vishalsg42/munim

**One MCP server holding a live session with every client's account at once.**
A coding agent can be logged in to one Cloudflare account. One Vercel. One
Resend. Connect a second client and the first goes away. So the person looking
after a dozen small businesses runs a dozen agent sessions, and none of them can
answer a question about more than one client.
Munim holds them all. Each client gets its own registration with the provider,
its own token and its own namespace in the tool list, so one agent can **read
across every client and write inside the one you named**.
That is a real run against two real Cloudflare accounts, not a diagram. The
second account is a client's and their address is replaced here: they did not
consent to a public repository, and this file is also the PyPI page.
Reproduce it with your own two:
scripts/cross_account_probe.py.
Install
Requires Python 3.10+. Nothing else: no Node, no build step, no account to
create first.
If a coding agent is doing the install for you, point it at
llms-install.md, which says the parts that are easy to get
wrong when nobody is watching the terminal, and where it has to stop and hand
back.
Start
There is no wrong order. Connect first and the account you sign in to names the
client, or write the client down first and connect whenever. Both arrive in the
same place.
Then ask your coding agent something a single logged-in session cannot answer:
Doing the work, not just the diagnosis
Munim does not wrap each provider in verbs of its own. Every provider here runs
its own MCP server with its own tools, so Munim forwards them and supplies the
credential:
Your coding agent gets the same two as list_provider_tools and
call_provider_tool. There is no model in this path, so it works with agents
off, and every call is written to the run log with the tool and its arguments.
A call names one client and resolves that client's credentials alone.
When a provider's own MCP server does not publish what you need,
call_provider_api goes a layer down and makes one HTTP call to that provider's
API with the same client's credential. Vercel publishes no environment-variable
write and no way to attach a domain to a project, which is what this is for. It
takes a path and never a URL, and refuses anything that would send the
credential to another host.
**Munim is local by default.** The checks, the audit and the mail plan are
deterministic: they never needed a model and never call one, and neither does
the passthrough above. Three tools can also reason about what they find
(check, work_on_client, ask_across_clients), and that is switched off
until you ask for it, so having a key lying around is not the same as
consenting to use it.
Hosts are Amazon Bedrock, which works out of the box, plus Google Gemini and
Anthropic, which Strands ships as extras: pip install 'munim[gemini]'.
One thing this does not change: Munim runs as an MCP server, so whatever its
tools return goes into your coding agent's context and therefore to whichever
model that agent runs on. Turning agents off stops Munim calling a model of its
own; it cannot change how MCP works. The privacy policy
says so plainly.
**munim doctor** says what is set up, what is not, and the exact command to fix
each gap. Start there whenever something is unclear.