See what a Cloudflare deploy will change, before it changes it.

$ murus plan

admin-api  account 00000000  no environment
./wrangler.jsonc

  settings
  ~ compatibility_date  2025-01-01 → 2025-11-01

  bindings
  + RATE_LIMITS   kv_namespace
      rate-limits-prod (0000000000000000000000000000aaaa)
  ~ ADMIN_DB      d1
      prod-admin (9f3c2211-4d5e-6f70-8192-a3b4c5d6e7f8)
    → staging-admin (aaaa1111-bbbb-2222-cccc-333344445555)
  - LEGACY_CACHE  kv_namespace old-cache (0000000000000000000000000000cccc)

  vars
  - LEGACY_FLAG  true

  !  LEGACY_FLAG is set on the deployed Worker but absent from config, and will
     be deleted.
     Add them to `vars`, or set `keep_vars = true` in the config to preserve
     them.

     1 secret set outside config and left untouched. STRIPE_KEY

1 to add, 2 to change, 2 to destroy.

Install

curl -fsSL https://murus.dev/install.sh | sh

Picks the binary for your platform, checks it against the published SHA256SUMS, and refuses to install on a mismatch. Read it first, the way you should with any installer.

No state file

Cloudflare already returns a deployed Worker's complete configuration, so plan is a structural comparison against live infrastructure. There is no .tfstate to store, share, lock or drift, and nothing is deployed into your account to hold state on your behalf. Delete ~/.config/murus and murus is gone.

Least privilege, derived

wrangler login asks for 28 OAuth scopes to deploy a Worker that needs six. Your config already declares every binding, so murus computes the minimal set and shows you the difference on a credential you already hold.

A status code is not proof

Three of the four Cloudflare create endpoints tested return 200 while silently dropping fields they do not recognise. So apply reads the resource back afterwards and checks it against what the plan promised.

Pre-1.0

Workers only for now, and minor versions may break things. Open source under Apache-2.0. Read the source.