# Installation

> Palladin documentation · 1.0 · EN · 2026-10-25


## Install with npm

You need Node.js 20.5.0 or newer and npm 9.7.1 or newer. Open a terminal on the computer or server where your agent runs:

```sh
npm install --global @palladin/cli
```

Installation makes the `palladin` command available. The package starts a native runtime matched to the CLI version and operating system.

## Verify installation

```sh
palladin --version
palladin doctor
```

`--version` shows the CLI version. `doctor` checks the runtime and access to the system key store. It does not register an agent or grant vault access.

If your terminal cannot find `palladin`, open a new session and check that npm's global executable directory is in `PATH`. See [troubleshooting](/docs/developers/troubleshooting).

## Operating system and key storage

CLI 0.0.9 provides a native runtime for macOS Apple Silicon and Linux. Windows and macOS Intel are not available in this release. It requires access to the system key store. Do not run it with `sudo` merely to bypass a permissions error: the agent should run as its intended system user.

### Hardened and Convenience

**Hardened — Palladin’s recommended protection mode.** It uses operating-system controls to restrict other processes’ access to agent keys and credentials. It does not protect against a fully compromised system or a program you authorize to receive a secret.

**Convenience — a mode with limited isolation.** It uses system key storage and requires trust in other processes running under the same system account. A malicious process may gain access to credentials or their use. On Linux, Secret Service cannot distinguish processes with the same user ID.

Hardened and Convenience name Palladin protection levels, not a certification or industry standard. Apple Hardened Runtime is a separate macOS mechanism; it does not describe all of Palladin’s key protection.

| Platform | Installation and protection |
| --- | --- |
| macOS Apple Silicon | The official npm package includes the signed Hardened runtime. Access to the organization credential requires user presence. |
| Linux | CLI 0.0.9 installed through npm uses Convenience and Secret Service. The Hardened broker is not included in that release. |
| Windows / macOS Intel | No public runtime package in release 0.0.9. |

Check `palladin doctor` before connecting an agent. If your environment requires Hardened, do not substitute Convenience. A successful `npm install` does not establish the protection level.

## Update

```sh
npm install --global @palladin/cli@latest
palladin --version
palladin doctor
```

Keep your existing profiles. If you use MCP, restart its server after updating.

## Next step

[Connect an agent to your panel](/docs/developers/connect). We recommend CLI integration. MCP is an option for applications that require that interface.