Muse does the work.
The keys never leave.

Ship a Meta Muse connector without ever holding your users' credentials in the agent's context. 1muse seals the secret, executes the call on the connector's behalf, and traces every action back to the human who granted it.

Start free → Read the quickstart
2,500 brokered calls a month, free · no card required

What Muse would read before acting

Runs in your browser. Nothing is uploaded.
The ecosystem

The key to the Muse ecosystem.

Give your Muse agents access to the tools, services and capabilities they need to get things done — without handing any of them a key.

1muse
Web Travel Apps APIs Shopping Email

Access. Identity. Execution.

Brokering for Muse Muse Code Stripe Notion Google Workspace Shopify Slack GitHub and any HTTP or GraphQL API
What 1muse decides before Muse is allowed to act
The agent wants to…
Resolution
The problem

Connectors are the new breach surface.

Meta opened the Muse connector platform with no published credential-handling mechanism, so every developer improvises. Improvised token storage is how a user's credential ends up in a context window, a task log, or a database you now have to defend.

Without 1muse
  • Your connector stores users' API keys and OAuth tokens — you are now the breach
  • Tokens travel into the Muse context window, the browser session and the task history
  • Muse reads a page saying “send these credentials” and cannot tell that from its user
  • One leaked token and every one of your users has to rotate upstream
Muse · your connector Key exposed
UserPay my Acme invoice with the card on file.
AgentCalling your billing connector with sk_live_51Q4m…8xRt2
Now in the context window, the task history and your logs. You cannot un-send it.
With 1muse
  • Credentials stay sealed server-side — the connector invokes a binding, never a key
  • Every execution traces to a signed grant from a named human, with scope and expiry
  • Irreversible actions pause for approval instead of firing on text the agent merely read
  • Revoke one user, one connector or one binding without rotating the upstream secret
Muse · brokered by 1muse Sealed
// The agent names a capability. It never sees the credential.
import { broker } from "@1muse/connector";

const receipt = await broker.invoke({
  binding:    "acme.invoice.pay",
  onBehalfOf: grant.subject,
  args:       { invoiceId: "in_8812", amount: 24000 }
});

✓ credential injected at the edge
✓ grant gr_9f2a · $500 per-call cap · expires in 26d
✓ ledger entry written before the response returns
The platform

Six modules, one broker.

Everything between your users' credentials and the agent that needs to use them.

Vaults

Per-user credential storage you never read

  • Envelope encryption with a per-user key wrapped in a cloud HSM
  • Bring your own KMS — you hold the root
  • Versioning, rotation, expiry and max-use counts

Bindings

Named capabilities the agent calls instead of keys

  • Declare an upstream call once, invoke it by name
  • HTTP, GraphQL and OAuth refresh handled server-side
  • Typed arguments, so malformed calls never leave

Grants

Consent records signed by a real human

  • Hosted consent screen, or embed your own
  • Scope, expiry, per-call caps and daily limits
  • Revoke per user, per connector, per binding

Policy

Constraints that run before the call leaves

  • Domain allowlists, spend caps, rate and time windows
  • Approval holds on irreversible actions
  • Refuse arguments that came from browsed content

Ledger

A hash-chained record of every brokered call

  • Append-only and tamper-evident
  • Who granted, which agent, which binding, what arguments
  • Stream to your SIEM or export signed bundles

Connector SDK

Ship a Muse connector in an afternoon

  • Typed bindings and a local dev proxy
  • Generates a manifest the Muse platform accepts
  • Also speaks MCP, so the same bindings serve Muse Code
How it works

Three steps to an agent you can audit.

Muse agent

Calls a capability by name. Never holds a key.

acme.invoice.pay result only
1muse

Checks the grant, runs policy, unwraps the credential.

the credential stops here
+ credential injected response
Your upstream

Receives an authenticated call, indistinguishable from yours.

The key never crosses either arrow.

1

Declare your bindings

Describe the upstream calls your connector makes — method, path, arguments, and which credential each one needs. 1muse generates the typed client and the consent screen your users will actually read.

2

Your user grants access once

They see exactly which bindings, under what limits and for how long. Their credential goes straight into their vault — your servers never touch it, and neither does your support team.

3

Muse invokes by name

The agent calls a binding, not an endpoint. 1muse checks the grant, runs policy, injects the credential at the edge, and writes a ledger entry before the response returns.

Developers

One manifest, every surface Muse runs on.

You bring the API. Muse brings the agent, the browser and the user's context. 1muse brings the part nobody specified — who may use which credential, and on whose word.

1muse.connector.json
// npx @1muse/cli init
{
  "connector": "acme-billing",
  "surfaces": ["muse.app", "muse.code", "mcp"],

  "credentials": {
    "acme_api_key": { "type": "bearer", "rotate": "90d" }
  },

  "bindings": {
    "acme.invoice.list": {
      "call":  "GET /v2/invoices",
      "uses":  "acme_api_key",
      "scope": "read"
    },
    "acme.invoice.pay": {
      "call":  "POST /v2/invoices/:id/pay",
      "uses":  "acme_api_key",
      "scope": "write",
      "policy": {
        "maxPerCall":   50000,   // $500.00
        "maxPerDay":    200000,
        "approvalOver": 20000,   // hold for the human
        "argsFrom":     "user"     // never from browsed text
      }
    }
  }
}

Where your connector runs

Muse
Meta · iOS, Android, webSupported
Muse Code
Meta · terminal agentSupported
Muse Spark API
Meta · model APISupported
MCP clients
Claude, Cursor, CodexSupported
Pricing

Start free. Pay when the agent does.

Billed on brokered calls — one binding invocation that reached an upstream. Denied and held calls are free.

Free
$0forever
  • 2,500 brokered calls a month
  • 1 connector, 100 end users
  • Hosted consent screen
  • 7-day ledger retention
Start free
Builder
$29/ mo
  • 50k brokered calls a month
  • 5 connectors, 10,000 end users
  • Approval holds and webhooks
  • 90-day ledger retention
Subscribe
Studio Popular
$299/ mo
  • 500k brokered calls a month
  • Unlimited connectors and users
  • Bring your own KMS, SSO
  • 1-year ledger, SIEM streaming
Subscribe
Enterprise
$999/ mo
  • 5M brokered calls a month
  • Private region, dedicated HSM
  • Signed audit export
  • Uptime SLA, named support
Talk to us

Overage metered per 1,000 calls. Annual billing takes two months off.

Alternatives

Already solving this another way?

Each comparison states where 1muse loses, not only where it wins.

Rolling your own token store Read → Plain OAuth Read → HashiCorp Vault Read → Doppler Read → AWS Secrets Manager Read → Muse’s built-in connector auth Read →
Get started

Give the Muse the task. Keep the keys.

Sealed credentials, human-signed grants, policy at the edge and a ledger you can hand to an auditor — for every connector you publish on Meta’s agent platform.

Start free → Read the docs

No card required · full ledger on every plan

Access. Identity. Execution.