> For the complete documentation index, see [llms.txt](https://docs.mithrl.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mithrl.com/getting-started/installation.md).

# CLI Installation

`mithrl` ships as a signed, single-file binary — there's no Python, `pip`, or `uv` install required.

## Download and install

Binaries are published to [`mithrl-labs/public-releases`](https://github.com/mithrl-labs/public-releases), a public repository that holds nothing but signed release binaries (no source). That repo is shared by more than one Mithrl product, so releases are tagged with a `lattice-cli/` prefix — anything below that finds the newest release under that prefix and ignores releases tagged for a different product.

There's no Intel Mac (`darwin-x86_64`) or Linux arm64 build yet. The install script below stops with a message saying so rather than fetching a binary that can't run — if that's your platform, contact <support@mithrl.com>.

### Quick install (recommended)

One command downloads the right binary for your machine, names it `mithrl`, and makes it executable. No `gh` CLI or GitHub login needed — just `curl` (preinstalled on macOS/Linux) or PowerShell (preinstalled on Windows).

**macOS and Linux** (and Windows under Git Bash):

```bash
curl -fsSL https://raw.githubusercontent.com/mithrl-labs/public-releases/main/install-mithrl.sh | sh
```

**Windows (PowerShell):**

```powershell
irm https://raw.githubusercontent.com/mithrl-labs/public-releases/main/install-mithrl.ps1 | iex
```

The binary lands in the current directory and the script prints where it went. To put it straight on your `PATH` instead:

```bash
curl -fsSL https://raw.githubusercontent.com/mithrl-labs/public-releases/main/install-mithrl.sh | MITHRL_INSTALL_DIR=~/.local/bin sh
```

```powershell
& ([scriptblock]::Create((irm https://raw.githubusercontent.com/mithrl-labs/public-releases/main/install-mithrl.ps1))) -InstallDir "$HOME\bin"
```

The script checks the download's SHA-256 against the release's manifest and refuses to install on a mismatch. That catches a corrupt or truncated download, but it is not a signature check — `mithrl update` verifies the release signature, see [Staying up to date](#staying-up-to-date).

Piping a URL into a shell means trusting whatever it serves at that moment. To read it first:

```bash
curl -fsSL https://raw.githubusercontent.com/mithrl-labs/public-releases/main/install-mithrl.sh -o install-mithrl.sh
less install-mithrl.sh
sh install-mithrl.sh
```

<details>

<summary>Prefer the <code>gh</code> CLI?</summary>

```bash
TAG=$(gh release list --repo mithrl-labs/public-releases --json tagName,publishedAt \
  --jq 'map(select(.tagName | startswith("lattice-cli/"))) | sort_by(.publishedAt) | reverse | .[0].tagName')
gh release download "$TAG" --repo mithrl-labs/public-releases --pattern 'mithrl-darwin-arm64'  # or -linux-x86_64 / -windows-amd64.exe
mv mithrl-darwin-arm64 mithrl && chmod u+rwx mithrl  # adjust the source name to match whichever pattern you used above
```

Requires `gh auth login` first, even for this public repo. This path does no checksum check.

</details>

### Manual download

Prefer to pick the file yourself? Open the [Releases page](https://github.com/mithrl-labs/public-releases/releases), find the newest release tagged `lattice-cli/cli-vX.Y.Z`, and download the asset for your platform from its Assets section:

| Platform              | Asset                      |
| --------------------- | -------------------------- |
| macOS (Apple Silicon) | `mithrl-darwin-arm64`      |
| Linux (x86\_64)       | `mithrl-linux-x86_64`      |
| Windows (x86\_64)     | `mithrl-windows-amd64.exe` |

```bash
chmod +x mithrl-darwin-arm64      # or mithrl-linux-x86_64
mv mithrl-darwin-arm64 /usr/local/bin/mithrl
./mithrl --version
```

A file downloaded through a browser (unlike the `curl`/PowerShell commands above) is tagged by macOS/Windows as coming from the internet, and the binary isn't notarized by Apple or Authenticode-signed by Microsoft yet — it's signed with mithrl's own release key instead, which `mithrl update` verifies itself (see below). That means Gatekeeper or SmartScreen may block the first launch:

* **macOS:** "cannot be opened because the developer cannot be verified" — clear the quarantine flag once before running it: `xattr -d com.apple.quarantine ./mithrl-darwin-arm64`
* **Windows:** SmartScreen warning — choose **More info** → **Run anyway**.

## Verify

```bash
./mithrl --version
```

## Staying up to date

`mithrl update` checks `mithrl-labs/public-releases` for a newer version, verifies its Ed25519 signature and checksum before touching anything, and replaces the running binary in place:

```bash
./mithrl update --check
./mithrl update
```

See the [CLI reference](/docs/cli.md) for `--rollback` and its other flags.

Next: [Quick start](/getting-started/quickstart.md).