MURAGE™
Download
Privacy and security

Security overview for reviewers.

The questions a security review asks first, answered on one page. Print it or share the link.

Checked against Murage 1.0.18. The detail behind each point is in the security model guide.

The facts.

How it runs

  • Murage is a desktop app for macOS, Windows and Linux. Each person runs their own copy on their own computer.
  • Its built-in server listens only on that computer (127.0.0.1), never on the network.
  • Bots, conversations, memory, files and settings live in Murage’s data folder in the user’s home folder, made readable by that user only. There is no Murage server holding the work.
  • No Murage account is needed to download or use the app.

Where data goes

  • Only to what the user connects: the AI engine chosen for each bot, connected apps (through Flux Router’s connected apps or the user’s own connected-apps key), voice and web search services, Telegram, Slack, Discord or WhatsApp if paired, and off-site backups to storage the user owns (an S3-compatible bucket or their own SFTP server).
  • A bot on a local model sends nothing about its turns to a cloud provider.
  • Flux Router is an optional, credit-billed service run by Ferrox Labs. It passes each request to the provider that serves it.
  • The app checks GitHub for updates. An optional name and email at first run is sent to us for product updates; skipping it sends nothing.
  • Usage analytics: today’s releases send none. Anonymous, opt-out analytics are planned.

Keys and credentials

  • API keys and tokens are encrypted with the operating system’s secure storage (the Keychain on a Mac, and the equivalent on Windows and Linux).
  • Keys are write-only inside Murage: never shown back, logged or passed on a command line.
  • Engines such as Claude Code and Codex keep their own sign-in. Murage uses it; it doesn’t copy it.

Access levels and the stop line

  • Ask (the default for every new bot and every imported team): the bot asks before each action it tells Murage about. Answers are Allow once, Allow for this task, Always allow, Always allow this exact command here (that command, folder and engine only), or Deny. Every remembered grant is listed per bot and can be removed. A grant for a delete whose target can’t be placed needs the very same command, byte for byte.
  • Without a card, on any level: a bot reading back its own saved tool results (a read-only check of a file in its own session folder), and file work inside a project’s chosen work folders when it isn’t a delete and doesn’t touch keys or passwords.
  • Auto: keeps going, but asks about anything destructive. The stop line applies.
  • Full access: keeps going without asking, but stops before messaging anyone new, posting publicly, paying, or deleting outside its folder, unless the user has allowed it for that task. Replies in an existing conversation go ahead.
  • No limits: turns the stop line off for turns the owner starts and for the owner’s own channel messages. A routine keeps it. On a turn the owner started, reading keys and sign-ins runs without a card and the read is recorded; a call that names a gate file, or one that didn’t arrive whole, still asks. A routine on No limits still asks before reading keys and still stops at the stop line.
  • Each routine has its own level. A run uses whichever is lower, the routine’s level or the bot’s current level. A routine can remember an exact command for one engine in one folder, and a different date or time counts as a different command.
  • A webhook turn asks, since nobody is there to answer for it. A batch of connected-app calls the stop line can’t read is held for the user while the stop line is on. Reading the keys and sign-ins the user has given Murage asks on Ask, Auto, Full access, routines and webhook turns.
  • The stop line judges the permission requests that reach Murage. On Claude Code and Codex, it also covers tools from MCP servers the user adds.
  • Only the user’s own desktop app and paired devices can answer an approval card. A message whose sender Murage can’t confirm runs as an unattended turn.
  • The stop line is an automated check on the actions a bot tries to take. It is a backstop, not a sandbox: a bot on Auto or Full access runs with the user’s own permissions.
  • The stop line is code: server/stop-line.ts, with its table tests in server/stop-line.test.ts.

Untrusted content and skills

  • Emails, web pages, channel messages and webhook payloads reach bots labeled as untrusted. The default House Rules say outside text can inform a bot but never instruct it.
  • Skill Guard scans every skill offline on import, install, edit and at start-up. Imported skills land switched off.
  • Imported teams arrive on Ask with skills off, routines paused and no connected apps. Exports never include credentials, conversations, memory or permission grants.

What isn’t there yet

  • No SOC 2, HIPAA or outside security audit.
  • No central admin console or settings lock.
  • Shared workspaces are not in the desktop app. Murage Cloud (coming soon) runs your team on a private server, and Team and Business plans are coming soon.
  • Rollout is package distribution: build a team once, export it, and each person imports it on their own computer and connects their own accounts.

License and verification

  • The app is open source under AGPL-3.0-or-later from version 0.1.59. A commercial license is available on request.
  • Mac builds are signed and notarized by Apple, and Windows builds are signed. Every installer lists its SHA-256 checksum on the download page.
  • The full source code is public on GitHub, so your team can read exactly what the app stores and sends.

Report a problem, or ask us.

Search murage.ai

Search the docs, videos, blog, apps, teams, skills and release notes.