One command, and you have the whole thing.
Every capability works with no licence, on up to 25 hosts per scan. That is the scanners, the scoring, the reports, the Challenge Coins and the web dashboard. A licence raises the scope and adds what only matters once this is a programme. See what a licence adds.
The installer verifies a SHA-384 checksum before it puts anything on your PATH, and refuses to install if it cannot check. It installs the Enclave edition by default, which is the one described above.
You can skip all of that. Download one file, run it, and the Command Deck opens in your browser.
macOS. Drag it to Applications and open it. Signed with a Developer ID certificate and notarized by Apple, so a first run brings no security warning and no right-click dance. Universal, so one file covers Intel and Apple Silicon.
Windows. Run the installer and use the PQCAT Terminal shortcut it adds to the Start Menu. There is also an MSI for Group Policy, Intune and SCCM deployment. Both are unsigned for now, so SmartScreen will show a warning on the way in: choose More info, then Run anyway. Verify what you downloaded against SHA384SUMS if you would rather not take that on trust.
Three builds come off the same engine. Most people want the first one, and the installer picks it for you.
| Build | What it is | Take this if |
|---|---|---|
Defaultpqcat-enclave-* |
Enclave. Scanning, scoring across eleven frameworks, PDF, HTML and CBOM reports, Challenge Coins, selective disclosure, the Harvest Clock, firmware verdicts. No network server is compiled into it at all. | You want the product. Start here. |
pqcat-pro-* |
Pro. Everything in Enclave, plus the Command Deck web dashboard and the REST API. The dashboard needs no licence. | You want the dashboard, or you are running it as a service. |
pqcat-* |
Scanner. The Apache-2.0 open-source build, compiled from the source in the public repository. Discovery and classification only: no scoring, no reports, no evidence layer. | You need a binary you can rebuild yourself from public source. |
To install one of the others, set the edition before you run the installer:
curl -sSL https://install.pqcat.io | PQCAT_EDITION=pro sh
The variable goes before sh, not before curl. Put it first and it sets the environment of the download, not of the installer.
Verify the download
One SHA384SUMS covers every archive in a release. The ML-DSA-65 signature over it is published separately as SHA384SUMS.pqsig, because the release key is deliberately kept off CI.
Prove the Enclave air gap
Returns nothing. There is no HTTP server in that binary: not disabled, absent. Run the same command against pqcat-pro and you will see the symbols, which is how you know the test means something. A release refuses to publish if either half of that stops being true.
Nothing here phones home. The installer fetches from GitHub, and the binary talks only to the hosts you point it at. There is no account, no telemetry and no licence server. If you need to work fully offline, take the archive on a machine that has a network and carry it across.