> ## Documentation Index
> Fetch the complete documentation index at: https://docs.runlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Runlayer CLI

> Deploy the Runlayer CLI to your fleet with a signed, self-contained package — no configuration required.

The Runlayer CLI ships as one signed, self-contained package per operating system. Each installer drops the `runlayer` binary on `PATH` and does nothing else — there is no Python or `uv` prerequisite on managed devices.

Unlike [AI Watch](/shadow-ai/deploy), the CLI package requires **no configuration**: no MDM Configuration Profiles, no MSI properties, no PPPC/TCC grants, and no bundled agents or scheduled tasks. Deploy the package and you are done; each user authenticates once with `runlayer login` afterward.

<Note>
  This page covers pushing the `runlayer` binary to a fleet. For running MCP servers locally, syncing client configs, or connecting individual clients once the CLI is installed, see [Local MCPs](/local-mcps), [Auto-Sync to Clients](/auto-provisioning), and [Connecting Clients](/connecting-clients).
</Note>

## How It Works

1. **Push the package** — deploy the signed `.pkg` / `.msi` / `.deb` / `.rpm` to your fleet through your MDM or configuration management. No profiles or properties to configure.
2. **Binary lands on `PATH`** — the installer writes the self-contained `runlayer` binary (and, on Windows, updates the system `PATH`). Nothing runs at install time.
3. **Users authenticate** — each user runs `runlayer login` once to store credentials, then the CLI is ready for local MCPs, auto-sync, and other commands.

## Get the artifacts

Download the CLI installers from your Runlayer downloads access. Official builds are signed and notarized (macOS) or Authenticode-signed (Windows) by Anysource Inc. Contact your Runlayer account team if you don't have access yet.

| Platform | Artifacts                                                                                                               |
| -------- | ----------------------------------------------------------------------------------------------------------------------- |
| macOS    | `runlayer-<version>-macos-arm64.pkg`, `runlayer-<version>-macos-arm64.zip` (raw bundle)                                 |
| Windows  | `runlayer-<version>-win-x64.intunewin`, `runlayer-<version>-win-x64.msi`, `runlayer-<version>-win-x64.zip` (raw bundle) |
| Linux    | `runlayer_<version>_amd64.deb`, `runlayer-<version>-*.rpm`, `runlayer-<version>-linux-x86_64.tar.gz`, `SHA256SUMS`      |

## Platform support

| Platform                      | Managed deployment                                           | Installed layout                                                        |
| ----------------------------- | ------------------------------------------------------------ | ----------------------------------------------------------------------- |
| macOS (Apple Silicon / arm64) | Signed + notarized `.pkg`                                    | `/usr/local/lib/runlayer/runlayer/` + symlink `/usr/local/bin/runlayer` |
| Windows (x64)                 | Authenticode-signed `.msi` wrapped for Intune (`.intunewin`) | `C:\Program Files\Runlayer\CLI\` (added to the system `PATH`)           |
| Linux (x86\_64)               | `.deb` / `.rpm` (plus raw `.tar.gz`)                         | `/usr/lib/runlayer/` + symlink `/usr/bin/runlayer`                      |

The signed macOS `.pkg` ships for Apple Silicon Macs. For Intel Macs or other architectures, use the cross-platform `uv tool install runlayer` path, or contact your Runlayer account team.

## MDM Deployment

Deploy the signed package through your platform's managed deployment flow:

<CardGroup cols={2}>
  <Card title="macOS" icon="apple" href="/deploy-cli/macos">
    Deploy the signed `.pkg` through any MDM with package deployment
  </Card>

  <Card title="Windows (Intune)" icon="windows" href="/deploy-cli/intune">
    Deploy the Authenticode-signed MSI as an Intune Win32 app
  </Card>

  <Card title="Linux" icon="linux" href="/deploy-cli/linux">
    Install the `.deb` / `.rpm` through your configuration management
  </Card>
</CardGroup>

## After installation

The package installs the binary but leaves it unauthenticated by design. Each user logs in once to store credentials in the OS keychain (with a fallback to `~/.runlayer/config.yaml`):

```bash theme={null}
runlayer login --host https://your-tenant.runlayer.com
```

After login, the CLI is ready for [Local MCPs](/local-mcps) (`runlayer run <server-id>`), [Auto-Sync to Clients](/auto-provisioning) (`runlayer setup sync`), and other commands.

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="Is the package custom-built per organization?">
    No. The signed `.pkg` / `.msi` / `.deb` / `.rpm` is the same artifact for every customer — nothing tenant-specific is compiled into it. The package installs only the `runlayer` binary; tenant host and credentials are supplied later, per user, by `runlayer login`. That means the package can be verified once (signature, notarization) and reused unchanged across your whole fleet.
  </Accordion>

  <Accordion title="Is Python, uv, or any other runtime a prerequisite?">
    No. The package is fully self-contained: it installs a single signed `runlayer` binary with its runtime bundled. There is no Python, `uv`, or separate install required on managed devices. The `uv tool install runlayer` / `uvx runlayer` path is only for manual, single-device or developer use.
  </Accordion>

  <Accordion title="Does the package need any configuration or network access at install time?">
    No. Installation only writes the binary to disk (and, on Windows, updates the system `PATH`); nothing runs, and no network access is required. The CLI reaches your Runlayer tenant host over HTTPS (443) only when a user runs an authenticated command such as `runlayer login`, `runlayer run`, or `runlayer setup sync`.
  </Accordion>
</AccordionGroup>

## Related Resources

<CardGroup cols={2}>
  <Card title="Auto-Sync to Clients" icon="arrows-rotate" href="/auto-provisioning">
    Push managed MCP configs to developer tools across your fleet
  </Card>

  <Card title="Local MCPs" icon="server" href="/local-mcps">
    Run MCP servers on developer machines through the CLI proxy
  </Card>

  <Card title="Connecting Clients" icon="plug" href="/connecting-clients">
    Point AI clients at Runlayer-managed MCP servers
  </Card>

  <Card title="Troubleshooting" icon="wrench" href="/mcp-troubleshooting">
    Common CLI and PATH issues and how to resolve them
  </Card>
</CardGroup>