Install the CLI
The gatedCLI scans targets your hosted workers can’t reach — localhost, private staging, anything behind a VPN or corporate firewall — by proxying MCP traffic from a machine that can. It also triggers scans for any target your organization owns and streams findings to your terminal. One command installs it on macOS, Linux, and Windows.
Overview
The CLI is a single, self-contained binary — no runtime to install, no dependencies to resolve. The installers below download the build for your platform, verify its SHA-256 checksum against the published manifest, and drop the binary on your PATH. The CLI is a thin proxy: it forwards MCP traffic and authenticates you to the platform. It never holds check logic, target credentials, or scan authorization — those stay server-side.
Install
macOS and Linux— run in a terminal:
Windows— run in PowerShell:
Each installer writes gatedto a per-user directory — ~/.local/bin on macOS and Linux, %LOCALAPPDATA%\Gated\binon Windows — so no sudoor administrator prompt is needed. If that directory isn’t already on your PATH, the installer prints the line to add.
Verify the install
Open a new terminal so the updated PATH takes effect, then confirm the binary runs:
It prints the version, commit, and build date. If the command isn’t found, the install directory isn’t on your PATHyet — re-read the line the installer printed.
Options
Both installers read two environment variables. Pin a specific version — useful in CI, where you want reproducible builds rather than whatever is current:
Or choose where the binary lands — for example a directory already on a shared PATH:
If you’d rather not pipe a script to a shell, download the archive and checksum directly and install the binary yourself. Archives live at https://get.gated.cc/releases/<version>/gated_<os>_<arch> — .tar.gz for macOS and Linux, .zip for Windows — alongside a checksums.txt. Use latest in place of a version for the current release.
Unsigned binaries
We don’t yet code-sign the CLI. On first run, macOS Gatekeeper or Windows SmartScreen may warn that the developer can’t be verified. The binary is the same artifact the installer checksum-verified; the warning reflects the absence of a platform signature, not a problem with the download. On macOS you can allow it once under System Settings → Privacy & Security. Signing is on the roadmap and will remove these prompts.
Next steps
Authenticate the CLI to the platform, then run a scan:
gated loginuses an OAuth device flow and stores the session token in your OS keychain — never in a file or environment variable. gated scan defaults to a passive scan and exits non-zero when it finds issues at or above your threshold, which is what makes it usable as a CI gate. From here, browse the check catalog to see what a scan looks for, or read the dependency model to understand why a given check runs or sits out.