murk-secrets

PyPI

Python bindings for murk — an encrypted secrets manager for developers.

murk stores encrypted secrets in a single .murk file safe to commit to git. This package lets Python apps read those secrets at runtime.

Prerequisites

You need the murk CLI to create and manage vaults. This package only reads them.

# Install the CLI first
brew tap interrupted-inc/murk && brew install murk

# Initialize a vault and add secrets
murk init
murk add DATABASE_URL
murk add API_KEY

Then add the Python package to your project:

pip install murk-secrets

Quick start

# Load your key (created by murk init)
source .env

import murk

# Load the vault (reads MURK_KEY from environment)
vault = murk.load()

# Get a single secret
db_url = vault.get("DATABASE_URL")

# Get all secrets as a dict
secrets = vault.export()

# Dict-style access
api_key = vault["API_KEY"]

API

murk.load(vault_path=".murk") -> Vault

Load and decrypt a murk vault. Reads MURK_KEY or MURK_KEY_FILE from the environment.

murk.get(key, vault_path=".murk") -> str | None

One-liner: load the vault and get a single value.

murk.export_all(vault_path=".murk") -> dict[str, str]

One-liner: load the vault and export all secrets as a dict.

murk.has_identity() -> bool

Whether a decryption identity (MURK_KEY / MURK_KEY_FILE) is available — i.e. whether load() can decrypt. This is not a check for whether a secret exists; use key in vault / vault.keys() for that.

Vault

Method Returns Description
vault.get(key) str | None Get a single decrypted value
vault.export() dict[str, str] All secrets as a dict
vault.keys() list[str] List of key names
vault[key] str Dict-style access (raises on missing key)
key in vault bool Check if a key exists
len(vault) int Number of secrets

Scoped (per-user) overrides are applied automatically — if you have a scoped value for a key, it takes priority over the shared value.

Memory hygiene

Every decrypted value murk returns is a plain Python string. murk zeroes plaintext from its own memory when a value is dropped, but that guarantee ends at the FFI boundary: once a value crosses into Python the interpreter owns it, and its garbage collector — not murk — controls its lifetime. This is inherent to reading secrets into a process (see the threat model); avoid holding decrypted values longer than you need them.

Agent policy

When the loaded key is an agent grant (minted with murk agent grant), the vault's agent policy is enforced on read, the same way the CLI enforces it at murk agent exec: get() and export() raise RuntimeError if the policy forbids a key. Operator keys are unaffected. This makes a policy vault strict from every entry point — though an agent already cannot decrypt out-of-scope secrets at all, since its ephemeral key is not a recipient of them.

Environment

Set one of:

  • MURK_KEY — your age secret key directly
  • MURK_KEY_FILE — path to your key file (created by murk init)

The easiest setup is source .env in your project directory after running murk init.

Requirements

  • Python >= 3.9
  • murk CLI installed (to create and manage vaults)
  • A .murk vault file in your project (created with murk init)
  • MURK_KEY or MURK_KEY_FILE in the environment (created by murk init, loaded via source .env)

License

MIT OR Apache-2.0

Project links

Data verified by PyPI on Aug 4, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.11.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for iicky from gravatar.com iicky

GitHub Statistics

Data verified by PyPI on Aug 4, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

Apache Software License, MIT License (MIT OR Apache-2.0)

Requires

Python >=3.9

Tags

secrets encryption age dotenv security

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

murk_secrets-0.10.2.tar.gz (6.6 MB view details)

Uploaded Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

murk_secrets-0.10.2-cp39-abi3-win_amd64.whl (1.0 MB view details)

Uploaded CPython 3.9+Windows x86-64

murk_secrets-0.10.2-cp39-abi3-manylinux_2_28_aarch64.whl (1.2 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.28+ ARM64

murk_secrets-0.10.2-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (1.3 MB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ x86-64

murk_secrets-0.10.2-cp39-abi3-macosx_11_0_arm64.whl (1.1 MB view details)

Uploaded CPython 3.9+macOS 11.0+ ARM64

murk_secrets-0.10.2-cp39-abi3-macosx_10_12_x86_64.whl (1.2 MB view details)

Uploaded CPython 3.9+macOS 10.12+ x86-64

File details

Details for the file murk_secrets-0.10.2.tar.gz.

File metadata

  • Download URL: murk_secrets-0.10.2.tar.gz
  • Upload date:
  • Size: 6.6 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for murk_secrets-0.10.2.tar.gz
Algorithm Hash digest
SHA256 6e490bf1dc34760e686aae9ed5ba0b6c55b8e2fe84cb2c4f17045f9661fd5813
MD5 446ad6f4b80964bc90928ad095e502bd
BLAKE2b-256 d8e7863708ae982ca1f153b999aee6d269787f683c5e4053df43f61b3de056b6

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.10.2.tar.gz:

Publisher: python.yaml on interrupted-inc/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file murk_secrets-0.10.2-cp39-abi3-win_amd64.whl.

File metadata

File hashes

Hashes for murk_secrets-0.10.2-cp39-abi3-win_amd64.whl
Algorithm Hash digest
SHA256 748bd42cc00bf2caa13bb0df8b3ce6fec9a968138ae352c5217451beed5972a1
MD5 2a9d79c62e09a42885d5e5200a3e30b3
BLAKE2b-256 59217dae01378a65b33d33c084ca5eeb134020f25f339241630e4265d3a7b154

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.10.2-cp39-abi3-win_amd64.whl:

Publisher: python.yaml on interrupted-inc/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file murk_secrets-0.10.2-cp39-abi3-manylinux_2_28_aarch64.whl.

File metadata

File hashes

Hashes for murk_secrets-0.10.2-cp39-abi3-manylinux_2_28_aarch64.whl
Algorithm Hash digest
SHA256 1f3a6e94a66132fd050edfb56be819e3fb8a54ec88912df189f6e591c7aee1a8
MD5 91d09dc501439da0963c062a01aa55fb
BLAKE2b-256 e9c55ce5b5b0f458aa6fcc77e68c30099daaf68d2e6cd37aebbd154cda9a4c76

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.10.2-cp39-abi3-manylinux_2_28_aarch64.whl:

Publisher: python.yaml on interrupted-inc/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file murk_secrets-0.10.2-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.

File metadata

File hashes

Hashes for murk_secrets-0.10.2-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Algorithm Hash digest
SHA256 5dad95b67074b86b6e16bc5d9e428e979939d6d95f3290297fad4708c667286c
MD5 12755c45c3a5979ca1f6b6c656e48242
BLAKE2b-256 d2686cff3a5f529e99270b9350d6901471c46989acce1a23c413b60a539825ba

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.10.2-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl:

Publisher: python.yaml on interrupted-inc/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file murk_secrets-0.10.2-cp39-abi3-macosx_11_0_arm64.whl.

File metadata

File hashes

Hashes for murk_secrets-0.10.2-cp39-abi3-macosx_11_0_arm64.whl
Algorithm Hash digest
SHA256 0753743f52eaf2a6b9d69e544aa81e0f1b20848e7c7c0d275fc29410878fa9eb
MD5 d9be4ffa7f51eaada128869f01d835f1
BLAKE2b-256 7847250c57a269dc7434786965761538f872d7b02d88267192b9150a2b5c57a0

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.10.2-cp39-abi3-macosx_11_0_arm64.whl:

Publisher: python.yaml on interrupted-inc/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file murk_secrets-0.10.2-cp39-abi3-macosx_10_12_x86_64.whl.

File metadata

File hashes

Hashes for murk_secrets-0.10.2-cp39-abi3-macosx_10_12_x86_64.whl
Algorithm Hash digest
SHA256 40a493bfa9d4d8a384b5a205b648b5d27dfac159db019861a9d81e556455701c
MD5 6aaa87c5acf707c0a403a92429168dfc
BLAKE2b-256 35663813defa3deff9bb0fe602f2fbd82ee10d88638014f2024106298435e142

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.10.2-cp39-abi3-macosx_10_12_x86_64.whl:

Publisher: python.yaml on interrupted-inc/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.11.0

6 files

0.10.3

6 files

This release

0.10.2 This release

6 files

0.10.1

6 files

0.10.0

6 files

0.9.1

6 files

0.9.0

6 files

0.8.0

6 files

0.7.0

6 files

0.6.2

6 files

0.6.1

6 files

0.6.0

6 files

0.5.11

6 files

0.5.10

6 files

0.5.9

6 files

0.5.8

6 files

0.5.7

6 files

0.5.6

6 files

0.5.5

6 files

0.5.4

6 files

0.5.3

6 files

0.5.1

6 files

0.5.0

6 files

0.4.1

6 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page