Skip to main content
The Runlayer CLI ships as one signed, self-contained package per operating system. Each installer drops the runlayer binary on PATH and does nothing else — there is no Python or uv prerequisite on managed devices. Unlike AI Watch, the CLI package requires no configuration: no MDM Configuration Profiles, no MSI properties, no PPPC/TCC grants, and no bundled agents or scheduled tasks. Deploy the package and you are done; each user authenticates once with runlayer login afterward.
This page covers pushing the runlayer binary to a fleet. For running MCP servers locally, syncing client configs, or connecting individual clients once the CLI is installed, see Local MCPs, Auto-Sync to Clients, and Connecting Clients.

​
How It Works

  1. Push the package — deploy the signed .pkg / .msi / .deb / .rpm to your fleet through your MDM or configuration management. No profiles or properties to configure.
  2. Binary lands on PATH — the installer writes the self-contained runlayer binary (and, on Windows, updates the system PATH). Nothing runs at install time.
  3. Users authenticate — each user runs runlayer login once to store credentials, then the CLI is ready for local MCPs, auto-sync, and other commands.

​
Get the artifacts

Download the CLI installers from your Runlayer downloads access. Official builds are signed and notarized (macOS) or Authenticode-signed (Windows) by Anysource Inc. Contact your Runlayer account team if you don’t have access yet.
PlatformArtifacts
macOSrunlayer-<version>-macos-arm64.pkg, runlayer-<version>-macos-arm64.zip (raw bundle)
Windowsrunlayer-<version>-win-x64.intunewin, runlayer-<version>-win-x64.msi, runlayer-<version>-win-x64.zip (raw bundle)
Linuxrunlayer_<version>_amd64.deb, runlayer-<version>-*.rpm, runlayer-<version>-linux-x86_64.tar.gz, SHA256SUMS

​
Platform support

PlatformManaged deploymentInstalled layout
macOS (Apple Silicon / arm64)Signed + notarized .pkg/usr/local/lib/runlayer/runlayer/ + symlink /usr/local/bin/runlayer
Windows (x64)Authenticode-signed .msi wrapped for Intune (.intunewin)C:\Program Files\Runlayer\CLI\ (added to the system PATH)
Linux (x86_64).deb / .rpm (plus raw .tar.gz)/usr/lib/runlayer/ + symlink /usr/bin/runlayer
The signed macOS .pkg ships for Apple Silicon Macs. For Intel Macs or other architectures, use the cross-platform uv tool install runlayer path, or contact your Runlayer account team.

​
MDM Deployment

Deploy the signed package through your platform’s managed deployment flow:

macOS

Deploy the signed .pkg through any MDM with package deployment

Windows (Intune)

Deploy the Authenticode-signed MSI as an Intune Win32 app

Linux

Install the .deb / .rpm through your configuration management

​
After installation

The package installs the binary but leaves it unauthenticated by design. Each user logs in once to store credentials in the OS keychain (with a fallback to ~/.runlayer/config.yaml): 
runlayer login --host https://your-tenant.runlayer.com
After login, the CLI is ready for Local MCPs (runlayer run <server-id>), Auto-Sync to Clients (runlayer setup sync), and other commands.

​
Frequently Asked Questions

No. The signed .pkg / .msi / .deb / .rpm is the same artifact for every customer — nothing tenant-specific is compiled into it. The package installs only the runlayer binary; tenant host and credentials are supplied later, per user, by runlayer login. That means the package can be verified once (signature, notarization) and reused unchanged across your whole fleet.
No. The package is fully self-contained: it installs a single signed runlayer binary with its runtime bundled. There is no Python, uv, or separate install required on managed devices. The uv tool install runlayer / uvx runlayer path is only for manual, single-device or developer use.
No. Installation only writes the binary to disk (and, on Windows, updates the system PATH); nothing runs, and no network access is required. The CLI reaches your Runlayer tenant host over HTTPS (443) only when a user runs an authenticated command such as runlayer login, runlayer run, or runlayer setup sync.

Auto-Sync to Clients

Push managed MCP configs to developer tools across your fleet

Local MCPs

Run MCP servers on developer machines through the CLI proxy

Connecting Clients

Point AI clients at Runlayer-managed MCP servers

Troubleshooting

Common CLI and PATH issues and how to resolve them