Meta Muse connectors: how to build one and get it approved

Muse connectors let Meta’s Muse agent use your service through your API or an MCP server, instead of through your website in its own browser. Meta opened the Muse connector platform to outside developers on 18 September 2026.¹ You submit at platform.muse.ai, Meta reviews the connector in three stages, and approved connectors become available to the agent and in Muse’s settings.² The partners Meta has named so far are retailers, payment providers, travel and grocery services and small-business tools, so teams in those markets have the clearest reason to build one now.

If you already run a remote MCP server with OAuth, the shortest path is to submit it with each tool labelled read, write or sensitive write, an OAuth client registered for Meta, a read-only option and a test account. Meta’s public pages don’t name an MCP revision, a transport, a token lifetime, a review time or any fee, so build around those gaps.

We haven’t built or submitted a Muse connector. Everything here comes from Meta’s pages and other vendors’ documentation, read on 24 October 2026.

Where Muse connectors show up

Muse is Meta’s personal AI agent, launched on 8 September 2026. Each user’s Muse runs in its own cloud virtual machine with a browser, and Meta says Muse Spark powers it.³ On 12 October Meta introduced Muse Wonder and said it would soon power Muse, subscribers first.⁴ The open-weight Muse Spark Open is covered in our post on its hardware and licence.

People reach Muse through the Muse app on iOS and Android, WhatsApp, the web and a Mac app.³⁵ At Connect on 23 September, Meta said Muse would reach its AI glasses in the coming months, able to act on what the wearer is looking at. It also announced Muse Charm, a pocket device for talking to Muse.⁶ Muse launched in the US, and Meta’s small-business post three weeks later says the US and Canada.⁷

Muse launched with dozens of partner connectors plus the entire Shopify catalogue. At Connect it added Walmart, Best Buy, American Eagle Outfitters, DICK’S Sporting Goods, Fanatics, Gap, Michael Kors, Sephora, Ulta and Wayfair, plus Shop Pay and PayPal for payments, and said Expedia was coming soon.⁶ Muse for Small Business, on 29 September, added Asana, Canva, Dropbox, Figma, HighLevel, Intuit QuickBooks, Klaviyo, Slack, Stripe, Zoom and others.⁷ Meta hasn’t published a Muse connectors list on the web, and says the full list is in the app’s settings.

A Muse custom connector is one that a user asks Muse to build for an unlisted service. Setup can involve fetching API details from that service, and Meta doesn’t review the result.⁸ The help page doesn’t say whether a custom connector can point at an MCP server. Either way, any service with a public API can end up connected through a user’s own credentials.

The Muse connector platform as of 24 October 2026

Mark Zuckerberg announced developer access on X on 18 September, US time, saying new connectors were live that day.¹ The Muse Connector Terms took effect the same day.⁹ Meta’s public material on Muse for developers is a landing page, a guidelines page and the terms, and the submission form needs a Meta login.

Two requirements decide whether a connector is worth building. It must finish what it starts, including checkout and confirmation if you sell something, and Meta says sending users off to complete the whole checkout fails. It must also beat Muse’s own browser through better information, account access, more reliable actions or fewer steps. A wrapper around public pages fails. A read-only connector can pass when the information is the outcome, such as an account report.²

This table turns the guidelines into a submission checklist, as of 24 October 2026.²

Review has three stages. A risk assessment covers security, privacy and integrity. A tool review approves tools one at a time, so a connector can be approved without all of its tools. End-to-end QA tests whole workflows, partly by hand, and checks that sensitive writes always ask.² Status shows only in the portal. Featuring is a separate editorial decision, with no promise of ranking or traffic.

Every tool is classed as a read, a write or a sensitive write, and a tool that mixes reads and writes counts as a write. Reads and ordinary writes ask on first use and offer Always allow. Sensitive writes, such as a purchase or a sent email, ask every time. An approval covers only the details shown, so a changed price or recipient needs a new one. Finance connectors may read data, but Meta isn’t approving tools that move money or place trades.²

Under the terms, you give Meta a royalty-free licence to run and promote your connector, and to use its content and interaction data, including queries, tool calls and outputs, to operate, support and improve Muse. Each side is an independent controller of user data. You accept audits, normally at most one a year, and indemnify Meta. Either side can end the terms on 30 days’ notice, and Meta’s total liability is capped at $1,000.⁹ Neither document mentions a developer fee, a revenue share or a review time.

Building a Muse connector on MCP or a plain API

Meta accepts either. The terms count MCP servers as connectors, and the guidelines ask for documentation of your API or MCP server.⁹² Meta’s launch-day security write-up describes its built-in connectors as Meta-written code and skills over each partner’s API.¹⁰ Meta’s public pages don’t say how Muse calls a submitted MCP server, or which MCP revision or transport it uses.

Submit an MCP server if you have one. Its tool schemas and annotations cover much of what the form asks for, and the same server serves ChatGPT, Claude and Cursor. A REST API needs the same documentation, and Meta’s pages don’t mention OpenAPI.

The form takes OAuth client credentials or an API key, plus the scopes Muse should request.² Client credentials are what the MCP spec calls pre-registration, a client’s first choice ahead of Client ID Metadata Documents (CIMD) and dynamic client registration (DCR).¹¹ The spec requires PKCE with S256 from MCP clients.¹² Meta doesn’t mention PKCE, so keep it advertised. The table maps each request onto the spec.¹³¹⁴¹⁵

Meta names no revision, so serve both. The 2026-07-28 revision removed the initialize handshake and protocol sessions.¹⁶ Under the spec’s compatibility rules, an older client can’t use a server that speaks only the new revision, while a dual-era server works with both.¹⁷ Our stateless MCP migration guide covers client support and running both revisions on one endpoint.

Tool design for phones, voice and glasses

Muse has a voice mode that keeps working while the user talks, and it is coming to glasses and Muse Charm, where nobody can read a table.⁵ Return a one-line summary the agent can say, structured fields for anything it must act on, and results in pages.

Meta wants quoted, pending, confirmed, failed and cancelled states kept apart, status checked before retries, and no duplicate charges.² A quote that a write tool can commit only once covers all three.

def create_booking(quote_id: str, user_id: str) -> dict:
    existing = bookings.find(quote_id=quote_id, owner=user_id)
    if existing:                                  # a retry gets the first result back
        return existing.summary()
    quote = quotes.get(quote_id, owner=user_id)   # the quote belongs to this user
    if quote is None or quote.expired():
        return {"status": "failed", "reason": "quote_expired"}
    if supplier.current_total(quote) != quote.total:
        return {"status": "failed", "reason": "price_changed"}  # new quote, new approval
    booking = bookings.create(quote)              # unique index on quote_id
    return booking.summary()                      # "pending" until the supplier confirms

Label the tool a sensitive write in your documentation, and keep these refusals on the server whatever the label says.

One MCP server for Muse, ChatGPT, Claude and Cursor

We’ve built MCP servers that work in Claude, ChatGPT, Cursor and VS Code, and our field note has the OAuth and protocol-version fixes. This table compares the four programmes, from each vendor’s documentation as of 24 October 2026.^{2181920212223} OpenAI’s old Apps SDK pages now redirect to its plugin docs.

Checkout is the sharpest conflict. Meta expects a connector to finish the purchase, while OpenAI requires external checkout on your own domain and keeps in-chat Instant Checkout for select marketplace partners.²⁴ The MCP spec lets a server vary its tool list by the authorisation on a request,¹⁴ so expose a checkout tool only to the OAuth clients whose rules allow it.

API keys are the least portable option. ChatGPT’s portal has no API-key flow, Claude’s static headers are a limited beta, and Cursor accepts headers in mcp.json.¹⁸²⁰²¹ OAuth is the one method all four document.

Refresh behaviour differs. Claude adds offline_access when your authorisation server lists it, refreshes on a 401 and up to five minutes before expiry, and waits up to 30 seconds for a refresh.²⁰ Cursor uses refresh tokens if you issue them, and otherwise signs the user in again.²¹ The spec lets clients request offline_access and tells servers to keep it out of resource metadata.¹³ Meta says nothing about token lifetimes, so issue refresh tokens without requiring offline_access, and test a token expiring mid-task.

Meta treats a mixed read and write tool as a write, Anthropic rejects one that accepts both safe and unsafe HTTP methods, and OpenAI wants explicit true or false values for readOnlyHint, destructiveHint and openWorldHint.²²⁵²⁴ Separate tools for reads and writes satisfy all three. Of the docs we read, only Claude Code’s give numbers for output size. It warns above 10,000 tokens and by default saves anything over 25,000 to a file.²⁶

Commerce connectors and payments in Muse

Muse launched paying through Link, Stripe’s wallet. Stripe says Muse checks out with a US user’s saved Link payment method at more than 1 million businesses that accept Link, and elsewhere uses a single-use virtual card scoped to the purchase the user approved in chat.²⁷ Meta announced Shop Pay and PayPal at Connect.⁶ Its pages don’t explain how a submitted connector takes a payment, beyond a landing-page mention of a Stripe partnership for accepting payments with Link.²⁸

A Shopify store has most of this on already. Shopify says products reach Meta through Shopify Catalog, and that direct checkout on Meta surfaces, including Muse when available, is on by default for eligible stores selling to the US, Canada, Mexico, Brazil, Japan or Singapore. Subscriptions, bundles, customisable and B2B-only products are excluded, and client-side analytics pixels don’t fire. The store stays the merchant of record, with no fee beyond payment processing.²⁹

A store on its own stack should start with product data, because Meta wants the full price with currency, taxes, fees, recurring charges and refund policy before the user commits.² Checkout must then run end to end through your API, allow guest checkout where you offer it, and survive a pause for sign-in or payment verification. Finally, name the seller of record in every quote, since the seller heads Meta’s list of required details. Meta doesn’t say who the seller of record is for a sale through a submitted connector, so settle it with your payment provider and in your terms.

Privacy, prompt injection and what Meta’s docs don’t say

Muse treats what your connector returns as part of the user’s interactions. Under the Muse Privacy Policy, effective 17 September 2026, one toggle decides whether those interactions, connector data included, train Meta’s models. The policy says “This setting is on when you first use Muse” and lets users switch it off.³⁰ It also says Muse doesn’t share conversations or VM data with Meta’s ad systems. Your rights are narrower. The guidelines ban selling connector data, using it for unrelated ads or training models on it.² Brief your privacy team on both before you fill in the questionnaire.

Tool output is a prompt-injection route. Meta says it labels external data as untrusted, runs injection classifiers over tool results, and sends every connector action and network request through a separate approval agent called Sentinel.¹⁰ On your side, descriptions and responses must not tell Muse to ignore its rules, steer users away from competitors or take unrequested actions, and MCP servers must sanitise tool outputs.²¹⁴ Put text that other people wrote, such as reviews or messages, in labelled fields, and trim it.

Enforcement stays on your server. The spec treats a handle such as a quote ID as a name, to be checked against the caller’s authorisation on every call.¹⁴ Stop access when a user disconnects, and keep tokens and payment data out of prompts, tool descriptions, URLs and logs.²

As of 24 October 2026, Meta’s public pages leave these open.

A launch checklist for a Muse connector

1. Write the use case, with the task, the user and why your connector beats Muse’s browser.
2. Map each task end to end, including checkout, status, changes, cancellations and refunds.
3. Split reads from writes, label each tool read, write or sensitive write, and document errors and rate limits.
4. Return the seller, total, fees and refund terms before any commitment, and keep each transaction state distinct.
5. Make writes safe to retry, and re-check price and recipient when they run.
6. Register a confidential OAuth client for Meta, offer a read-only scope, advertise PKCE with S256 and issue refresh tokens.
7. Answer 2025-11-25 and 2026-07-28 clients on one endpoint.
8. Keep tool output short enough to speak, and label text that other people wrote.
9. Prepare business verification, contacts, a maintainer, the questionnaire and a test account with charge-free checkout.
10. Connect the same server to Claude, ChatGPT and Cursor, and gate client-specific tools such as in-chat checkout by OAuth client.

If you’d like help with the server side, our AI engineering team builds MCP servers that work across Claude, ChatGPT, Cursor and VS Code. Plans start at $5,000.

Frequently asked questions