Skip to main content

Install a Pavri Endpoint Agent

Use the endpoint agent to collect endpoint posture and coding-assistant security signals. You need the Admin or operator role that can mint an enrollment token.

Before you begin​

  • Use the Endpoints page to confirm the release and platform you need.
  • Make sure the target host can reach the gateway URL shown in the dashboard.
  • Keep the enrollment token private. It is single-use. Choose the shortest token lifetime that fits the installation window; the dashboard offers values from 1 hour through 7 days.

Install and enroll​

  1. In Pavri, go to Endpoints → Install Agent.

  2. Choose the Linux, macOS, or Windows artifact for the target architecture.

  3. Verify the artifact SHA-256 digest against the checksum shown on the page or the signed checksum list.

  4. Select Mint enrollment token to open Add Endpoint, choose the target platform, and generate a token.

  5. Copy the platform-specific installation script generated by Add Endpoint into a secure session on the target host. The script downloads, installs, and enrolls the correct artifact:

    • Linux extracts the selected archive, runs install.sh, writes the endpoint configuration, and starts pavri-endpointd.
    • macOS downloads the universal .pkg; complete the macOS installer, then run the displayed enrollment command.
    • Windows runs an administrator PowerShell script that expands the archive, configures the service, and installs it.

  6. If you use the manual path, run the enrollment command shown in the dashboard. It has this shape:

    sudo endpointctl enroll \
      --token "<single-use-enrollment-token>" \
      --gateway "<gateway-url-from-pavri>"

  7. Return to Endpoints. The host normally appears within about 30 seconds. Open the endpoint record to check posture, lifecycle, management state, and last-seen time.

Verify the result​

  • Confirm that the endpoint reports a recent Last seen value and the expected sensor version. Open its record to inspect posture, lifecycle, and installed coding assistants.
  • Coding-assistant sessions appear in Sessions after the endpoint records supported activity.
  • If the host does not appear, verify the token has not expired or been used, the gateway URL is reachable, and the device clock is correct. Create a new token rather than reusing an expired or consumed token.

Rollback and removal​

Use the endpoint record's Retire endpoint action to stop the sensor from accepting new coding sessions, then uninstall the platform package through your managed software process. Unused enrollment tokens expire automatically; mint a new token if the installation window closes.