Install PoisonZero, step by step.
The PoisonZero daemon runs on the machine you want to protect. It watches your AI agents' Memory Files, has every change scored by the cloud backend, and automatically reverts anything dangerous (fail-closed). It runs as a privileged service (systemd / launchd / Windows service) — a malicious agent running under the normal user account can neither stop it nor tamper with the binary or config. Using Claude Code? See Melira’s status line and /poisonzero command →
Step 0 — Create an app in the panel (once per machine)
Everything you need to enroll a machine comes from the control panel:
- console.poisonzero.com — sign in to the control panel.
- Create a new app — you receive an
appId. - On the app's detail page, generate an enrollment code — you receive a
code(time-limited, single use).
Step 1 — Install
All install methods live on one page — the one-line installer for Linux, macOS and Windows, Homebrew and Scoop, plus the signed .deb / .rpm packages and direct binaries with their SHA-256 checksums. Pick your operating system there; every option verifies the checksum before installing.
Get PoisonZero on the download page
Step 2 — Confirm it's running
Check the service status on the host:
Cross-platform: poisonzero status (audit summary) and poisonzero log. The app also shows up as “online” in the panel.
How enrollment works (the enroll file)
Enrollment is driven by a small JSON file, not by command-line flags. The quick installer writes it for you; for native packages or fully private setups, create it yourself, then run the enroll command:
Then enroll and start the service:
appId and the code from Step 0 in the panel — nothing else.Everyday commands
Once installed, the CLI gives you the daemon's status and audit tools:
| Command | What it does |
|---|---|
poisonzero enroll | Reads the enroll file and registers the daemon with your app. |
poisonzero status | Shows the audit summary and whether the daemon is connected. |
poisonzero log | Streams the daemon's decision log (allow / revert). |
poisonzero egress | Shows the egress ledger — what the daemon sent for scoring. |
poisonzero redact | Manages redaction rules for sensitive content before scoring. |
Unattended / enterprise (no prompts)
Set the two variables up front and the install runs scriptably (app ID and code per machine). Works the same in Ansible, MDM, Intune or SCCM:
Windows (Intune/SCCM) — run as SYSTEM:
Updating
Uninstalling
Stop and remove the service, then delete the binary and config (commands shown per platform):
Troubleshooting
| Symptom | Cause / fix |
|---|---|
| Checksum mismatch | Aborted by design — repeat the download and check any proxy/cache. |
Enrollment failed / enroll http 403 | The enroll code is single-use and time-limited → generate a fresh code in the panel and re-run the installer. |
| macOS “Load failed: Input/output error” on (re-)install | Fixed from this version on. If it still appears, reload the daemon by hand (note the space between system and the path): sudo launchctl bootout system/com.poisonzero.daemon 2>/dev/null; sudo launchctl bootstrap system /Library/LaunchDaemons/com.poisonzero.daemon.plist |
| Is the daemon running? (status & logs) | macOS: sudo launchctl print system/com.poisonzero.daemon | head and sudo tail -f "/Library/Application Support/PoisonZero/daemon.log". Linux: systemctl status poisonzero and journalctl -u poisonzero. |
| Device shows “revoked” / “removed” in the panel | Re-enrolling with a fresh code reactivates it — status returns to enrolled. Just re-run the installer with the new code. |
| Force an update / poll now (macOS) | Don't wait for the next poll cycle: sudo launchctl kickstart -k system/com.poisonzero.daemon. |
subscription_required (402) | Trial expired / no payment → add a payment method under Billing in the panel. |
| macOS “killed: 9” | Only for manually copied, unsigned arm64 binaries — remove quarantine with xattr -dr com.apple.quarantine. Release binaries are ad-hoc signed. |
| Windows SmartScreen | Only on browser-downloaded .exe; via install.ps1 or Scoop this doesn't appear. |