Murmur records your meetings, transcribes and reasons over them entirely on your Mac, and turns each one into a clean note you own — as plain Markdown, inside your own Obsidian vault.
Three ideas run through everything in these docs:
Local-first. Recording, transcription and the reasoning brain are designed to work with no network at all. Cloud providers are opt-in, clearly labelled, and pass through a redaction firewall.
One source of truth. An encrypted SQLite database is canonical. The app UI, a local read-only MCP server, and your exported Markdown files are three thin readers over the same store — never three diverging copies.
Yours to keep. Every note is also plain .md with YAML front-matter and [[wikilinks]]. No proprietary format, ever.
This is a proof-of-concept documentation template — a few sections, a handful of pages — so we can agree on the shape before writing the full set.
One tree for everything you record and everything you write. Spaces replaced the two separate folder systems Murmur used to have.
One tree, four kinds of thing
A Space holds folders; a folder holds your recordings, notes, tasks and boards. There is no second hierarchy to keep in sync, and nothing belongs to "notes" instead of to a project. Move a recording into a folder and its note, its tasks and its board all sit beside it.
The rail and the panel
A slim icon rail is always on the left: Capture, Search (⌘K), Spaces, Shared Brains, Ask, Browse, and at the bottom New note (⌘N) and Settings. Beside it, one contextual panel switches between the Spaces tree and a flat Browse view that lists everything by kind — meetings, notes, tasks, boards, reminders — plus the Brain, Analytics, Graph and People.
Filing, by hand or by Brain
Drag an item where it belongs, or use File recordings with Brain and let it propose a home for the strays. You always see the proposed plan first, and nothing moves until you approve it.
Locking a Space
Lock a Space and everything inside it is sealed with it — recordings, notes, transcripts, timelines and audio. A sealed Space still shows its name, because that is what you need in order to unlock it, and nothing else: no counts, no children, no items, not even totals.
A Space lock cascades by locking each child folder in its own right, so every gate described on the lock model page applies to a Space unchanged — including the search index, the graph and the local server.
A board is a handful of things you care about, pulled onto one page — and then read through whichever lens you need.
Ten kinds of tile
Put a note, a recording, a document or a person on a board directly. Or add a derived tile: a reminders list, a drift watch (how one fact changed over time), a numbers roll-up, an activity pulse, a promise ledger, or a living answer.
Living answers
A living answer is a question the board keeps up to date — it shows the answer, and when it was last answered. If any source it drew on stops being readable (you locked the Space, or left the organization that shared it), the tile withholds the answer rather than serving a stale one from a source you can no longer see.
Five lenses, one set of tiles
Brief is the summary read: the pinned answer, what needs attention, the recent evidence. Overview shows the tiles themselves. Commitments collects every promise and reminder the board can resolve. Sources lists the material it can actually read. People groups it by who is involved. No lens keeps a second copy of anything.
Ask a board
You can ask a board a question directly, and the answer is grounded only in what is on it. Each board also states its own boundary — how many sources it can read, and how many views it derived from them — so you can tell the difference between "nothing to report" and "I can't see the material".
Bring the notes you already have. Three sources, no account, no key, and no network call.
Three sources
Notion — export your workspace as Markdown & CSV with "Create folders for subpages" on, then point Murmur at the .zip or the unpacked folder. Obsidian — point it at the vault folder. Apple Notes — Murmur reads them through macOS, which will ask your permission the first time.
Entirely offline
Every import runs on your Mac. Nothing is uploaded, and no provider is contacted — importing does not touch the cloud settings at all.
Dry run first
Every import is a dry run before it is a write. Murmur reports exactly what it would create, and what it recognises as already imported, so re-running an import doesn't duplicate anything. An import that has nowhere obvious to go lands in its own named, badged container rather than being scattered.
After the import
Imported notes are ordinary notes: filed in a Space, searchable, [[linkable]], part of the same brain, and covered by the same lock. Find it all in Settings → Imports.
Two different things on purpose: tasks are shared work owned by an organization; reminders are private follow-ups that stay on this Mac.
Tasks — shared work
A task carries a status, a due date, an assignee, a checklist of subtasks, and the same View only / Can edit permissions as any other shared document. Tasks live inside an organization, which is why they are the one surface here that needs a signed-in account.
Reminders — private follow-ups
Reminders never leave your Mac. Each one keeps a link back to the recording or note it came from, so a follow-up always says where it came from. They arrive in an inbox split into overdue, upcoming and completed, and can repeat.
Proposed, never imposed
The brain can propose reminders out of what was actually said — you accept or dismiss each one. Action items from a meeting note can also be pushed to Apple Reminders if you would rather they lived there.
Murmur hears both sides of the call, transcribes each independently, and merges them into one clean transcript.
Dual-stream capture
Your microphone and the other side's system audio (via a ScreenCaptureKit sidecar) are recorded as two separate streams, then transcribed independently before being merged by wall-clock into a single Me / Others timeline. This avoids the echo and cross-talk problems of single-stream capture.
On-device Whisper
Transcription runs fully on-device via whisper.cpp with Metal acceleration. Pick a model from tiny to large-v3 depending on your speed/accuracy tradeoff, with optional speaker diarization and voice-activity detection.
Live captions while you talk, not just after the call ends
A floating recorder bar you can trigger from any app
Segments land straight in the encrypted SQLite store as the single source of truth
A reasoning model runs locally over a semantic index of everything you've recorded — answering questions live, mid-meeting, with sources.
Say a wake phrase (or tap once) during a live call and Murmur answers out of your own meeting memory — grounded in retrieved transcript, not a guess — while the recording keeps rolling. The same brain also powers Ask Your Vault: a Q&A surface over months of past meetings and notes, every claim linked back to its source.
Pluggable providers
The reasoning layer is one trait behind a swappable provider seam:
On-device (Bielik-11B, Qwen via Metal) — fully local, the default
Ollama — fully local, your own models
Claude Code / Anthropic / any OpenAI-compatible gateway — cloud-bound text passes a redaction firewall first
Cloud egress is opt-in and fail-closed: nothing leaves the Mac until you explicitly enable a cloud provider, and even then only redacted text goes out.
Three different surfaces — Meeting Recipes, the Brain menu, and Ask — all run through one gated tool registry underneath. Here's exactly what it can reach, and what it can't.
Meeting Recipes — one-click artifacts
On any meeting, a row of quick chips turns the transcript into a specific, ready-to-use artifact — strictly grounded in that one meeting, never invented:
Follow-up email — context, decisions, and a per-attendee action list, uncertain items flagged
Decision log — only the decisions made, who owns each one, and the rationale if stated
Work ticket — the top action item as a title, description, and acceptance criteria
1:1 recap — wins, blockers, feedback, and next steps
Sales recap — pain points, objections, buying signals, and a deal-risk note
Interview notes — strengths, concerns, and a hire / no-hire lean grounded only in what was said
The Brain menu — 19 actions on any selection
Select text anywhere in the note editor and run one of nineteen actions, grouped as Edit (Refine, Fix grammar, Shorten, Expand, Simplify, Change tone, Translate), Structure (Bullet points, Table, Key points), From your brain (Enhance context, Find related, Link entities, Fact-check, Ask about this), Extract (Action items, Decisions), and Create (Draft follow-up, Spin-off note) — full details on the Standalone notes & the Brain menu page.
Ask — a tiered, gated tool-use loop
Behind the wake phrase and Ask Your Vault sits one agentic loop: the model decides which tools to call, grounds its answer in what they return, and falls back to a deterministic, no-tools answer if it can't converge. Which tools it's even allowed to reach is enforced by code, not by trusting the prompt — a tier can't be talked into reaching a higher one:
1 · Current meeting
No tools at all — answers only from the live meeting, prompt-injected directly.
All Tier 2, plusweb_searchcalendar_lookupjira_searchslack_searchorg_brain_search
Full
The complete catalog above, for the deliberately vault-wide surfaces (the Ask page, MCP).
Two write tools exist alongside the reads: propose_note only drafts a suggestion for you to accept — it writes nothing until you do — while save_note and create_reminder (straight into Apple Reminders) write for real, and only when the surface that invoked the loop explicitly allows writes.
The tier boundary is an allowlist in code, not prompt instructions — a model that mis-judges scope still has no way to call a higher tier's tools this turn.
Connectors — reaching outside the vault
Web search, calendar, Jira, and Slack are live connectors the brain can call on demand, turned into cited answers exactly like a vault hit. Web search (Brave), Jira, and Slack are off by default and reachable only once you've both enabled and explicitly consented to each — the outgoing query is scrubbed by the same redaction firewall as any other cloud-bound text. Your local macOS Calendar is different: it's read entirely on-device via EventKit, so it needs the Calendar permission but no cloud consent — nothing about it ever leaves the Mac. Every connector hit, local or external, carries a visible source label (e.g. "web · Brave", "calendar") so you always know exactly where an answer came from.
Murmur's notes don't ask you to trust them. Every line that's grounded in what was actually said carries a receipt back to the tape.
What counts as a receipt
When the brain writes a note or answers a question, each claim it can trace back to a specific transcript segment gets a small receipt chip. Click it and Murmur jumps straight to that second of audio — no searching through the recording to check whether it's accurate.
Reading confidence
Every receipt carries the speaker (Me / Others) and the ASR confidence for that segment, so you can see at a glance how solid the source is. Paraphrased or unsupported lines simply carry no receipt — that absence is itself the signal that a claim wasn't directly grounded.
Receipts respect the lock model like everything else: a sealed, locked meeting leaks no timing or speaker information through its receipts, ever.
Every call becomes a structured note. People and projects are extracted automatically into a knowledge graph — and everything is reachable from outside the app too.
Structured notes & the auto graph
Notes carry a summary, decisions, action items and quotes, exported as atomic Markdown with front-matter and [[wikilinks]]. Entities mentioned across meetings are extracted into a graph automatically, so you can open a person or project and see every related meeting — entity dossiers, related meetings, and weekly digests included.
A local, read-only MCP server
Murmur exposes an MCP server on 127.0.0.1:8765 so Claude Desktop or Claude Code can query your notes directly — read-only, and it respects the lock model: a sealed, locked meeting is invisible to it too. Setup, the config snippet, and every other integration point live on the Obsidian, MCP, Reminders & file ingestion page.
Not just meeting notes — a full Markdown editor for anything you write, backed by the same brain and the same encrypted store.
A full editor, not just meeting notes
Murmur's note editor works with folders, tags and properties like the meeting notes it generates — but you can open a blank note and write anything. It's the same encrypted SQLite store, the same per-folder Touch ID lock, and the same Markdown export underneath.
The Brain command menu
Select any passage and a command menu appears with nineteen actions one keystroke away — Refine, Shorten, Change tone, Translate, Fact-check, or just type what you want done. Every action is grounded in your own meetings and notes, not the model's guesses.
Nineteen Brain actions, one keystroke away
Grounded in your own meetings & notes via the same retrieval as Ask Your Vault
Same encrypted store, same Touch ID lock, same Markdown export
Custom recipes & automationsPro
Build automations on top of your notes and action items — your own recipes for what should happen once a meeting ends, instead of doing it by hand every time.
On the roadmap, not available yet — everything else on this page is already shipped and free.
Work as a team on notes and meeting summaries, still end-to-end encrypted — the server never sees plaintext.
Publish and stay in sync
Publish a note or meeting summary into your org's Shared Brain and it stays in sync for every member as you edit it. Everything is sealed on your Mac before it ever leaves the device — the relay only ever stores ciphertext, wrapped keys, and public keys, never your content.
Verify-before-publish
Publishing follows the same discipline as locking a folder: content is AES-256-GCM sealed under an org content key and verified decryptable before it's ever sent. You can belong to more than one org, each with its own independent encrypted feed.
Shared Brain is an opt-in tier — Murmur is fully usable with no account at all, and org sharing is free today.
Sync & cloud backupPro
Pro extends the same end-to-end-encrypted design to your own devices: notes and meetings kept in sync across your Macs and iPhone, plus a zero-knowledge encrypted backup of your vault you can restore from if you lose a device — without giving up the local-first design the Free plan already has.
On the roadmap, not shipped yet — pricing is indicative and not final. See the pricing section for the current plans.
The reasoning layer behind the in-meeting brain, Ask Your Vault, and note-writing is one trait behind a swappable provider seam — pick what runs where.
On-device (the default)
Bielik-11B or Qwen, running locally via Metal. No account, no API key, no network call — this is what Murmur uses out of the box for the brain, Ask, and note-writing.
Ollama
Point Murmur at your own local Ollama models. Still fully local — no meeting text ever leaves the Mac with this provider either.
Cloud providers (opt-in)
Provider
Setup
Notes
Claude Code
Local CLI, no key to paste
The default cloud summarizer, if you opt in
Codex
OpenAI's CLI, no key to paste
Run tool-free: no ambient config, an empty tool registry, and a deny-everything hook before any tool call
Anthropic API
Bring your own key, stored in Keychain
Direct HTTPS to Anthropic
AI Gateway
Any OpenAI-compatible endpoint
LiteLLM, Kong, Portkey, vLLM, or your own
Every cloud provider is opt-in and every request it sends passes through the redaction firewall first — see Redaction firewall & cloud egress for exactly what that means.
Managed brainPro
An optional low-latency, cloud-hosted brain you can opt into when you want faster responses than the on-device model gives you. It's still opt-in and still passes through the same redaction firewall as any other cloud provider — nothing changes about consent or what gets scrubbed first.
On the roadmap, not available yet. Murmur stays fully usable and free while it ships.
Murmur plugs into the tools you already use instead of asking you to live inside a new one.
Your Obsidian vault
Every note is exported as atomic Markdown straight into your vault — YAML front-matter, [[wikilinks]], obsidian:// block-refs, and an optional canvas board. They're plain files you own, editable in Obsidian or anything else that reads Markdown.
A local, read-only MCP server
Murmur exposes an MCP server on 127.0.0.1:8765 so Claude Desktop or Claude Code can query your notes directly. It's read-only, and it respects the lock model exactly like the app — a sealed, locked meeting is invisible to it too. Twenty tools cover your meetings and their transcripts, imported documents and their outlines, semantic search, open commitments, entity dossiers, the entity list, note folders, your Spaces hierarchy, your boards, your shared tasks, and your Shared Brain.
claude_desktop_config.json
// Point Claude Desktop at your local Murmur MCP server
{
"mcpServers": {
"murmur": {
"url": "http://127.0.0.1:8765"
}
}
}
Apple Reminders
Action items extracted from a meeting note can push straight into Apple Reminders, so follow-ups don't have to live only inside Murmur.
Feed it more than meetings
Drop in PDFs, Office documents, web pages, and images — they're chunked into the same on-device brain and become searchable alongside your meetings, in the same encrypted store.
Every group below is a real Settings section in the app today, not a hypothetical — grouped the same way you'd find them there.
Appearance
Theme (Light / Dark / System — the same switch this docs site uses), an accent color, sidebar options, and a Liquid Glass transparency slider for the app's frosted chrome.
Audio & transcription
Toggles for capturing system audio, smart speech detection, keeping high-fidelity audio masters, splitting "Others" into individual speakers, recognising speakers across meetings, and removing speaker echo from recordings — plus the transcription model picker, the live-caption engine, on-device brain lifecycle settings, and the voice trigger toggle behind the in-meeting wake phrase.
AI & connectors
Pick a provider and configure connectors from here — see AI providers for the provider list and What the Brain can do for what each connector unlocks. A separate "Remember facts about you" toggle controls whether the brain builds a persistent memory of you across sessions.
Obsidian, storage & notes
Your Obsidian vault path, an auto-delete policy for old recordings (plus a manual "Free up space now"), and a toggle to organize notes into thematic subfolders automatically.
Sharing & organizations
Your sharing account and incoming shares, and the organizations you belong to for Shared Brain.
A plain-language breakdown of what stays local by default, and the one thing that can leave — only if you opt in.
Stays on your Mac, always
The raw audio of every recording
The full transcript, merged Me / Others
The semantic search index and embeddings behind Ask Your Vault
The auto-extracted entity graph (people, projects)
Every encryption key — the SQLCipher DEK and every folder's content key
Only leaves if you opt in
The single exception is meeting text sent to a cloud provider you've explicitly enabled — and even then, only after the redaction firewall scrubs emails, phone numbers, and card-like numbers. See Redaction firewall & cloud egress for the full provider-by-provider breakdown and AI providers for how to configure one.
The app itself is signed & notarized for macOS — Gatekeeper verifies it before it ever runs, the same bar every trusted Mac app has to clear.
A per-folder lock is a second, independent encryption layer on top of the whole-database encryption — and every read path respects it.
Two layers, not one
The entire SQLite database is SQLCipher-encrypted at rest. On top of that, locking a folder wraps its notes, transcripts, timelines and audio in a per-folder AES-256-GCM content key, itself wrapped by a master key released only by Touch ID.
Verify-before-destroy
Sealing never trusts the ciphertext blind: Murmur decrypts what it just wrote and checks it's byte-identical before it ever blanks the plaintext. A crash mid-seal can never destroy the only copy of your content.
Read path
Sealed & not unlocked
App detail view
Masked — 🔒 Locked, no note/segments
Search & the graph
Invisible — excluded from results entirely
MCP server
Invisible — same visibility gate as the app
Audio playback
No path handed to the player while sealed
Screen-share aware
A watcher can auto-relock sealed folders and wipe the cached key the moment screen sharing is detected — so a shared screen can't spill private notes. Unlocking is session-scoped and reversible: a Touch ID prompt unwraps the content key for that session only; relocking (manual, or automatic) blanks the decrypted copies again without touching the sealed data underneath.
If you ever opt into a cloud provider, sensitive text is scrubbed first — and egress is fail-closed behind a one-time consent.
What's scrubbed before it leaves
Emails, phone numbers, and card-like numbers are redacted from meeting text before it's ever sent to a cloud summarizer. Nothing crosses the network until you've explicitly consented to that specific provider — the default is fully on-device.
Providers & what actually leaves your Mac
Brain / provider
Where it runs
Does meeting text leave your Mac?
On-device brain (Bielik / Qwen)
Fully local
No
Ollama
Fully local
No
Claude Code (default summarizer)
Local CLI → cloud
Redacted only
Anthropic API (bring your own key)
Direct HTTPS
Redacted only
AI Gateway (OpenAI-compatible endpoint)
Direct HTTPS
Redacted only
Every egress decision is logged so you can see, in plain language, exactly what left the Mac and when — a running ledger, not a one-time toggle you forget about.
