Skip to main content
The Runlayer CLI ships as one signed, self-contained package per operating system. Each installer drops the runlayer binary on PATH — there is no Python or uv prerequisite on managed devices. Unlike AI Watch, the CLI package requires no configuration to deploy: no MSI properties and no PPPC/TCC grants. The macOS and Windows installers add a package-owned hourly updater; managed updates default on once Host and OrgApiKey are available from the CLI or AI Watch configuration, and otherwise exit silently — set AutoUpdate=false to opt out. Linux updates are explicit. Native packages on all three platforms also schedule managed skill sync: a per-user LaunchAgent on macOS, a SYSTEM task that drops to logged-on users on Windows, and a root runuser cron wrapper on Linux — these jobs stay idle without managed host and key settings. Deploy the package and each user can authenticate once with runlayer login afterward.
This page covers pushing the runlayer binary to a fleet. For running MCP servers locally, syncing client configs, or connecting individual clients once the CLI is installed, see Local MCPs, Auto-Sync to Clients, and Connecting Clients.

​
How It Works

  1. Push the package — deploy the signed .pkg / .msi / .deb / .rpm to your fleet through your MDM or configuration management. No profiles or properties to configure.
  2. Binary lands on PATH — the installer writes the self-contained runlayer binary (and, on Windows, updates the system PATH).
  3. Background jobs register — native packages register their platform’s updater and/or managed-skill scheduler. Unconfigured jobs are quiet no-ops.
  4. Users authenticate — each user runs runlayer login once to store credentials, then the CLI is ready for local MCPs, auto-sync, and other commands.

​
Get the artifacts

Download the CLI installers from your Runlayer downloads access. Official builds are signed and notarized (macOS) or Authenticode-signed (Windows) by Anysource Inc. Contact your Runlayer account team if you don’t have access yet.

​
Platform support

The signed macOS .pkg ships for Apple Silicon Macs. For Intel Macs or other architectures, use the cross-platform uv tool install runlayer path, or contact your Runlayer account team.

​
MDM Deployment

Deploy the signed package through your platform’s managed deployment flow:

macOS

Deploy the signed .pkg through any MDM with package deployment

Windows (Intune)

Deploy the Authenticode-signed MSI as an Intune Win32 app

Linux

Install the .deb / .rpm through your configuration management

​
After installation

The package installs the binary but leaves it unauthenticated by design. Each user logs in once to store credentials in the OS keychain (with a fallback to ~/.runlayer/config.yaml):
After login, the CLI is ready for Local MCPs (runlayer run <server-id>), Auto-Sync to Clients (runlayer setup sync), and other commands.

​
Frequently Asked Questions

No. The signed .pkg / .msi / .deb / .rpm is the same artifact for every customer — nothing tenant-specific is compiled into it. Tenant host and credentials are supplied later through runlayer login or managed settings; package-owned background jobs remain idle until configured. The package can be verified once and reused unchanged across your whole fleet.
No. The package is fully self-contained: it installs a single signed runlayer binary with its runtime bundled. There is no Python, uv, or separate install required on managed devices. The uv tool install runlayer / uvx runlayer path is only for manual, single-device or developer use.
No. Installation writes the binary to disk and registers package-owned launchd jobs, Windows tasks, or Linux cron content; no network access is required, and without managed settings those jobs exit immediately. The CLI reaches your Runlayer tenant host over HTTPS (443) only for authenticated commands such as runlayer login, runlayer run, or runlayer setup sync, or when managed keys enable auto-update or skill sync.

Auto-Sync to Clients

Push managed MCP configs to developer tools across your fleet

Local MCPs

Run MCP servers on developer machines through the CLI proxy

Connecting Clients

Point AI clients at Runlayer-managed MCP servers

Windows PATH verification

Open a new terminal after installation and verify the system PATH update