Installation

The CLI

The unveilr CLI is the free, offline scanner. It runs on macOS, Linux, and Windows (WSL), needs no account to scan, and never sends your source anywhere unless you explicitly upload.

Private source

The Unveilr git repository is private. Install binaries from the CDN your operator publishes — not from GitHub raw URLs.

Design partners — works today

Your Unveilr contact hands you a standalone binary for your platform (no Python required) plus its SHA-256 checksum:

shasum -a 256 -c unveilr.sha256     # verify the artifact you were sent
chmod +x unveilr && sudo mv unveilr /usr/local/bin/
unveilr scan .                      # offline — nothing leaves your machine

Every binary is built by the release pipeline with published checksums, an SPDX SBOM, and (once the repo is public or provenance is enabled) a GitHub build-provenance attestation.

Standalone binary via CDN — after GA cut

Not live yet

get.unveilr.ai is provisioned as part of the GA cut (Production APIs). Until then this command will not resolve — use the design-partner path above.

curl -fsSL https://get.unveilr.ai/install.sh | sh
# pin a release:
curl -fsSL https://get.unveilr.ai/install.sh | UNVEILR_VERSION=v0.1.0 sh

The installer downloads the binary for your OS/arch to /usr/local/bin/unveilr (override with UNVEILR_BIN_DIR) and verifies SHA-256 against checksums.txt on the same CDN prefix.

pip / pipx

If you have Python ≥ 3.11 and your operator publishes a wheel to an index you can reach:

pipx install unveilr-cli     # isolated (recommended)
# or
pip install unveilr-cli

From source (Unveilr operators / design partners with repo access only)

# Requires access to the private monorepo
make install
apps/api/.venv/bin/unveilr scan --help
# or: GH_TOKEN=… UNVEILR_VERSION=v0.1.0 ./scripts/install.sh

Verify

unveilr --help
unveilr scan .          # scans the current directory

The console + API

The console (web UI) and Admin API are how teams review findings, browse the AI-BOM, triage, and export evidence.

Hosted: https://guard.unveilr.ai (goes live with the GA cut — until then, design partners get a dedicated instance or run locally below) — configure clients with UNVEILR_API=https://guard.unveilr.ai. Details and personas: Production APIs.

Local evaluation (operators with the private repo):

make api    # API on :8080 (SQLite)
make web    # Console on :3000

Then open http://localhost:3000. For a real deployment (SSO, Postgres), see Self-hosting.

Configuration

What	How
Credentials store	~/.unveilr/config.json (override the directory with UNVEILR_CONFIG_DIR)
API endpoint for uploads	--api <url> or apiUrl in the config file (set to your hosted origin)
Detection rules	bundled with the CLI; advanced override via UNVEILR_DETECTION_RULES_PATH