Installation

Use this page to install the kt CLI on supported platforms, choose the right distribution path for your environment, and verify that the binary is ready for gateway or operator workflows. It is the right starting point for automation runtimes and implementation teams who need concrete installation commands rather than higher-level CLI guidance.

Hosted Regional Installer

Use the hosted regional installer when you want the install pinned to an exact regional release host and optionally register a local gateway service. The public installer scripts are served from the regional get.<region>.keeptrusts.com hosts and are the supported install entry points for customer use.

Region	Shell installer	PowerShell installer	Release base
EU	`https://get.eu.keeptrusts.com/install.sh`	`https://get.eu.keeptrusts.com/install.ps1`	`https://dl.eu.keeptrusts.com/releases/latest`
US	`https://get.us.keeptrusts.com/install.sh`	`https://get.us.keeptrusts.com/install.ps1`	`https://dl.us.keeptrusts.com/releases/latest`

macOS and Linux

curl -fsSL https://get.eu.keeptrusts.com/install.sh | sh

The shell installer downloads the regional macOS DMG. On Linux x86_64 it downloads the matching .deb or .rpm package from the regional download host; on other Linux architectures it installs the regional standalone binary. It creates a service unless you pass --no-service. That service install prompts for root or sudo on Linux instead of silently switching to a user-local binary path. Regional installers fail closed against their own dl.<region>.keeptrusts.com bucket and do not fall back across regions.

To configure the gateway service during install, pass the runtime token and optional agent name through environment variables:

curl -fsSL https://get.eu.keeptrusts.com/install.sh \
  | KEEPTRUSTS_API_TOKEN="kt_your_gateway_token" \
    KEEPTRUSTS_AGENT_NAME="Assistant" \
    sh

If you need an exact binding, use KEEPTRUSTS_AGENT_ID instead. Agent ID takes precedence when both variables are set.

On Linux service installs, the installer writes runtime env values such as KEEPTRUSTS_API_URL, KEEPTRUSTS_API_TOKEN, and the optional agent selector to /etc/keeptrusts/keeptrusts-kt.env, then points the keeptrusts-kt systemd unit at that file.

Install only the binary:

curl -fsSL https://get.eu.keeptrusts.com/install.sh | sh -s -- --no-service

Windows PowerShell

Run the PowerShell installer from an elevated PowerShell session:

$installer = Join-Path $env:TEMP "keeptrusts-install.ps1"
Invoke-WebRequest -Uri "https://get.eu.keeptrusts.com/install.ps1" -OutFile $installer
powershell.exe -ExecutionPolicy Bypass -File $installer `
  -Token "kt_your_gateway_token" `
  -AgentName "Assistant"

The Windows installer:

downloads kt.exe and kt.exe.sha256 from the regional release bucket,
verifies the SHA-256 checksum before installation,
installs the binary to Program Files\Keeptrusts,
adds the install directory to the system PATH,
registers and starts the KeeptrustsGateway Windows service unless you pass -NoService.

You can provide credentials through -Token and either -AgentName or -Agent, or through KEEPTRUSTS_API_TOKEN and either KEEPTRUSTS_AGENT_NAME or KEEPTRUSTS_AGENT_ID. Windows ARM64 systems install the x64 binary for Windows emulation until a native ARM64 artifact is published.

If you need to test a staged release, set KEEPTRUSTS_INSTALL_RELEASE_BASE to the exact regional staged release base before running the installer:

$env:KEEPTRUSTS_INSTALL_RELEASE_BASE = "https://dl.eu.keeptrusts.com/releases/staged-release-id"

Validate a Windows install:

kt --version
Get-Service KeeptrustsGateway

From Binary Release

Choose the exact regional release base before downloading artifacts. Direct downloads do not switch regions automatically.

RELEASE_BASE="https://dl.eu.keeptrusts.com/releases/latest" # or https://dl.us.keeptrusts.com/releases/latest

# macOS (universal: Apple Silicon + Intel)
curl -fsSL "${RELEASE_BASE}/kt-macos-universal.tar.gz" \
  | sudo tar xz -C /usr/local/bin kt

# Linux (x86_64)
curl -fsSL "${RELEASE_BASE}/kt-linux-x86_64.tar.gz" \
  | sudo tar xz -C /usr/local/bin kt

From Source

Requires Rust 1.91.1+ and Cargo:

git clone https://github.com/keeptrusts/keeptrusts.git
cd keeptrusts/cli
cargo build --release

# The workspace target directory is one level above cli/
sudo cp ../target/release/kt /usr/local/bin/

Docker

The CLI is available as a Docker image:

docker pull keeptrusts/kt:latest

# Run a command
docker run --rm \
  -v "$PWD/policy-config.yaml:/config/policy-config.yaml:ro" \
  keeptrusts/kt:latest policy lint --file /config/policy-config.yaml

# Run the gateway
: "${KEEPTRUSTS_API_TOKEN:?Set a gateway runtime token}"
: "${KEEPTRUSTS_OPENAI_API_KEY:?Set the provider credential}"

docker run --rm -p 127.0.0.1:41002:41002 \
  -e KEEPTRUSTS_API_URL="https://api.eu.keeptrusts.com" \
  -e KEEPTRUSTS_API_TOKEN \
  -e KEEPTRUSTS_OPENAI_API_KEY \
  -v "$PWD/policy-config.yaml:/config/policy-config.yaml:ro" \
  keeptrusts/kt:latest gateway run \
    --listen 0.0.0.0:41002 \
    --agent "Assistant" \
    --policy-config /config/policy-config.yaml

In the recommended workflow, /config/policy-config.yaml defines the provider target and reads KEEPTRUSTS_OPENAI_API_KEY through secret_key_ref.env. The runtime resolves the exact declared name; it does not implicitly fall back to OPENAI_API_KEY.

The runtime uses KEEPTRUSTS_API_TOKEN to connect to the Keeptrusts control plane. It is not the bearer token that applications send to public model routes. Use a separately issued application token, Access Key, or Gateway Key for model requests, according to the published endpoint's auth policy.

Docker Compose

Use Docker Compose when you want the gateway, its runtime env, and the policy file captured in one reusable project file.

services:
  kt-gateway:
    image: keeptrusts/kt:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:41002:41002"
    environment:
      KEEPTRUSTS_API_URL: https://api.eu.keeptrusts.com
      KEEPTRUSTS_API_TOKEN: ${KEEPTRUSTS_API_TOKEN:?Set a gateway runtime token}
      KEEPTRUSTS_AGENT_NAME: Assistant
      KEEPTRUSTS_OPENAI_API_KEY: ${KEEPTRUSTS_OPENAI_API_KEY:?Set the provider credential}
    volumes:
      - ./policy-config.yaml:/config/policy-config.yaml:ro
    command:
      - gateway
      - run
      - --listen
      - 0.0.0.0:41002
      - --agent
      - Assistant
      - --policy-config
      - /config/policy-config.yaml

Start the stack:

docker compose up -d
docker compose logs -f kt-gateway

Export both required values in the invoking shell, or load them from a deployment secret manager. If you use a local .env file for Compose interpolation, exclude it from version control and restrict its file permissions. The reusable Compose file should contain variable references, not credential values.

The process listens on 0.0.0.0 inside the container so Docker can forward the port, while the examples publish it only on host loopback. Change the host bind only when your ingress and firewall design intentionally exposes the gateway.

This is the right fit when you want a durable local gateway process without installing the host binary first, or when you are sharing a consistent setup across a team or CI workspace.

Verify Installation

kt --version

Next steps

CLI Overview — Command surface and workflows
kt init — Scaffold your first policy project
kt doctor — Verify installation and connectivity
Quickstart — First governed request end-to-end

Hosted Regional Installer​

macOS and Linux​

Windows PowerShell​

From Binary Release​

From Source​

Docker​

Docker Compose​

Verify Installation​

Next steps​