AI agents and Muster

How-to guides for platform teams operating Muster, authoring workflows, managing MCP servers, and wiring multi-cluster access, RBAC, and single sign-on.

These guides are for platform teams and power users who operate Muster, rather than for people who just want to ask their AI assistant a question. If you only need to connect your IDE or the developer portal chat, start with Set up your AI agent instead.

For the concepts behind everything here, see the AI agents overview: what Muster is, how the aggregator works, the meta-tools agents actually see, and the security model.

In this section

• Author a workflow: package a multi-step operation as a single workflow_<name> tool, written the code-grounded way.
• Save tokens with workflows: why one workflow call is dramatically cheaper than a raw-tool loop, with the measured numbers and the design rules that maximize the saving.
• Manage MCP servers: add and configure downstream servers with MCPServer resources.
• Connect custom MCP servers: bring third-party servers behind the gateway, including ones that don’t publish standard discovery metadata.
• Give agents multi-cluster access: expose a whole fleet through one central Muster.
• Map RBAC and SSO: connect identity-provider groups to cluster permissions.
• Troubleshoot agent access: work through authentication loops, missing tools, and disconnected clusters.

Operating the platform versus self-hosting

The guides in this section are about operating the platform: authoring workflows, managing MCP servers, wiring multi-cluster access, mapping RBAC and SSO, and troubleshooting. They apply whether Muster is run for you on the managed Giant Swarm platform or you host it yourself.

If you also run your own Muster, the self-hosting subsection covers deploying the Helm charts, protecting the endpoint with OAuth, and bridging single sign-on across multiple management clusters. Those guides don’t apply on the managed Giant Swarm platform, where Muster is already deployed and protected for you.

• Author a Muster workflow
  Write a Muster Workflow resource that packages a multi-step operation into one named tool an AI agent can discover and call, grounded in the fields the engine actually implements.
• Save agent tokens with workflows
  Why a Muster workflow makes an AI agent dramatically cheaper, with the measured before-and-after numbers and the design rules that maximize the saving.
• Manage MCP servers in Muster
  Add and configure downstream MCP servers behind Muster with MCPServer resources, covering stdio and remote transports, tool prefixes, server families, startup control, and authentication.
• Connect custom MCP servers
  Bring third-party and internal MCP servers behind Muster, including servers that don't publish RFC 9728 metadata, using the authorizationServer override.
• Give agents multi-cluster access
  Expose an entire fleet of management clusters through one central Muster, with the instance-selection argument contract and RFC 8693 token exchange for cross-cluster single sign-on.
• Map RBAC and single sign-on
  Connect identity-provider groups to Kubernetes RBAC so AI agents act with each user's own permissions, and handle large tokens and group limits.
• Troubleshoot AI agent access
  Work through the common Muster failure modes for platform teams, from authentication loops and disconnected clusters to missing tools and workflows agents can't find.
• Self-hosting Muster
  Operate your own Muster aggregator. Deploy the Helm charts, protect the endpoint with OAuth and Dex, and bridge single sign-on across multiple management clusters.