Install on Linux

LaunchZero ships for Linux as a .deb package (Debian, Ubuntu, Mint, Pop!_OS…) and an .rpm package (Fedora, RHEL, openSUSE…), for both x86_64 and arm64. The gateway, policy, approvals, and Activity run on your own hardware. Monitored tools and LaunchZero-managed integrations use that local policy path.

What you download and install is LaunchZero Setup - the setup wizard. It carries the product payload, then installs and starts LaunchZero on first launch.

Requirements

• A 64-bit machine - x86_64 or arm64 (aarch64).
• glibc 2.31 or newer - Ubuntu 20.04+, Debian 11+, Fedora 33+, openSUSE Leap 15.3+ (or newer).
• libwebkit2gtk-4.1 - installed automatically by the .deb / .rpm as a package dependency.
• appindicator support for the tray icon (recommended by the .rpm).
• A few hundred MB of free disk space.
• Nothing else to install. The .NET runtime is bundled with the installer, and the setup wizard installs Node.js for you if it isn’t already present (Node is used by OpenClaw). You don’t need to install an AI agent first - the wizard installs and configures OpenClaw, Hermes, or both, running side by side.

Grab the package that matches your distribution and architecture from the download page.

Install

The package installs its WebKit dependency for you - this is why the package is the recommended path on Linux over any script-based install. Install it with your package manager:

# Debian, Ubuntu, Mint, Pop!_OS…
sudo apt install ./LaunchZero-*-linux-x64.deb

# Fedora, RHEL…
sudo dnf install ./LaunchZero-*-linux-x64.rpm

# openSUSE
sudo zypper install ./LaunchZero-*-linux-x64.rpm

On an arm64 machine, use the -linux-arm64 package instead.

Then launch LaunchZero from your applications menu. There is no terminal command to run - the package installs no /usr/bin entry by design. The first launch runs the setup wizard; every launch after that opens the tray app, from the same menu entry.

Verify the download

Confirm the file matches the published hash before you install it. Every release ships a SHA256SUMS manifest covering every artifact; check your download against it:

sha256sum -c SHA256SUMS --ignore-missing

Run it in the directory holding both the package and SHA256SUMS. --ignore-missing checks only the files you actually have. If the check reports anything other than OK for your package, delete it and download it again - do not install it. The checksums section has the full verify steps.

First run

The first time you launch LaunchZero, the setup wizard:

1. Brings up the gateway - the three planes (GatewayServer decides, Executor runs, HostIntegrity watches) - and initializes the encrypted, machine-bound secret store.
2. Applies the recommended Balanced posture: common reads may run, selected writes and sends ask for approval, and unknown calls deny.
3. Detects, installs, and configures your agent - OpenClaw, Hermes, or both, running side by side - and sets up the model and API key.

A system-tray supervisor keeps the gateway running while you’re logged in.

Confirm it’s running

There’s no CLI to check - status lives in the tray and the dashboard.

• The tray icon shows the gateway running.
• After setup, the tray supervisor launches the ControlApp, which opens the dashboard already signed in - it runs locally on your machine. Open it any time from the tray icon - Home shows the system healthy and your agent connected, and Agents shows it running.

Where things live

• The setup wizard and menu entry are installed by the package under /usr/lib/launchzero/ and /usr/share/applications/.
• The product itself installs to ~/.local/share/launchzero.
• Configuration, policy, and the machine-bound secret store: ~/.launchzero (subfolders db/, logs/, keys/).

See Configuration for what each file controls.

Uninstalling

Uninstall LaunchZero from its own uninstaller, reached from the tray menu. It removes LaunchZero’s apps and configuration and cleans LaunchZero’s entries out of your agent configs, and can optionally uninstall the agents themselves (OpenClaw and Hermes) if you choose. It handles cleanup, including the machine-bound secret store, so any secrets it held can’t be recovered afterward.

Next steps

• Quickstart - install to a monitored, approvable call in minutes.
• Connect your agent - what the wizard writes into your agent’s config, and running OpenClaw and Hermes side by side.