Skip to content

Downloads

The registry hosts its own binaries at /download: the CLI for macOS (Apple silicon and Intel), Linux (x86-64 and arm64), and Windows. The desktop app ships for Linux x86-64, Windows x86-64 and macOS; the forms below are the release matrix, and the page says which of them exist today — a form not built yet says so on its card instead of linking to nothing — and marks the card matching your platform. In a phone's or a tablet's browser, or a browser window narrower than 640 pixels, the page says instead that apps for iOS and Android are coming soon, with a link to the full page. The set is also machine-readable at /downloads/manifest.json (each artifact with its format, channel — stable for a tagged release, main for a build between tags — whether it is code-signed, and whether Apple notarized it), next to /downloads/SHA256SUMS.

Installing the CLI with one command

Each site serves an install script that puts its own CLI on your PATH:

# macOS and Linux
curl -fsSL https://secureagentry.net/install.sh | sh

# Windows, in PowerShell
irm https://secureagentry.net/install.ps1 | iex

The dev site's scripts, at https://dev.secureagentry.net/install.sh and /install.ps1, install the dev CLI in the same way. Neither script asks for administrator rights. Each one does this:

  • The CLI. It downloads the binary that the site's /downloads/manifest.json lists for your OS and architecture, and installs it only if its SHA-256 matches the one the manifest lists. On Windows, when the manifest says the file is signed, its Authenticode signature must also be valid. It goes in ~/.local/bin/agentry (or $XDG_BIN_HOME) on macOS and Linux, and %LOCALAPPDATA%\Programs\agentry\bin\agentry.exe on Windows. Set AGENTRY_INSTALL_DIR to choose another directory.
  • PATH. If that directory is not already on your PATH, the script adds one marked line to your shell's startup file: ~/.zshrc, ~/.bashrc (~/.bash_profile on macOS), ~/.profile, or ~/.config/fish/conf.d/agentry.fish. For bash on Linux it also adds the line to your login profile when that profile does not read ~/.bashrc. For csh and tcsh it writes nothing and tells you which directory to add. On Windows it puts the directory first in your user Path. Open a new terminal afterwards. If another agentry comes earlier on your PATH, the script says so.
  • Node.js, which the MCP server needs. If node is missing or older than 20, the script installs Node.js v24 for your user only, from nodejs.org's official archive, checked against a SHA-256 pinned in the script. On macOS and Linux it goes in ~/.local/share/agentry/node, with node, npm, npx and corepack linked into the same bin directory (a link is never put over a file of yours there). On Windows it goes in %LOCALAPPDATA%\Programs\agentry\node, which is put first in your user Path. Set AGENTRY_NO_NODE=1 to skip this step.
  • A container engine and Python are checked, never installed. agentry run needs a container engine that serves the Docker API: Docker Engine, Docker Desktop, podman, Colima, Rancher Desktop, Podman Desktop and others (which, and what each needs). The script names the engine a run would use, by kind and version, such as "Docker Engine 29.7.2 (Docker Desktop), running" or "podman 5.8.4, running". For podman it also checks the API socket a run needs and gives the command that turns it on. When no engine answers, it says so and names the choices for your system. Docker Desktop is free for personal use and small companies and licensed per seat for others; see Docker's terms. The script also says whether python3 is there, which only the MCP server's session tools use.

Running the script again installs whatever version the site now serves, and changes nothing if you already have it. Its last lines are AGENTRY_BIN=<path> and, when Node.js is there, AGENTRY_NODE=<path>, for a program that installs the CLI and needs to know where it went.

To remove it, delete the agentry binary and the lines the script added, each marked # Added by the agentry CLI installer. If the script installed Node.js, delete its directory, named above, and on macOS and Linux the node, npm, npx and corepack links beside agentry. On Windows, remove the bin directory, and the node directory if the script installed Node.js, from your user Path in Settings → System → About → Advanced system settings → Environment Variables.

Platform Installer Archive
Windows …-windows-amd64-setup.exe: a per-user installer, no administrator password; your settings and sign-in live outside the install directory, so an upgrade replaces the program and nothing else …-windows-amd64.exe, the standalone program; …-windows-amd64.zip, the same zipped
macOS …-darwin-universal.dmg: open it and drag Agentry Desktop to Applications (one universal build, Apple silicon and Intel) …-darwin-universal.zip: unzip it and move agentry-desktop.app to Applications
Linux …-linux-amd64.deb (apt, dpkg) and …-linux-amd64.rpm (dnf, rpm); your settings live outside the package's files, so an upgrade replaces the program and nothing else …-linux-amd64, a single executable needing GTK 3 and WebKit2GTK 4.1 from your distribution, or …-linux-amd64.tar.gz

Your settings, installed QuickAgents, runner policy and sign-in live under your home directory, never in an install directory, so an upgrade of any form replaces the program and nothing else.

The desktop's installers and its macOS app also carry the agentry command, at the CLI version the app was built with (the standalone Windows program and the Linux archive do not). The Windows installer adds it to your user Path and the Linux packages install /usr/bin/agentry. On macOS (Agentry Desktop 0.6.121 or later) it sits inside the app, and Install the agentry command, in the first-run wizard's last step and under Settings → Update settings → Agentry Desktop, links ~/.local/bin/agentry to it and puts that folder on your PATH, so a new terminal finds it and an update of the app updates it.

A binary downloaded from a registry's /download page connects to that registry unless you say otherwise, with --registry or the CLI's config file. A CLI built from source defaults to http://localhost:8080.

Every file carries a checksum: each card shows its SHA-256, and SHA256SUMS covers the set. Check the file you downloaded — the installer, the disk image, the package, the zip — before you open or install it; the digest is of that file, not of what it unpacks:

sha256sum -c --ignore-missing SHA256SUMS      # Linux: binary, .deb, .rpm, .tar.gz
shasum -a 256 -c --ignore-missing SHA256SUMS  # macOS: .dmg, .zip
Get-FileHash .\agentry-desktop-*.exe          # Windows: the installer or the .exe, compare by eye

Which builds carry an OS code signature is what the manifest's signed field says, and the page says "signed" only when a build is, so a card without the word is an unsigned build; an unsigned build's first launch is met by Windows SmartScreen or macOS Gatekeeper saying the publisher is unknown. The CLI's Windows executable is Authenticode-signed from the CLI releases cut after 3 October 2026. Before its card says "signed", the site checks that the signature chains to Microsoft's code-signing root and names the publisher the release's own build record claims. The CLI's macOS binaries are also notarised by Apple, and their cards say "signed, notarised". A single binary cannot carry its notarisation ticket, so macOS checks it online the first time a copy downloaded with a browser runs; a binary fetched with curl is not checked by Gatekeeper at all.

The MCP server is one file for every platform, agentry-mcp-<version>.tar.gz: the built server with its dependencies, which needs Node 20 or newer and the CLI on the same machine. The manifest files it under product mcp with os and arch any. Unpack it anywhere and add agentry-mcp-<version>/dist/index.js to your coding agent as a stdio server run with node (the MCP server page has the commands for Claude Code and Codex). The page also offers a prompt to paste into your coding agent, which has the agent check the CLI and Node, download the file, compare its SHA-256 with the one on the card, unpack it and add the server. Before 1.0.0 the prompt downloads from this site; from 1.0.0 it downloads the same release from the MCP server's GitHub releases. From version 0.6.13 its releases carry a signature over their sums, SHA256SUMS.minisig, made with Agentry's update-signing key, and the site serves one only after reading it from the MCP server's own GitHub Release and checking that signature, its sums, its tag and the branch its commit is on; a release without the signature is not served. The tarball itself is JavaScript and carries no OS code signature, so its card does not say "signed".

A Homebrew tap is planned but not published yet, so there is no brew install command to run today; download the binary above until it ships. After installing: agentry --version, then agentry setup once — the runner reference takes it from there, including installing QuickAgents into Claude Code, Codex, or OpenClaw instead of the container path.