Overview

Swif CLI is a command-line tool that lets IT admins and engineers manage devices, check compliance, and retrieve agent installer information — all from the terminal. It supports multiple environments, structured output for automation, and secure browser-based authentication.

You can access at:

https://www.npmjs.com/package/@swif-ai/cli

or Swif portal > MCP > Swif CLI

Requirements

Package installers (PKG, MSI, ZIP, EXE, tar.gz, binary): No Node.js or npm needed.
- macOS: Apple Silicon (arm64) or Intel (x64)
- Windows: x64 or ARM64
- Linux: x64 or ARM64, glibc-based distribution (Ubuntu, Debian, RHEL)
npm installation: Node.js 24 or higher (LTS recommended) and npm
A Swif account with team access. You need Team Admin access to see the installer downloads on the Swif CLI onboarding page.

Installation

Swif CLI comes as standalone packages for macOS, Windows, and Linux, so you don't need Node.js or npm. This makes it easy to deploy on machines that aren't set up for developers. npm is still available as an option.

To get the latest download links and commands for your device, go to Swif portal > MCP > Swif CLI. Pick your operating system tab (macOS, Windows, or Linux) and your processor type (arm64 or x64). Every file name, download link and command on the page changes to match what you pick. Each command has a copy button.

Note: The examples below use version 1.0.6. For the latest version, use the links shown in the Swif portal.

Choose the right package

Platform	Check with	Result → Package
macOS	`uname -m`	`arm64` → Apple Silicon (arm64) · `x86_64` → Intel (x64)
Linux	`uname -m`	`aarch64` or `arm64` → arm64 · `x86_64` → x64
Windows	Settings > System > About	x64 or ARM64

Available packages

Note, you can find newer version at Swif admin console.

Platform	Architecture	Type	File (v1.0.6)
Windows	x64 / ARM64	MSI installer	x64 · ARM64
Windows	x64 / ARM64	Portable ZIP	x64 · ARM64
Windows	x64 / ARM64	Standalone EXE	x64 · ARM64
macOS	arm64 / x64	PKG installer	arm64 · x64
Linux	x64 / ARM64	tar.gz	x64 · ARM64
Linux	x64 / ARM64	Standalone binary	x64 · ARM64

Install on macOS

You can install with the graphical installer, in Terminal, with npm, or silently through MDM. Swif CLI installs to /usr/local/bin/swif.

Graphical install

Download the PKG that matches your Mac's processor.
Double-click the file.
Follow the macOS Installer prompts.
Enter your administrator password when asked.

Terminal install (Apple Silicon shown; for Intel Macs, replace arm64 with x64)

curl -fLO https://cdn.swifteam.com/st-cli/1.0.6/macos/swif-cli-1.0.6-darwin-arm64.pkg
sudo installer -pkg swif-cli-1.0.6-darwin-arm64.pkg -target /
swif --version

Silent install (MDM)
To deploy to managed Macs through your MDM, run:

/usr/sbin/installer -pkg /path/to/swif-cli.pkg -target /

Verify package integrity (optional)
For Intel Macs, replace arm64 with x64.

curl -fLO https://cdn.swifteam.com/st-cli/1.0.6/macos/SHA256SUMS
grep "swif-cli-1.0.6-darwin-arm64.pkg" SHA256SUMS | shasum -a 256 -c -
pkgutil --check-signature swif-cli-1.0.6-darwin-arm64.pkg
spctl --assess --type install -vv swif-cli-1.0.6-darwin-arm64.pkg

Uninstall

sudo rm -f /usr/local/bin/swif

Install on Windows

You can install with the MSI installer, the portable ZIP, the standalone EXE, npm, or silently through MDM. The MSI installs to C:\Program Files\Swif\swif.exe.

MSI installer

Download the MSI that matches your processor (x64 or ARM64).
Run the installer and follow the prompts.

Portable ZIP / Standalone EXE
Download the ZIP (and extract it) or the EXE. Run swif.exe directly, or add its folder to your system PATH so you can run swif from any terminal.

Silent install (MDM)

msiexec.exe /i "swif-cli-1.0.6-windows-x64.msi" /qn /norestart

For ARM64 devices:

msiexec.exe /i "swif-cli-1.0.6-windows-arm64.msi" /qn /norestart

Verify the installation (PowerShell)

& "C:\Program Files\Swif\swif.exe" --version

Install on Linux

You can install with the tar.gz package, the standalone binary, npm, or silently through a script. The Linux packages are built for glibc-based distributions such as Ubuntu, Debian, and RHEL. Swif CLI installs to /usr/local/bin/swif.

tar.gz / Silent install (x64 shown; for ARM64, replace x64 with arm64)

curl -fLO https://cdn.swifteam.com/st-cli/1.0.6/linux/swif-cli-1.0.6-linux-x64.tar.gz
tar -xzf swif-cli-1.0.6-linux-x64.tar.gz
sudo install -m 0755 swif /usr/local/bin/swif
swif --version

Standalone binary

curl -fLO https://cdn.swifteam.com/st-cli/1.0.6/linux/swif-1.0.6-linux-x64
sudo install -m 0755 swif-1.0.6-linux-x64 /usr/local/bin/swif
swif --version

Verify package integrity (optional)

curl -fLO https://cdn.swifteam.com/st-cli/1.0.6/linux/SHA256SUMS
grep "swif-cli-1.0.6-linux-x64.tar.gz" SHA256SUMS | sha256sum -c -

Each binary and archive also has a matching .asc GPG signature for signature checks (for example, SHA256SUMS.asc).

Install with npm (all platforms)

If Node.js is already installed, you can still use npm:

npm install -g @swif-ai/cli
swif --version

Updating Swif CLI

Starting with version 1.0.7, Swif CLI can update itself. You can update by hand with swif update, and Swif CLI also checks for new versions on its own in the background.

Check for updates

swif update --check

If you have the latest version, you'll see: Swif CLI is up to date (1.0.7)
If a newer version is out, you'll see: Update available: 1.0.6 → 1.0.7. Run swif update to install it.

Checking doesn't download or install anything.

For scripts and automation, add --json:

swif update --check --json

This prints only valid JSON with the version details, status and download URL. It has no colors, progress bars or banners.

Install an update

swif update

Platform	What to expect
macOS	Enter your administrator password when asked. Swif CLI replaces the binary at `/usr/local/bin/swif`.
Windows	Approve the User Account Control (UAC) prompt. The installer runs and replaces the files in `C:\Program Files\Swif\`.
Linux	Swif CLI installs to `/usr/local/bin`, so `swif update` asks for your sudo password to replace the binary. In scripts or other non-interactive shells, run `sudo swif update`. If you installed Swif CLI to a folder you can write to without admin rights (for example, `~/.local/bin`), it may have already updated itself in the background. If so, you'll see `✔ Update installed`.

To confirm the update, run:

swif --version

If you run swif update when you already have the latest version, it tells you you're up to date and makes no changes.

To see all update options, run swif update --help.

Automatic updates

Swif CLI checks for new versions in the background, so your commands don't slow down. What happens next depends on how you installed it:

npm installs: The update installs silently. The next command you run shows a green ✔ Update installed.
Package installs (PKG, MSI, and Linux installs in /usr/local/bin): After a command finishes, a yellow notice appears: ⬆ Update available 1.0.6 → 1.0.7 · Run swif update. It shows up at most once every 24 hours. Linux installs in a folder you can write to without admin rights (for example, ~/.local/bin) update silently, and the next command you run shows a green ✔ Update installed.

To keep scripts and pipelines from breaking, the update notice never appears when:

A command uses --json
Output is piped (for example, swif whoami | cat)
Swif CLI is running in CI

Turn off automatic updates

Change these settings in ~/.swif/config.toml:

Setting	Effect
`auto_update = false`	Stops automatic installs. You'll still see the update notice.
`update_check = false`	Stops all update checks and notices.

To turn off all checks and notices without editing the file (for example, on CI runners), set this environment variable:

SWIF_NO_UPDATE_CHECK=1

Check your installation with `swif doctor`

swif doctor

This shows a table with:

CLI version: the version you have installed
Install method: npm, standalone, pkg or msi
Latest version: the newest version available
Auto-update: enabled or disabled

Authentication

Swif CLI uses secure browser-based login. Each session is tied to a profile that corresponds to your Swif environment (us, eu, or dev).

Log in

swif login --profile us

Swif CLI uses browser login by default. If you are in a headless or restricted environment, use device-code login instead:

swif login --device-auth --profile us

For CI or non-interactive use:

swif --no-input login --device-auth --profile us

Check your session

swif auth status --json 
swif whoami --profile us

Log out

swif logout --profile us

Logging out clears your saved session for that profile.

Profiles and Context

Swif CLI supports multiple environment profiles. You can work with us, eu, or dev — each maintains its own session and team context.

List available contexts

swif context list --profile us

Show active context

swif context show --profile us

Switch context

swif context use <team-id> --profile us

Device Management

List devices

View all devices in your team:

swif device list --profile us

Filter devices with any combination of these flags:

Flag	Description
`--owner <email>`	Filter by device owner
`--os <os>`	Filter by operating system
`--device-type <type>`	Filter by device type
`--compliant`	Show only compliant devices
`--non-compliant`	Show only non-compliant devices
`--agent-status`	Show devices with an active agent
`--no-agent`	Show devices with no agent installed
`--has-serial`	Show devices with a serial number
`--no-serial`	Show devices without a serial number

Example:

swif device list --profile eu --os macOS --compliant

Get device details

swif device get <device-id-or-serial> --profile us

Check device status

swif device status <device-id-or-serial> --profile us

Assign a device

Assign an unassigned device to a team member:

swif device assign <device-id-or-serial> --employee user@company.com --profile us

Reassign a device

Transfer a device to a different team member:

swif device reassign <device-id-or-serial> --employee newuser@company.com --profile us

Unassign a device

Remove the current owner from a device:

swif device unassign <device-id-or-serial> --profile us

All write commands include safe failure handling — for example, assigning a device that's already assigned, or unassigning a device with no owner, will return a clear error message without changing any state.

Device Auditing

The device audit command generates report-style results for fleet oversight:

swif device audit --unassigned --profile us
swif device audit --non-compliant --profile eu
swif device audit --mdm-pending --profile us
swif device audit --no-agent --profile us

You can combine audit flags with --owner, --os, and --device-type for more targeted results:

swif device audit --non-compliant --os windows --profile us --output json

When no devices match the audit criteria, the CLI displays a clear summary instead of a blank table.

Employee Management

Manage your team's employee records directly from the terminal. This feature supports listing, retrieving, creating, updating, and deleting employees.

List employees

View all employees in your team:

swif employee list --profile us

Get employee details

Retrieve a specific employee record by ID or email:

swif employee get <employee-id-or-email> --profile us

Create an employee

Create a new employee record using a JSON payload file:

swif employee create --file employee.json --profile us

Example employee.json:

{
  "firstName": "CLI",
  "lastName": "Test User",
  "emails": ["cli-test@example.com"],
  "position": "QA",
  "department": "Engineering",
  "isActive": true
}

Update an employee

Update an existing employee record using a JSON payload file:
swif employee update <employee-id> --file employee-update.json --profile us

Example employee-update.json:

{
  "firstName": "CLI Updated",
  "lastName": "Test User Updated",
  "emails": ["cli-test-updated@example.com"],
  "position": "Senior QA",
  "department": "QA"
}

Delete an employee

Remove an employee record from your team. Use the --confirm flag to bypass the interactive confirmation:

swif employee delete <employee-id> --confirm --profile us

Agent Installer Lookup

Retrieve the latest Swif agent installer URL for a given OS — useful for scripted deployments and automation pipelines. Starting with CLI version 1.0.6, installer naming has been updated from TrustClaw to Agentic Security.

swif agent installer latest --os mac --profile us 
swif agent installer latest --os windows --profile eu 
swif agent installer latest --os linux-arm64 --profile us
swif agent installer latest --os AgenticSecurityLinuxARM64 --profile us
swif agent installer latest --os AgenticSecurityWindowsX64 --profile us --json

Supported OS Values

The CLI supports MDM agent and Agentic Security OS values for precise automation:

MDM OS aliases:
- mac
- windows
- linux-x64
- linux-arm64
Agentic Security OS aliases:
- AgenticSecurityMacOSARM64
- AgenticSecurityWindowsX64
- AgenticSecurityLinuxX64
- AgenticSecurityLinuxARM64

The installer URL is resolved from backend metadata (not a static CDN path), so it always points to the current release.

JSON Output Integrity

Run any installer command with the --json flag.

The output is valid JSON containing the url, version, and os (now prefixed with AgenticSecurity).

Output Formats

Most commands support structured output for scripting and automation:

Flag	Format
`--output json` or `--json`	JSON object
`--output jsonl`	Newline-delimited JSON
(default)	Human-readable table