Todoist

Use the installed todoist CLI. Start with todoist status. If it reports not_connected, run todoist authorize-url and share only the returned connect_url with the user.

OAuth uses one shared public client and PKCE through authd. No client secret enters Muse, and credentials must never be requested in chat.

The first connection requests read-only Todoist access. Before every write or deletion, run todoist status --for-command <permission> with the permission matching the requested action. This check is required even when todoist list-tools advertises the provider tool: the catalogue describes available operations, not the scopes granted to the current connection.