A local-first fleet of specialized AI agents
Agents that run as long-lived local processes on the Mac you already own — each with its own model, skills and permissions. What they learn is stored as plain YAML, matures over time, and reaches 16+ AI tools. Not static rules. Not someone else's datacenter.
brew tap mur-run/tap && brew install murAlso available via cargo install · macOS, Linux, Windows
The Problem MUR Solves
Without MUR
Day 1:
"Use Swift Testing instead of XCTest"
Day 3:
"Use Swift Testing instead of XCTest"
Day 7:
"Use Swift Testing instead of XCTest"
🔄 Endless repetition. AI never learns.
With MUR
Day 1:
"Use Swift Testing instead of XCTest"
✓ Skill saved automatically
Day 3:
"Write tests for this function"
→ AI already uses Swift Testing
Day 7:
"Add more test coverage"
→ AI knows all your conventions
✨ Zero repetition. Continuous learning.
Works with 16+ AI tools
One knowledge base, every AI assistant
How it works
Install & Setup
One command to install. mur init sets up your config. mur sync connects to your AI tools.
Use AI Normally
Work with Claude, Cursor, or any supported tool. MUR watches and learns in the background.
AI Gets Smarter
Your skills are injected automatically. Your AI remembers your preferences forever.
What makes MUR different
Rules sync tools write static config files. Memory frameworks store generic data. MUR is the only closed-loop system that learns, evolves, and syncs.
👁️ Work That Outlives The Turn
A CI run, a fleet run, a subprocess — MUR keeps checking until the source gives a real answer, across daemon restarts, and says something once when it matters. Being unable to read a source is reported as unknown, never as a failure: when MUR says your build failed, it failed. It can act on what it finds, and anything reaching outside MUR stops and asks first — approvals wait as long as you need rather than timing out into acting alone. When the rules run out it can ask a model what to do, off by default and narrow when on: the model picks from three verbs or its answer is discarded, and it never decides what counts as risky.
🧭 Code Navigation, One Repo Per Entry
mur code-nav setup gives an agent structural search with ast-grep and, on request, serena's definition, reference and hover lookup. Every binary lives under MUR's own tools directory and the sandbox is granted exec only there. Each repository gets its own serena entry with its own home, so two repos never race on one registry. MUR refuses an entry name that would share a tool prefix with another server, before it writes anything, so a call can't silently land on the wrong repository.
🧐 A Second Agent That Reviews The First
mur fleet review --main coder --reviewer critic "task" runs them round after round until the reviewer approves, blocks, or a limit trips. A finding rejected twice waits for your ruling: /rule drop closes it, /rule fix makes it binding on both agents. Finding IDs come from MUR, not the model, and you see every message before it is sent. A crash leaves the session paused; mur fleet review-resume picks it up after the last finished round, and the channel stays as the audit record.
🔎 Research You Do Not Have To Sit Through
mur deep-research "question" puts a squad of workers on it under a budget you set, and saves a report. Reaching the web needs consent you gave once, in the setup wizard — asking a question never grants it. From a chat it is /deep-research, rendered on your screen without spending the agent a turn; from an agent it returns a handle in under a second, so a twenty-minute run never sits inside a call waiting to time out.
⏳ A Slow Model Is Not A Hung One
Nothing cuts a reply off by elapsed time. A local model that spends a minute loading weights before its first token finishes its answer. What is bounded is silence, not work — and a stream that stops sending keeps whatever arrived and marks it [output truncated] instead of failing the turn, because a truncated reply that looks complete is worse than an error.
🎚️ One Reasoning Dial, Every Vendor
Every provider spells “think harder” differently. One takes a level name, one a token budget, one only an on/off switch, and one rejects the parameter outright. MUR keeps a single scale and a table of what each model really accepts, so low through max means the same thing everywhere. Ask for a level a model has no step for and it degrades to the nearest one it has — and says so, rather than letting you believe a setting that never applied. Thinking hard needs room, so each registry entry can set its own output ceiling with max_tokens— a truncated answer says so instead of stopping silently.
🎯 A Router That Knows Its Limits
MUR can run background work on a cheaper model. It will never hand that work to a model that can't do it. Price orders the candidates; it doesn't decide who is eligible — a request carrying an image only goes to something that declares it can see. The two silences are read differently, because the failures are: a blind model answers confidently and wrongly, while a tool-incapable one is refused out loud and the chain just moves on. Your own picks are never second-guessed, cost-saving routing is off until you ask for it (mur model smart on), and per agent it is genuinely three-state — follow, on, off. And you can audit every call it made: mur agent routing lists each decision and marks the ones MUR chose for you.
⏸️ Approvals Wait For You
An unattended run that hits a step needing your say-so doesn't spend five minutes finding out you're asleep and then fail. The request parks, the step is blocked rather than broken, and everything that doesn't depend on it still finishes. Approve in the morning — the next run continues from there, because approvals match the action's content hash, not a throwaway id. Change the action and the old approval stops covering it. Your explicit “no” outranks any standing policy, and every auto-approval is written to the signed channel. When you are watching, the same pinning stops the nagging: the tool calls in one model response arrive as a single card instead of a prompt each, and an answer you already gave is not asked twice. There is no approve-all — the batch groups the question, never the answers. And if the kernel sandbox failed to seal, nothing is asked at all: an unsealed agent could forge its own approval, so tools that need one are refused on that boot — even ones you approved before. Session auto-approve has a ceiling too: it answers reads and writes, never spend, destructive, privileged or network-egress calls — and a browser tool that clicks, types or navigates in your logged-in session counts as egress, so it still asks. The Hub'sDon't ask again this session uses that same ceiling and remembers the answer only for the conversation you're in.
📂 Delegation Checks The Grant First
Hand work to a fleet and each member is told exactly which directory to work in — the repo root of the target — and checked for write access there before anything is sent. A missing grant is one approval that adds it, reseals the sandbox, and restarts the member, not an agent that finds out halfway through by building in the wrong tree. Ten jobs to one member ask once. A guessed directory is always confirmed, and nothing is dispatched until every member passes. Same check for mur fleet run, parallel_jobs, and a workflow's delegate_to steps.
🔑 An Expired Token Doesn't End Your Session
OAuth tokens age out every few hours. Your turn used to die on a bare 401 that named neither the credential nor where it lived./loginfixes it in place, and stops at the cheapest step that works — usually just asking the CLI that owns the credential to refresh it, with no browser and no interruption. MUR never holds your token: it reads the owner CLI's own status and the credential store's timestamp, never its contents.
🤫 A Credential the Model Never Sees
Your agent needs a deploy token, so you paste it into the chat — and it lands in the model's context, in the agent's signed append-only log, and at your provider. Secret redaction catches the shapes it knows and misses a bare hex token entirely. /secret reads it through a hidden prompt instead: the value goes to your OS keychain and into the agent's shell as $KEY, while the model is told the name and nothing more — and every tool result comes back with the value stripped out.
💓 A Run Status That Can't Lie
Most tools answer “is it running?” from whatever the run last wrote down — so a crashed job reports healthy until a timeout expires. MUR asks both questions: what the run last recorded, and whether the process behind it is still there. A dead orchestrator says DEAD the moment you ask, a long run is never falsely failed, and a record rebuilt after a crash admits what it cannot know instead of printing a stale pid as fact. Failed steps carry their reason, so a red run tells you what broke instead of sending you to the logs — and a step that failed with nothing to say says that too.
👁️ Your Agent Can Actually See
Point an agent at a screenshot, a photo, a rendered chart — read_file returns it as real vision input, and MCP servers that return images reach the model the same way. Ask any other agent runtime to read a JPEG and it decodes the bytes as text; the model, unable to say it never saw a picture, describes one anyway.
⏰ An Agent Asks For Time, It Doesn’t Take It
An agent can want a schedule and cannot create one. It writes a proposal — your words next to the cron, so you review the request rather than the expression — and nothing fires until you grant it with mur agent schedule accept. One-off reminders stop when they are done: cron has no year field, so “tomorrow at 10” would otherwise repeat every year forever.
🏷️ Provider Churn Is One Line
Anthropic, OpenAI and Google rename and retire model ids constantly. Your agents never name a model — they name a registry key, so a rename is one edit and every agent pointing at that key follows. No per-agent migration.mur model doctoraudits it offline and reports what drifted — and never rewrites an id for you, because which model you run is a cost decision, not a detail to silently upgrade.
🔑 One Key, Many Models
mur model connect anthropictakes your API key once, puts it in the Keychain, and lists that provider's models for you to pick — pricing and context windows filled in. Local runtimes (Ollama, MLX, LM Studio) are found by probing, no key at all. Setting up a second machine is copying one file and runningmur model import: it carries secret references, never keys, and tells you exactly which ones still need re-keying there.
📝 Agents That Remember & Say So
State a preference once — the agent saves it, announces it in one line, and applies it next turn. Proven knowledge federates to the whole fleet over Ed25519-signed snapshots, gated on maturity. Undo is one/forget away.
⏱️ Bounded, Not Budgeted
Three knobs bound every run — deadline, stuck, cost_usd — one schema at every scope, inner replacing outer, nothing multiplied. A turn you are watching never stops on its own; unattended work stops on its deadline or after ten minutes with no real progress, and a delegated member inherits the fleet's remaining clock. Local models cost nothing, so nothing pretends to cap their spend. mur limits <name> shows every bound in force and which scope set it; every stop reaches the settlement with its remedy. Long work returns a handle — dispatch a fleet, keep working, poll mur_job_status — and a member missing a tool the fleet declared it needs fails at dispatch, not after its budget. A run whose process died without a result reads abandoned on every surface once its grace window passes, instead of claiming to be running forever.
🔁 Loops That Know When To Stop
A squad you feed with jobs ends when the queue drains — checked before any model call, so a scheduled fleet that wakes to nothing costs nothing. Every other loop setting is checked too: a calendar date is not a deadline, zero iterations is not zero, and a cron expression that can never fire is not a schedule. mur fleet set-loop— and you watch every run live: a per-member rail plus milestone lines streamed from the fleet's signed channel, right in the chat TUI. Know the plan already? A procedure: in fleet.yaml runs your exact step graph with no router in the loop — and a typo in it fails the run instead of quietly broadcasting to everyone.
🔨 Agents That Can Check Their Own Work
An agent allowed to run cargo still couldn't compile: building means running binaries that don't exist yet, at paths no allowlist could name. Grant the build directory instead —mur agent perm allow-spawn-dir — and it compiles, tests, and reports what actually passed. Narrow by construction: a home directory or a bare mount point is refused, and filesystem and network limits still bound whatever runs.
📄 Reads The AGENTS.md You Already Wrote
An agent picks up the project's ownAGENTS.md,AGENT.md orCLAUDE.md — root first, so the deeper file is the more specific rule. It arrives as project context, not as operator rules, and it can't widen permissions: a file the agent couldn't read itself is left out. At most 32 KiB, and anything cut is named.
🧭 Capability Routing
Your front-door agent holds no build keys — and doesn't hand the job back to you. A sandbox-blocked command names the agents that can actually run it, ranked least-privileged first, derived from what the kernel enforces rather than a list anyone maintains. mur agent who
🧾 Settlement
An agent that edits nine files and runs nothing will still tell you it's done. So the runtime closes each turn with its own accounting — what was verified, what merely changed, what was blocked — drawn from the tool record, not the model's summary. The verified row prints even when it's empty: nothing ran — no evidence this works
↩️ Turn Undo
Each writing turn runs in a throwaway git worktree, and the original bytes are saved before its changes land. Put the project back with one command. It lists any file changed since and asks before overwriting it. And a turn that ran no tools but reports a commit, a PR, or a test tally gets an unverified row on its settlement card. mur agent turn undo <agent> <turn>
🧠 Agent Memory
Agents remember your preferences mid-chat — as local, decaying notes with /forget as the undo. Private per agent until you approve sharing; every proposal Ed25519-signed and verified. Rules that must never lose a ranking go in as permanent instructions (/instruct, /pin): sent every turn, never truncated, inside a fixed 3,500-token budget that refuses an overflow instead of dropping something silently.
🔄 Closed-Loop Learning
Session recording → skill extraction → injection → feedback → evolution. The full loop, automated.
🧬 Knowledge With A Lifecycle
Skills mature Draft → Emerging → Stable → Canonical on real usage, and decay when they stop earning their place. A skill can even self-evolve from its own telemetry. What works gets stronger; stale knowledge fades instead of piling up.
🔍 Hybrid Semantic Search
Vector similarity (70%) + BM25 keywords (30%) + multi-factor scoring. More precise than pure vector search. In a chat, /search queries the project index without leaving the conversation — a short preview per hit, then --lines N or --expand for a hit's full chunk.
📁 YAML + Git Friendly
Human-readable skills you can version control. No opaque database lock-in. Rebuild the index anytime with mur reindex.
🔒 100% Local First
All data stays on your machine. Zero telemetry. Injection scanning + content hashing for security. Cloud sync is optional.
⚙️ Workflow Engine
Multi-step workflows with variables and permissions — extracted from sessions or defined manually.
👥 Team sharing
Share knowledge across your team, and hand a whole agent to someone as a signed file.
🔀 Model Gateway
One local endpoint for Anthropic, OpenAI & Gemini — agents reuse the subscriptions you already pay for, credentials stay in your OS keychain.
💳 ChatGPT Subscription, No API Key
Sign in through Codex, pick the models on your plan, and agents run on your ChatGPT subscription — never a metered key. Entries are provider: codex with no secret; the runtime only talks to the loopback gateway, and MUR never adds a usage-billed fallback behind a subscription model on its own.
💳 Claude Subscription, No API Key
Sign in through Claude Code and agents run on your Claude Pro/Max plan. Entries are provider: claude with no secret; the runtime only talks to the loopback gateway, and pointing one at api.anthropic.com is refused at startup rather than quietly billed.
⚡ One Command Setup
mur init configures everything. Works invisibly in the background after that.
🖥️ MUR Hub 2.0
One master–detail shell for every page — agents, fleets, chats, the four library pages, settings — with a ⌘K palette, ⌘↩ to open any agent or fleet in its own window, a side-peek from Home, multi-select bulk Start / Stop, and a Permissions section that shows every sandbox entitlement and edits it in place. The Hub app stays fully local: your fleet, your Mac.
🧩 Model Library
Connect any provider — cloud (Anthropic, OpenAI, OpenRouter…) or local (Ollama, MLX, LM Studio). Models are auto-discovered, pricing auto-fills from models.dev, and keys stay in your Keychain.
🎚️ Per-Stage Model Routing
Pin any conversation stage to its own model — a cheap one for extraction, a strong one for answers, a local runtime for anything that should never leave the machine. Unpinned stages follow your default. mur chat doctor shows the exact endpoint each stage will dial and probes it, so you can verify routing before any data exists.
🧰 Agents & Capabilities
Real local agent processes — and mur capability install wires a whole bundle (MCP server + skills + program requirements) onto one in a single command. The media capability adds VLC control and local-model video analysis.
🔐 Governed & Never-Shadow
Capabilities and imported plugins install with pinned provenance — an add-on skill can never silently override a built-in. mur skill doctor flags drift and de-pins stale copies; a per-OS kernel sandbox and a protected launch chain — the runtime binary, other agents' directories, the autostart entries — keep every action governed, with an append-only audit ledger and mur agent runtime-doctor reporting what the chain blocks.
🎓 Dev-Discipline Skills
Seventeen built-in engineering-discipline skills — design-before-code, test-first, root-cause debugging, evidence-before-done — internalized from superpowers & mattpocock. One hub routes; sixteen leaves load on demand via mur skill show, so they cost nothing until used and never shadow a skill you wrote.
Simple Pricing
Free forever for individuals. Paid plans for teams.
Free
🎉 Includes 90-day Pro trial
Full Pro features free for 90 days
- ✓ Unlimited skills
- ✓ All 10+ tool integrations
- ✓ LLM-powered extraction
- ✓ Semantic search
- ✓ Local dashboard
Invite friends, get rewarded
Share your referral link and both of you benefit.
Get your referral link via mur referral or app.mur.run
Share the link with a friend
Friend signs up via GitHub, GitLab, Bitbucket, or Gitee
After 7+ days active, both of you get rewarded
Free & Trial users
Get +30 days of Pro trial per qualified referral. Up to 3 referrals (= +90 days).
Pro & Team users
Get +1 device slot per qualified referral. Up to 3 bonus slots.
⚠️ A referral is "qualified" when your friend has been active for 7+ days.