Downloads · CodeTruss Boundary · v0.2.43
Take the CLI. No account.
CodeTruss Boundary is the local first-pass gate for AI-written code, and it is free forever. There is no sign-in on this page, no trial clock, and no seat count. Every artifact below is served from this domain with a published SHA-256 you can check before you run anything.
curl -fsSL https://codetruss.com/install.sh | shirm https://codetruss.com/install.ps1 | iexRequires Node.js 20.9.0 or newer, npm, and Git. The installer fetches the release metadata, downloads the versioned package, compares its SHA-256 with the published digest, and refuses to install on a mismatch. Then run codetruss setup once inside a Git repository. Homebrew, npm, and npx installs, plus the full quickstart, are on the CLI page.
Artifacts
Digests come from the release metadata this deploy ships. Tarballs also carry a .sha256 sidecar in the format shasum -c reads.
| Artifact | Version | SHA-256 |
|---|---|---|
| codetruss-cli-0.2.43.tgz The package the installers resolve and npm installs. | 0.2.43 | e759a7ffce29ae0a0ba61aeb9bd8819cd75adb114abd1410a7e309d6f8a923c3.sha256 sidecar |
| codetruss-cli-latest.tgz Moving alias. Today it serves the same bytes as 0.2.43. | latest → 0.2.43 | e759a7ffce29ae0a0ba61aeb9bd8819cd75adb114abd1410a7e309d6f8a923c3.sha256 sidecar |
| codetruss-cli-0.2.43.sbom.cdx.json CycloneDX software bill of materials for that package. | 0.2.43 | 18fc146333cb4afb963eca9542f09e597e0667ffd3e5210950606087aa69eefc |
| codetruss-cli-latest.json Release metadata install.sh reads to resolve the version and its digest. | latest → 0.2.43 | — |
Verify before you run it
curl -fsSLO https://codetruss.com/downloads/codetruss-cli-0.2.43.tgz
curl -fsSLO https://codetruss.com/downloads/codetruss-cli-0.2.43.tgz.sha256
shasum -a 256 -c codetruss-cli-0.2.43.tgz.sha256This proves the bytes you received match the digest CodeTruss publishes. It is tamper-evidence against a corrupted or swapped download; by itself it is not independent package provenance.
gh attestation verify codetruss-cli-0.2.43.tgz --repo CodeTruss/codetruss-cliThe GitHub CLI checks the artifact against the signed provenance recorded by the v0.2.43 release in the CLI repository. That ties these bytes to the workflow that built them.
The CLI is free forever.
Installing Boundary, running every local command, and producing signed receipts cost nothing, and they always will. The paid line sits at the network boundary: local stays free, hosted receipt sync is billed.