Install the CLI

The CLI is served by your Shield360 platform, so machines download it from the same server they report to. Replace https://app.shield360.ai with your own address if you self-host.

curl -fsSL https://app.shield360.ai/api/cli/install.sh | SHIELD360_INSTALL_KEY=<key> sh

$env:SHIELD360_INSTALL_KEY = "<key>"
iwr -useb https://app.shield360.ai/api/cli/install.ps1 | iex

The install scripts also enrol the machine, start the collector and add coding-agent hooks. Get the install key from Settings → Collection & deployment. For a binary without the enrolment, download it from Settings → Collection & deployment or from /api/cli/download/<target>. See Deploy the collector for every target, MDM rollout and multi-user machines.

Install the CLI only

To install the binary without an install key, enrolment, collector or hooks (for example to run shield360 configure and wire coding agents yourself):

curl -fsSL https://app.shield360.ai/api/cli/install-cli.sh | sh

iwr -useb https://app.shield360.ai/api/cli/install-cli.ps1 | iex

No GitHub account or token is needed. The script reads the version and sha256 of each platform’s binary from /api/cli/targets, downloads the binary from /api/cli/download/<file>, and refuses to install it if the sha256 does not match. On a self-hosted deployment, fetch the script from your own server: it defaults to the server it was served from.

Environment variable	Purpose	Default
SHIELD360_URL	Server or mirror to download from	The server that served the script
SHIELD360_VERSION	Version to require, e.g. 1.2.0. A server serves one version, the one it was built with, so a pin it does not serve fails rather than installing another version	latest (whatever the server serves)
SHIELD360_INSTALL_DIR	Target install directory	$HOME/.shield360/bin
SHIELD360_SKIP_CHECKSUM	Set to 1 to install when the server publishes no sha256. Not recommended	unset

Air-gapped installs

Point SHIELD360_URL at your own Shield360 server, which serves the CLI it was built with. To use a plain file mirror instead, serve two paths from any HTTP(S) host:

• /api/cli/targets: a copy of the JSON list from a Shield360 server (file, version and sha256 for each platform)
• /api/cli/download/<file>: the binaries it names, for example shield360-linux-amd64 and shield360-windows-amd64.exe

Then run the script from a copy with SHIELD360_URL=https://mirror.example sh install-cli.sh.

Install locations & PATH

Method	Install location	PATH handling
macOS / Linux script	~/.shield360/bin/shield360	Prints a PATH-add hint if the directory isn’t on $PATH
Windows script	%USERPROFILE%\.shield360\bin\shield360.exe	Updates user-scope PATH automatically - open a new terminal to pick it up
From source	~/.shield360/bin/shield360	Add it to $PATH if not already

Tip

The CLI binary must be on $PATH for the vendor plugin installs to work. The shield360 coding install command rewrites the shield360 token in each generated hook manifest to the absolute path of the running binary, which sidesteps the minimal PATH that GUI-launched agents (like Cursor) inherit - but the binary still has to be found at install time.

Script options

Environment variable	Purpose	Default
SHIELD360_INSTALL_KEY	Organization install key used to enrol the machine (required)	none
SHIELD360_URL	Server to download from and enrol with	The server that served the script
SHIELD360_INSTALL_DIR	Target install directory	$HOME/.shield360/bin
SHIELD360_SKIP_CHECKSUM	Set to 1 to install a binary the server publishes no sha256 for. Not recommended	unset

The enrolling scripts check the binary against the sha256 the server publishes before running it, the same as the CLI-only scripts above.

Verify the install

shield360 version
# shield360 v1.2.3 (abc1234)

shield360 doctor
# Prints resolved config, dials your OTLP endpoint, lists installed plugins

Uninstall

The shield360 binary is never touched by shield360 coding uninstall (which only removes vendor plugin manifests). Remove the binary the way you installed it:

shield360 collector uninstall           # stop background reporting
rm ~/.shield360/bin/shield360           # remove the binary

On Windows, run shield360 collector uninstall, then delete %USERPROFILE%\.shield360\bin\shield360.exe.

Next steps

Configuration

Point the CLI at your Shield360 collector

Wire your coding agents

Claude Code, Cursor, Codex, and OpenCode in under a minute