my files?

Not on the defaults. The token starts read-only within allowed folders, and destructive operations (delete, move, overwrite) are separate permissions with confirm-before-write enabled.

Do Muse Code's sub-agents get the same Drive access?

Yes. Sub-agents use the session's MCP connections, so the PortEden token's folder rules bound the whole fleet, up to 16 parallel agents.

Can Muse Code read Google Docs and Sheets through this connection?

The drive server covers file search, metadata, reading, and file operations. For structured editing of Docs and Sheets content, add the dedicated servers: https://mcp.porteden.com/google-docs and https://mcp.porteden.com/google-sheets, each with its own scoped token and guide.

Will Meta train on my Drive files?

It depends on the Meta Model API tier behind your session; the standard tier does not include training rights, while the discounted contributor tier documents them. PortEden limits what reaches Meta on any tier: only allowed folders are visible, sensitive fields are redacted, and everything is logged. Check Meta's current terms for your tier.

Next steps

Connect Google Docs to Muse Code

Structured reading and editing of Docs, with per-folder scope.

Connect Google Sheets to Muse Code

Read and append to spreadsheets with per-file scoping.

MCP Drive tool reference

All drive tools exposed by the PortEden MCP server, with arguments and responses.

Muse Code MCP servers, explained

What Muse Code can reach over MCP and what Meta's docs say about sandboxing and tiers.