Get started

The reference implementation is a Python library: a MURX client, server, and node registry, plus a sample client/backend pair (using an ERP-style login as the illustrative case — the same code shape works for database brokering, game matchmaking, or any other backend pool). Source: github.com/Inxsoft/murx.

Install

git clone https://github.com/Inxsoft/murx.git
cd murx/python
pip install -e ".[dev]"       # library + test dependencies
pip install -e ".[dev,srv]"   # also pulls in dnspython for SRV discovery

Authenticate as `user@domain`

The client resolves which MURX server handles the domain (default: murx.<domain> on port 2743 — no DNS record required), authenticates over TLS, and follows the redirect to whichever backend node MURX picked.

import asyncio
from murx import MurxClient, resolve_murx_server, split_client_id, tls

async def main():
    client_id = "[email protected]"
    _, domain = split_client_id(client_id)
    host, port = await resolve_murx_server(domain)
    ctx = tls.client_context()   # ALPN murx/1, verifies certificates

    route = await MurxClient.authenticate(
        host=host, port=port, client_id=client_id,
        auth_data=b"hunter2", ssl_context=ctx,
    )
    reader, writer = await MurxClient.connect_to_backend(route, ssl_context=ctx)
    # reader/writer is now an authenticated session with the backend
    # node MURX routed this client to.

asyncio.run(main())

Run the demos

In one process, with no setup: a MURX server, two toy backend nodes that register over authenticated UDP, and a client.

python examples/erp_backend_demo.py

MURX server listening on 127.0.0.1:PORT (tcp+udp)
Routed to 127.0.0.1:PORT (65-byte signed token)
Backend says: ERP[erp-1]: welcome, [email protected]

In separate containers: the nodes announce their service names, so the client is redirected to a DNS name.

docker compose up --build --abort-on-container-exit --exit-code-from client

client-1  | client: redirected to erp-1:9200
client-1  | client: backend says: ERP[erp-1]: welcome, [email protected]

Run the tests

cd murx/python
pytest

The suite covers end-to-end TLS, forged, expired and replayed tokens, bad and stale UDP MACs, fuzzing of every decoder, and the byte-exact conformance test vectors that other implementations can check against. CI runs it on Python 3.9–3.13.

Inspect traffic in Wireshark

A Lua dissector decodes MURX on port 2743, including signed tokens and the UDP authentication trailer.

tshark -X lua_script:tools/wireshark/murx.lua -r capture.pcap -Y murx

NODE_ANNOUNCE node=erp-1 at erp-1.internal:9200
AUTH_CONNECT [email protected]
ROUTE_REDIRECT -> erp-1.internal:9200
AUTH_REJECT Invalid credentials

Status

This is a reference implementation of spec revision 1.1, not a production gateway. The included StaticAuthBackend is for demos and tests; real deployments plug in their own AuthBackend, add rate limiting, and provision one random secret per backend node. See Security Considerations in the spec.