Every channel here installs the same signed build. None of them is a different edition.
Shell scriptmacOS, Linux
Show commandHide command
Terminal
$ curl -fsSL https://sparcle.app/install.sh | sh
Detects your platform. On Debian and Ubuntu it installs the .deb; anywhere else on Linux, the AppImage into ~/.local/bin. Read it first at sparcle.app/install.sh.
PowerShellWindows
Show commandHide command
Windows PowerShell
PS> irm https://sparcle.app/install.ps1 | iex
Downloads the signed .msi, verifies it before anything is trusted or run, then installs silently and opens Bolt. No admin rights needed, and it is safe to re-run. Read it first at sparcle.app/install.ps1.
HomebrewmacOS
Show commandHide command
Terminal
$ brew tap sparclehq/tap
$ brew install --cask sparclehq/tap/bolt
Naming the cask in full trusts the tap as part of the install, so no separate brew trust step is needed.
wingetWindowsComing soon
There is no winget package yet, so nothing to copy. Until there is, the PowerShell one-liner and the signed .msi are the two supported ways in on Windows.
Direct installersmacOS, Windows, Linux
Every release keeps its .dmg, .msi, .AppImage and .deb, each signed, including older versions if you need to pin one. Browse the releases.
On a managed laptop or a locked-down network?
You need IT approval first
What leaves the endpoint, every permission Bolt asks for, how it is signed, and what
we do not have yet, on one page written for a security reviewer.
Send your IT team this page.
The download is blocked
The exact hostnames Bolt needs, why each one, and the steps for Palo Alto, Zscaler,
Umbrella, Netskope and Fortinet.
Send your network team the allowlist.
Deploying for a team? The same app runs centrally deployed, governed and audited.
See what your org gets ↓
For your organization
Deploy centrally for governance.
The paid org tiers are the same product, run inside your VPC or on-prem,
with the controls IT and security need to make AI safe at scale.
Governance and audit
Signed with Ed25519 and chained with Merkle: Aeira queries, tool calls, LLM calls, human approvals, masking and authorization decisions, admin policy changes, the security-relevant identity transitions, and privileged key and identity operations (KMS rotation and crypto-shred, PII reveal, SCIM tokens)
Verify it offline with a standalone binary, so you do not have to trust us
Streams to Splunk, Microsoft Sentinel or syslog as it happens, or to your own forwarder as JSON
Per-tenant CMK envelopes, crypto-shred for right-to-erasure
SIG Lite, threat model, DPA and MSA drafts ready for security review
AI-DLP at the boundary
Detect, mask, tokenize and restore on our own local engine, on-device and at your org boundary
Masked before the LLM adapter is invoked, not after the fact
Internal tools still operate on unmasked values, so productivity does not regress. Results are re-masked on the way back
Remembered values pass the same chokepoint, so a stored identifier reaches the model as a token
28 built-in policy packs, plus your own recognizers
Identity at the edge
SSO via Microsoft Entra, Okta, Google Workspace, OneLogin, Auth0 or any OIDC provider
SCIM 2.0 provisioning for joiner, mover and leaver
IDP-bound ACLs propagated to every query and every downstream tool call
No service-account fan-out: the user's identity is the authorization primitive end to end
Device trust is a first-class policy axis, so an untrusted endpoint gets a stricter rule (EDR and XDR adapters are on the roadmap)
Agent gateway and MCP hub
Your own OpenAI-compatible endpoint, so existing tools point at Bolt unchanged and inherit masking
Speaks A2A, ACP and MCP. Agent Gateway is live for Claude; other agent CLIs are on the roadmap
Admin-curated MCP connector catalog. Users get the integrations IT approved, nothing else
Per-tenant token vault with envelope encryption. Agent allowlist with capability scoping
Your own skills and agents ship as signed .boltpack bundles, verified before install
No. Bolt runs entirely on your machine with no login required to get started. Add an AI API key (or connect Google / Microsoft for full productivity), and start using it.
Is Bolt really free?
Yes, for individuals. Download, install, and use Bolt on your own device with no time limit. The paid tiers on the pricing page are for organizations that need central deployment, governance, audit, SCIM, and IT-managed installs.
What AI keys work?
OpenAI, Anthropic, Google Gemini (has a free tier), OpenRouter, or Ollama for a fully local model. Anything else that speaks the OpenAI API works too: point Bolt at your own base URL for Groq, Together AI, Perplexity, LM Studio, or an endpoint you host.
Does Bolt send my data anywhere?
No. Bolt runs fully on your device. AI requests go directly from your machine to your chosen provider; nothing routes through Sparcle.
How do I launch Bolt?
Press Cmd+Shift+K on macOS or Ctrl+Shift+K on Windows/Linux. Or configure your own shortcut. Bolt appears as a non-disruptive overlay on top of your focused app.
Can I connect Gmail, Calendar, Drive, Tasks, and Contacts?
Yes. Sign in with Google or Microsoft from the settings, and per-feature connect cards walk you through each scope on demand. Your data stays on this device; sensitive values are masked before any LLM call.
What is demo mode?
Install Bolt and it opens on a persona picker before you sign in: choose a role, such as engineer, sales or executive, and Bolt fills with that person's sample data (emails, meetings, tasks), so you can explore everything instantly with no credentials. Sign in when you are ready and Bolt switches to your own data. Changed your mind? Reset App, on the login screen and in the App menu, wipes the local data and returns you to a fresh first run.