Declare it. Build it. Ship it.

Package, distribute, and deploy AI agents as isolated capsules.
Declare capabilities once. Run anywhere.

01

Write a manifest

Constraints are enforced, not trusted

The WASM sandbox enforces what's declared. The agent can't reach outside it regardless of what the LLM attempts. The manifest is the permission grant, the runtime is the enforcer.

02

Write a manifest

Pinned versions make behavior reproducible

Pinning an artifact locks it to one exact build, forever. A manifest pinned to coding-capsule@1.0.0 assembles the same environment today as it will six months from now. No silent upgrades.

03

Write a manifest

Every observable behavior has a config key

No hidden defaults. The manifest is the complete description of what the capsule does and how it behaves under edge conditions, readable, version-controllable, reviewable in a PR.

04

Install it

Install artifacts

mur install reads the manifest, pulls every declared .mur.zip artifact from your registry in parallel, validates each one, and stores it locally.

05

Run it

Run it anywhere

mur run reads the manifest, assembles the execution environment on demand, and runs the trace. Same behavior every time.

murmur.yaml
1name: coding-capsule2version: 1.0.03 4artifacts:5 - name: murmur-driver-anthropic6 version: "1.0.0" # this exact driver, always7 runtime: driver8 - name: murmur-tool-editor9 version: "1.0.0"10 runtime: tool11 - name: coding-conventions12 version: "1.4.1" # this exact skill, always13 runtime: skill14 15capabilities:16 shell:17 allow: [git, cargo] # bash not listed = blocked18 network:19 allow:20 - https://api.anthropic.com # everything else = blocked at runtime21 22inference:23 transport: http24 endpoint: https://api.anthropic.com25 model: claude-opus-4-826 api_key: ${ANTHROPIC_API_KEY}27 driver:28 artifact: murmur-driver-anthropic29 compaction:30 threshold: 0.6531 model: claude-haiku-4-532 system_prompt_file: instructions.md33 max_turns: 2534 35context:36 max_tokens: 100000037 38lifecycle:39 task_acceptance: queue # long-running40 queue_depth: 141 after_task: sleep42 43observability:44 otel_endpoint: http://localhost:431845eval:46 scorers:47 - type: max_turns48 - name: turn_limit49 - max: 25

Own the entire harness and
bring your own model

Murmur packages your agent as a single capsule, with its inference, tools, skills, and configuration all declared in one manifest. It runs on your own infrastructure, with nothing calling out except what you declared. And because everything is explicit, you get a lot for free: you can read exactly what the agent does, pin it so every run behaves the same, share it so your whole team runs an identical environment, and trust that it can never reach beyond what you granted.

DimensionMurmur capsuleAnthropic sandbox-runtime + Claude Agent SDKOpenAI Agents SDK sandbox
Self-hostable end to endYesPartialNo
ModelAny — pluggable / any providerProprietary (Claude, API-only)Proprietary (GPT, API-only)
Deployable unitSelf-contained capsule, open spec (.mur.zip + manifest), no container requiredNone — npm library, no container requiredNone — SDK + sandbox client, container required
PortabilityAny machine with the mur binarymacOS + Linux onlyAnywhere, swap the sandbox client
IsolationWASM sandbox, no containerOS-level (Seatbelt / bubblewrap), no containerContainer-based (Docker, E2B, Modal, …)
Capability enforcementDeclared in manifest, runtime-enforcedDeclared in config, OS-enforcedDeclared in code, enforced by sandbox client
LicenseApache 2.0Apache 2.0MIT

Inside the agent capsule runtime

Everything an agent needs ships as a single capsule. Declared by a manifest, isolated in a sandbox, with its own endpoint and filesystem. No container. No image registry. Yet runs anywhere, securely and contained.

Murmur agent capsule runtimeA layered diagram. The outer boundary is the Capsule, declared by murmur.yaml. Inside it a WASM sandbox holds the A2A Endpoint, Agent Loop (with an outbound model API call), Tools / Skills / Hooks, and Filesystem. Below the capsule the mur binary runs on bare compute with no container.Capsulemurmur.yamlSANDBOXA2A Endpointagent-card · message · tasks · streamAgent Loopinference drivers · tool dispatchLLM callsTools / Skills / Hookscapability-enforced · default denyFilesystemgrant-scoped · shell widens surfacemurmur-clino container · no image registrylaptop · VM · K8s2–5ms cold startmanifest grants enforcedpublic HTTP surfacecannot exceedmanifest grantsone command — mur deploybare VM · no Docker · K8s

The capsule runtime loop

// from the ecosystem

Ideas shaping the runtime

Article

The Pharmakon of a Billion Capsules

As AI agents proliferate, what happens to our own agency if the primary goal becomes eliminating human effort? A case for designing systems where every increase in artificial agency also expands human agency.

4 min read