> ## Documentation Index
> Fetch the complete documentation index at: https://docs.guardway.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Connect Endpoint
> The three steps that put a machine into Fleet — install the package, issue an endpoint key, enroll — and which package to use for each operating system.
## What this is for
**Connect endpoint** is the button at the top right of **Endpoint AI Risk › Fleet** (it also opens
from the empty fleet, from Inventory and from the Skills Marketplace). It walks through the three
things a machine needs before it reports: the agent installed, an endpoint key, and one enroll
command. Fleet administrators use it; the same steps work for one laptop by hand or for a thousand
through an MDM.
## The three steps
The dialog offers a download for every platform, with the machine you are browsing from preselected. Pick the package, not the archive, for anything that is not an evaluation:
| Operating system | Package | How it is deployed |
| - | - | - |
| macOS 13 or later, Apple Silicon and Intel | `guardway-gw-cli-macos-universal.pkg` | Jamf, Kandji, Intune, Mosyle, Workspace ONE, Addigy, or `installer -pkg` |
| Windows 10 and 11, x86\_64 | `guardway-gw-cli-windows-x86_64.msi` | Intune, SCCM, Group Policy, or `msiexec /i` |
| Ubuntu 22.04+, Debian 12+ | `guardway-agent_-1_amd64.deb`, `_arm64.deb` | `apt install`, or Ansible, Puppet, Chef, Salt |
| RHEL, Rocky and Alma 9, Fedora | `guardway-agent--1.x86_64.rpm`, `.aarch64.rpm` | `dnf install`, or your config manager |
Installing the package is the whole install. It starts the agent for every signed-in user right away and at every sign-in after that, in the **Observe** posture. See [macOS](/endpoint-ai-risk/connect/macos), [Windows](/endpoint-ai-risk/connect/windows) and [Linux](/endpoint-ai-risk/connect/linux).
Type a **Machine label** (for example `dana-mbp`) and click **Generate key**. The key begins with `sk-ep-`, enrolls one machine, and is shown once: copy it before you close the dialog. Issue one key per machine so you can tell them apart in Fleet.
The dialog fills your key into the command. Run it on the machine as the signed-in user:
```sh theme={null}
gw-cli enroll --key sk-ep-… --url https://api.us.guardway.ai --verify
```
`--verify` sends a first report straight away. The machine appears in Fleet within a minute. Details, including what to run on a managed install and how to script it, are on [Activate](/endpoint-ai-risk/connect/activate).
## Which install do I want?
| | Package (MDM or by hand) | Archive (`.tar.gz`, `.zip`) |
| - | - | - |
| Who it is for | Every customer machine | Evaluation on your own laptop |
| Where it installs | Machine-wide, for every user | The current user's home folder |
| Starts by itself | Yes, at every sign-in | Yes, for that user only |
| Can enforce policy | Yes: Live guard Block, AI Control, skill custody, Enforce posture | Records only |
| Updates | Through the console's update policy, or the next package | `gw-cli upgrade` |
The archives carry the same binary and a per-user `install.sh` or `install.ps1`. They are fine for
trying the agent, and the [Agent overview](/endpoint-ai-risk/agent/overview#evaluation-install) covers
them. Use the packages for anything you will manage.
## Downloads and checksums
Every release is published at `https://api.guardway.ai/v1/downloads/gw-cli//`, and the
newest at `.../gw-cli/latest/`. A `SHA256SUMS` file sits next to the packages in each folder;
the Linux packages also ship a `.sha256` each. Verify before you push a package to a fleet:
```sh macOS / Linux theme={null}
curl -LO https://api.guardway.ai/v1/downloads/gw-cli/latest/SHA256SUMS
curl -LO https://api.guardway.ai/v1/downloads/gw-cli/latest/guardway-gw-cli-macos-universal.pkg
shasum -a 256 -c --ignore-missing SHA256SUMS
```
```powershell Windows theme={null}
Invoke-WebRequest https://api.guardway.ai/v1/downloads/gw-cli/latest/SHA256SUMS -OutFile SHA256SUMS
Invoke-WebRequest https://api.guardway.ai/v1/downloads/gw-cli/latest/guardway-gw-cli-windows-x86_64.msi -OutFile guardway-gw-cli-windows-x86_64.msi
(Get-FileHash .\guardway-gw-cli-windows-x86_64.msi).Hash.ToLower() # compare with the SHA256SUMS line
```
The download buttons in the console appear once downloads are switched on for your organization.
Until then the dialog shows the archive command, and the URLs above still work.
## Before a fleet rollout
* Allow the hosts on [Network Requirements](/getting-started/network-requirements#endpoint-agent) on each machine. The agent ignores proxy settings and trusts only public certificate authorities.
* On macOS, push a Full Disk Access profile with the package; without it the agent cannot read `~/Desktop`, `~/Documents` and `~/Downloads`. See [macOS](/endpoint-ai-risk/connect/macos#full-disk-access).
* Decide the install mode. Every package installs **Observe** by default, which never changes how a developer's tools behave. The **managed** install adds the root-level service that Enforce, Live guard Block and skill custody need. [Activate](/endpoint-ai-risk/connect/activate#install-modes) explains how to choose it per OS.
* Create an [Endpoint AI Policy](/endpoint-ai-risk/policy) for the machines before they arrive, or they take the policy bound to **All endpoints**.
## Related
Enroll, verify the first report, and choose the install mode.
How machines move to a new agent release.
Where an enrolled machine shows up.
Removing the agent in the safe order.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.