How to Install Claude Code on Windows, Mac and Linux, and Set It Up Safely

Install Claude Code with Anthropic's native installer, which its setup page recommends. On macOS, Linux and WSL run curl -fsSL https://claude.ai/install.sh | bash. On Windows run irm https://claude.ai/install.ps1 | iex in PowerShell. Then open a new terminal, run claude --version, and sign in with a paid Claude plan or Console account.

The rest of this guide covers what Anthropic's documentation says about each step that matters for security: requirements, the five install routes, checking the signed release manifest, where your login is stored, which permission mode a new session starts in, how to pin versions for a team, and how to remove everything Claude Code leaves behind. Every command comes from Anthropic's Claude Code docs at code.claude.com, fetched on 23 October 2026.

Key takeaways

• Official sources: the claude.ai/install.sh, install.ps1 and install.cmd scripts, the signed apt, dnf and apk repositories on downloads.claude.ai, the Homebrew cask claude-code, the WinGet package Anthropic.ClaudeCode and the npm package @anthropic-ai/claude-code.
• Native installs update themselves. Homebrew, WinGet, apt, dnf and apk installs do not, unless you opt in.
• Each release has a manifest.json of SHA256 checksums signed with Anthropic's GPG key, fingerprint 31DD DE24 DDFA B679 F42D 7BD2 BAA9 29FF 1A7E CACE. macOS and Windows binaries are also code signed; Linux binaries are not.
• From v2.1.283, interactive sessions start in auto mode, where a classifier model reviews actions instead of you. Use claude --permission-mode default to approve every action yourself.
• The Bash sandbox is off by default. Turn it on with /sandbox on macOS, Linux or WSL2.
• A clean uninstall also removes ~/.claude and ~/.claude.json.

What are the system requirements for Claude Code?

From Anthropic's Advanced setup page:

There is no 32 bit Windows build; the troubleshooting page says so directly. You do not need Node.js unless you choose the npm route, and even then the page says the binary "doesn't use your Node.js at runtime." On native Windows, Anthropic recommends Git for Windows so Claude Code can use its Bash tool; without it, Claude Code runs commands through its PowerShell tool.

You also need an account. The setup page says Claude Code "requires a Pro, Max, Team, Enterprise, or Console account" and that the free claude.ai plan does not include it. Organizations can also use Amazon Bedrock, Google Cloud's Agent Platform or Microsoft Foundry.

Which install methods does Anthropic document, and which should you use?

Anthropic documents five routes: the native installer, Homebrew, WinGet, signed Linux package repositories and npm. The setup page labels the native installer "Recommended." The differences that matter for security show up after the first install.

Pick the native installer for the least upkeep. Pick apt, dnf or apk when every package must come through a signed system repository: Anthropic says all three are signed with the Claude Code release key, and your package manager checks those signatures on every install. Pick the stable channel, on any route that offers it, if you want versions that are "typically about one week old, skipping releases with major regressions."

Step by step: install Claude Code on macOS

Option 1: the native installer (recommended)

curl -fsSL https://claude.ai/install.sh | bash

The command shows no progress while it downloads. When it finishes, open a new terminal window and check:

claude --version

A working install prints something like 2.1.211 (Claude Code). The launcher lives at ~/.local/bin/claude, a symlink into ~/.local/share/claude/versions/. To choose the stable channel or pin a version, pass it to the script:

curl -fsSL https://claude.ai/install.sh | bash -s stable

curl -fsSL https://claude.ai/install.sh | bash -s 2.1.89

The channel you choose at install time becomes your default for auto-updates.

Option 2: Homebrew

brew install --cask claude-code

claude-code tracks the stable channel and claude-code@latest tracks latest. Neither updates itself by default.

Run a health check

claude doctor

Anthropic describes this as "read-only installation and settings diagnostics without starting a session," including install health and settings file errors. It is also the quickest way to see which install you are running if you have tried more than one route.

Step by step: install Claude Code on Linux

Option 1: the native installer

Run the same curl -fsSL https://claude.ai/install.sh | bash command as on macOS, open a new terminal and run claude --version.

Option 2: the signed apt repository (Debian and Ubuntu)

This route gives you signature checks on every install and upgrade through the tools you already use to patch the machine. Fresh systems may need curl and gpg first:

sudo apt install curl gnupg

Download the signing key:

sudo install -d -m 0755 /etc/apt/keyrings
sudo curl -fsSL https://downloads.claude.ai/keys/claude-code.asc \
  -o /etc/apt/keyrings/claude-code.asc

Check it before trusting it:

gpg --show-keys /etc/apt/keyrings/claude-code.asc

The fingerprint must be 31DDDE24DDFAB679F42D7BD2BAA929FF1A7ECACE. If gpg finds no valid OpenPGP data, the download failed or returned the wrong content; confirm you can reach downloads.claude.ai and download it again. Then register the stable repository and install:

echo "deb [signed-by=/etc/apt/keyrings/claude-code.asc] https://downloads.claude.ai/claude-code/apt/stable stable main" \
  | sudo tee /etc/apt/sources.list.d/claude-code.list
sudo apt update
sudo apt install claude-code

The signed-by option ties this repository to this one key. For the latest channel, both the URL path and the suite name change to latest.

Option 3: the signed dnf repository (Fedora and RHEL)

sudo tee /etc/yum.repos.d/claude-code.repo <<'EOF'
[claude-code]
name=Claude Code
baseurl=https://downloads.claude.ai/claude-code/rpm/stable
enabled=1
gpgcheck=1
gpgkey=https://downloads.claude.ai/keys/claude-code.asc
EOF
sudo dnf install claude-code

dnf asks you to confirm the key on first install. Accept only if it matches 31DD DE24 DDFA B679 F42D 7BD2 BAA9 29FF 1A7E CACE.

Option 4: the signed apk repository (Alpine)

Alpine lacks bash and curl by default, and Claude Code needs libgcc, libstdc++ and ripgrep at runtime:

apk add bash curl libgcc libstdc++ ripgrep

wget -O /etc/apk/keys/claude-code.rsa.pub \
  https://downloads.claude.ai/keys/claude-code.rsa.pub
echo "https://downloads.claude.ai/claude-code/apk/stable" >> /etc/apk/repositories
apk add claude-code

Verify the key with sha256sum /etc/apk/keys/claude-code.rsa.pub; it must print 395759c1f7449ef4cdef305a42e820f3c766d6090d142634ebdb049f113168b6. On musl systems, Anthropic also says to set USE_BUILTIN_RIPGREP to 0:

{
  "env": {
    "USE_BUILTIN_RIPGREP": "0"
  }
}

Option 5: npm

npm install -g @anthropic-ai/claude-code

This installs the same native binary through a per platform optional dependency such as @anthropic-ai/claude-code-darwin-arm64, so your package manager must allow optional dependencies. Anthropic's warning: "Do NOT use sudo npm install -g as this can lead to permission issues and security risks." If you hit permission errors, its troubleshooting page suggests switching to the native installer. Our Node.js install guide shows how to set up npm so global installs never need root.

Step by step: install Claude Code on Windows

Native Windows or WSL?

The sandboxing column is the deciding factor. If you want operating system limits on what Claude's shell commands can touch, install inside WSL 2.

Option 1: PowerShell

Your prompt shows PS C:\ in PowerShell. Run:

irm https://claude.ai/install.ps1 | iex

You do not need Administrator rights. Open a new window and run claude --version. The binary lands in %USERPROFILE%\.local\bin. For the stable channel, or a pinned version in place of stable:

& ([scriptblock]::Create((irm https://claude.ai/install.ps1))) stable

Option 2: CMD

Your prompt shows C:\ without PS in Command Prompt:

curl -fsSL https://claude.ai/install.cmd -o install.cmd && install.cmd && del install.cmd

This downloads the script to a file, runs it and deletes it. Add stable or a version number after install.cmd to choose a channel.

Option 3: WinGet

winget install Anthropic.ClaudeCode

Run winget upgrade Anthropic.ClaudeCode on a schedule; it does not update itself.

Option 4: inside WSL

Open your WSL distribution, run the Linux install.sh command, and launch claude inside WSL, not from PowerShell. For the sandbox, also install its dependencies:

sudo apt-get install bubblewrap socat

If Claude Code cannot find Git Bash on native Windows, set its path in settings.json:

{
  "env": {
    "CLAUDE_CODE_GIT_BASH_PATH": "C:\\Program Files\\Git\\bin\\bash.exe"
  }
}

Our Git install guide covers installing Git for Windows from its official source.

Installing Claude Code in VS Code

The VS Code page requires VS Code 1.94.0 or later and a paid Claude plan or Console account. Open the Extensions view (Cmd+Shift+X on Mac, Ctrl+Shift+X on Windows and Linux), search for "Claude Code" and click Install. Anthropic's install link uses the identifier anthropic.claude-code, so check the publisher before you click. The extension bundles its own CLI but does not put claude on your PATH; install the standalone CLI too if you want it in the integrated terminal.

How do you sign in, and where are credentials stored?

Run claude in your project. On first launch it opens a browser to log in. The authentication page lists the accepted account types: a Claude Pro or Max subscription, Claude for Teams or Enterprise, Claude Console (after an admin invites you), a cloud provider (Amazon Bedrock, Google Cloud's Agent Platform or Microsoft Foundry), or a self-hosted Claude apps gateway with corporate SSO.

If the browser does not open, press c to copy the login URL. In WSL2, over SSH and in containers, the browser often shows a login code instead of redirecting; paste it at the prompt, or run claude auth login.

Where your login lives on disk

Setting CLAUDE_CONFIG_DIR moves this file. Anthropic uses that to keep work and personal accounts apart:

alias claude-work='CLAUDE_CONFIG_DIR=~/.claude-work claude'

Watch for a stray ANTHROPIC_API_KEY. Once approved it outranks a subscription login, and the docs warn this "can cause authentication failures if the key belongs to a disabled or expired organization." Run /status to see which credential is active.

What leaves your machine

The data usage page says prompts and model outputs travel over TLS 1.2 or later, and that session transcripts are kept locally in plaintext under ~/.claude/projects/ for 30 days by default (change it with cleanupPeriodDays). Consumer plans (Free, Pro and Max) let you choose whether your data trains future models, with 5 year retention if you allow it and 30 days if you do not. For commercial accounts, Anthropic says it does not train generative models on Claude Code code or prompts unless the customer opts in, and standard retention is 30 days. Check your plan's terms before pointing Claude Code at code you may not share.

How do you verify the Claude Code installer and binary?

Anthropic documents three layers.

Layer 1: the signed release manifest

Each release publishes manifest.json with SHA256 checksums for every platform binary, signed with an Anthropic GPG key, so verifying the manifest "transitively verifies every binary it lists." Steps 1 to 3 need a POSIX shell; on Windows, use Git Bash or WSL.

curl -fsSL https://downloads.claude.ai/keys/claude-code.asc | gpg --import
gpg --fingerprint security@anthropic.com

The output must include:

31DD DE24 DDFA B679 F42D  7BD2 BAA9 29FF 1A7E CACE

Download the manifest and signature, then verify:

REPO=https://downloads.claude.ai/claude-code-releases
VERSION=2.1.89
curl -fsSLO "$REPO/$VERSION/manifest.json"
curl -fsSLO "$REPO/$VERSION/manifest.json.sig"
gpg --verify manifest.json.sig manifest.json

A valid result reports:

Good signature from "Anthropic Claude Code Release Signing <security@anthropic.com>"

gpg also prints a warning that the key "is not certified with a trusted signature" for any freshly imported key. Anthropic says this is expected; your fingerprint check is what confirms the key. Finally, hash the binary and compare it with your platform's checksum in manifest.json. For an installed native binary, point the command at the matching file under ~/.local/share/claude/versions/.

sha256sum claude

shasum -a 256 claude

(Get-FileHash claude.exe -Algorithm SHA256).Hash.ToLower()

The first is for Linux, the second for macOS, the third for Windows PowerShell. Manifest signatures exist from release 2.1.89 onward; earlier manifests are unsigned.

Layer 2: platform code signatures

Check the signer name, not only that a signature exists.

Layer 3: the updater's own check

When claude update or claude install cannot confirm a release is genuine, it prints Release verification failed for Claude Code and, per the troubleshooting page, installs nothing; your current version keeps working. If the message repeats, report it rather than working around it.

What the docs do not say

We found no published checksum or signature for the install.sh, install.ps1 or install.cmd scripts themselves. If your policy forbids piping an unchecked script into a shell, the signed apt, dnf and apk repositories and the manifest check above are the documented routes that verify before anything runs.

How do you avoid unofficial packages and lookalike install commands?

Lookalike pages rely on a domain one letter off or a package with a plausible name. Know the real names and refuse everything else:

Copy commands from code.claude.com, not from a forum post or video description. Check the @anthropic-ai npm scope. Get the Desktop app from the claude.ai and claude.com links on Anthropic's setup page, not a download portal. And if the install script fails with syntax error near unexpected token, the URL returned a web page instead of the script, often because of a proxy, a region restriction or an outage. Follow the troubleshooting steps; do not swap in a different URL.

Permission modes and safe first-run settings

Claude Code reads files, edits them and runs commands. The permission mode decides how much of that happens without asking. Understand it before your first real session.

The six modes

From the permission modes page:

Which mode your first session starts in

With v2.1.283 or later, auto mode is the built-in starting mode for interactive terminal and VS Code sessions on every plan. A separate classifier model reviews each action and blocks what it judges unsafe; by default that includes curl | bash style download and execute, sending sensitive data to external endpoints, production deploys, force pushes and git reset --hard. Your ask and deny rules still apply. Anthropic is clear about the limit: "Auto mode reduces permission prompts but does not guarantee safety."

Non-interactive claude -p runs with no mode set start in Manual from v2.1.302, and calls that need approval are denied unless a rule allows them.

A safe first session

In a new codebase, or any repository with secrets, production credentials or deploy scripts, start in Manual or plan mode:

claude --permission-mode default

claude --permission-mode plan

Plan mode blocks edits until you approve a plan. During a session, Shift+Tab cycles modes, and the status bar shows the active one. To make Manual your default on this machine, set permissions.defaultMode in ~/.claude/settings.json (the CLI accepts manual as an alias). auto and bypassPermissions do not take effect from a project's .claude/settings.json or .claude/settings.local.json, so a cloned repository's settings cannot start you in either mode.

Allow, ask and deny rules

Manage rules with /permissions. The permissions page says they are evaluated deny, then ask, then allow, and an allow rule "can't carve an exception out of a deny rule." Deny rules apply in every mode. The settings page gives this user settings example, which allows lint and test scripts and blocks reading .env files:

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "permissions": {
    "allow": [
      "Bash(npm run lint)",
      "Bash(npm run test *)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)"
    ]
  }
}

Settings files are strict JSON; run /status after saving to confirm the file loaded. Three limits from the docs: rules are enforced by Claude Code, not the model, so instructions in CLAUDE.md are not a control; a .claudeignore file has no effect; and Read and Edit deny rules cover recognized commands such as cat and sed but not something like grep -r that reads files without naming them. For hard limits on shell commands, use the sandbox.

Working directory and workspace trust

Claude can access the directory you start it in. In Manual mode its file tools ask before going outside it, but the security page notes a Bash command you approve "can still write anywhere your user account can." Add folders with --add-dir or /add-dir.

The first time you open a folder, Claude Code shows a workspace trust dialog that lists the allow rules and extra directories the project's settings would grant; they apply only after you accept. Servers in a project's .mcp.json get their own prompt. A claude -p run shows neither, so before running it in a repository you did not write, consider --setting-sources user (ignore the project's settings and .mcp.json) or --bare. Start Claude Code from a project folder, not your home directory, where trust lasts only for the session.

Turn on the sandbox

The sandboxing page describes an operating system enforced boundary around Claude's shell commands. It is off by default; run /sandbox, or set sandbox.enabled to true:

{
  "sandbox": {
    "enabled": true
  }
}

Sandboxed commands can write only to the working directory, a per-user temp directory and added directories, and network traffic goes through a local proxy whose allowed domains start empty. macOS uses Seatbelt; Linux and WSL2 need bubblewrap and socat. Native Windows is not supported. The sandbox wraps shell commands only: built-in file and web tools follow permission rules, hooks and local MCP servers run with your full access, and sandboxed commands can still read files such as ~/.ssh until you add denyRead entries. For one boundary around everything, Anthropic suggests running Claude Code itself in a container, VM or dev container.

Keep bypass mode off your laptop

bypassPermissions, also enabled by --dangerously-skip-permissions, turns off prompts and safety checks. Anthropic: "Only use this mode in isolated environments like containers, VMs, or dev containers without internet access, where Claude Code cannot damage your host system." Accepting its warning dialog once writes skipDangerousModePermissionPrompt to your user settings; remove that key if you accepted by mistake.

How do updates work, and how do you pin or disable them?

The setup page tells package manager users to upgrade "to get the latest features and security fixes," so updates are part of running Claude Code safely.

Native installs check on startup and periodically, download in the background and apply the update at your next start. To update now, run claude update; claude doctor shows the last update attempt. Other routes:

Avoid npm update -g, which respects the original semver range and may not reach the newest release. For Homebrew and WinGet, setting CLAUDE_CODE_PACKAGE_MANAGER_AUTO_UPDATE to 1 lets Claude Code run the upgrade for you; apt, dnf and apk always need a manual upgrade because they need elevated privileges.

Channels, floors and freezes

The autoUpdatesChannel setting chooses "latest" (the default) or "stable". minimumVersion sets a floor that updates will not go below. Together:

{
  "autoUpdatesChannel": "stable",
  "minimumVersion": "2.1.100"
}

Homebrew picks the channel by cask name and the Linux repositories by URL, so this setting does not apply to them. In managed settings, requiredMinimumVersion and requiredMaximumVersion make Claude Code refuse to start outside a version range. To stop background updates, set DISABLE_AUTOUPDATER:

{
  "env": {
    "DISABLE_AUTOUPDATER": "1"
  }
}

That stops only the background check; claude update still works. DISABLE_UPDATES blocks every update path, for teams that distribute Claude Code through their own channels. A frozen version is only safer than auto-update if someone owns moving it forward.

Roll it out to a team

Managed settings sit at the top of the precedence order: managed, command line, project local, shared project, user. Nothing in a developer's files overrides a managed key, and a deny at any level cannot be allowed by another. They can come from a managed-settings.json file, an MDM policy or server managed settings in the claude.ai admin console; /status shows which source applies. A documented baseline: a managed permissions.defaultMode, permissions.disableAutoMode set to "disable" if you want auto mode removed, deny rules for secrets and production tooling, sandbox.enabled, a release channel and a version floor.

How do you uninstall Claude Code cleanly?

Remove the binary the way you installed it. If claude still runs, you have a second install; which -a claude lists every copy on macOS and Linux.

Native install on macOS, Linux and WSL:

rm -f ~/.local/bin/claude
rm -rf ~/.local/share/claude

Native install on Windows PowerShell:

Remove-Item -Path "$env:USERPROFILE\.local\bin\claude.exe" -Force
Remove-Item -Path "$env:USERPROFILE\.local\share\claude" -Recurse -Force

Homebrew uses brew uninstall --cask claude-code (or claude-code@latest), WinGet uses winget uninstall Anthropic.ClaudeCode, and npm uses npm uninstall -g @anthropic-ai/claude-code. For apt and dnf, remove the repository entry and key too:

sudo apt remove claude-code
sudo rm /etc/apt/sources.list.d/claude-code.list /etc/apt/keyrings/claude-code.asc

sudo dnf remove claude-code
sudo rm /etc/yum.repos.d/claude-code.repo

For apk:

apk del claude-code
sed -i '\|downloads.claude.ai/claude-code/apk|d' /etc/apk/repositories
rm /etc/apk/keys/claude-code.rsa.pub

Remove configuration, history and credentials

This deletes "all your settings, allowed tools, MCP server configurations, and session history." The VS Code extension, JetBrains plugin and Desktop app also write to ~/.claude/, so uninstall them first. Anthropic says Claude Code manages stored credentials through /login and /logout, so run /logout before deleting files.

rm -rf ~/.claude
rm ~/.claude.json

Remove-Item -Path "$env:USERPROFILE\.claude" -Recurse -Force
Remove-Item -Path "$env:USERPROFILE\.claude.json" -Force

Project files are .claude and .mcp.json in each project directory. Remove them only where they are yours; a committed .claude/settings.json belongs to the team.

Common errors and how to fix them

From Anthropic's installation troubleshooting page.

"command not found: claude" or "'claude' is not recognized"

The install folder is not on your PATH. For Zsh, the macOS default:

echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc

Use ~/.bashrc for Bash on Linux and ~/.bash_profile for Bash on macOS. On Windows PowerShell:

$currentPath = [Environment]::GetEnvironmentVariable('PATH', 'User')
[Environment]::SetEnvironmentVariable('PATH', "$currentPath;$env:USERPROFILE\.local\bin", 'User')

Then open a new terminal, and restart your editor if the terminal runs inside one.

Wrong command for your Windows shell

"'irm' is not recognized" means you are in CMD; use the CMD installer. "The token '&&' is not a valid statement separator" means you ran the CMD command in PowerShell. An fsSL parameter error means you ran the macOS and Linux command in PowerShell, where curl is an alias for Invoke-WebRequest.

HTML instead of a script, or a 403

If the error mentions the app being unavailable in your region, Claude Code is not offered in your country. Otherwise it is often a proxy, firewall or outage. Test the download host:

curl -sI https://downloads.claude.ai/claude-code-releases/latest

On Windows, call curl.exe. Behind a corporate proxy, set both variables before installing:

export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080
curl -fsSL https://claude.ai/install.sh | bash

TLS or SSL errors

On Ubuntu and Debian, update CA certificates:

sudo apt-get update && sudo apt-get install ca-certificates

On macOS, updating macOS updates the root certificates. Never "fix" TLS errors by turning off certificate checks.

"running scripts is disabled on this system"

This is PowerShell's execution policy blocking npm's .ps1 launchers. Allow local scripts for your user, call the .cmd launchers, or use the PowerShell installer, which installs a binary:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

npm errors inside WSL

A platform mismatch means WSL is using the Windows npm; the docs suggest npm config set os linux and reinstalling without sudo. exec: node: not found means Node is coming from /mnt/c/. The native installer avoids both, since it does not use Node.

Login does not complete in WSL2, SSH or a container

Paste the code the browser shows, or run claude auth login. From WSL2 you can also press c to copy the login URL and open it yourself.

Common mistakes

• Copying install commands from anywhere but code.claude.com. A domain that is close is not good enough.
• Using sudo npm install -g. Anthropic says not to.
• Skipping the fingerprint check on the apt or dnf key. HTTPS proves where the file came from, not that it is the right key.
• Assuming the first session asks before every command. On v2.1.283 and later it starts in auto mode.
• Treating CLAUDE.md as a security control. Rules, modes, hooks and the sandbox are the controls.
• Running --dangerously-skip-permissions on a laptop. Anthropic limits it to isolated containers and VMs.
• Installing with Homebrew or WinGet and never upgrading.
• Leaving the repository entry and key behind after uninstalling.

Fix it without waiting for upstream

A verified, current Claude Code is the easy part. Once it helps you write code it also helps you add dependencies, and each new package brings its own vulnerabilities and its own release schedule.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

FAQ

How do I install Claude Code on Windows 11?

In PowerShell run irm https://claude.ai/install.ps1 | iex, or use the install.cmd command in Command Prompt. No Administrator rights are needed. Open a new terminal and run claude --version. Use WSL 2 instead if you want sandboxed shell commands.

How do I install Claude Code on a Mac?

Run curl -fsSL https://claude.ai/install.sh | bash, or brew install --cask claude-code. You need macOS 13.0 or later. The native install updates itself; the Homebrew cask does not.

How do I install Claude Code on Ubuntu?

Use the native installer, or add Anthropic's signed apt repository after checking the key fingerprint is 31DDDE24DDFAB679F42D7BD2BAA929FF1A7ECACE, then run sudo apt install claude-code. Ubuntu 20.04 or later is supported.

Do I need Node.js to install Claude Code?

No. Only the npm route needs it (Node.js 22 or later), and even then the binary does not use Node at runtime.

Is the curl install script for Claude Code safe?

It is Anthropic's recommended route, served from claude.ai over HTTPS, but Anthropic does not publish a separate signature for the script. For a cryptographic check before anything runs, use the signed apt, dnf or apk repositories, or verify the binary against the signed manifest.json.

Can I use Claude Code for free?

Not with the free claude.ai plan. It needs a Pro, Max, Team, Enterprise or Console account, or a supported cloud provider.

How do I update Claude Code?

Native installs update automatically; claude update updates now. Homebrew, WinGet, apt, dnf and apk need their own upgrade commands. For npm, use npm install -g @anthropic-ai/claude-code@latest.

How do I stop Claude Code from running commands without asking?

Start with claude --permission-mode default, or set permissions.defaultMode in ~/.claude/settings.json. Add ask and deny rules with /permissions.

How do I completely uninstall Claude Code?

Remove the binary for your install method, then delete ~/.claude and ~/.claude.json, plus project .claude and .mcp.json files that are yours. Uninstall the VS Code extension, JetBrains plugin and Desktop app first.

See how Safeguard would help

Safeguard does not install Claude Code or check its installer; Anthropic's steps above do that. It fits once Claude Code is working in your repositories, where it can scan a repository, read an SBOM and check an advisory from inside the conversation. The route to use is the directory: add Safeguard from Claude's connector directory on web, desktop or mobile and sign in once with OAuth, with no API key to create or paste. Anthropic's MCP page says connectors added in claude.ai "are automatically available in Claude Code" when you log in with a claude.ai account, and /mcp marks them as coming from claude.ai. They do not load when an API key, cloud provider or setup-token credential is active. Adding Safeguard by URL at https://mcp.safeguard.sh/mcp is the fallback. Anthropic reviews directory connectors against listing criteria but does not security audit MCP servers, so apply your permission rules to connector tools as well. To try the standalone tools, download Safeguard and follow the CLI setup guide.

The first demo connects Claude to the Safeguard MCP server with OAuth and shows how you choose which Safeguard tools Claude can use. That choice sits alongside Claude Code's own permission rules, which match MCP tools in the mcp__ form, so connector tools can be set to ask or deny like any Bash command.

Click through it at your own pace, or open it full screen.

The second demo is a real Safeguard CLI session. After install, safeguard opens the interactive terminal, you ask it to fix the lodash CVE in a repo, and it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing, then shows /permissions, /model and /scan .. It is the fix you want when a dependency added during a Claude Code session turns out to be vulnerable.

Click through it at your own pace, or open it full screen.

The third demo sets up the Safeguard runner on your own machine, approves it with its device code, and then scans from the terminal. That gives you a dependency inventory of the repositories you work on with Claude Code without moving the code anywhere else.

Click through it at your own pace, or open it full screen.

For more on running Claude Code safely, see our practical Claude Code security guide, the Claude Code GitHub Action security checklist and the Safeguard CLI as a security aware coding assistant.

Quick check

Sources

• Claude Code Docs: Advanced setup
• Claude Code Docs: Quickstart
• Claude Code Docs: Overview
• Claude Code Docs: Troubleshoot installation and login
• Claude Code Docs: Troubleshooting
• Claude Code Docs: Authentication
• Claude Code Docs: Security
• Claude Code Docs: Choose a permission mode
• Claude Code Docs: Configure permissions
• Claude Code Docs: Sandboxing
• Claude Code Docs: Settings
• Claude Code Docs: Data usage
• Claude Code Docs: Connect Claude Code to tools via MCP
• Claude Code Docs: Use Claude Code in VS Code
• Safeguard: Download

Last reviewed: 23 October 2026. Claude Code ships often and its defaults change between versions; check the linked Anthropic pages for the behaviour of your version.