Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.murmur.dev/llms.txt

Use this file to discover all available pages before exploring further.

Murmur never stores your credentials in plaintext — not on disk, not in transit, not in the control plane. Developer profiles are encrypted client-side and decrypted only in agent VM process memory.

​
Developer profiles

A developer profile contains everything an agent needs to work on your behalf:
CredentialPurpose
GitHub tokenClone repos, open PRs, comment, push
Claude OAuth token + refresh tokenAuthenticate Claude Code
Anthropic API keyAlternative to OAuth
OpenAI API keyFor Codex backend (optional)
SSH signing key (ed25519)Sign commits on VMs
Git identityuser.name and user.email for commits
Identity tokenAuthenticate to Murmur API from VMs

​
How encryption works

  1. murmur setup sends your credentials to the platform API, which encrypts them with KMS
  2. The KMS-encrypted blob is stored in .murmur/murmur.local.yaml (gitignored)
  3. When an agent starts, the blob is sent to the control plane
  4. The control worker (the only process with KMS decrypt permission) decrypts and re-seals the blob with the VM’s ephemeral X25519 public key (NaCl box encryption)
  5. The VM decrypts credentials in process memory only — never written to filesystem
  6. When the agent stops, credentials are destroyed with the process

​
Running murmur setup

murmur setup
The interactive flow:
  1. Discovers your GitHub identity via gh auth token
  2. Lists your available tenants (personal + orgs with the Macroscope GitHub App)
  3. Prompts for Claude credentials (OAuth browser flow or API key)
  4. Optionally discovers an OpenAI API key
  5. Generates an SSH signing key for commit verification
  6. Creates .murmur/murmur.yaml if it doesn’t exist
  7. Encrypts and writes .murmur/murmur.local.yaml
For CI or automation: 
export GH_TOKEN="..."
export ANTHROPIC_API_KEY="..."
murmur setup --non-interactive --skip-ssh-keys

​
Tenant secrets

Tenant secrets are shared across your team. They’re KMS-encrypted in the catalog and injected as environment variables on agent VMs. 
echo "sk-prod-abc123" | murmur secret set INTERNAL_API_KEY
Agents access them as MURMUR_SECRET_INTERNAL_API_KEY on the VM. Reference them in your workspace: 
secret_refs:
  - INTERNAL_API_KEY
  - DATABASE_URL
Manage secrets: 
murmur secret ls          # list names (values are encrypted)
murmur secret rm API_KEY  # delete

​
Developer secrets

Developer secrets (user-secret kind) are per-developer encrypted values. They’re encrypted with additional authenticated data (AAD) tied to your identity, so only your agents can decrypt them.

​
Credential rotation

Rotate credentials on a running agent and all its children: 
murmur rekey fix-auth-bug
This re-encrypts and re-delivers your profile to the agent’s VM without restarting it.

​
Commit signing

During murmur setup, an ed25519 SSH signing key is generated and encrypted in your profile. On VMs, this key is used to sign git commits. You can upload the public key to GitHub for verified commit badges: 
murmur setup --commit-signing