Installation

Install the CLI with npm, verify it, and update the package.

Install with npm

You need Node.js 20.5.0 or newer and npm 9.7.1 or newer. Open a terminal on the computer or server where your agent runs:

npm install --global @palladin/cli

Installation makes the palladin command available. The package starts a native runtime matched to the CLI version and operating system.

Verify installation

palladin --version
palladin doctor

--version shows the CLI version. doctor checks the runtime and access to the system key store. It does not register an agent or grant vault access.

If your terminal cannot find palladin, open a new session and check that npm’s global executable directory is in PATH. See troubleshooting.

Operating system and key storage

CLI 0.0.9 provides a native runtime for macOS Apple Silicon and Linux. Windows and macOS Intel are not available in this release. It requires access to the system key store. Do not run it with sudo merely to bypass a permissions error: the agent should run as its intended system user.

Hardened and Convenience

Hardened — Palladin’s recommended protection mode. It uses operating-system controls to restrict other processes’ access to agent keys and credentials. It does not protect against a fully compromised system or a program you authorize to receive a secret.

Convenience — a mode with limited isolation. It uses system key storage and requires trust in other processes running under the same system account. A malicious process may gain access to credentials or their use. On Linux, Secret Service cannot distinguish processes with the same user ID.

Hardened and Convenience name Palladin protection levels, not a certification or industry standard. Apple Hardened Runtime is a separate macOS mechanism; it does not describe all of Palladin’s key protection.

Platform	Installation and protection
macOS Apple Silicon	The official npm package includes the signed Hardened runtime. Access to the organization credential requires user presence.
Linux	CLI 0.0.9 installed through npm uses Convenience and Secret Service. The Hardened broker is not included in that release.
Windows / macOS Intel	No public runtime package in release 0.0.9.

Check palladin doctor before connecting an agent. If your environment requires Hardened, do not substitute Convenience. A successful npm install does not establish the protection level.

Update

npm install --global @palladin/cli@latest
palladin --version
palladin doctor

Keep your existing profiles. If you use MCP, restart its server after updating.

Next step

Connect an agent to your panel. We recommend CLI integration. MCP is an option for applications that require that interface.