CLI Installation

The Safeguard CLI is a single static binary. There is no runtime to install alongside it — no Node, no Python, no JVM — and nothing it depends on at run time beyond the scanners it downloads on first use.

Install

macOS and Linux

curl -fsSL https://cli.safeguard.sh/install | bash

Windows

irm https://cli.safeguard.sh/install.ps1 | iex

The installer detects your OS and architecture, resolves the current release, verifies the download against the published checksums, and puts one safeguard binary on your PATH.

Confirm it landed:

safeguard --version

Read it before you run it

Piping a script from the internet into a shell is worth being careful about. The installer is about a hundred lines of plain bash, and you are welcome to read it first:

curl -fsSL https://cli.safeguard.sh/install -o install.sh && less install.sh
bash install.sh

Never pipe a URL you have not read into a shell — ours included.

Checksum verification

Every release publishes a checksums.txt next to its archives. The installer downloads it, checks the archive it just fetched, and refuses to install on a mismatch.

The two installers differ in one security-relevant way, and it is worth knowing which one you are running:

To skip verification deliberately — an air-gapped mirror that does not carry the checksums file, for instance — set SAFEGUARD_SKIP_CHECKSUM=1. It is an explicit opt-out and it is never the default.

Environment variables

Both installers read two variables:

Pin a release:

curl -fsSL https://cli.safeguard.sh/install | SAFEGUARD_VERSION=1.2.0 bash

$env:SAFEGUARD_VERSION = "1.2.0"; irm https://cli.safeguard.sh/install.ps1 | iex

Choose where it lands:

curl -fsSL https://cli.safeguard.sh/install | SAFEGUARD_INSTALL_DIR="$HOME/bin" bash

Without SAFEGUARD_INSTALL_DIR, the shell installer tries /usr/local/bin and falls back to ~/.local/bin if that is not writable; the PowerShell installer uses %LOCALAPPDATA%\Safeguard\bin and adds it to your user PATH.

Which release you get

The installers resolve the current version from https://cli.safeguard.sh/releases/latest.txt on every run, so a plain install always gets the newest release. Pin SAFEGUARD_VERSION when you need a build to stay put — CI is the usual reason.

curl -fsSL https://cli.safeguard.sh/releases/latest.txt

Platforms

Windows on ARM is not published as its own build. The PowerShell installer detects an ARM64 host, warns, and installs the x86_64 binary, which runs under emulation.

First run

The CLI downloads its scanner toolchain the first time it needs it, so a freshly installed binary has no scanners yet. Open the interactive terminal once and let it complete setup:

safeguard

Sign in

Authentication happens inside the interactive terminal:

safeguard

Then type /login. Your browser opens, you approve the session, and the terminal picks it up. /whoami shows who you are signed in as, and /logout ends the session.

See Interactive terminal for what else that terminal does, and Slash commands for the full list.

Updating

Re-run the installer. It resolves the current release and replaces the binary in place:

curl -fsSL https://cli.safeguard.sh/install | bash

irm https://cli.safeguard.sh/install.ps1 | iex

Uninstalling

Delete the binary and its state directory.

rm "$(command -v safeguard)"
rm -rf ~/.sg

Remove-Item "$env:LOCALAPPDATA\Safeguard" -Recurse -Force

~/.sg holds logs and session state. Removing it signs you out and clears the local history; it does not touch anything on the platform.

Next Steps