Run your agent locally, across any protocol, with a signed receipt — in 60 seconds.

There is no public download. Sign in, request evaluation access, and once your workspace is authorized, acquire the signed CLI artifact for macOS, Linux, or Windows from your account. Verify the published digest and signature, install it, then:

aarmos login         # authorize this device for your workspace
aarmos --version

# optional: standalone verifier binary (macOS + Linux)
brew install aarmatix/tap/avar

1. 1Sign in. Your evaluation workspace and its bounded authorization are ready immediately.
2. 2Choose. Acquisition follows need — the software is fetched when you decide to install it.
3. 3Authenticate. Pair the CLI with your workspace from the device you will run on.
4. 4Acquire. Pull the signed artifact at a fixed version for your authorized workspace.
5. 5Verify. Check the artifact digest and signature before you run it.
6. 6Run. Start the runtime and record your first governed decision.

Already have an agent in LangChain / AutoGen / CrewAI / Swarm? Skip init and run aarmos proxy — set eval "$(aarmos env)" and your framework enrols with zero code changes. The proxy defaults to loopback port 7681; use --port or --listen to change it. See the compatibility matrix and the CLI reference for runtime flags.

aarmos init writes a starting policy source and generates a local Ed25519 signing key. It does not scaffold agent code — Aarmos runs the agent you already have.

aarmos init

# Wrote:
#   policy.aarmos.toml    (scopes, gates, rate limits)
#   avar.config.json      (receipt output path)
#   .aarmos/keys/         (Ed25519 signing key, gitignored)

This file is a policy source, not the whole picture. In a team or organisation several sources apply at once, and they resolve into a single effective policy with one digest — which is what decisions are judged against and what receipts cite. The merge only ever narrows, so a local file can tighten what your organisation allows but never widen it.

One agent, three tools, three protocols. Aarmos brokers all three under the same policy.

aarmos run my-agent

▸ tool: mcp://filesystem/read      (adapter: mcp)       ✓ scoped
▸ tool: openapi://api.example/get  (adapter: openapi)   ✓ scoped
▸ tool: deeplink://calendar/create (adapter: deeplink)  ✓ scoped
▸ tool: mcp://filesystem/read      (adapter: mcp)       ✓ cached — 0 tokens

✓ AVAR receipt: .aarmos/avar/receipt-2f9c…a1.avar.zip
  verify: aarmos verify .aarmos/avar/receipt-2f9c…a1.avar.zip

Every aarmos run emits a receipt. Not a flag. Not later. Every invocation.

To see what already happened — without leaving the terminal — aarmos activity reads the local receipt directory and prints a human-readable log. Read-only; it does not modify your evidence.

aarmos activity --since 24h

TIME (UTC)          STATUS    SOURCE          OP
2026-08-08 10:00:02 denied    aarmos-proxy    POST evil.example/exfil
2026-08-08 10:00:01 allowed   aarmos-proxy    GET api.openai.com/v1/chat

# only denials:      aarmos activity --status denied
# one line per run:  aarmos activity --runs
# tail live:         aarmos activity --follow

Prefer a visual view? aarmos observe starts a loopback-only, read-only observation service and prints a short-lived pairing code plus the address to open. See Observe a local runtime.

The receipt is portable. Stop Aarmos entirely; the bundle still verifies against the open AVAR spec using the same aarmos verify command — or the zero-dep @avar-standard/verify library, or the browser drop-zone at /trust/verify.

aarmos daemon stop
aarmos verify .aarmos/avar/receipt-2f9c…a1.avar.zip

✓ signature: valid (Ed25519, key fingerprint 8b3f…)
✓ chain:     4 entries, hash-linked, no gaps
✓ policy:    matches effective policy digest 9c41…e7
✓ verified without a running aarmos daemon.