Installation

The SecureAI CLI is a single static binary with no runtime dependencies. Install it with one command on macOS, Linux, or Windows. No account needed to download.

Install script

The fastest path on macOS and Linux. Detects your platform, verifies the download against the published checksum, and puts secureai on your PATH.

Terminal

curl -fsSL https://get.corelayersecurity.com/install.sh | sh

Prefer to read before you run? The installer is plain text at get.corelayersecurity.com/install.sh. Open it in a browser, then pipe it to sh once you are happy with it.

Terminal

$ curl -fsSL https://get.corelayersecurity.com/install.sh | sh

  secureai 0.1.1  darwin/arm64

  ✓ downloaded  secureai_0.1.1_darwin_arm64.tar.gz
  ✓ verified    sha256
  ✓ installed   /usr/local/bin/secureai

It installs to /usr/local/bin when that is writable and falls back to ~/.local/bin otherwise, printing the PATH line to add if the directory is not already there. It never asks for a password without telling you why.

Installer options

Variable	Effect
`SECUREAI_VERSION`	Install a specific version instead of the current stable one, e.g. `0.1.0`.
`SECUREAI_INSTALL_DIR`	Install somewhere explicit. Worth setting in CI so the location is deterministic.

Terminal

curl -fsSL https://get.corelayersecurity.com/install.sh | SECUREAI_VERSION=0.1.0 SECUREAI_INSTALL_DIR="$HOME/bin" sh

Windows

In PowerShell. Installs per-user under %LOCALAPPDATA%\\SecureAI\\bin and adds it to your user PATH, so no elevation is required.

PowerShell

irm https://get.corelayersecurity.com/install.ps1 | iex

Restart your terminal afterwards so the updated PATH is picked up.

Manual download

Every release is published as an archive plus a SHA-256 manifest. These links always point at the current stable release; substitute /v<version>/ for a pinned one.

Platform	Archive
macOS · Apple silicon	secureai_darwin_arm64.tar.gz
macOS · Intel	secureai_darwin_amd64.tar.gz
Linux · x86_64	secureai_linux_amd64.tar.gz
Linux · arm64	secureai_linux_arm64.tar.gz
Windows · x86_64	secureai_windows_amd64.zip
Windows · arm64	secureai_windows_arm64.zip

Terminal

curl -fsSLO https://get.corelayersecurity.com/latest/secureai_linux_amd64.tar.gz
tar -xzf secureai_linux_amd64.tar.gz
sudo install -m 0755 secureai /usr/local/bin/secureai

Verifying a manual download

Each directory carries a SHA256SUMS manifest covering every archive in it. The install script does this for you; do it yourself when downloading by hand.

Terminal

curl -fsSLO https://get.corelayersecurity.com/latest/SHA256SUMS
shasum -a 256 -c SHA256SUMS --ignore-missing

secureai_linux_amd64.tar.gz: OK

A mismatch is not a retry

If the checksum does not match, do not run the binary. Re-download over a connection you trust and check again; if it still fails, tell us before executing anything.

Pinning a version

Versioned paths are immutable. /v0.1.0/ will serve the same bytes with the same checksum indefinitely, so a pinned CI job or an air-gapped mirror keeps working across later releases. latest/ is re-pointed on each release, and stable.txt names the version the install script resolves.

Path	Contents
`/v<version>/`	Release archives plus SHA256SUMS. Immutable, cached indefinitely.
`/latest/`	The current stable archives under unversioned filenames.
`/stable.txt`	The current stable version, as plain text.
`/install.sh`	The POSIX install script, also served at the bare hostname.
`/install.ps1`	The PowerShell install script.

Verify the installation

Terminal

$ secureai --version
secureai version 0.1.1

$ secureai --help
BUILD:  secureai scan <target>   static risk scanning of prompts and tool configs
TEST:   secureai test --target   offensive prompt-injection / jailbreak testing

Point it at your control plane

Every command that uploads results or fetches payloads needs a control-plane URL. Set it once rather than passing --server each time.

~/.zshrc

export SECUREAI_SERVER=https://api.corelayersecurity.com

Resolution order is flag → environment → default. With neither set, the CLI falls back to http://localhost:8080, which is only useful when running the control plane locally.

The CLI ships without attack payloads

The adversarial corpus used by secureai test is not compiled into the binary. The CLI fetches it from the control plane at run time over an authenticated request, so a copied or decompiled binary yields nothing. This is why test requires you to be logged in even when the target is your own endpoint, while downloading the CLI requires no account.

Running in a container

For CI, bake the binary into a small image rather than downloading it on every run. The binary is static, so a distroless base is enough.

Dockerfile

FROM debian:12-slim AS install
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl \
 && curl -fsSL https://get.corelayersecurity.com/install.sh | SECUREAI_INSTALL_DIR=/out sh

FROM gcr.io/distroless/base-debian12
COPY --from=install /out/secureai /usr/local/bin/secureai
ENTRYPOINT ["secureai"]

Pin SECUREAI_VERSION in the install step if you want reproducible images. See CI integration for pipeline-level recipes.

Upgrading

Re-run the installer. It overwrites the existing binary in place.

Terminal

curl -fsSL https://get.corelayersecurity.com/install.sh | sh

Uninstalling

Remove the binary and the credential directory:

Terminal

secureai logout
rm -f "$(command -v secureai)"
rm -rf ~/.secureai

What lives in ~/.secureai

credentials.json. Your CLI session: server, token, email, name, and role. Written with owner-only permissions.

Removing the directory logs you out on that machine. It does not revoke anything server-side. For that, see CLI access.

Requirements

	Requirement
Operating system	macOS 12+, Linux (glibc or musl), or Windows 10+
Architecture	amd64 or arm64
Dependencies	None. The binary is statically linked
Network	Outbound HTTPS to `get.corelayersecurity.com` to install, and to your control plane (`api.corelayersecurity.com`) to run
Account	Only to use it. An invitation to a SecureAI organisation. Downloading needs nothing.