murmur setup CLI command

Gathers your credentials, discovers your tenant and workspace, encrypts your profile, and writes the local config file (murmur.local.yaml). Run this once per repo to get ready to spawn agents.

Synopsis

murmur setup [flags]
murmur setup auth <add|update|remove|list> [<label>] [--service-profile NAME]

Arguments

Name	Type	Required	Description
`--out`	string	no	Write local config to this path. Use `-` for stdout. Default: `murmur.local.yaml` in the `.murmur/` directory.
`--non-interactive`	bool	no	Skip prompts and the OAuth flow — read credentials from environment variables instead. Requires an existing `murmur.yaml`. Default: `false`.
`--skip-ssh-keys`	bool	no	Skip SSH key discovery. Use in environments without key pairs. Default: `false`.
`--commit-signing`	bool	no	Upload a signing key to GitHub for verified commits. In interactive mode, you are prompted when this flag is not set. Default: `false`.
`--upload`	bool	no	Upload your developer profile to the server for dashboard spawning. In interactive mode, you are prompted. Default: `false`.

What it does

In interactive mode, murmur setup walks through these steps:

GitHub authentication — Discovers your GitHub token via the gh CLI. If gh is not authenticated, opens gh auth login for you.
Tenant selection — Lists the tenants you belong to and lets you pick one. If only one tenant exists, it is selected automatically.
Workspace selection — Lists workspaces for the selected tenant and lets you pick one.
Claude credentials — Prompts for an Anthropic API key, or offers to run a Claude OAuth flow for subscription-based access. Skippable if you use an OpenAI key instead.
OpenAI credentials — Checks for OPENAI_API_KEY in the environment and prompts for confirmation.
murmur.yaml creation — Creates .murmur/murmur.yaml (shared team config) if it does not exist, with your tenant and workspace. Adds murmur.local.yaml to .gitignore.
Profile encryption — Encrypts your credentials and writes murmur.local.yaml (personal, gitignored).
Profile upload — Optionally uploads your profile so you can spawn agents from the dashboard.
MCP server — If Claude Code is installed, offers to register murmur as an MCP server (claude mcp add).

Non-interactive mode

With --non-interactive, murmur setup reads credentials from environment variables instead of prompting. An existing .murmur/murmur.yaml is required. The recognized variables are:

Variable	Purpose
`CLAUDE_CODE_OAUTH_TOKEN`	Claude OAuth access token.
`CLAUDE_CODE_OAUTH_REFRESH_TOKEN`	Claude OAuth refresh token.
`ANTHROPIC_API_KEY`	Anthropic API key (alternative to OAuth tokens).
`OPENAI_API_KEY`	OpenAI API key for Codex backend.

At least one of a Claude OAuth token, an Anthropic API key, or an OpenAI API key is required.

murmur setup auth

murmur setup auth manages the labeled Claude OAuth credential set that spawns round-robin across. The legacy single credential from murmur setup is entry 0, label default.

Subcommand	Description
`add <label>`	Run the OAuth flow and add a labeled credential to the rotation.
`update <label>`	Run the OAuth flow and rotate a labeled credential’s values in place (`update default` rotates the legacy pair).
`remove <label>`	Remove a credential from the rotation and delete its secrets (`remove default` removes the legacy pair).
`list`	Show the credential set — labels and secret names, never values.

Your credentials are recorded in murmur.local.yaml — the source of truth, with every token value KMS-encrypted like the rest of the file — and after each change you are asked whether to upload them to your developer profile. The upload mirrors the file: it overwrites the profile’s Claude credential state from murmur.local.yaml. Declining leaves the profile stale; murmur setup auth update <label> re-runs the flow and offers the upload again. A confirmed upload after remove also deletes the removed credential’s server-side secrets — and if that upload was declined or failed, re-running murmur setup auth remove <label> offers to finish the server-side cleanup. Selection is server-side and does not require an upload: spawns from this machine (CLI or MCP) carry the full local rotation on the request, and the server assigns each spawn one credential from it (round-robin). The uploaded profile is what dashboard spawns select from — keep it mirrored if you spawn from the dashboard. With --service-profile NAME, the subcommands manage a service profile’s credential set instead. Service-profile credentials are server-only and never touch murmur.local.yaml.

murmur setup auth add user2          # Add a second Claude subscription to the rotation
murmur setup auth update user2       # Re-authenticate after a claude credential "user2" error
murmur setup auth update default     # Rotate the legacy credential
murmur setup auth remove user2       # Remove "user2" and delete its secrets
murmur setup auth list --service-profile ci-builder

Examples

Interactive setup in a new repo

murmur setup

▸ Discovering GitHub token...
✓ gh CLI authenticated as "alice"
  Use this token? [Y/n] y
▸ Discovering tenants...
  Using personal tenant: github_oauth/alice
▸ Discovering workspaces...
  Using workspace: backend
▸ Authenticating with Claude...
✓ Authenticated (expires in 31536000 seconds, scopes: user:profile user:inference user:file_upload)
▸ Resolving identity...
  identity: github_oauth/alice
▸ Gathering credentials and SSH keys...
  Alice Smith <alice@example.com> (github: alice)
  2 SSH key(s)
✓ Wrote .murmur/murmur.local.yaml (identity: github_oauth/alice)
  Upload developer profile to the server for dashboard spawning? [Y/n] y
▸ Uploading credentials to CatalogUser...
✓ Credentials uploaded to CatalogUser

✓ Setup complete — you're ready to use murmur.

Non-interactive setup in CI

export ANTHROPIC_API_KEY="sk-ant-..."
murmur setup --non-interactive --skip-ssh-keys --upload

Write local config to stdout

murmur setup --out -

Errors

Code	Meaning	What to do
`gh CLI not found`	The `gh` CLI is not installed.	Install it from cli.github.com.
`no .murmur/murmur.yaml found`	Non-interactive mode requires an existing config file.	Run interactive `murmur setup` first, or create `.murmur/murmur.yaml` manually.
`no tenants found`	Your GitHub account is not associated with any tenant.	Contact your organization admin to be added.
`at least one of a Claude OAuth token, an Anthropic API key, or an OpenAI API key is required`	No credentials were provided.	Supply at least one credential via the interactive prompts or environment variables.
`murmur.yaml is required`	No config file exists and creation was declined.	Run `murmur setup` from a git repository, or create `.murmur/murmur.yaml` manually.

Profiles and secrets — what the profile contains and how credentials are stored
Workspaces — concept overview
murmur auth — standalone Claude OAuth flow
murmur init — onboarding wizard for new repos
murmur spawn — start an agent
Configuration: murmur.yaml — shared team config file
Configuration: local overlays — per-developer local config

Getting Started

Core Concepts

Guides

murmur setup CLI command

Synopsis

Arguments

What it does

Non-interactive mode

murmur setup auth

Examples

Interactive setup in a new repo

Non-interactive setup in CI

Write local config to stdout

Errors

​Synopsis

​Arguments

​What it does

​Non-interactive mode

​murmur setup auth

​Examples

​Interactive setup in a new repo

​Non-interactive setup in CI

​Write local config to stdout

​Errors

​Related

Synopsis

Arguments

What it does

Non-interactive mode

murmur setup auth

Examples

Interactive setup in a new repo

Non-interactive setup in CI

Write local config to stdout

Errors

Related