Download

Paste anything. Bolt handles it locally.

Free for individuals on macOS. No account needed, and it works offline.

Download for macOS

Apple Silicon · 161 MB v0.1.162

or one-line install from the terminal

Terminal 
curl -fsSL https://sparcle.app/install.sh | sh

Installs the same signed build. Read it first at sparcle.app/install.sh.

Signed and independently checked

Notarized by Apple

Gatekeeper opens it without a warning

EV code signing on Windows

The signing key lives on hardware, not on a build box

Assessed under Google CASA

Reviewed by a third party, not self-attested

Verify it yourself Signed installers on GitHub

Prefer a package manager?

Every channel here installs the same signed build. None of them is a different edition.

macOS, Linux

Shell script

Show command Hide command
Terminal 
curl -fsSL https://sparcle.app/install.sh | sh

Detects your platform. On Debian and Ubuntu it installs the .deb; anywhere else on Linux, the AppImage into ~/.local/bin. Read it first at sparcle.app/install.sh.

Windows

PowerShell

Show command Hide command
Windows PowerShell 
irm https://sparcle.app/install.ps1 | iex

Downloads the signed .msi, verifies it before anything is trusted or run, then installs silently and opens Bolt. No admin rights needed, and it is safe to re-run. Read it first at sparcle.app/install.ps1.

macOS

Homebrew

Show command Hide command
Terminal 
brew tap sparclehq/tap
  brew install --cask sparclehq/tap/bolt

Naming the cask in full trusts the tap as part of the install, so no separate brew trust step is needed.

Windows

winget

Coming soon

There is no winget package yet, so nothing to copy. Until there is, the PowerShell one-liner and the signed .msi are the two supported ways in on Windows.

macOS, Windows, Linux

Direct installers

Every release keeps its .dmg, .msi, .AppImage and .deb, each signed, including older versions if you need to pin one. Browse the releases.

On a managed laptop or a locked-down network?

You need IT approval first

What leaves the endpoint, every permission Bolt asks for, how it is signed, and what we do not have yet, on one page written for a security reviewer. Send your IT team this page.

The download is blocked

The exact hostnames Bolt needs, why each one, and the steps for Palo Alto, Zscaler, Umbrella, Netskope and Fortinet. Send your network team the allowlist.

Deploying for a team? The same app runs centrally deployed, governed and audited.

See what your org gets ↓

For your organization

Deploy centrally for governance.

The paid org tiers are the same product, run inside your VPC or on-prem, with the controls IT and security need to make AI safe at scale.

Governance and audit

  • Signed with Ed25519 and chained with Merkle: Aeira queries, tool calls, LLM calls, human approvals, masking and authorization decisions, admin policy changes, the security-relevant identity transitions, and privileged key and identity operations (KMS rotation and crypto-shred, PII reveal, SCIM tokens)
  • Verify it offline with a standalone binary, so you do not have to trust us
  • Streams to Splunk, Microsoft Sentinel or syslog as it happens, or to your own forwarder as JSON
  • Per-tenant CMK envelopes, crypto-shred for right-to-erasure
  • SIG Lite, threat model, DPA and MSA drafts ready for security review

AI-DLP at the boundary

  • Detect, mask, tokenize and restore on our own local engine, on-device and at your org boundary
  • Masked before the LLM adapter is invoked, not after the fact
  • Internal tools still operate on unmasked values, so productivity does not regress. Results are re-masked on the way back
  • Remembered values pass the same chokepoint, so a stored identifier reaches the model as a token
  • 28 built-in policy packs, plus your own recognizers

Identity at the edge

  • SSO via Microsoft Entra, Okta, Google Workspace, OneLogin, Auth0 or any OIDC provider
  • SCIM 2.0 provisioning for joiner, mover and leaver
  • IDP-bound ACLs propagated to every query and every downstream tool call
  • No service-account fan-out: the user's identity is the authorization primitive end to end
  • Device trust is a first-class policy axis, so an untrusted endpoint gets a stricter rule (EDR and XDR adapters are on the roadmap)

Agent gateway and MCP hub

  • Your own OpenAI-compatible endpoint, so existing tools point at Bolt unchanged and inherit masking
  • Speaks A2A, ACP and MCP. Agent Gateway is live for Claude; other agent CLIs are on the roadmap
  • Admin-curated MCP connector catalog. Users get the integrations IT approved, nothing else
  • Per-tenant token vault with envelope encryption. Agent allowlist with capability scoping
  • Your own skills and agents ship as signed .boltpack bundles, verified before install

LLM control and cost

  • BYO LLM: Azure OpenAI, AWS Bedrock, Google Vertex, Anthropic, OpenAI, on-prem Llama, anything OpenAI-compatible
  • Zero token markup
  • Per-org, per-team and per-user token telemetry with dashboards
  • Model routing by sensitivity tier
  • Privacy-tier gating: no-train providers, on-prem-only models for regulated workloads

Self-hosted deployment

  • Docker compose (docker-compose.ha.yml) for single-host deployments
  • Helm chart for multi-node, HA and multi-cluster production scale
  • Runs inside your VPC, on-prem datacenter or cloud account
  • Air-gapped at the Federated Aeira tier
  • Sparcle has no inbound or outbound access to your deployment. Architecture designed for HIPAA, GDPR and DPDPA workflows
See pricing → Start with $5K Discovery → Architecture →

FAQ

Questions?

Do I need an account to use Bolt?

No. Bolt runs entirely on your machine with no login required to get started. Add an AI API key (or connect Google / Microsoft for full productivity), and start using it.

Is Bolt really free?

Yes, for individuals. Download, install, and use Bolt on your own device with no time limit. The paid tiers on the pricing page are for organizations that need central deployment, governance, audit, SCIM, and IT-managed installs.

What AI keys work?

OpenAI, Anthropic, Google Gemini (has a free tier), OpenRouter, or Ollama for a fully local model. Anything else that speaks the OpenAI API works too: point Bolt at your own base URL for Groq, Together AI, Perplexity, LM Studio, or an endpoint you host.

Does Bolt send my data anywhere?

No. Bolt runs fully on your device. AI requests go directly from your machine to your chosen provider; nothing routes through Sparcle.

How do I launch Bolt?

Press Cmd+Shift+K on macOS or Ctrl+Shift+K on Windows/Linux. Or configure your own shortcut. Bolt appears as a non-disruptive overlay on top of your focused app.

Can I connect Gmail, Calendar, Drive, Tasks, and Contacts?

Yes. Sign in with Google or Microsoft from the settings, and per-feature connect cards walk you through each scope on demand. Your data stays on this device; sensitive values are masked before any LLM call.

What is demo mode?

Install Bolt and it opens on a persona picker before you sign in: choose a role, such as engineer, sales or executive, and Bolt fills with that person's sample data (emails, meetings, tasks), so you can explore everything instantly with no credentials. Sign in when you are ready and Bolt switches to your own data. Changed your mind? Reset App, on the login screen and in the App menu, wipes the local data and returns you to a fresh first run.