> ## Documentation Index
> Fetch the complete documentation index at: https://warden.buildlab.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Homebrew

> Install the gateway and the MCP server on macOS or Linux.

```bash theme={null}
brew tap abhishek-mallick/tap
brew install warden
```

Or in one line:

```bash theme={null}
brew install abhishek-mallick/tap/warden
```

This installs two executables:

| Command | What it is |
| - | - |
| `warden` | [The gateway and its CLI](https://warden.buildlab.in/offerings/gateway.md) |
| `warden-mcp` | [The MCP server](https://warden.buildlab.in/offerings/mcp-server.md) for agent hosts |

Confirm it:

```bash theme={null}
warden version
warden --help
```

> [!NOTE]
>
> **Available from the first tagged release.** Pushing a `vX.Y.Z` tag builds macOS and Linux binaries on native runners, publishes them with checksums, and updates the formula. Until that first tag, `brew install` reports that the tap does not exist.

## Where the binaries come from

Warden's source repository is private. The binaries are not: they are published to a
separate **public** repository that holds release archives and checksums and no source
code at all.

| Repository | Visibility | Contents |
| - | - | - |
| `Abhishek-Mallick/Warden` | Private | The source |
| `Abhishek-Mallick/warden-dist` | Public | Release archives and `checksums.txt` |
| `Abhishek-Mallick/homebrew-tap` | Public | One generated formula |

This split is not cosmetic. Homebrew downloads a release asset **anonymously**, so an
archive attached to a private repository fails with a 403 for everyone who is not a
collaborator — including you, on a machine that is not signed in. Keeping the artefacts
public and the source private is what makes `brew install` work for anyone while the
code stays closed.

## Upgrading and removing

```bash theme={null}
brew update && brew upgrade warden
brew uninstall warden
```

Uninstalling removes the binaries. It does not touch your configuration, your policies, or the state directory holding the audit chain — those are yours, and deleting them silently would destroy an audit trail.

## What the formula does not do

* **No service definition.** Warden needs a configuration file naming a database, so there is nothing sensible to start automatically. Run `warden serve --config …` yourself, or use a service manager. The formula prints this as a caveat.
* **No configuration is written.** Start from the examples under `deploy/` in the repository and read [the configuration reference](https://warden.buildlab.in/configure/warden-yaml.md).

## Maintaining the tap

For whoever owns the tap repository:

* **Create the two public repositories once:** `./scripts/bootstrap-distribution.sh` from a clone of the private repository. It creates `warden-dist` and `homebrew-tap`, both public, both without source, and prints the remaining steps. It is safe to re-run.
* **One token, one secret.** The release workflow writes to repositories other than its own, which its built-in `GITHUB_TOKEN` cannot do. Add a `PUBLISH_TOKEN` secret to the private repository: a classic token with `repo` and `write:packages`, or a fine-grained token with Contents read-and-write on both public repositories.
* **The formula is generated**, at `Formula/warden.rb`, by `scripts/brew-formula.sh <version> <checksums.txt>` from a release's own checksums. Do not hand-edit it; the next release overwrites it.
* **To repair a tap by hand:** download `checksums.txt` from a release in `warden-dist`, run the script, and commit the result.
* **A missing token does not cost you a release.** The formula step says so and stops; the binaries are already published.

> [card] [Verify what you installed](https://warden.buildlab.in/install/releases.md)
>
> Checksums, what is in each archive, and how releases are built.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.