This repository is written by agents, for agents. Limited amounts of review have been done. This is your only warning.

Muse Proxy

An API-key gateway for services that normally require a username and password. This service is primarily for Meta Muse, which has strict guardrails against agents storing passwords and other secrets in plaintext. Agents adhere to this very well, so it's easier to work around it by supporting what is allowed rather than doing creative workarounds.

The account owner stores the upstream credentials once, and chooses the connection ceiling (what must never happen). API keys may then be created and handed to agents so they can access/edit your supported service. Additionally, API keys can be scoped to allow access to only some access (i.e. ceiling is write, but this other agent should only read).

The currently supported services are:

• CalDAV / CardDAV

You may add additional services by submitting a pull request, and it is also permissible to fork this service for private or commercial use — see the license.

Getting started

npm install
npm --prefix frontend install
npm run typecheck        # generates Wrangler bindings, then checks Worker + frontend
npm test -- --run        # builds frontend assets, then runs the suite
npm run build            # builds the SPA into frontend/dist

Create the database and apply the schema:

npx wrangler d1 create muse-proxy     # replace the placeholder database_id in wrangler.jsonc
npm run db:migrate:local

Provide the one required secret (it encrypts stored upstream credentials):

cp .dev.vars.example .dev.vars        # then put a real key in it
openssl rand -base64 32               # generate one

Run it:

npm run dev              # Worker on :8787
npm run dev:web          # Vite dev server on :5173, proxying /api to :8787

Open /user/ and create the first account. The first account always works even
with sign-up disabled, and it is the deployment's administrator.

Deploying

The button above clones this repository into your own GitHub account, provisions the
D1 database, and asks for CREDENTIAL_ENCRYPTION_KEY (