# NuCypher's TACo node runtime is now reference code

> nucypher is the Python runtime behind TACo, a threshold access control network for end-to-end encrypted data sharing without a central authority. The organisation has stopped maintaining it, the last push was on 2026-05-24, and the project expects to be forked and relaunched, so the interesting question is what to read it for and what to deploy.

**nucypher/nucypher** — Threshold Access Control (TACo) Node Runtime

- Repository: https://github.com/nucypher/nucypher
- Stars: 704 · Forks: 274
- Language: Python
- License: AGPL-3.0
- Published: 2026-10-21 · Updated: 2026-10-21 · Language: en
- Canonical page: https://hysenlabs.com/projects/nucypher-nucypher

## What threshold access control is meant to solve

TACo is described as end-to-end encrypted data sharing and communication without the requirement of trusting a centralized authority that might unilaterally deny service or even decrypt private user data. The problem it addresses is the trust dependency in conventional key management. In a setup where a server holds the keys, that server is a single point of failure and a single point of compromise, and the operator can revoke or withhold access on their own schedule. A threshold scheme splits the authority instead. No single node can decrypt alone, and access conditions are attached to the data itself so that a policy change is a cryptographic fact rather than a server state. The project claims to be the only access control layer available to Web3 developers that can offer a decentralized service through a live, well-collateralized and battle-tested network, and the examples in the repository cover a simple local case, a testnet case, a compound multichain case, and a pre directory of example data files. The audience is therefore developers building applications that need to share sensitive data with revocable, condition-bound access.

## The organisation has stopped working on it

This is the first fact to read, and the README states it in a heading of its own. The project is marked as an inactive project. The NuCypher organisation is no longer active and will not continue development or maintenance of this code base. The code remains available for reference and historical purposes, but no updates, fixes or support should be expected. The last push to the repository was on 2026-05-24, and the most recent release is v7.6.1 from 2025-09-24, with v7.6.0 in August 2025 and v7.5.0 in April 2025 before it. The plan stated in the README is that the original TACo project is expected to be forked and relaunched by the World Ethical Data Forum in the latter half of 2026, supported by a coalition of node operators drawn from organizations with experience in privacy advocacy, anti-surveillance technologies, human rights, encryption, whistleblower protection and academic research. Read as an adoption decision, that means the code is a starting point rather than a product, and the successor may not preserve the same interfaces.

## The packaging shows a Python 3.10 floor and a pinned crypto stack

The pyproject.toml describes a Poetry project named nucypher at version 7.6.1, with a Python constraint of >=3.10,<4. The cryptography work is deliberate. nucypher-core is pinned to an exact version, 0.15.0, which is the separate core library holding the primitives, while cryptography is held at >=44.0.1 with a comment noting it is the latest version with no known vulnerabilities as per 2025-09-23, and pynacl is at >=1.4.0. The setup.py takes a different, older route to the same metadata: it reads requirements from requirements.txt and dev-requirements.txt, and it declares a console_scripts entry point pointing at nucypher.cli.main:nucypher_cli, which is the command you invoke. Its classifiers still describe the project as Development Status :: 3 - Alpha and list Python 3.10, 3.11 and 3.12, which is a useful signal of where the project saw itself. The requirements file shows a fully pinned dependency set with environment markers, so an install resolves to known versions rather than a floating range.

## A CLI, a Flask surface and a node operator's toolchain

The dependency list shows the shape of the runtime, which is a node as much as a library. web3 is pinned to a 6.x range and atxm to 0.5.0 for the chain interaction, siwe at ^4.2.0 for sign-in with Ethereum, flask and hendrix for the web surface, twisted at ^24.2.0rc1 for the async networking layer, prometheus-client for metrics, marshmallow and pydantic for the serialisation and validation boundaries, and jsonpath-ng for querying structured output. A few pins carry explanatory comments that read like a maintenance diary: marshmallow is held at ^3.26.1 with a note to revert to a wildcard in the future because version 4 changes a keyword argument, and pydantic is held at ~2.11.0 because a later version raised an attribute error, with a note to move to 2.12. Those comments are a fair signal of the project's condition. A handful of dependencies carry placeholder versions such as constant-sorrow at ^0.1.0a9, which is an alpha release of a package. The Makefile rounds this out with release tooling that enables GPG signing for release commits, runs towncrier to generate release notes, and pushes both the main branch and the version tag upstream in one step.

## The examples directory shows the intended usage shape

The example files are the closest thing to a tutorial in this repository, and they are worth reading before the source. There is a local_simple_taco.py example, which is the smallest path, a testnet_simple_taco.py for a single testnet flow, and a testnet_compound_multichain_taco.py for the harder case where a condition spans more than one chain. Alongside them sits a pre directory and an .env.template, which tells you that configuration is expected to come from environment variables rather than from a config file you write by hand. The naming of the local example is instructive: it implies the code can run without a live network, which is what you want when evaluating whether the library fits your application. The compound multichain example is the one to look at if your use case involves policies that depend on activity across chains, since that is where the threshold logic becomes more than a single condition. The repository also carries an examples directory at the top level alongside nucypher/, tests/, scripts/ and deploy/, so the code is split into a library package, a test suite, operational scripts and deployment resources rather than a single flat module.

## An AGPL licence and an export control notice

Two legal points sit in the README and both deserve attention before you deploy. The first is the licence, AGPL-3.0, which is the same licence the project badge points at. AGPL obligations reach networked use rather than only distribution, so running a modified nucypher node as a service for other people is the case that needs a lawyer rather than the case where you merely run it for yourself. This is your own review, not advice. The second is the cryptography notice, which is unusual to see spelled out in this much detail. The distribution includes cryptographic software, and the country you reside in may restrict the import, possession, use or re-export of encryption software, so the notice asks you to check your own laws first and points at the Wassenaar arrangement. It also states that the software may be subject to the U.S. Export Administration Regulations, including ECCN 5D002, which covers information security software performing cryptographic functions with asymmetric algorithms, and says the source is intended to qualify for treatment under EAR 742.15 and 734.3(b)(3). The maintainers report having submitted notification of the source code to crypt@bis.doc.gov and enc@nsa.gov. That kind of filing usually signals a deliberate, reviewed decision about how the code should be distributed.

## What happens to the code when nobody maintains it

The security policy in the README describes a process that no longer has an owner behind it, and that tells you something about the state of the project. Vulnerabilities are to be emailed to security@nucypher.com, with a promise to coordinate disclosure among stakers, partners and users, and researchers are asked to honour an embargo period that varies with severity so fixes can ship first. The README even suggests a more secure channel such as Signal for sensitive findings, and points researchers at the testnet as a place to begin. The problem is that an embargo is only meaningful if someone is there to fix the issue, and the header says plainly that no fixes are expected. The community channels named in the README are a Discord server, a contribution guide in CONTRIBUTING.rst and the open issues list, all of which belong to an organisation that is no longer active. The realistic reading for anyone still running this code is that the security contact and the disclosure process are historical, and that vulnerability handling for a deployment becomes your own problem.

## Conclusion

Adopt nucypher as a reference implementation if you are studying threshold access control or need the cryptographic primitives and the client interfaces, and plan to build on the relaunched fork rather than on this repository. Skip it if you need a maintained production node runtime, because the organisation is no longer active, no updates or fixes are expected, and the last push was on 2026-05-24. Before you write anything against it, read the release notes for v7.6.1 and the docs.taco.build documentation, check the AGPL-3.0 terms against your deployment model, and confirm that the Python version in your environment satisfies the >=3.10,<4 constraint in the packaging metadata.

## FAQ

### Is the NuCypher nucypher project still maintained?

No. The README marks it as an inactive project and states that the NuCypher organisation is no longer active and will not continue development or maintenance, so no updates or fixes are expected. The last push was on 2026-05-24 and the most recent release is v7.6.1 from 2025-09-24.

### What is TACo and what problem does nucypher solve for it?

TACo is end-to-end encrypted data sharing and communication without the need to trust a centralized authority that might deny service or decrypt private data. nucypher is the Python node runtime hosting the cryptographic primitives for that network.

### What are the minimum requirements to run the nucypher code?

The packaging metadata requires Python >=3.10,<4, and the setup classifiers list Python 3.10, 3.11 and 3.12. The cryptographic stack is pinned, with nucypher-core at 0.15.0 and cryptography at 44.0.1 or newer.

### What licence and export conditions apply to nucypher?

The project is licensed under AGPL-3.0, which matters most if you run a modified node as a service. The README also carries a cryptography notice stating that the software may be subject to U.S. Export Administration Regulations under ECCN 5D002, and asks users to check their own country's rules on encryption software.

### Where can I see how the nucypher client is meant to be used?

The examples directory contains local_simple_taco.py, testnet_simple_taco.py and testnet_compound_multichain_taco.py, along with a pre directory and an .env.template for configuration. The TACo documentation is hosted at docs.taco.build.

## Sources

- [Issues](https://github.com/nucypher/nucypher/issues)
- [License: AGPL-3.0](https://github.com/nucypher/nucypher/blob/main/LICENSE)
- [nucypher/nucypher on GitHub](https://github.com/nucypher/nucypher)
- [README](https://github.com/nucypher/nucypher/blob/main/README.md)
- [Releases](https://github.com/nucypher/nucypher/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/nucypher-nucypher