> ## Documentation Index
> Fetch the complete documentation index at: https://docs.runlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Runlayer CLI

> Deploy the Runlayer CLI to your fleet with a signed, self-contained package — no configuration required.

The Runlayer CLI ships as one signed, self-contained package per operating system. Each installer drops the `runlayer` binary on `PATH` — there is no Python or `uv` prerequisite on managed devices.

Unlike [AI Watch](/shadow-ai/deploy), the CLI package requires **no configuration to deploy**: no MSI properties and no PPPC/TCC grants. Deploy the package and each user can authenticate once with `runlayer login` afterward.

* **Managed updates** — the macOS and Windows installers add a package-owned hourly updater. It activates once `Host` and `OrgApiKey` are available from the CLI or AI Watch configuration, and otherwise exits silently. Use Client Updates to select or pin the installed version. Linux updates are explicit.
* **Managed skill sync** — native packages on all three platforms schedule [skill sync](/platform-skills#sync-to-devices) per user (a LaunchAgent on macOS, a SYSTEM task on Windows, a cron wrapper on Linux). These jobs stay idle without managed host and key settings.

<Note>
  This page covers pushing the `runlayer` binary to a fleet. For running MCP servers locally, syncing client configs, or connecting individual clients once the CLI is installed, see [Local MCPs](/local-mcps), [Auto-Sync to Clients](/auto-provisioning), and [Connecting Clients](/connecting-clients).
</Note>

## How It Works

1. **Push the package** — deploy the signed `.pkg` / `.msi` / `.deb` / `.rpm` to your fleet through your MDM or configuration management. No profiles or properties to configure.
2. **Binary lands on `PATH`** — the installer writes the self-contained `runlayer` binary (and, on Windows, updates the system `PATH`).
3. **Background jobs register** — native packages register their platform's updater and/or managed-skill scheduler. Unconfigured jobs are quiet no-ops.
4. **Users authenticate** — each user runs `runlayer login` once to store credentials, then the CLI is ready for local MCPs, auto-sync, and other commands.

## Get the artifacts

Download the CLI installers from your Runlayer downloads access. Official builds are signed and notarized (macOS) or Authenticode-signed (Windows) by Anysource Inc. Contact your Runlayer account team if you don't have access.

| Platform | Artifacts |
| - | - |
| macOS | `runlayer-<version>-macos-arm64.pkg`, `runlayer-<version>-macos-arm64.zip` (raw bundle) |
| Windows | `runlayer-<version>-win-x64.intunewin`, `runlayer-<version>-win-x64.msi`, `runlayer-<version>-win-x64.zip` (raw bundle) |
| Linux | `runlayer_<version>_amd64.deb`, `runlayer-<version>-*.rpm`, `runlayer-<version>-linux-x86_64.tar.gz`, `SHA256SUMS` |
| Linux (legacy glibc 2.17 variant) | `runlayer_<version>_amd64.glibc2.17.deb`, `runlayer-<version>-1.x86_64.glibc2.17.rpm`, `SHA256SUMS-glibc2.17` — see [Legacy distributions](/deploy-cli/linux#legacy-distributions-glibc-217) |

## Platform support

| Platform | Managed deployment | Installed layout |
| - | - | - |
| macOS (Apple Silicon / arm64) | Signed + notarized `.pkg` | `/usr/local/lib/runlayer/runlayer/` + symlink `/usr/local/bin/runlayer` |
| Windows (x64) | Authenticode-signed `.msi` wrapped for Intune (`.intunewin`) | `C:\Program Files\Runlayer\CLI\` (added to the system `PATH`) |
| Linux (x86\_64) | `.deb` / `.rpm` (plus raw `.tar.gz`) | `/usr/lib/runlayer/` + symlink `/usr/bin/runlayer` |

The signed macOS `.pkg` ships for Apple Silicon Macs. For Intel Macs or other architectures, use the cross-platform `uv tool install runlayer` path, or contact your Runlayer account team.

## MDM Deployment

Deploy the signed package through your platform's managed deployment flow:

<CardGroup cols={2}>
  <Card title="macOS" icon="apple" href="/deploy-cli/macos">
    Deploy the signed `.pkg` through any MDM with package deployment
  </Card>

  <Card title="Windows (Intune)" icon="windows" href="/deploy-cli/intune">
    Deploy the Authenticode-signed MSI as an Intune Win32 app
  </Card>

  <Card title="Linux" icon="linux" href="/deploy-cli/linux">
    Install the `.deb` / `.rpm` through your configuration management
  </Card>
</CardGroup>

## After installation

The package installs the binary but leaves it unauthenticated by design. Each user logs in once to store credentials in the OS keychain (with a fallback to `~/.runlayer/config.yaml`):

```bash theme={null}
runlayer login --host https://your-tenant.runlayer.com
```

After login, the CLI is ready for [Local MCPs](/local-mcps) (`runlayer run <server-id>`), [Auto-Sync to Clients](/auto-provisioning) (`runlayer setup sync`), and other commands.

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="Is the package custom-built per organization?">
    No. The signed `.pkg` / `.msi` / `.deb` / `.rpm` is the same artifact for every customer — nothing tenant-specific is compiled into it. Tenant host and credentials are supplied later through `runlayer login` or managed settings; package-owned background jobs remain idle until configured. The package can be verified once and reused unchanged across your whole fleet.
  </Accordion>

  <Accordion title="Is Python, uv, or any other runtime a prerequisite?">
    No. The package is fully self-contained: it installs a single signed `runlayer` binary with its runtime bundled. There is no Python, `uv`, or separate install required on managed devices. The `uv tool install runlayer` / `uvx runlayer` path is only for manual, single-device or developer use.
  </Accordion>

  <Accordion title="Does the package need any configuration or network access at install time?">
    No. Installation writes the binary to disk and registers package-owned launchd jobs, Windows tasks, or Linux cron content; no network access is required, and without managed settings those jobs exit immediately. The CLI reaches your Runlayer tenant host over HTTPS (443) only for authenticated commands such as `runlayer login`, `runlayer run`, or `runlayer setup sync`, or when managed keys enable auto-update or skill sync.
  </Accordion>
</AccordionGroup>

## Related Resources

<CardGroup cols={2}>
  <Card title="Auto-Sync to Clients" icon="arrows-rotate" href="/auto-provisioning">
    Push managed MCP configs to developer tools across your fleet
  </Card>

  <Card title="Local MCPs" icon="server" href="/local-mcps">
    Run MCP servers on developer machines through the CLI proxy
  </Card>

  <Card title="Connecting Clients" icon="plug" href="/connecting-clients">
    Point AI clients at Runlayer-managed MCP servers
  </Card>

  <Card title="Windows PATH verification" icon="wrench" href="/deploy-cli/intune#verification">
    Open a new terminal after installation and verify the system PATH update
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.