Install the Fencer CLI

Overview

The Fencer CLI (fencer) is a supported binary for talking to the Fencer REST API from a terminal, CI, or an MCP client. It connects to https://app.fencer.dev and reports its version with fencer version. Releases are published on the CLI GitHub Releases page.

Prerequisites

A Fencer account with access to at least one organization.
macOS, Linux, or Windows on amd64 or arm64.
For the macOS and Linux install script: curl, tar, and either sha256sum or shasum.

Supported platforms

OS	Architectures	Package
macOS	amd64, arm64	tarball, install script, Homebrew cask
Linux	amd64, arm64	tarball, `.deb`, `.rpm`, install script
Windows	amd64, arm64	zip, PowerShell install script

Other OS/architecture combinations are unsupported. Fencer does not support unofficial or modified builds.

Install

macOS and Linux

curl -fsSL https://raw.githubusercontent.com/Fencer-Security/cli/main/scripts/install.sh | sh

Read the script before you run it — view it on GitHub. It downloads the release archive for your OS and architecture and checks it against the release’s SHA256SUMS before installing.

The script installs fencer into /usr/local/bin when it is writable, otherwise ~/.local/bin, and tells you if that directory is not on your PATH. Override the destination with FENCER_CLI_DIR, and pin a version with FENCER_CLI_VERSION (for example FENCER_CLI_VERSION=0.1.1). Windows Subsystem for Linux uses this script too; Git Bash, MSYS, and Cygwin do not, so use PowerShell there.

Windows (PowerShell)

irm https://raw.githubusercontent.com/Fencer-Security/cli/main/scripts/install.ps1 | iex

The PowerShell installer checks the archive against SHA256SUMS and installs fencer.exe into %LOCALAPPDATA%\Programs\fencer. It does not change your PATH; it tells you when that directory is missing from it. Set $env:FENCER_CLI_DIR to install somewhere else, or $env:FENCER_CLI_VERSION = "0.1.1" to pin a version, before you run it.

Homebrew

brew install --cask fencer-security/tap/fencer

The cask comes from the Fencer-Security/homebrew-tap tap and is updated with each release.

Debian / RPM

Download fencer_<version>_amd64.deb or fencer_<version>_arm64.deb (or the matching .rpm) from the CLI GitHub Releases page and install it with sudo dpkg -i or sudo rpm -i. The package installs fencer into /usr/bin.

Windows (manual)

Download fencer_<version>_windows_amd64.zip or fencer_<version>_windows_arm64.zip from CLI GitHub Releases.
Verify the zip against SHA256SUMS.
Extract fencer.exe to a directory on your PATH.

Verify the binary

fencer version
fencer --version

fencer version prints the version, commit, build date, OS/architecture, and API origin; fencer --version prints the version only. fencer version --output json includes version, commit, date, goos, goarch, and default_base_url (https://app.fencer.dev).

Verify checksums and signatures

Every release includes SHA256SUMS and a cosign keyless signature of that file (SHA256SUMS.sig, SHA256SUMS.pem). An SPDX SBOM (<archive>.spdx.json) ships next to each archive.

sha256sum -c SHA256SUMS --ignore-missing

cosign verify-blob SHA256SUMS \
  --certificate SHA256SUMS.pem \
  --signature SHA256SUMS.sig \
  --certificate-identity-regexp '^https://github\.com/Fencer-Security/cli/\.github/workflows/release\.yml@refs/tags/v.+$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'

Each archive also contains LICENSE (Fencer CLI software license), THIRD_PARTY_NOTICES, and a README.md.