Installing the agent

One static binary, no dependencies, on macOS, Linux and Windows. It makes outbound connections only and never listens on a port, so no inbound firewall rule is needed and there is nothing on the endpoint for anyone to attack.

1. Install

curl -fsSL https://guardyn.dev/install.sh | sh

The installer detects the platform, verifies the published SHA-256 checksum, and installs to /usr/local/bin/guardyn-agent. It does not enrol — enrolment needs a token you paste yourself, so a leaked install command cannot add machines to anyone’s fleet.

On Windows, download guardyn-agent-windows-amd64.exe from the same path.

2. Enrol

Issue a token from Fleet in the console, then:

guardyn-agent enroll --server https://guardyn.dev --token gdn_enrol_… --label "build-01"

The shared enrolment token is exchanged for a token unique to this machine, and only that per-machine token is used afterwards. So the shared secret is used once per endpoint and can be revoked without touching machines already enrolled. Re-enrolling the same machine rotates its token rather than creating a duplicate entry.

3. Connect

guardyn-agent connect

This holds one outbound stream open. While it is open the machine is inspectable in real time; when it closes, the console says offline instead of guessing. It reconnects with backoff on its own, so a closed laptop lid or a reboot needs no intervention.

As a service

For a machine you want permanently inspectable, install it as a service. The repository ships deploy/guardyn-agent.service:

sudo cp deploy/guardyn-agent.service /etc/systemd/system/
sudo systemctl enable --now guardyn-agent
journalctl -u guardyn-agent -f

On macOS, a launchd plist in /Library/LaunchDaemons running guardyn-agent connect --quiet does the same job.

Privileges

Run it as root or Administrator for full coverage. Without elevation the privileged collectors — the operating system event log, package and kernel-module integrity — are skipped, and their areas are unexamined rather than clear. The console says so on the machine page and the analyst says so in its answers, but the gap is real.

Other commands

Command	What it does
`guardyn-agent tools`	Every tool this binary offers, with its arguments.
`guardyn-agent collectors`	Every collector compiled in.
`guardyn-agent scan`	One full collection, uploaded as a snapshot. Works without a live connection.
`guardyn-agent audit`	The local log of everything this agent has done.
`guardyn-agent version`	Version, OS and architecture.

Where it keeps state

Linux/macOS as root: /var/lib/guardyn-agent/
Otherwise: ~/.guardyn-agent/
Windows: %ProgramData%\\GuardynAgent\\

Two files: state.json (mode 0600 — it holds the machine token) and audit.log, one JSON line per action. That audit log is the machine owner’s copy: a tool that reads a machine and reports upstream has to be auditable from the machine’s own side, or it is indistinguishable from spyware.

Removing it

sudo systemctl disable --now guardyn-agent   # if installed as a service
sudo rm /usr/local/bin/guardyn-agent
sudo rm -rf /var/lib/guardyn-agent          # or ~/.guardyn-agent

Also revoke the machine from its page in the console, which invalidates its token and drops any live connection immediately. The machine’s history is kept as evidence; the seat is freed.