This Week in Extensibility: Meta open-sources the Muse Gadgets SDK for building hardware its agent controls, Microsoft ships MXC, a stable cross-platform sandbox for untrusted code, and the Model Context Protocol adds Server Cards for sizing up a server before connecting

2026-10-09T00:00:00-04:00

Meta released the Muse Gadgets SDK, open-source kits that turn a hobbyist circuit board or a spare computer into a device its Muse personal agent can control. Microsoft shipped the first stable version of MXC, an open-source sandbox for safely running untrusted code such as plugins and AI output. It also gave administrators a switch that forces the coding agent in its editor to run walled off from a machine's files and network. The Model Context Protocol agreed on a way for an AI client to check what an outside tool server offers before it connects, and the draft WebMCP standard dropped the way a site could declare those tools in its page markup, leaving the way that registers them with JavaScript.

Customization: Meta open-sources a build-your-own gadget platform for its Muse agent

Meta open-sourced kits that let anyone build a physical device its Muse personal AI agent can see and control. On October 2 the company published the Muse Gadgets SDK, open-source kits for two kinds of hardware: a small hobbyist circuit board, or a spare computer running Linux. A gadget pairs with the Muse app on a phone, and the agent can then read from and act on whatever a builder wires up, such as screens, buttons, sensors, and lights. Alongside the kits Meta shipped dozens of ready-made "skills," each a short text file that teaches the agent to operate a specific product, covering printers, televisions, speakers, smart plugs, vacuums, and garage doors from a range of makers. Anyone can write another. Muse is Meta's personal AI agent, which it introduced in September to connect to a user's email, calendar, shopping, and smart home.

Why it matters: the set of things a personal AI agent can operate usually ends at the integrations its maker ships. Meta is handing that decision to its users. Each skill adds a device the agent can run, and the format is plain enough that a hobbyist can write one rather than wait for the vendor. These are open-source kits for hobbyists, so the near-term reach is the maker crowd, not every Muse owner.

Sandboxes: Microsoft ships a stable release of MXC for running untrusted plugins, tools, and model output

Microsoft published the first stable version of MXC, an open-source system that runs untrusted code in isolation. On October 7 the company released MXC 1.0.0, which it calls a sandbox for running untrusted code: the output of an AI model, plus plugins and tools. An application hands MXC a piece of code and a policy for what it may touch. MXC runs the code walled off from the rest of the machine, and the policy decides which files and network connections it can reach. Rather than a new sandbox, MXC is a common layer over the isolation each operating system already provides: it uses the built-in sandbox on each platform, such as Apple's Seatbelt on macOS, and on Windows and Linux can step a riskier job up to a lightweight virtual machine for stronger separation. Version 1.0.0 is the first release Microsoft marks as stable and supported, and it lets a caller run a task to completion or work with it live through a terminal. The same week, the Strands Agents project open-sourced Strands Box, a sandbox for running AI agents rather than a product's plugins and tools, so far only on Apple silicon Macs.

Why it matters: letting customers extend an app with plugins, or letting a user's agent run code, means running code the app's maker did not write and cannot fully trust. The hard part is doing that safely, and products have mostly built their own containment on each platform from scratch. One policy model spans every desktop operating system's own isolation, and backed by a major vendor it lowers the cost of offering that kind of extensibility. An app has to build on MXC for anyone to benefit, and it is one vendor's library rather than a shared standard.

Protocols: The Model Context Protocol agrees on how a client checks a server before connecting

The Model Context Protocol accepted a standard way for an AI client to find out what an outside tool server offers before it connects. The protocol, the shared standard that lets a user's AI assistant reach tools and data its maker did not build in, adopted a proposal called Server Cards on October 6. A server can publish a card describing its capabilities, the ways to reach it, and which versions of the protocol it speaks, so a client reads that first and decides how to connect instead of probing by trial and error.

Why it matters: discovery decides how easily a user can point an assistant at a new tool. When the client can read a server's own description first, connecting it takes less hand-configuration. No released version of the specification includes Server Cards, and the protocol's SDKs have not added them.

Governance: Microsoft lets administrators lock the coding agent in its editor inside a sandbox

Microsoft gave administrators a way to force the AI agent inside Visual Studio Code to run sealed off from a computer's files, network, and terminal, with no user override. The October 7 release of the widely used code editor added a setting an organization can push to its machines that both turns on operating-system-level sandboxing of the agent and stops an individual user from switching it off; an older control that a user could override is being retired. The same release gathers the tool servers contributed by a user's installed extensions into one place, so they can be reviewed next to the servers a user set up by hand.

Why it matters: an AI coding agent works with real reach into the machine it runs on, and until now sandboxing it was a setting a user could turn off. Moving that decision to the administrator lets a workplace guarantee the agent stays boxed in rather than trust each person to leave the protection on. Anthropic made the same move in Claude Code last week, where a built-in security mod lets administrators cap what user-installed mods can do on a managed machine.

Standards: The draft WebMCP spec drops its HTML path for exposing a page's tools

The editors of WebMCP removed the way a site could declare tools in the page's HTML, leaving the way that registers them with JavaScript. WebMCP lets a page publish actions, such as filling a form or running a search, that a user's agent can call. Until an October 8 change the draft offered two ways to do that: writing the tools into the page's HTML, or registering them with JavaScript. The editors cut the HTML option and kept the JavaScript one, and moved the HTML approach into a separate explainer to keep working on it outside the spec. Separately, the editors proposed language that would make a hostile page feeding an agent bad instructions the agent's problem to defend against, not something the standard tries to prevent. That proposal is still open, as are the privacy objections the draft drew earlier.

Why it matters: narrowing the draft to the JavaScript way leaves browsers one mechanism to build and secure instead of two while it is young. It also drops the HTML-only path, which would have let a page expose tools without writing JavaScript.

Also worth knowing

Anthropic let a user add a plugin marketplace and install from it in one command, still gated by an administrator's marketplace allowlist. A week after opening Claude Code to user-installed plugins and mods, the October 6 release folded adding a marketplace and installing a plugin into a single step. On a managed machine, an administrator's allowlist fixes which marketplace sources are permitted, and a source outside it is refused with no user override.
A proposal to the W3C WebExtensions Community Group would let an extension ask for a new permission on an update without alarming existing users. The proposal, opened October 8, would let a developer mark a permission as required for new installs but optional on an update, so adding a capability does not confront current users with a jarring permission prompt and risk losing them. The cross-browser extension group has not decided on it, and the notes from its October 8 public call are not yet published.
The Model Context Protocol's finalized "skills" still have not reached its TypeScript SDK. The portable bundles meant to carry a user's customizations from one tool to another were finalized in the specification weeks ago, but the TypeScript SDK still ships without them, as of its October 5 update.
The WebAssembly group's vote on a dedicated Component Model subgroup has no published outcome yet. The October 6 call was set to decide whether to form a subgroup for the Component Model, the layer that lets WebAssembly plugins written in different languages compose; the meeting notes remain unfilled, and no subgroup has appeared in the group's records.

On the radar

October 15: The chartered W3C WebExtensions Working Group meets next.
October 16: Registration closes for the W3C's annual technical plenary, where the WebExtensions group plans sessions on autofill and extension security.
October 20: The W3C WebAssembly Community Group holds its next call, which should publish the October 6 notes and the Component Model subgroup decision.
November 3: Chrome tentatively targets shipping WebMCP in Chrome 157, until which point it remains an origin trial.
November 17: Chrome's WebMCP origin trial is scheduled to end.
December 1, 2026: New Microsoft 365 Copilot Business licenses switch to usage-based billing by default, a date Microsoft moved back from November 2.
December 31, 2026: Support ends for the preview line of Cloudflare's Sandbox SDK.
March 1, 2027: Shopify stops running storefront scripts injected the old way.

This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.

Todd Schiller - Muse