# Meta Muse

Muse runs your agent on its own Linux computer and connects to Catena with the
[CLI](https://docs.catena.com/connect/cli.md). That computer usually has no desktop keyring (such as the
Secret Service keyring), which changes where the CLI stores the agent's key.

## Requirements

Before you start, you'll need:

- **Catena CLI 0.17 or later on the Muse computer:** Earlier versions of our CLI
  could not store a key without a keyring. The prompt below installs the latest
  version.
- **The admin role:** You need the admin role in the Catena organization the
  agent will join, or someone with that role who can approve the link.

## Connect Muse

1. Ask Muse:

   ```prompt
   Connect yourself to my Catena account. Install the Catena CLI with `npm i -g @catena/cli`, then run `catena guide` and follow it. Use plain `catena link`, not `--service`. Send me the approval link it prints.
   ```

2. Muse runs `catena link` and sends you an approval link.
3. Open the link, choose the organization (live or sandbox) and the agent's
   [policy](https://docs.catena.com/policies.md), and approve.
4. Tell Muse you approved. It will run `catena link` again, which prints `Done`.

## Test the connection

To check that everything is working, ask Muse to run `catena whoami` and
`catena policy show`.

## Credential storage

When the computer has no keyring, `catena link` stores the key in a file under
`~/.config/catena/credentials/` that only Muse's user can read, and it says so.
Muse does not need to install keyring software. See
[Credential storage](https://docs.catena.com/connect/credentials.md#the-file-store) for details.

> [!WARNING] **Do not use `catena link --service`**
>
> `catena link --service` is for a person provisioning a deployed service. It
> prints a raw key and stores nothing on the machine. If Muse suggests it, tell
> Muse to use plain `catena link`.

If Muse's computer does not keep its home directory between sessions, the link
will be lost. In that case, we recommend creating a
[secret key](https://docs.catena.com/connect/secret-keys.md) and giving it to Muse as `CATENA_SECRET_KEY`.

## Limitations

There are a few things to keep in mind when you use Muse:

- Payments at or above your approval threshold will wait for an admin.
- Muse can ask you to confirm its own actions, such as network requests. Those
  prompts come from Muse and are separate from Catena approvals.

## Related

- [Link with the CLI](https://docs.catena.com/connect/cli.md): Link a new or existing agent that runs in a terminal, on your own machine or a headless host, with catena link.
- [Credential storage](https://docs.catena.com/connect/credentials.md): Where the CLI keeps an agent's signing key on each kind of host, and which credential mode to use when there's no keychain.
- [Link with secret keys](https://docs.catena.com/connect/secret-keys.md): A secret key lets an agent act in Catena from hosts where catena link cannot store a credential, such as CI jobs, cloud sandboxes, and deployed services.