Installation

The Installation section is where you generate, deploy, and manage Dev Machine Guard across your fleet. It has two pages:

• Script — a four-step wizard that generates a ready-to-deploy installation package for macOS, Windows, or Linux.
• Settings — organization-wide configuration, covering the telemetry key agents authenticate with, the scan schedule that controls how often devices run a full scan, and the device-activity threshold.

For step-by-step fleet rollout guides for each MDM platform, see MDM Deployment.

How Dev Machine Guard is deployed

Dev Machine Guard is delivered using a two-piece architecture:

• The loader script is a lightweight shell (macOS, Linux) or PowerShell (Windows) script that you deploy through your existing MDM or EDR tooling. It downloads the Dev Machine Guard binary, writes the embedded configuration to disk, and delegates execution to the binary.
• The Dev Machine Guard binary (stepsecurity-dev-machine-guard) is published on GitHub Releases at github.com/step-security/dev-machine-guard. On each scheduled run, the loader:

  • Fetches a signed version manifest from the StepSecurity API.
  • Verifies the manifest signature against the StepSecurity releases public key, which is embedded in the loader at the time it is generated.
  • Downloads the binary identified by the manifest from GitHub Releases.
  • Verifies the binary's SHA-256 against the value in the signed manifest.
  • Executes the binary only if both verifications pass.

  The signature is an Ed25519 SSH signature, verified using ssh-keygen -Y verify. The signing key ([email protected]) is held by StepSecurity and is the trust root for every released build. The corresponding public key, which you can use to independently verify the signed checksum, is:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILN+WG4lOH/x6MysYOf1oY0PKXLLu9d3ZvQDcvq5Cboi [email protected]

This separation has two practical benefits:

1. You only need to deploy the loader script once via MDM. Binary updates are delivered automatically the next time the loader runs, without requiring an MDM redeploy.
2. Every binary the loader runs is cryptographically tied back to a single trust root: the StepSecurity releases signing key. Because that key is embedded in the loader rather than a per-build checksum, devices stay safe across version changes without re-deploying the loader. Substituting a malicious binary would require compromising both the StepSecurity API and the offline signing key, not just one or the other.

Network requirements

Dev Machine Guard needs outbound HTTPS access to a small set of endpoints. If developer machines sit behind an egress proxy or firewall, authorize the following before deploying the agent:

Endpoint	Port	Purpose
agent.api.stepsecurity.io	443	Control plane APIs, including the signed version manifest the loader fetches on each run
customer-transient-data-277233109775.s3.us-west-2.amazonaws.com	443	Telemetry event upload
github.com	443	Agent binary download from GitHub Releases
release-assets.githubusercontent.com	443	GitHub Releases redirect target. Asset downloads on github.com return an HTTP 302 to this domain, so it must be authorized alongside github.com for the binary download to succeed

All connections are outbound only. The agent never listens for inbound connections.

A StepSecurity-hosted binary distribution endpoint is in progress for customers whose network policy does not permit github.com. Contact [email protected] if this applies to your environment.

Signed installer (Windows)

For Windows fleets, Dev Machine Guard also ships as a signed Windows Installer (.msi), published on GitHub Releases for both x64 and ARM64 architectures. The MSI integrates natively with Windows application-management tooling (SCCM, Intune Win32 apps, GPO software installation), exposes a standard ProductCode and UpgradeCode for detection and supersedence, and never spawns PowerShell during install, upgrade, or uninstall.

The MSI is the recommended path for production Windows fleets, especially in environments where EDR blocks PowerShell from making outbound network calls. See Windows MDM Deployment for details.

What the agent does not collect

The Dev Machine Guard binary is designed to collect only the metadata required for supply chain visibility. It does not collect:

• Source code
• Secrets or credentials
• Personal data outside the developer's installed tooling inventory

For details on what data Dev Machine Guard does collect, see the Devices page.