# Install Fortem safely

Fortem is a local Kubernetes environment inspector. The installer downloads one
release archive, verifies its SHA-256 checksum, and installs only the `fortem`
binary. It does not read kubeconfig, contact a cluster, start Fortem, or enable
management mode.

## macOS and Linux

Review <https://fortem.dev/install.sh>, then run:

```sh
curl -fsSL https://fortem.dev/install.sh | sh
```

The default destination is `~/.local/bin/fortem`. Override it with
`FORTEM_INSTALL_DIR`. The script detects macOS/Linux and x86_64/arm64, resolves
the latest GitHub release, downloads the matching archive and `checksums.txt`,
and refuses to install when the checksum does not match. If `~/.local/bin` is
not on `PATH`, the installer prints both an absolute command that works
immediately and the exact `export PATH=...` line for future shells.

Homebrew is also supported:

```sh
brew install cybrixcc/tap/fortem
```

## Windows PowerShell

Review <https://fortem.dev/install.ps1>, then run:

```powershell
irm https://fortem.dev/install.ps1 | iex
```

The default destination is `%LOCALAPPDATA%\Fortem\bin`. The script downloads the
matching x86_64 or arm64 ZIP, verifies its SHA-256 checksum, installs
`fortem.exe`, and adds that directory to the current user's PATH when needed.

## Verify without touching a cluster

```sh
fortem --version
fortem --demo
```

Demo mode uses synthetic data and does not read kubeconfig. Before using a live
context, inspect permissions with `fortem --doctor --context CONTEXT`. Fortem is
read-only by default; do not add `--manage` unless you intentionally want the
documented, confirmation-gated mutations.

Fortem can invoke the external authentication command named by kubeconfig. It
does not replace AWS CLI, gcloud, Azure CLI, kubelogin, OIDC login, VPN access,
or private-cluster connectivity. Never send kubeconfig or credentials to a web
page or coding agent.