MUR
The local-first AI agent platform, in native Rust.
Run a fleet of specialized AI agents on the machine you already own — agents that learn from every session, speak with an on-device voice, plug into the AI tools you already use, and can be handed to a friend as a single file.
Quick start · Features · Architecture · CLI · Docs · Website
What is MUR?
Every AI tool you use today is stateless and cloud-tethered: each session starts from zero, and the agent lives in someone else's datacenter. MUR inverts both assumptions.
MUR runs specialized agents as long-lived local processes — each with its own model binding, system prompt, MCP servers, skills, schedule, voice, and permissions — supervised by one small Rust runtime speaking A2A v0.3. On top of the runtime sits a memory pipeline with a maturity lifecycle: what an agent learns in one session is captured, scored, stored as plain YAML, retrieved by hybrid semantic search, and injected into the next session — and it decays when it stops being useful, so no junk accumulates.
You talk to your fleet through the MUR Hub desktop app (chat, approvals,
desktop pets), by voice, from an iPhone, from the terminal, or
through Slack / Telegram / Jira. And when an agent becomes genuinely useful,
you can export it as a signed .muragent file and give it to someone who has
never heard of MUR.
In one line: a native-Rust, local-first fleet of specialized AI agents that learn and evolve — light enough to be always-on on the Mac you already own, and each exportable as a companion you can hand to anyone.
Why local-first?
- It fits on your machine. ~200K lines of native Rust — no Electron, no Python sidecar. An always-on fleet plus a local LLM fits in consumer RAM.
- Marginal cost ≈ 0. Inference runs on your hardware. Everything local is free, with no per-token meter.
- Privacy is structural, not a setting. Memory, recordings, telemetry, and
voice stay under
~/.mur/. Logs pass through a redaction chokepoint before they touch disk, and a compile-time test forbids the companion module from importing network clients.
How MUR compares
| Capability | MUR | Agent harnesses(Archon, …) | Coding agents(Claude Code, Cursor) | Memory layers(Mem0, Zep, …) |
|---|---|---|---|---|
| Local-first multi-agent runtime (native Rust) | ✅ | ✗ | ✗ | ✗ |
| Memory that evolves (decay + Draft→Canonical lifecycle) | ✅ | ✗ | ✗ | partial |
| Kernel sandbox (Landlock / seccomp / SBPL / Job Object) | ✅ | ✗ | ✗ | ✗ |
| Export an agent as a giveable artifact | ✅ | ✗ | ✗ | ✗ |
| On-device voice, DND-aware | ✅ | ✗ | ✗ | ✗ |
| Feeds learning into 16+ existing AI tools | ✅ | ✗ | partial | ✗ |
🚀 Quick start
The 5-minute path — MUR Hub (macOS, Apple Silicon)
- Download MUR-Hub-aarch64-apple-darwin.dmg from the latest release.
- Drag MUR Hub into Applications and open it.
- Say hi — the built-in concierge agent MUR is alive immediately: offline, no API key, no signup, running on a bundled local multimodal model.
- + New Agent asks where the next one comes from — a role template MUR
fills in for you (skills, system prompt, least-privilege permissions), the
official catalog, or a
.muragenta friend shared. Giving it a pet look is the last step of every route, so any agent can live on your desktop.
Received a .muragent file from a friend? Double-click it. Hub verifies the
signature, walks you through model setup, and the agent comes alive.
Power users: Hub menu → Install Command-Line Tools… puts
muron yourPATH.
The CLI path
# macOS / Linux
|
# Windows (PowerShell)
|
# Homebrew (macOS arm64)
# From source
# Later: upgrade in place, and restart agents onto the new binary
# --resume continues the last conversation
In the chat, type / to open a completion menu of slash commands (with their subcommands) and the agent's skills — ↑↓ to move, Tab/Enter to accept, Esc to dismiss. And when the agent offers you choices, they appear as Tab-to-fill suggestions right in the input: a single one as greyed ghost text, several as a picker.
Models & providers
Agents draw from a local provider/model registry at ~/.mur/models.yaml:
# input/output pricing + context window are auto-filled
# from the models.dev catalog (--no-fetch to skip, or
# --input-cost/--output-cost to set them by hand)
API keys are stored as SecretRefs (env:, keychain:, file:, cmd:) — never written to config in plaintext. The MUR Hub desktop app has a Model Library that connects cloud providers (key saved to the macOS Keychain), auto-detects local runtimes (Ollama / MLX / LM Studio), discovers their models via /v1/models, and adds them to the registry — no YAML editing required.
Reuse the subscriptions you already pay for. The companion mur-model-gateway runs a local endpoint (127.0.0.1:8088) that routes Anthropic / OpenAI / Gemini calls through one outlet and attaches credentials from your OS keychain — point a registry entry's base_url at it and your agents ride your existing Claude Code login instead of a separate metered API key.
Cloud LLM backend (opt-in)
Conversation stages inherit the top-level llm: block by default. Each stage
accepts an optional BackendConfig override in ~/.mur/config.yaml, so you
can pin individual stages to a different provider while everything else inherits
the top-level setting:
conversations:
compact:
# extractive stage → cloud (fast + cheap). abstractive_backend is left
# unset here, so it inherits the top-level `llm:` block (local or
# cloud, whatever that's set to) — give it its own override to pin it
# independently.
extractive_backend:
provider: anthropic # ollama | anthropic | openai | openrouter | gemini
model: claude-haiku-4-5
api_key_env: ANTHROPIC_API_KEY
# endpoint: https://api.anthropic.com # optional override
# timeout_secs: 120 # optional, default 120
ask:
# answer stage → cloud. rewriter_backend is left unset here, so the
# rewriter follows this same answer-stage backend (cloud too) — set
# rewriter_backend explicitly if you want the rewriter pinned somewhere
# else (e.g. kept local while the answer stage runs in the cloud).
backend:
provider: anthropic
model: claude-sonnet-5
api_key_env: ANTHROPIC_API_KEY
# rewriter_backend: # same shape, per-stage
rollup:
# weekly/monthly rollups take the same two overrides as compact
# extractive_backend: …
# abstractive_backend: …
Fields: provider, model, optional endpoint, api_key_env (name of the
env var holding the key — the key itself never lives in config), api_key_ref
(a secret-ref string such as env:VARNAME, checked before api_key_env), and
timeout_secs. Leaving an override unset makes that stage inherit the
top-level llm: block — there is no separate local-only fallback anymore.
mur chat doctor prints every stage with the provider, model and endpoint it
will actually dial, marked [pinned] or [follows smart], then probes each
distinct endpoint once — so you can verify routing before any conversation
data exists.
Upgrading: configs written before per-stage backends stored a bare model
name plus an ollama_endpoint. MUR converts them the first time it loads your
config and writes the result back once. A stage still on its shipped defaults
becomes an inherit; a stage you had customized is pinned to an explicit Ollama
backend, preserving exactly what it did before.
Typical cost with Haiku-extractive + Sonnet-ask is on the order of a few
dollars per month of daily use. Verify your setup with the ignored live
test: cargo test -p mur-core live_anthropic_haiku_responds -- --ignored
(requires ANTHROPIC_API_KEY; costs ~$0.0001 per run).
Teach the AI tools you already use
MUR's memory layer works even if you never create an agent — it rides along with Claude Code, Codex, Cursor, Gemini-family CLIs, and a dozen more:
Dev-discipline skills (built-in)
MUR ships a curated engineering-discipline pack — internalized from the
MIT-licensed obra/superpowers and
mattpocock/skills (see
docs/ATTRIBUTIONS.md), merged and adapted to MUR's runtime (no sub-agents
required; delegation-aware). One hub routes; sixteen on-demand leaves carry
the method:
mur-dev (hub) · mur-grilling · mur-brainstorm · mur-domain-modeling ·
mur-writing-plans · mur-tickets · mur-executing-plans ·
mur-delegate-dev · mur-worktree · mur-tdd · mur-debugging ·
mur-code-review · mur-receiving-review · mur-verification ·
mur-finishing-branch · mur-merge-conflicts · mur-skill-authoring
- Zero token cost until used: only the hub appears in the session-start
learning index; leaves load on demand (
mur skill show mur-tdd). - Never-shadow: with the superpowers plugin installed, the hub hides itself
on the CLI surface (
skills.dev_discipline_index: auto|always|neverin~/.mur/config.yaml); a user-authored skill with the same name is never overwritten.
✨ What can a MUR agent do?
🤖 Run as a real local process
One BusyBox-style runtime binary, one symlink per agent (mur_agent_coach).
Each agent owns its model binding (Ollama, MLX, Anthropic, OpenAI, … via the
~/.mur/models.yaml registry), system prompt, MCP servers, skills,
keychain-backed secrets, cron schedules, webhook receiver, and a rotating Ed25519
identity. mur agent exposes 40+ subcommands for the full lifecycle — create,
chat, export, schedule, permissions, telemetry, trash, rollback.
🧠 Learn — and forget — like a teammate
flowchart LR
C["capture<br/>significance · feedback"] --> S["store<br/>YAML truth + vector index"]
S --> R["retrieve<br/>vector 0.7 + BM25 0.3"]
R --> I["inject<br/>hooks · MCP · prompts"]
I -.->|next session| C
E["evolve<br/>decay · maturity · recombination"] <-.-> S
Knowledge moves through a maturity lifecycle driven by real usage, with decay half-lives by tier (session 14d / project 90d / core 365d):
stateDiagram-v2
direction LR
[*] --> Draft
Draft --> Emerging: validated by usage
Emerging --> Stable: repeated wins
Stable --> Canonical: proven over months
Canonical --> Stable: unused — decay
Stable --> Emerging: unused — decay
Recurring tool sequences across sessions are mined into suggested workflows
(mur workflow suggest) — no drag-and-drop DAG editor, no marketplace; your own
recorded behavior is the authoring tool.
Capture is ambient: once hooks are installed, every session is recorded
locally (scrubbed at write, retention-GC'd, one line of config to turn off).
mur in just marks the current session as important; mur out reviews what
MUR queued for you — workflow proposals harvested from recent sessions, and
memory notes your agents want to share. Accept a workflow proposal and it
becomes a draft you can run with mur run.
Agents remember proactively: state a durable preference mid-chat ("from
now on, reply in zh-TW") and the agent saves it as a memory note — and tells
you so, in one line, with /forget as the undo (/memories lists everything
it knows). Notes come in two kinds with matched decay: rule (behavioral
guidance, fast half-life) and fact (environment truth, slow half-life). A
reserved injection slot keeps fresh notes from being permanently outbid by
mature skills. Off switch / confirm-first: memory.capture in
~/.mur/config.yaml.
What an agent remembers stays its own until you say otherwise: each
remember also files a proposal into your mur out review lane — accept and
the note goes global (every agent's loader sees it), dismiss and the agent
keeps its private copy. Nothing an agent inferred reaches other agents
without usage-earned maturity or that explicit human gate.
Knowledge federates on maturity, signed both ways: each agent's sleep
cycle drops an Ed25519-signed snapshot request; the daemon verifies it
outside the sandbox and assembles the curated skills (lifecycle ≥ stable
by default) into that agent's local cache. Outbound is signed too — evidence
signals and memory proposals are signed with the agent's identity key as they
leave its home, and ingest verifies who said it (and that it may) before
anything is applied; the review lane labels each proposal ✓ signed.
MUR_SIGNAL_REQUIRE_SIG=1 turns tolerance for legacy unsigned drops off.
💬 Be everywhere you are
- MUR Hub — multi-conversation rail across the fleet, streaming replies, human-in-the-loop tool approvals, dashboards, and drag-out desktop pets with expressions and speech bubbles.
- Voice — fully on-device TTS (Kokoro 82M) + STT (whisper.cpp); respects Do Not Disturb, Focus, and a busy microphone.
- iPhone — the in-repo iOS companion (
mur-mobile-app) pairs over LAN withmur agent pair(QR); off-LAN traffic falls back to a relay that forwards only end-to-end-signed envelopes. All AI stays on your Mac. - Watch together — agents open videos in VLC, explain the current scene, analyze whole videos with timestamps, and (opt-in) comment on scene changes — on a local multimodal model.
- Bridges — Slack, Telegram, Jira (
@mur implement PROJ-123), and webhooks.
🎁 Be given away
flowchart LR
A["Your agent<br/>in Hub or CLI"] -- "Share /<br/>mur agent export" --> B["coach.muragent<br/>signed · sanitized · data-only"]
B -- "any channel" --> C["Friend<br/>double-clicks"]
C --> D["Hub verifies signature,<br/>guides model setup"]
D --> E["Agent alive<br/>on their machine"]
The .muragent package is DSSE-signed and contains no executable code and no
secrets — private keys and API keys are stripped at export. The recipient
installs MUR Hub once (signed + notarized); after that, agents travel as plain
files.
MUR publishes agents the same way. mur official list browses the curated
catalog and mur official install agents/<name> installs one — the bundle is
signed by MUR and carries a license bound to your account, so an installed
official agent verifies on your machine and nowhere else. The Hub's + New
Agent wizard offers the same catalog as a source.
🔐 Stay governed
- Kernel sandbox per OS — Landlock + seccomp (Linux), SBPL (macOS), Job Object (Windows) — plus a DNS-resolver guard that filters network egress.
- Human-in-the-loop — tool calls pause for your approval in Hub and in
mur agent cli(opt out per session with--auto). - Loop settings that can't quietly mean something else — a fleet loop ends
when its job queue drains, when a member emits an agreed marker on a line of
its own, or when the router judges it done.
mur fleet set-looprefuses a value that would be silently reinterpreted: a calendar date is not a deadline,--max-iterations 0is not zero, and a cron expression that can never fire is not a schedule. Unattended auto-run still needs an explicit budget, andmur fleet stopstill ends everything. - Settlement — a turn that changed anything ends with a card the runtime
draws from its own tool records, not from the model's summary: what was
verified (a command ran and passed), what was changed (files edited,
nothing run), what was blocked, and whether the turn stopped early. The
verified row is printed even when it's empty —
✔ verified (nothing ran — no evidence this works)— so "all fixed" over an empty column reads as the contradiction it is. The same ledger rides along as JSON, somur agent send, fleet steps and Hub get the accounting without scraping prose. - Capability routing — an agent blocked by the sandbox doesn't hand the job
back to you: the denial names the fleets that actually hold that binary, and
the agent delegates.
mur agent who --can cargoshows the same picture, derived from what the kernel enforces rather than from a list anyone maintains — including the capable fleets you haven't authorized yet, and the command that authorizes them. - Deletion safety — destructive file actions go through a trash with a
cancel window and explicit restore (
mur agent trash); nothing is hard-deleted on a timer. - Auditability — every action lands in an append-only JSONL ledger; MUR Commander (companion crate) adds an Ed25519-signed constitution and a hash-chained audit log for cross-network fleets.
- Governed distribution — agents, fleets, and capabilities (bundled MCP
servers + skills + program requirements,
mur capability install) carry pinned provenance under a strict never-shadow rule: an imported plugin or bundled skill can never silently override a builtin.mur skill doctorflags drift and de-pins stale vendored copies; imported add-ons re-verify onmur agent addon reimport. - Enforced MCP pins — an agent refuses to start when an MCP server's
binary no longer matches the hash pinned at install, or isn't signed.
mur agent mcp inspect <agent>shows pinned vs current;mur agent mcp pin <agent> <server>re-approves;mur doctorreports drift across every agent before you meet it as a failed startup. MUR's own bundled MCP server re-pins itself when MUR upgrades, and interpreter-launched servers (npx …,python -m …) are reported as unprotected rather than enforced — hashing the interpreter breaks on unrelated runtime upgrades without covering what it runs.
🔌 Power the tools you already pay for
Three integration layers, by interaction shape:
| Layer | Shape | What it does |
|---|---|---|
| Hooks | fire-and-forget | mur sync writes memory into each tool's native config; session hooks inject context automatically |
| MCP server | interactive | mur-mcp-server (stdio) exposes 18 tools — search, recall, project code search, agent status, token compression, media control |
| Skills | teaching | curated manifests that tell agents when and why to reach for MUR |
Synced tools include Claude Code, Gemini CLI, Auggie, Cursor, Copilot CLI,
OpenClaw, OpenCode, Amp, Codex, Aider, Windsurf, Zed, Junie, Trae, Cline, and
Amazon Q. The compression tools (mur_compress / mur_retrieve) shrink large
payloads 40–80%, reversibly — originals stay retrievable by hash.
🦀 Architecture
| Crate | Role |
|---|---|
mur-core |
The mur CLI — memory pipeline, sync, sources, dashboard server, agent management |
mur-common |
Shared types — Pattern, Workflow, A2A envelopes, .muragent format |
mur-agent-runtime |
Per-agent A2A v0.3 supervisor — sandbox, voice, export, telemetry |
mur-daemon |
Always-on background daemon — queues, schedules, dashboard API |
mur-mcp-server |
stdio MCP server exposing MUR to AI clients mid-conversation |
mur-compress |
Offline, reversible token compression |
mur-gui-core |
Shared GUI library — sidecar supervisor, companion bridge, A2A client |
mur-agent-launcher |
<100 KB per-agent stub (Dock identity, file association) |
mur-mobile-sdk |
Rust mobile core (UniFFI → Swift/Kotlin) — transport, signed envelopes, audio framing |
mur-hub-gui |
MUR Hub desktop app (Tauri 2 + React) |
mur-mobile-app |
iOS voice companion (Swift) |
MUR Commander — the cross-network orchestration, governance, and evaluation plane — ships as a separate crate.
On disk, everything lives under ~/.mur/: agents, skills, notes, and workflows
as human-readable, git-friendly YAML (the source of truth), plus a
LanceDB vector index that is always rebuildable (mur internals reindex). No
opaque database lock-in.
🧰 CLI at a glance
mur
├── init / doctor / update / stats / verify
├── agent create · cli · send · card · who · export · install · addon · companion ·
│ voice · pair · schedule · perm · secret · trash · rollback … (40+)
├── capability install · list · show · remove (MCP + skills + programs bundled → an agent)
├── fleet create · list · show · run · set-loop · send · jobs (squads of agents over a shared channel)
├── official list · install (official agents/fleets from the app.mur.run catalog)
├── deep-research setup · status · ask (web research with wizard UX)
├── skill install · search · show · doctor · generate · suggest · evolve · recombine ·
│ publish · audit · trust · exchange · drafts · eval …
├── notes create · search · list · show
├── workflow run · suggest · list · schedule · show · search · new · publish · install
├── session start · stop · record · status · list · review · show · export · push
├── open add · done (what is still outstanding, by whether MUR saw it)
├── sync (16+ AI tools) · status · fleet pull/push/both
├── hook unified hook entry for AI tools (prompt / tool / stop / session-start)
├── chat conversations archive + ask
├── model add · list · show · remove · migrate
├── source external knowledge — Obsidian · Notion · Joplin
├── project index · search (semantic code search)
├── daemon start · stop · status · serve · sleep
├── auth login · logout
├── team shared skills (private registries)
├── push / fetch signal outbox / inbox ↔ server
├── deploy Docker Compose deployment
└── internals low-level store access · reindex
Deep research, simplified
mur deep-research setup # one-time wizard: model, workers, budget, egress consent
mur deep-research # status panel
mur deep-research "question" # preflight (start workers, re-pin gateway) + guarded run
provision / run remain as the flag-based advanced path. Egress is only ever granted in setup/provision --grant-egress (explicit consent); the smart run never touches grants.
Runs report progress: each step prints ✓ s2 research dr_worker_2 $0.08 42s as it
completes, every iteration ends with a summary (iteration 2 done: 3✓ 0✗ 2 pending · spend $0.31/$2.00 · model claude_haiku), and the bare mur deep-research panel shows
the in-flight run (per-phase counts, running steps, spend vs budget) or the last run's
outcome. Progress lives in ~/.mur/fleets/deep-research/.run_progress.json (best-effort;
never affects the run).
🔨 Build from source
&&
The two Tauri apps (mur-hub-gui, legacy mur-agent-gui) build from their own
manifests so the workspace build never pulls WebKitGTK / Cocoa / WebView2. The
iOS app builds with mur-mobile-app/build-ios.sh.
🧭 Roadmap
- Cost-Router orchestrator — route the easy ~80% of sub-tasks to local
models and spawn a frontier coding agent (
claude/codex/agy) only for the hard parts, as governed, sandboxed subprocesses. Spec merged; router in progress. - Fleet Sync (Pro) — replicate your evolved fleet (profiles, skills, workflows, and their maturity/lifecycle state) across devices. Everything local stays free.
- Hub on Windows / Linux, and an Android companion from the same Rust mobile core.
Want to teach an agent something new? See Authoring Skills.
Design history lives in docs/superpowers/specs/ and
docs/architecture/runtime-overview.md.
🤝 Contributing
Issues and PRs are welcome — see CONTRIBUTING.md.
&&