> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploying the Agent

> Install the Myrmex software agent from the in-console Download Agent flow: generate an installation token, run the per-OS installer for Windows, macOS, or Linux, then authorize the device.

You install the Myrmex **software agent** from the **Download Agent** page in the console. The flow is the same on every platform: get an installation token, run the installer for your operating system, then authorize the new device.

<Note>
  This installs the **software agent** on a host. Once it's authorized, the
  [AI agents](/documentation/multi-agent-system/overview) can read its telemetry
  and act on the host.
</Note>

## Get an Installation Token

Every install needs an **installation token**, which the console generates for you:

<Steps>
  <Step title="Open Download Agent">
    Open the **Download Agent** page from the console.
  </Step>

  <Step title="Generate a token">
    Generate an installation token. It's valid for **24 hours** and is
    **reusable** within that window, so a single token can onboard many hosts.
  </Step>

  <Step title="Pick your OS">
    Choose Windows, macOS, or Linux to get the matching installer and a
    ready-to-run command with the token already embedded.
  </Step>
</Steps>

<Tip>
  Copy the exact command from the Download Agent page — it already includes your
  token. The commands below show the general shape; the placeholder
  `YOUR_TOKEN` stands in for the one the console generates.
</Tip>

## Windows

**Requirements:** Windows 10 or later, or Windows Server 2016 or later. Install as a local **Administrator**.

Choose either method:

* **MSI package** — download the MSI from the Download Agent page and run it. Approve the User Account Control prompt and follow the setup wizard to the end.
* **PowerShell one-liner** — run the command from the console in an elevated PowerShell session:

```powershell theme={null}
# Run in an elevated PowerShell (shape shown; copy the exact command from the console)
msiexec /i MyrmexAgent.msi INSTALLATION_TOKEN=YOUR_TOKEN /qn
```

The agent installs as a system service and starts automatically.

## macOS

**Requirements:** a supported macOS version on **Apple Silicon (arm64)**.

Choose either method:

* **.pkg installer** — download the `.pkg` from the Download Agent page and run it, following the prompts.
* **Bash one-liner** — run the command from the console in Terminal:

```bash theme={null}
# Shape shown; copy the exact command from the console
sudo INSTALLATION_TOKEN=YOUR_TOKEN bash -c "$(curl -fsSL <installer-url>)"
```

## Linux

**Requirements:** a supported distribution — Debian, Ubuntu, Fedora, RHEL, CentOS, Oracle Linux, or Amazon Linux. Install as **root** (or with `sudo`).

Linux uses a single **universal installer** you run with `curl | bash`, passing your token as an environment variable:

```bash theme={null}
# Shape shown; copy the exact command from the console
curl -fsSL <installer-url> | sudo INSTALLATION_TOKEN=YOUR_TOKEN bash
```

The installer detects your distribution, installs the agent, and registers it as a service.

<Note>
  During installation the host downloads dependency packages, so allow outbound
  **443** to `*.myrmex.ai` and to your distribution's official repositories. See
  [Collector mode](/documentation/agent-endpoint-security/collector-mode#communication-architecture)
  for the full network model.
</Note>

## Authorize the Device

<Warning>
  A newly installed device appears as **unauthorized** and reports nothing until
  you approve it. This step is required.
</Warning>

Open the new device from the [Endpoints view](/documentation/agent-endpoint-security/endpoints-view) or its [detail view](/documentation/agent-endpoint-security/device-details) and choose **Authorize**. The device activates and begins reporting, and you can then set its role, rules, and more.

## Migrate a Host Between Contexts

A **context** is the organization / tenant a host reports into. To move an already-installed host from one context to another you don't uninstall anything — you **re-run the installer with the new context's token**, and the agent re-enrolls itself.

<Steps>
  <Step title="Get the new context's install command">
    Switch to the **target context** and open its **Download Agent** page. Generate an installation token there and copy the ready-to-run command — it is scoped to that context.
  </Step>

  <Step title="Run it on the host">
    Run that exact command on the host as root / administrator — the same command as a fresh install. The agent re-registers against the new context: it obtains a new identity, rewrites `config.yml` / `env.conf` to point at the new context, and reconnects. No uninstall or reboot is needed.
  </Step>

  <Step title="Authorize it in the new context">
    The host appears in the new context's [Endpoints view](/documentation/agent-endpoint-security/endpoints-view) as **unauthorized**. Approve it there to reactivate telemetry and response. In the old context it stops reporting and can be removed.
  </Step>
</Steps>

<Warning>
  **No integrations are migrated by this.** Integrations belong to the context — they live in the platform, not on the host — so re-enrolling a host only moves that host's agent. It does not copy, move, or delete any integration: the old context keeps its integrations, and the new context uses whatever is configured there.
</Warning>

<Note>
  Re-running the installer simply overwrites the host's context binding (`config.yml` / `env.conf`) with the new context's — that is the whole migration. The agent binary and its services stay in place.
</Note>

## Where to Go Next

<CardGroup cols={2}>
  <Card title="Device details & actions" icon="desktop" href="/documentation/agent-endpoint-security/device-details">
    Authorize, set the role, and run actions on the host.
  </Card>

  <Card title="Endpoint vs Collector" icon="arrows-left-right" href="/documentation/agent-endpoint-security/endpoint-mode">
    Choose how the device runs after install.
  </Card>

  <Card title="Agent communication" icon="lock" href="/documentation/agent-endpoint-security/communication">
    How enrollment and the token work under the hood.
  </Card>

  <Card title="Agent capabilities" icon="list-check" href="/documentation/agent-endpoint-security/features">
    What the agent does once it's live.
  </Card>
</CardGroup>