murk-secrets

PyPI

Python bindings for murk — an encrypted secrets manager for developers.

murk stores encrypted secrets in a single .murk file safe to commit to git. This package lets Python apps read those secrets at runtime.

Prerequisites

You need the murk CLI to create and manage vaults. This package only reads them.

# Install the CLI first
brew tap iicky/murk && brew install murk

# Initialize a vault and add secrets
murk init
murk add DATABASE_URL
murk add API_KEY

Then add the Python package to your project:

pip install murk-secrets

Quick start

# Load your key (created by murk init)
source .env

import murk

# Load the vault (reads MURK_KEY from environment)
vault = murk.load()

# Get a single secret
db_url = vault.get("DATABASE_URL")

# Get all secrets as a dict
secrets = vault.export()

# Dict-style access
api_key = vault["API_KEY"]

API

murk.load(vault_path=".murk") -> Vault

Load and decrypt a murk vault. Reads MURK_KEY or MURK_KEY_FILE from the environment.

murk.get(key, vault_path=".murk") -> str | None

One-liner: load the vault and get a single value.

murk.export_all(vault_path=".murk") -> dict[str, str]

One-liner: load the vault and export all secrets as a dict.

murk.has_key() -> bool

Check if a MURK_KEY is available in the environment.

Vault

Method Returns Description
vault.get(key) str | None Get a single decrypted value
vault.export() dict[str, str] All secrets as a dict
vault.keys() list[str] List of key names
vault[key] str Dict-style access (raises on missing key)
key in vault bool Check if a key exists
len(vault) int Number of secrets

Scoped (per-user) overrides are applied automatically — if you have a scoped value for a key, it takes priority over the shared value.

Agent policy

When the loaded key is an agent grant (minted with murk agent grant), the vault's agent policy is enforced on read, the same way the CLI enforces it at murk agent exec: get() and export() raise RuntimeError if the policy forbids a key. Operator keys are unaffected. This makes a policy vault strict from every entry point — though an agent already cannot decrypt out-of-scope secrets at all, since its ephemeral key is not a recipient of them.

Environment

Set one of:

  • MURK_KEY — your age secret key directly
  • MURK_KEY_FILE — path to your key file (created by murk init)

The easiest setup is source .env in your project directory after running murk init.

Requirements

  • Python >= 3.9
  • murk CLI installed (to create and manage vaults)
  • A .murk vault file in your project (created with murk init)
  • MURK_KEY or MURK_KEY_FILE in the environment (created by murk init, loaded via source .env)

License

MIT OR Apache-2.0

Project links

Data verified by PyPI on Jul 10, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.11.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for iicky from gravatar.com iicky

GitHub Statistics

Data verified by PyPI on Jul 10, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

Apache Software License, MIT License (MIT OR Apache-2.0)

Requires

Python >=3.9

Tags

secrets encryption age dotenv security

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

murk_secrets-0.9.0.tar.gz (5.2 MB view details)

Uploaded Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

murk_secrets-0.9.0-cp312-cp312-win_amd64.whl (975.5 kB view details)

Uploaded CPython 3.12Windows x86-64

murk_secrets-0.9.0-cp312-cp312-manylinux_2_28_aarch64.whl (1.2 MB view details)

Uploaded CPython 3.12manylinux: glibc 2.28+ ARM64

murk_secrets-0.9.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (1.2 MB view details)

Uploaded CPython 3.12manylinux: glibc 2.17+ x86-64

murk_secrets-0.9.0-cp312-cp312-macosx_11_0_arm64.whl (1.1 MB view details)

Uploaded CPython 3.12macOS 11.0+ ARM64

murk_secrets-0.9.0-cp312-cp312-macosx_10_12_x86_64.whl (1.2 MB view details)

Uploaded CPython 3.12macOS 10.12+ x86-64

File details

Details for the file murk_secrets-0.9.0.tar.gz.

File metadata

  • Download URL: murk_secrets-0.9.0.tar.gz
  • Upload date:
  • Size: 5.2 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for murk_secrets-0.9.0.tar.gz
Algorithm Hash digest
SHA256 7c24e09b724d090eb417e476d325a57f1948ec469d6f0ea816aa3e825100ecb0
MD5 97522becec063e0df9b869906a7e1f34
BLAKE2b-256 3b5394d8529d178e597e234403894eb4d1fe295cde4534fde7e64a1f9b34a20a

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.9.0.tar.gz:

Publisher: python.yaml on iicky/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file murk_secrets-0.9.0-cp312-cp312-win_amd64.whl.

File metadata

File hashes

Hashes for murk_secrets-0.9.0-cp312-cp312-win_amd64.whl
Algorithm Hash digest
SHA256 b78b79b08b17546ae70b3f09ded4cf170aaef7bd20a1f75fe318849235d21d84
MD5 d00267d8b545be87e4e2d0b1109b4714
BLAKE2b-256 8f39a57cf46b32fd1620a2596015ee3c788bbab65eacc790916334c2b28f006b

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.9.0-cp312-cp312-win_amd64.whl:

Publisher: python.yaml on iicky/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file murk_secrets-0.9.0-cp312-cp312-manylinux_2_28_aarch64.whl.

File metadata

File hashes

Hashes for murk_secrets-0.9.0-cp312-cp312-manylinux_2_28_aarch64.whl
Algorithm Hash digest
SHA256 18f33cd35c9806ba05d756f4075f7d8586232bfad6d3c8e1fc6ae261154548ce
MD5 e017b5bc48e4970144cc0df1c6f32efa
BLAKE2b-256 4c60dd52fa0208838e2546accfdf0e063bd25d97c6016db2984ef16201b3aa75

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.9.0-cp312-cp312-manylinux_2_28_aarch64.whl:

Publisher: python.yaml on iicky/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file murk_secrets-0.9.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.

File metadata

File hashes

Hashes for murk_secrets-0.9.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Algorithm Hash digest
SHA256 8064711b43c8a011199527a27dddf1b7477c93000342bd62423b48d564b6473b
MD5 da987162c4ccbd07745d23d422eda953
BLAKE2b-256 5baebb2065c58991051490c1431c33a62a50f323623c6d002f649a1fbb09b2e7

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.9.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl:

Publisher: python.yaml on iicky/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file murk_secrets-0.9.0-cp312-cp312-macosx_11_0_arm64.whl.

File metadata

File hashes

Hashes for murk_secrets-0.9.0-cp312-cp312-macosx_11_0_arm64.whl
Algorithm Hash digest
SHA256 8fbe38b750644b1891251bffd87f29cb795b311f74a91f6f991e9ae71d6259b8
MD5 d1220e6bc9a8938c8ffc757a077bf7ae
BLAKE2b-256 06069e63ef3880652f3a85b2c12a73602102f66cf7da660526e2069317f6f079

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.9.0-cp312-cp312-macosx_11_0_arm64.whl:

Publisher: python.yaml on iicky/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file murk_secrets-0.9.0-cp312-cp312-macosx_10_12_x86_64.whl.

File metadata

File hashes

Hashes for murk_secrets-0.9.0-cp312-cp312-macosx_10_12_x86_64.whl
Algorithm Hash digest
SHA256 be71da95abd58f6405b196d1a1bba2d57e17fdea1a69e37e30c38a36832ad788
MD5 ba311165f75ed34e7237718c67dcc05c
BLAKE2b-256 b1922e96d45f29673c7ce5a65d6e8d5ace6b88fe243ff955ea9cc632e7d94fe0

See more details on using hashes here.

Provenance

The following attestation bundles were made for murk_secrets-0.9.0-cp312-cp312-macosx_10_12_x86_64.whl:

Publisher: python.yaml on iicky/murk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.11.0

6 files

0.10.3

6 files

0.10.2

6 files

0.10.1

6 files

0.10.0

6 files

0.9.1

6 files

This release

0.9.0 This release

6 files

0.8.0

6 files

0.7.0

6 files

0.6.2

6 files

0.6.1

6 files

0.6.0

6 files

0.5.11

6 files

0.5.10

6 files

0.5.9

6 files

0.5.8

6 files

0.5.7

6 files

0.5.6

6 files

0.5.5

6 files

0.5.4

6 files

0.5.3

6 files

0.5.1

6 files

0.5.0

6 files

0.4.1

6 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page