Platform support
This page lists the operating systems and CPU architectures supported by the sc binary and daemon. Passkey and browser support is covered separately in Passkey support.
Legend: ✅ available · 🚧 in progress · ❌ not supported
| Platform | Architecture | Status | Binary |
|---|---|---|---|
| macOS | Apple Silicon (arm64) | ✅ | safeclaw-macos-aarch64 |
| macOS | Intel (x86_64) | ✅ | safeclaw-macos-x86_64 |
| Linux | x86_64 | ✅ | safeclaw-linux-x86_64 (static, musl) |
| Linux | aarch64 | ✅ | safeclaw-linux-aarch64 (static, musl) |
| Windows | x86_64 | 🚧 | see Windows |
| Windows | 32-bit / Arm | ❌ | not planned |
| Any other OS / arch | N/A | ❌ | the installer exits with "Unsupported platform" |
Install
curl -fsSL https://safeclaw.pro/install.sh | sh
Puts the sc binary in ~/.local/bin (override with $SAFECLAW_BIN_DIR),
verifies the download's SHA256, installs the agent skill, and prints
sc setup --name <name> as the next step. No sudo, no system changes, no
telemetry. Linux binaries are statically linked (musl), so there is no glibc or
runtime-dependency requirement.
Verifying the download
Every release publishes a SHA256SUMS file, which the installer checks. Each
release also carries a sigstore build-provenance attestation. To verify a
binary yourself:
gh attestation verify ~/.local/bin/sc --repo getsafeclaw/safeclaw
macOS
The binary is not yet Apple-notarized. The curl | sh install above runs
without a Gatekeeper prompt; a binary downloaded through a browser would be
quarantined and blocked as "unidentified developer" instead. Verify provenance
with the attestation command above if you obtained it another way.
sc up installs a launchd LaunchAgent (pro.safeclaw.daemon) that starts the
daemon at login and restarts it on crash; sc down removes it. Logs at
~/.safeclaw/daemon.log.
Linux
A single static binary, no runtime dependencies. sc up installs a per-user
systemd unit (~/.config/systemd/user/safeclaw.service, systemctl --user)
that starts the daemon and restarts it on failure; sc log reads its journal.
Running it as a system-wide service is possible by hand-writing your own unit.
Windows
Native Windows support is not available in the standard install channel. The
installer does not provide a Windows build, and an unsigned .exe would
trigger SmartScreen.
On Windows the binary is named safeclaw.exe, not sc.exe, because sc is
Windows' own Service Control Manager and would shadow ours.
Runtime
The daemon (sc serve, started by sc up) listens on 127.0.0.1:23293
(control) and 127.0.0.1:23294 (the proxy sc run routes agent traffic
through). Both are localhost-only and overridable via $SAFECLAW_PORT. Unlock
uses your platform passkey, see Passkey support.
Related: Quickstart · Security model