Installation

TMAegis is a single static binary written in Go. There is nothing to install on the machines you scan.

Download a release

Each GitHub release has one archive per platform, named tmaegis_<version>_<os>_<arch>: .zip for Windows and .tar.gz for Linux and macOS. It also has checksums.txt with the SHA-256 of every archive. The Downloads page shows these files with their hashes. The archive contains the tmaegis binary, the rules, the plugins and the license files. Verify the download before you run it.

sha256sum -c checksums.txt --ignore-missing
mkdir tmaegis && tar -xzf tmaegis_<version>_linux_amd64.tar.gz -C tmaegis && cd tmaegis
./tmaegis --help

Build from source

You need Git, Go 1.27 or newer and make.

git clone https://github.com/tmaegis/tmaegis.git
cd tmaegis
make build
./bin/tmaegis --help

make build-all cross-compiles for Linux, Windows and macOS.

Check that it works

tmaegis discover        # operating system and installed software
tmaegis rules export -o rules.json   # the full rule catalog as JSON

Self-hosted dashboard (optional)

Collect results from many hosts with the bundled server. Scans push their JSON report to it.

export TMAEGIS_SERVER_TOKEN=$(openssl rand -hex 24)
docker compose up -d
tmaegis scan --auto-detect --push-url http://localhost:8080

Configuration

Settings live in config.yaml (see config.example.yaml) and are loaded automatically. Explicit flags override the file. Useful keys are the enabled plugins, the AI provider and the display language.

Run scans as root when you can. Many checks read files or settings that only root can see, and a non-root scan reports those as failed.