SDKs & CLI

Agent Installation

Four agent binaries extend CoreLink beyond the SaaS boundary. All support macOS, Linux, and Windows across amd64 and arm64. Download links on the Registry. All agents authenticate via NHI passwordless attestation -- no tokens, no certificates, no API keys.

Transit Agent

Bridges airgapped and on-premises environments -- no inbound firewall rules required

NHI passwordless attestation -- no config file required Environment variables (set before starting)

# No configuration file needed.
# Set two environment variables and start the agent:
NHI_ID=<your-nhi-id>          # from Self-Service → NHI Onboarding
PLATFORM_URL=https://usecorelink.com

Linux -- systemd service

sudo systemctl enable --now corelink-agent

Download the agent binary

VER=1.0.1
BASE=https://usecorelink.com/static/downloads/v$VER

curl -LO $BASE/corelink-transit-agent-v$VER-linux-amd64.tar.gz
tar -xzf corelink-transit-agent-v$VER-linux-amd64.tar.gz
sudo mv corelink-transit-agent /usr/local/bin/

Kubernetes (sidecar or DaemonSet)

The agent container image is published to a private registry, so this manifest needs an imagePullSecret. If you would rather not manage one, bake the downloaded binary into your own base image -- the tarball above is the supported distribution route.

containers:
  - name: agent
    image: ghcr.io/dw-develop/corelink-transit-agent:latest
    env:
      - name: NHI_ID
        valueFrom:
          secretKeyRef:
            name: nhi-ids
            key: transit-nhi-id
      - name: PLATFORM_URL
        value: "https://usecorelink.com"

MCP Server

Model Context Protocol integration for Claude, Cursor, and other AI assistants

Run with npx (no install required -- works on macOS, Linux, Windows)

npx @corelink/mcp-server

Claude Code / Cursor config (~/.claude/settings.json)

{
  "mcpServers": {
    "corelink": {
      "command": "npx",
      "args": ["-y", "@corelink/mcp-server"],
      "env": { "CORELINK_API_KEY": "sk_live_..." }
    }
  }
}

Read-only by default. Set CORELINK_MCP_ALLOW_WRITE=true to enable secret creation from AI tools.

Scan Agent

Detects secrets in Git repos and filesystems -- 120+ credential patterns across cloud, database, and SaaS targets

CLI -- scan a directory

# macOS / Linux
corelink-scan --dir /path/to/repo --output json

# Windows (PowerShell)
.\corelink-scan.exe --dir C:\repos\myapp --output json

GitHub Actions

- uses: techblend/corelink-scan-action@v2
  with:
    api-key: ${{ secrets.CORELINK_API_KEY }}
    fail-on-findings: true

Without an API key the scan runs standalone and outputs to stdout only. Provide CORELINK_API_KEY to push findings to the compliance dashboard.

Windows Session Agent

Installs on Windows RDP target machines. Provisions JIT local accounts, records sessions, and uploads recordings to CoreLink.

NHI passwordless attestation -- no tokens required Install -- run from an elevated PowerShell prompt

# Install and register the Windows Service (TBCLWindowsAgent)
.\tbcl-windows-agent.exe install `
  --platform https://usecorelink.com `
  --nhi-id <your-nhi-id> `
  --target-id <target-id>

# Start the service
sc start TBCLWindowsAgent

# Verify it is running
Get-Service -Name TBCLWindowsAgent

Create an NHI

Navigate to Self-Service → NHI Onboarding and create a new NHI for this target machine. Copy the NHI ID -- it is used in the install command above.

Run interactively (optional -- for testing)

.\tbcl-windows-agent.exe run `
  --platform https://usecorelink.com `
  --nhi-id <your-nhi-id> `
  --target-id <target-id> `
  --fps 5

Uninstall

.\tbcl-windows-agent.exe uninstall

The service runs as LocalSystem and auto-starts on boot. Config is stored DPAPI-encrypted at C:\ProgramData\tbcl\tbcl-config.json. Logs are written to C:\ProgramData\tbcl\tbcl-windows-agent.log.

The installer must be run from an elevated prompt (Run as Administrator). This agent is distinct from the Transit Agent and uses NHI attestation, not transit tokens.