docs · install

Install the agent. One command per device.

The agent installs from a single script on macOS, Linux, and Windows. Push it through your MDM or run it directly. No SDK. No code changes.

Your enrollment token lives in the portal under Settings → Deployment. Treat it like a password. Every command on this page uses the placeholder <your-enrollment-token>. Real tokens never appear here.

Quick install

Replace <your-enrollment-token> with the token from Settings → Deployment. macOS and Linux require root. Windows requires an elevated PowerShell.

macos · run as root

curl -fsSL "https://stg.nevertrust.ai/api/v1/install/<your-enrollment-token>?os=macos" | sudo bash

linux · run as root

curl -fsSL "https://stg.nevertrust.ai/api/v1/install/<your-enrollment-token>?os=linux" | sudo bash

windows · elevated powershell

irm https://stg.nevertrust.ai/api/v1/install/<your-enrollment-token>?os=windows | iex

Deploy via MDM

For managed devices and air-gapped environments where piping from the network is not possible, download the installer script for each platform from Settings → Deployment in the portal. The script ships with your enrollment token pre-embedded, so deploy it as you would any other package and protect it accordingly.

macOS

Compatible with Jamf Pro, Jamf Now, Mosyle, and any MDM that supports script deployment. Installs a LaunchDaemon that keeps the agent running at all times.

Push via MDM or run as root.

sudo bash nevertrust-install-macos.sh

Native package. A signed .pkg is available for Jamf and Munki distribution, with the enrollment token embedded at build time. Upload it as a package and scope a policy to your target devices.

Linux

Compatible with Ansible, Puppet, Chef, and direct deployment via SSH. Installs a systemd service that starts automatically on boot.

Push via your configuration tool or run as root.

sudo bash nevertrust-install-linux.sh

Native package. A .deb package is available for apt-based distributions and an .rpm for yum/dnf-based distributions such as RHEL and Amazon Linux, each with the enrollment token embedded at build time.

Windows

Compatible with Microsoft Intune, SCCM, and PDQ Deploy. Installs the agent as a Windows Service and trusts the root CA in the system certificate store. Requires Windows 10 / Server 2019 or later.

Run as Administrator in PowerShell.

.\nevertrust-install-windows.ps1

Native package. A .msi installer is available for Intune and SCCM distribution. Pass the token at install time with msiexec /i nevertrust-agent.msi ENROLLMENT_TOKEN=<your-enrollment-token> /qn. Omit the property and the installer prompts during interactive install.

What happens on first run

01The installer writes the enrollment token to a root-only file on the device. It is never passed on the command line.
02The agent contacts the portal and exchanges the token for a device-specific API key.
03The key is saved to the device, readable only by its owner. The enrollment token is discarded from memory.
04Subsequent runs use the saved API key. If the key file is lost, generate a new enrollment token from the portal.

enrollment tokens are issued in the portal, not on this page