Enum Command 

pub enum Command {
    Init {
        vault: String,
    },
    Env {
        vault: String,
    },
    Restore {
        vault: String,
    },
    Recover,
    Add {
        key: String,
        desc: Option<String>,
        group: Option<String>,
        scoped: bool,
        tag: Vec<String>,
        vault: String,
    },
    Generate {
        key: String,
        length: usize,
        hex: bool,
        desc: Option<String>,
        group: Option<String>,
        tag: Vec<String>,
        vault: String,
    },
    Rotate {
        key: Option<String>,
        all: bool,
        generate: bool,
        length: usize,
        hex: bool,
        list: bool,
        json: bool,
        vault: String,
    },
    Rm {
        key: String,
        vault: String,
    },
    Get {
        key: String,
        vault: String,
    },
    Edit {
        key: Option<String>,
        scoped: bool,
        group: Option<String>,
        vault: String,
    },
    Ls {
        tag: Vec<String>,
        json: bool,
        vault: String,
    },
    Export {
        tag: Vec<String>,
        json: bool,
        vault: String,
    },
    Import {
        file: String,
        force: bool,
        group: Option<String>,
        vault: String,
    },
    Describe {
        key: String,
        description: String,
        example: Option<String>,
        tag: Vec<String>,
        rotate_every: Option<String>,
        expires: Option<String>,
        vault: String,
    },
    Info {
        tag: Vec<String>,
        json: bool,
        vault: String,
    },
    Skeleton {
        output: Option<String>,
        vault: String,
    },
    Exec {
        only: Vec<String>,
        tag: Vec<String>,
        clean_env: bool,
        vault: String,
        command: Vec<String>,
    },
    Agent {
        sub: AgentCommand,
    },
    Mcp {
        vault: String,
        allow_exec: bool,
    },
    Policy {
        sub: PolicyCommand,
    },
    Circle {
        sub: Option<CircleCommand>,
        json: bool,
        vault: String,
    },
    Authorize {
        pubkey: String,
        name: Option<String>,
        force: bool,
        allow_ssh_rsa: bool,
        vault: String,
    },
    Revoke {
        recipient: String,
        rotate: bool,
        vault: String,
    },
    Group {
        sub: GroupCommand,
    },
    Verify {
        vault: String,
    },
    Doctor {
        vault: String,
    },
    Scan {
        paths: Vec<String>,
        vault: String,
    },
    Diff {
        git_ref: String,
        show_values: bool,
        json: bool,
        vault: String,
    },
    SetupMergeDriver,
    MergeDriver {
        base: String,
        ours: String,
        theirs: String,
    },
    Completion {
        action: CompletionAction,
    },
}

Variants

Init

Initialize a new vault and generate a keypair

Fields

vault: String

Vault filename

Env

Write a .envrc for direnv integration

Fields

vault: String

Vault filename

Restore

Restore MURK_KEY from a BIP39 recovery phrase

Fields

vault: String

Vault filename, for the restored-identity recipient check

Recover

Re-derive recovery phrase from current MURK_KEY

Add

Add or update a secret

Fields

key: String

Secret key name

desc: Option<String>

Description for this key

group: Option<String>

Who can read it: a group name, everyone (default), or me

scoped: bool

Deprecated alias for --group me

tag: Vec<String>

Tag for grouping (repeatable)

vault: String

Vault filename

Generate

Generate a random secret and store it

Fields

key: String

Secret key name

length: usize

Length in bytes (default 32)

hex: bool

Output as hex instead of base64

desc: Option<String>

Description for this key

group: Option<String>

Who can read it: a group name, everyone (default), or me

tag: Vec<String>

Tag for grouping (repeatable)

vault: String

Vault filename

Rotate

Rotate secrets with new values

Fields

key: Option<String>

Secret key name (omit for –all)

all: bool

Rotate all secrets in the vault

generate: bool

Generate random values instead of prompting

length: usize

Length in bytes for generated values (default 32)

hex: bool

Output generated values as hex instead of base64

list: bool

List keys needing rotation instead of rotating (exits 1 if any)

json: bool

Output the listing as JSON (with –list; always exits 0)

vault: String

Vault filename

Rm

Remove a secret

Fields

key: String

Secret key name

vault: String

Vault filename

Get

Get a single decrypted value

Fields

key: String

Secret key name

vault: String

Vault filename

Edit

Edit secrets in $EDITOR

Fields

key: Option<String>

Edit a single key (omit to edit all)

scoped: bool

Edit scoped overrides instead of shared secrets

group: Option<String>

Edit values for this group instead of shared secrets

vault: String

Vault filename

Ls

List all key names

Fields

tag: Vec<String>

Filter by tag (repeatable)

json: bool

Output as JSON

vault: String

Vault filename

Export

Export all secrets as shell export statements

Fields

tag: Vec<String>

Filter by tag (repeatable)

json: bool

Output as JSON

vault: String

Vault filename

Import

Import secrets from a .env file

Fields

file: String

Path to the .env file to import

force: bool

Overwrite existing secrets without prompting

group: Option<String>

Assign imported secrets to this group (default: everyone)

vault: String

Vault filename

Describe

Add or update a key description

Fields

key: String

Secret key name

description: String

Description text

example: Option<String>

Example value

tag: Vec<String>

Tag for grouping (repeatable, replaces existing tags)

rotate_every: Option<String>

Rotation interval, e.g. 90d or 90 (days); never clears it

expires: Option<String>

Hard expiry date, e.g. 2026-09-01; never clears it

vault: String

Vault filename

Info

Show public schema and key info

Fields

tag: Vec<String>

Filter by tag (repeatable)

json: bool

Output as JSON

vault: String

Vault filename

Skeleton

Export schema-only vault with no secrets or recipients

Fields

output: Option<String>

Output file (prints to stdout if omitted)

vault: String

Vault filename

Exec

Run a command with secrets injected as environment variables

Fields

only: Vec<String>

Only inject these specific keys (repeatable)

tag: Vec<String>

Filter by tag (repeatable)

clean_env: bool

Strip inherited environment (only murk secrets + PATH)

vault: String

Vault filename

command: Vec<String>

Command and arguments to execute

Agent

Agent-oriented commands (schema-only output for AI agent prompts)

Fields

sub: AgentCommand

Mcp

Run an MCP (Model Context Protocol) stdio server for AI agents

Fields

vault: String

Vault filename

allow_exec: bool

Enable the murk_exec tool (run commands with scoped secrets injected). Off by default: it runs arbitrary commands as this user — the injected secrets are grant-scoped, but the command itself is not sandboxed.

Policy

Manage the agent access policy

Fields

sub: PolicyCommand

Circle

Manage recipients

Fields

sub: Option<CircleCommand>

json: bool

Output as JSON

vault: String

Vault filename

Authorize

Add a recipient to the vault

Fields

pubkey: String

Public key (age1…), ssh:path, ssh: (default ~/.ssh/id_ed25519.pub), or github:username

name: Option<String>

Display name for this recipient

force: bool

Accept changed GitHub keys without confirmation

allow_ssh_rsa: bool

Allow ssh-rsa recipients (rejected by default — use ed25519)

vault: String

Vault filename

Revoke

Remove a recipient from the vault

Fields

recipient: String

Recipient pubkey or display name

rotate: bool

Rotate the secrets they had access to in the same session

vault: String

Vault filename

Group

Manage recipient groups

Fields

sub: GroupCommand

Verify

Verify vault integrity without exporting secrets

Fields

vault: String

Vault filename

Doctor

Check the surrounding repo for hygiene issues

Fields

vault: String

Vault filename

Scan

Scan files for leaked secret values

Fields

paths: Vec<String>

Files or directories to scan (defaults to current directory)

vault: String

Vault filename

Diff

Show secret changes vs a git ref

Fields

git_ref: String

Git ref to compare against

show_values: bool

Show actual values (not just key names)

json: bool

Output as JSON

vault: String

Vault filename

SetupMergeDriver

Configure git to use murk’s merge driver for .murk files

MergeDriver

Git merge driver for .murk vault files (called by git)

Fields

base: String

Path to base version (%O)

ours: String

Path to ours version (%A) — result is written here

theirs: String

Path to theirs version (%B)

Completion

Generate or install shell completions

Fields

action: CompletionAction

Trait Implementations

impl FromArgMatches for Command

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut<'b>( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

impl Subcommand for Command

fn augment_subcommands<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate Self via FromArgMatches::from_arg_matches_mut

fn augment_subcommands_for_update<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate self via FromArgMatches::update_from_arg_matches_mut

fn has_subcommand(__clap_name: &str) -> bool

Test whether Self can parse a specific subcommand