---
title: "Murmur"
description: "The infrastructure layer for AI agents. Package any agent once and run it anywhere, reproducibly and fully isolated."
canonical_url: "https://murmur.nexus/"
last_updated: "2026-09-12T18:31:37.294Z"
---

# Murmur — own the harness

The open-source capsule runtime. Package any agent once and run it anywhere, reproducibly and fully isolated.

## What Murmur is

Murmur packages an agent as a single **capsule**: inference, tools, skills, and configuration all declared in one manifest, `murmur.yaml`. The runtime enforces what's declared — a WASM sandbox, not a trust boundary the agent could talk its way past. Whatever the model attempts, the capsule can't reach outside what the manifest grants.

A representative manifest:

```yaml
name: coding-capsule
version: 1.0.0

artifacts:
  - name: murmur-driver-anthropic
    version: "1.0.0"
    runtime: driver
  - name: murmur-tool-editor
    version: "1.0.0"
    runtime: tool
  - name: coding-conventions
    version: "1.4.1"
    runtime: skill

capabilities:
  shell:
    allow: [git, cargo]      # bash not listed = blocked
  network:
    allow:
      - https://api.anthropic.com   # everything else = blocked at runtime

inference:
  transport: http
  endpoint: https://api.anthropic.com
  model: claude-opus-4-8
  api_key: ${ANTHROPIC_API_KEY}
  driver:
    artifact: murmur-driver-anthropic
```

`capabilities` is the whole trust boundary in one place: which shell commands run, which hosts are reachable, nothing implicit. `artifacts` pins exact versions of the driver, tools, and skills the capsule needs — `mur install` fetches them, and the same manifest produces the same capsule everywhere.

## Why it exists

Today's agent harnesses shift under you without warning, and every vendor ships its own opinions you have to work around. Murmur places the opposite bet: one manifest as the whole contract, defined by you, for any occasion — reviewing a pull request, migrating a database, triaging a production incident, auditing a dependency tree, refactoring a legacy service.

Because the manifest is explicit and complete, a capsule is reproducible (pin it and every run behaves the same), shareable (a whole team runs an identical environment), and auditable (you can read exactly what it does and trust it can't reach beyond what it was granted).

## How it compares

| | Murmur | Typical agent SDK | Container-based sandboxes |
|---|---|---|---|
| Hosting | Self-hostable end to end | Proprietary, API-only | Container-based (Docker, E2B, Modal, …) |
| Deployable unit | Self-contained capsule, open spec (`.mur.zip` + manifest), no container required | None — SDK + sandbox client, container required | Container image |
| Isolation | WASM sandbox, no container | OS-level (Seatbelt / bubblewrap), no container | Container-based |
| Capability enforcement | Declared in manifest, runtime-enforced | Declared in code, enforced by sandbox client | Declared in config, OS-enforced |
| Runs on | Any machine with the `mur` binary | macOS + Linux only | Anywhere, swap the sandbox client |

## Getting started

```bash
mur install
mur run --task "..."
```

`mur install` fetches every pinned artifact into a local store. `mur run` starts the capsule and prints a session ID you can inspect while it works.

## Where to go next

- [Documentation](https://docs.murmur.nexus/llms.txt): concepts, how-to guides, CLI and manifest reference.
- [Blog](https://murmur.nexus/blog/): long-form writing on Murmur's design.
- [Changelog](https://murmur.nexus/changelog/): release notes.
- [GitHub](https://github.com/murmur-nexus/murmur): source, issues, releases.