1.0.1 — Latest

CoreLink Registry

Download the CLI, SDKs, and platform agents for every supported operating system and architecture. Every release ships a SHA256 manifest so you can verify what you downloaded.

Last updated: July 26, 2026

Quick Install
$curl -fsSL https://usecorelink.com/install.sh | sh
Detected: macOS
Download Binaries
macOS
1.0.1 — Intel + Apple Silicon
arm64 amd64
corelink-cli-v1.0.1-darwin-arm64.tar.gz corelink-cli-v1.0.1-darwin-amd64.tar.gz
Linux
1.0.1 — glibc 2.17+
amd64 arm64
corelink-cli-v1.0.1-linux-amd64.tar.gz corelink-cli-v1.0.1-linux-arm64.tar.gz
Windows
1.0.1 — Windows 10 / Server 2019+
amd64
corelink-cli-v1.0.1-windows-amd64.zip
Verify Installation
corelink --version
Available SDKs
Go
1.0.1 — Transit client for Go applications
After downloading 
tar -xzf corelink-sdk-go.tar.gz
Quick-start example 
import "github.com/techblend/corelink-go/v2"

func main() {
    client := corelink.NewClient(
        corelink.WithAPIKey(os.Getenv("CORELINK_API_KEY")),
    )
    secret, err := client.Secrets.Get(ctx, "my-db-password")
    if err != nil {
        log.Fatal(err)
    }
    fmt.Println(secret.Value)
}
Download Package View SDK docs
Python
1.0.1 — Transit client for Python applications
After downloading 
pip install ./corelink-sdk-python.tar.gz
Quick-start example 
import corelink
import os

client = corelink.Client(
    api_key=os.environ["CORELINK_API_KEY"]
)
secret = client.secrets.get("my-db-password")
print(secret.value)
Download Package View SDK docs
Java
1.0.1 — Transit client for JVM applications
After downloading 
tar -xzf corelink-sdk-java.tar.gz
Quick-start example 
CoreLinkClient client = CoreLinkClient.builder()
    .apiKey(System.getenv("CORELINK_API_KEY"))
    .build();

Secret secret = client.secrets().get("my-db-password");
System.out.println(secret.getValue());
Download Package View SDK docs
.NET
1.0.1 — Transit client for .NET applications
After downloading 
dotnet add reference corelink-sdk-dotnet.dll
Quick-start example 
using CoreLink;

var client = new CoreLinkClient(new CoreLinkOptions
{
    ApiKey = Environment.GetEnvironmentVariable("CORELINK_API_KEY")
});

var secret = await client.Secrets.GetAsync("my-db-password");
Console.WriteLine(secret.Value);
Download Package View SDK docs
Node.js
1.0.1 — Transit client for Node.js applications
After downloading 
tar -xzf corelink-sdk-node.tar.gz
Quick-start example 
const { TransitClient } = require("@techblend/transit");

const client = new TransitClient({
    transitUrl: "http://127.0.0.1:8200",
    platformUrl: "https://usecorelink.com",
    nhiId: process.env.NHI_ID,
});

await client.bootstrap();
const value = await client.getSecret("db-password");
Download Package View SDK docs
Ruby
1.0.1 — Transit client for Ruby applications
After downloading 
tar -xzf corelink-sdk-ruby.tar.gz
Quick-start example 
require "transit_client"

client = TransitClient::Client.new(
  transit_url: "http://127.0.0.1:8200",
  platform_url: "https://usecorelink.com",
  nhi_id: ENV["NHI_ID"]
)

client.bootstrap
value = client.get_secret("db-password")
Download Package View SDK docs
Platform Agents
Transit Agent
Bridges airgapped environments to CoreLink Cloud
Linux macOS Windows
Start NHI_ID=<your-nhi-id> PLATFORM_URL=https://usecorelink.com corelink-transit-agent
Setup (NHI attestation)

Create a Non-Human Identity in the CoreLink self-service portal (Self-Service > New NHI), then set the two environment variables below. No tokens are issued -- the agent authenticates via host fingerprint attestation on first connect. An admin approves the first connection; subsequent connects auto-approve when the fingerprint matches.

Install & start (Linux) 
tar -xzf corelink-transit-agent.tar.gz
sudo mv corelink-transit-agent /usr/local/bin/
export NHI_ID="<your-nhi-id>"
export PLATFORM_URL="https://usecorelink.com"
corelink-transit-agent
Configuration (agent.yaml) 
agent:
  nhi_id: "<your-nhi-id>"
  platform_url: "https://usecorelink.com"
  interval: 30s
Download binary Linux amd64 Linux arm64 macOS arm64 Windows amd64
Kubernetes Operator
Passwordless workload identity + secrets sync. One operator, no pre-shared tokens.
EKS GKE AKS kind / k3d OpenShift
Install kubectl apply -f https://usecorelink.com/static/downloads/k8s/tbcl-k8s-nhi-operator.yaml
Setup (no pre-shared secret)

Create a workload template under Tenant > Workload Templates with attestation type kubernetes, the cluster's OIDC issuer URL, and audience corelink. The operator runs in your cluster as a Deployment and detects pods that mount a projected ServiceAccount token with that audience, mints a short-lived JWT for each via the Kubernetes TokenRequest API, and POSTs it to /api/v1/nhi-agent/connect for JIT NHI registration. The same operator can also mirror CoreLink secrets into native Kubernetes Secret objects (controlled via OPERATOR_MODE in the bundled ConfigMap).

Install in cluster 
# 1. Download the manifest and edit tbcl-config (endpoint, tenant_id)
curl -O https://usecorelink.com/static/downloads/k8s/tbcl-k8s-nhi-operator.yaml

# 2. Apply -- creates the corelink-system namespace, ServiceAccount, RBAC,
#    Deployment, and an example secrets-sync ConfigMap.
kubectl apply -f tbcl-k8s-nhi-operator.yaml

# 3. Verify
kubectl -n corelink-system rollout status deploy/tbcl-k8s-operator
kubectl -n corelink-system logs deploy/tbcl-k8s-operator --tail=20

The operator image lives at ghcr.io/dw-develop/tbcl-k8s-nhi-operator:latest. Anonymous pulls are currently rejected, so add an imagePullSecret for GitHub Container Registry to the corelink-system namespace before applying the manifest. EKS, GKE, AKS, kind, k3d and OpenShift are all supported.

Running outside the cluster (airgap, jumphost, validation)

If you can't run the operator in-cluster -- airgapped registries, no admin access to apply Deployments, validating before in-cluster install -- the same binary runs as a host-level daemon using a kubeconfig. The installer applies the same RBAC and mints a least-privilege ServiceAccount kubeconfig for the daemon to use.

# Linux / macOS
curl -fsSL https://usecorelink.com/static/downloads/k8s/tbcl-k8s-nhi-operator-installer.tar.gz | tar -xz
sudo k8s-nhi-operator/install.sh --endpoint https://usecorelink.com --tenant-id <your-tenant-uuid>

# Windows (elevated PowerShell)
Invoke-WebRequest -Uri https://usecorelink.com/static/downloads/k8s/tbcl-k8s-nhi-operator-installer.zip -OutFile installer.zip
Expand-Archive installer.zip
.\installer\k8s-nhi-operator\install.ps1 -Endpoint https://usecorelink.com -TenantId <your-tenant-uuid>
Opt a workload in 
apiVersion: v1
kind: Pod
metadata:
  name: myapp-web
  namespace: prod
spec:
  serviceAccountName: myapp-web
  containers:
    - name: app
      image: nginx:alpine
      volumeMounts:
        - name: corelink-token
          mountPath: /var/run/secrets/corelink
          readOnly: true
  volumes:
    - name: corelink-token
      projected:
        sources:
          - serviceAccountToken:
              path: token
              audience: corelink
              expirationSeconds: 3600
Operator configuration (/etc/corelink-nhi/operator.env) 
CORELINK_ENDPOINT=https://usecorelink.com
CORELINK_TENANT_ID=<your-tenant-uuid>
CORELINK_AUDIENCE=corelink
KUBECONFIG=/etc/corelink-nhi/kubeconfig
POLL_INTERVAL=30s
SESSION_REFRESH=10m

install.sh writes both files; the daemon runs as the system user corelink-nhi. Logs: journalctl -u tbcl-k8s-nhi-operator -f.

Download installer installer.tar.gz installer.zip Linux amd64 Linux arm64 macOS arm64 Windows amd64 Windows arm64
Prefer the in-cluster pattern? An in-cluster manifest is also available. It does the same thing but runs as a Pod with a published image.
Windows Session Agent
JIT accounts, session recording for RDP targets
Windows
Install .\tbcl-windows-agent.exe install --server <url> --target-id <id> --nhi-id <your-nhi-id>
Setup (NHI attestation)

Create a Non-Human Identity in the CoreLink self-service portal (Self-Service > New NHI), copy the NHI ID, then pass it during install. No token is required -- the agent authenticates via host fingerprint attestation.

Install (Windows) 
# Extract and run as Administrator
.\corelink-windows-agent.exe --install
Configuration & service management 
# Register the service (NHI attestation -- no token required)
.\tbcl-windows-agent.exe install `
  --server    https://usecorelink.com `
  --target-id <target-id-from-ui> `
  --nhi-id    <your-nhi-id>

# Start the service
sc start TBCLWindowsAgent

# Verify status
Get-Service -Name TBCLWindowsAgent

# Uninstall
.\tbcl-windows-agent.exe uninstall
Download binary Windows amd64
Must be run from an elevated (Administrator) prompt. The service runs as LocalSystem. The NHI ID (nhi_...) is obtained from the self-service portal after creating a Non-Human Identity.
MCP Server
Model Context Protocol for AI assistants
Claude OpenAI Gemini Cursor Windsurf
1. Generate an MCP token

Go to Developer > MCP Tokens in the CoreLink dashboard to create an API key for your MCP server.

2. Configure your AI tool

Add the CoreLink MCP server to your AI tool's configuration. The server URL is your CoreLink instance.

Claude / Claude Code 
// claude_desktop_config.json or .claude/settings.json
{
  "mcpServers": {
    "corelink": {
      "url": "https://usecorelink.com/mcp",
      "headers": {
        "Authorization": "Bearer mcp_xxxxxxxxxxxx"
      }
    }
  }
}
OpenAI / ChatGPT 
# Use the CoreLink MCP endpoint as a tool server
# MCP URL: https://usecorelink.com/mcp
# Auth: Bearer mcp_xxxxxxxxxxxx

# Available tools:
#   get_secret, list_secrets, create_secret,
#   rotate_secret, list_audit_events
Google Gemini 
# Use the CoreLink MCP endpoint as a tool server
# MCP URL: https://usecorelink.com/mcp
# Auth: Bearer mcp_xxxxxxxxxxxx
Cursor / Windsurf 
// .cursor/mcp.json or .windsurf/mcp.json
{
  "mcpServers": {
    "corelink": {
      "url": "https://usecorelink.com/mcp",
      "headers": {
        "Authorization": "Bearer mcp_xxxxxxxxxxxx"
      }
    }
  }
}
Scan Agent
Detects exposed secrets in repos and filesystems
Linux macOS Windows
Scan corelink-scan --dir /path/to/repo --output json
Install (Linux) 
tar -xzf corelink-scan-agent.tar.gz
sudo mv corelink-scan-agent /usr/local/bin/
GitHub Actions integration 
- uses: techblend/corelink-scan-action@v2
  with:
    api-key: ${{ secrets.CORELINK_API_KEY }}
Download binary Linux amd64 macOS arm64
EPM Agent
Endpoint posture reporting for access gating
Linux macOS Windows
Start NHI_ID=<your-nhi-id> PLATFORM_URL=https://usecorelink.com corelink-epm-agent
Setup (NHI attestation)

Create a Non-Human Identity in the CoreLink self-service portal (Self-Service > New NHI), copy the NHI ID, then set the two environment variables below. No token is required.

Install & start 
tar -xzf corelink-epm-agent.tar.gz
sudo mv corelink-epm-agent /usr/local/bin/
export NHI_ID="<your-nhi-id>"
export PLATFORM_URL="https://usecorelink.com"
corelink-epm-agent
Configuration (epm-agent.yaml) 
epm:
  nhi_id: "<your-nhi-id>"
  platform_url: "https://usecorelink.com"
  check_interval: 5m
  edr_integrations:
    - "crowdstrike"
    - "sentinelone"
Download binary Windows amd64 macOS arm64 Linux amd64

Verify your download

Every release ships a SHA256 manifest. Check your archive against it before you run it.

shasum -a 256 -c corelink-v1.0.1-checksums.txt
SHA256 Checksums (1.0.1)