Skip to main content
Murmur treats agent VMs as untrusted. Credentials are encrypted end-to-end, tenants are cryptographically isolated, and the platform enforces strict boundaries between what different components can access. Untrusted means the boundaries sit around the VM, not inside it: the agent has root (passwordless sudo) on its own ephemeral, single-tenant machine, and every isolation guarantee is enforced server-side. See Agent VM controls.

​
Agent VM controls

A coding agent is exposed to the lethal trifecta: secret access, untrusted input, and network egress, all at once. Murmur gives you a control for each leg: scope what secrets an agent can reach, control who is allowed to steer it, and apply egress control through customer placements. See Agent VM controls.

​
Repository confinement

Narrow one agent’s GitHub reach to the repositories its spawn involves. Its GitHub access is limited to that set, and the VM holds no GitHub token of its own: each operation is authorized and credentialed individually. See Repository confinement.

​
Authentication

Developers log in with GitHub, and organization membership establishes tenant membership. Agents authenticate with their own runtime identity. Their permissions include their own subtree and grants supplied directly or through runtime extension. See Authentication.

​
Authorization

Org admins get full access by default. Org members can spawn and manage their own agents. For finer control, define roles, create groups, and bind them with tenant-bindings. See Authorization.

​
Encryption

Developer credentials are encrypted at rest, re-sealed to each VM’s ephemeral key before delivery, and decrypted only in process memory. Each tenant has its own KMS key. Secrets follow the same encryption lifecycle. See Encryption.