Install

Vulkro is distributed as a single self-contained binary. There are no runtime dependencies, no Electron, no native deps to compile.

Account required

Running scans requires a Vulkro account. Install the binary, then run vulkro login to connect the CLI to your account; your 14-day trial starts on your first login. Air-gapped teams use a license file instead (see Air-gapped install below). Scans always run locally: your code is never uploaded.

One-line install (macOS, Linux, Windows)

curl -fsSL https://dist.vulkro.com/install.sh | bash

The installer:

1. Detects your OS and architecture.
2. Fetches the matching binary from the Vulkro release feed.
3. Verifies the SHA-256 checksum against the published .sha256 file.
4. Installs to /usr/local/bin/vulkro, falling back to ~/.local/bin if /usr/local/bin isn't writable.
5. Runs vulkro update once to fetch the latest signed CVE bundle from the Vulkro CDN, so dependency scanning works on the first scan.

Three network calls total: the release feed for the binary, the CVE CDN for the bundle, and one anonymous best-effort install-completion ping carrying only product, os, and version (no code, no paths, no IP stored). All three are documented and reproducible; the ping is skippable with VULKRO_NO_ANALYTICS=1 or VULKRO_OFFLINE=1.

Connect your account

After installing, connect the CLI to your Vulkro account:

vulkro login

Your first login on a device starts a 14-day trial automatically. From then on the CLI holds a signed lease and refreshes it in the background about once a day; the lease stays valid for 14 days, so short offline stretches (travel, flaky networks) never interrupt scanning. The refresh carries only minimal usage keys, never your code and never findings.

When the trial lapses, request a license from the Vulkro team at [email protected]; Vulkro is licensed per seat, directly through our team. vulkro buy opens a pre-filled license-request email with this machine's fingerprint and your days-of-use stats; the team replies with a .lic file you install with vulkro activate <file.lic>.

For the full account model (login flows, the offline lease and its grace window, vulkro account / vulkro logout / vulkro license-status, and the air-gap path) see Accounts and licensing.

Configurable installer

Variable / flag	Effect
VULKRO_VERSION=v0.3.0	Pin a specific release tag.
VULKRO_BIN_DIR=/opt/bin	Override the install destination.
VULKRO_OFFLINE=1	Refuse all outbound network calls, including the first-run bundle fetch and the install-completion ping (you can apply a bundle later via vulkro update --bundle <path>).
VULKRO_NO_ANALYTICS=1	Skip the anonymous install-completion ping.
VULKRO_ANALYTICS_URL=<url>	Override the install-ping endpoint (default: https://api.vulkro.com/v1/downloads).

Windows

The Windows binary works under PowerShell and inside WSL. Run the PowerShell installer:

iwr -useb https://dist.vulkro.com/install.ps1 | iex

Air-gapped install

If the machine running vulkro cannot reach the public internet, request an offline bundle (binary tarball + signed CVE bundle) and a license file from the Vulkro team. Then on the target:

# extract the binary archive, then apply the signed CVE bundle
vulkro update --bundle ./vulkro-cve-<date>.vkbundle

# install the license file (replaces `vulkro login` on air-gapped machines)
vulkro activate ./your-team.lic

No outbound calls during normal scan operation when VULKRO_OFFLINE=1. The license file satisfies the account requirement without any network access.

Staying up to date

Checking for a new version is something you do, not something the scanner does behind your back. A plain vulkro scan makes no release-feed request and prints no update notice.

To check and upgrade:

vulkro update             # version check + prompt, then refresh CVE data

vulkro update asks the release feed for the latest tag (ignoring the 24-hour cache), prompts to run the installer if a newer release exists, and then pulls the latest signed CVE snapshot:

  ! Update available: 0.3.0 -> 0.3.1
  Run `curl -sSfL https://dist.vulkro.com/install.sh | bash` now? [y/N]

The prompt is skipped when stdin is not a TTY, so CI pipelines and cron jobs are never blocked. Suppress it explicitly with --no-version-check or VULKRO_NO_UPDATE_CHECK=1 (any non-empty value); VULKRO_OFFLINE=1 disables the whole command's network access.

dist/upgrade.sh is the vendored script form of the binary install, for restricted environments where curl ... | bash is policy-blocked. See CLI -> update for details.

Vulkro for Salesforce (vulkro-sf)

Vulkro for Salesforce is a separate binary on the same engine, distributed via a separate installer, and documented under /docs/salesforce/. Install it instead of (or alongside) the general vulkro binary if you audit Salesforce code or live orgs.

curl -fsSL https://dist.vulkro.com/install-sf.sh | bash

The full install walk-through, the org-connector privacy statement, the command reference, and the live-org workflow live on the Vulkro for Salesforce install page:

Install Vulkro for Salesforce ->

What's next

• Run your first scan ->
• Configure your first CI integration ->