Install on macOS

This guide installs LaunchZero on macOS, on Apple silicon or Intel. What you download is LaunchZero Setup - a signed, notarized .zip that carries the product payload. The build is local-first: the gateway, policy, approvals, and Activity run on your machine, and the setup wizard plus a menu-bar supervisor keep the gateway online.

Requirements

• Apple silicon or Intel - the download page defaults to the Apple Silicon build, with Intel one click away. Not sure which you have? Apple menu → About This Mac.
• A few hundred MB of free disk space.
• A standard user account is fine; you don’t need to disable Gatekeeper or SIP.
• Nothing else to install. The .NET runtime is bundled with the installer, and the setup wizard installs Node.js for you if it isn’t already present (Node is used by OpenClaw).

Install

1. Download the .zip from the download page - LaunchZero-<version>-osx-arm64.zip for Apple Silicon, or -osx-x64.zip for Intel.
2. Double-click the zip - it expands to Install LaunchZero.app.
3. Double-click Install LaunchZero.app - the setup wizard opens. LaunchZero then lives in your menu bar (there’s no Dock icon).

Verify the download

Confirm the download matches the published hash before you run it. Every release ships a SHA256SUMS manifest covering every artifact; check your download against it (run this in the directory holding both the .zip and SHA256SUMS):

shasum -a 256 -c SHA256SUMS --ignore-missing

--ignore-missing checks only the files you actually have. If the check reports anything other than OK for your .zip, stop and re-download rather than running it. The checksums section has the full verify steps.

First run

The first time you run Install LaunchZero.app, the setup wizard:

1. Brings up the gateway - the three planes (GatewayServer decides, Executor runs, HostIntegrity watches) - and seals the encrypted, machine-bound secret store to this Mac.
2. Applies the recommended Balanced posture: common reads may run, selected writes and sends ask for approval, and unknown calls deny.
3. Detects, installs, and configures your agent - OpenClaw, Hermes, or both, running side by side - and sets up the model and API key, so you reach a governed agent without a terminal or hand-edited config.

When it finishes, a menu-bar supervisor appears in the macOS status bar. It keeps the gateway running and is where you’ll see approval prompts and gateway status.

Confirm it’s running

There’s no CLI to check - status lives in the menu bar and the dashboard.

• The menu-bar icon shows the gateway running.
• After setup, the menu-bar supervisor launches the ControlApp, which opens the dashboard already signed in - it runs locally on your machine. Open it any time from the menu-bar icon - Home shows the system healthy and your agent connected, and Agents shows it running.

Where things live

• Configuration, policy, and the machine-bound secret store: ~/.launchzero (subfolders db/, logs/, keys/).

Keys managed through LaunchZero live in the encrypted, machine-bound secret store rather than plaintext LaunchZero-managed configuration. See Configuration for what each file controls.

Uninstalling

Uninstall LaunchZero from its own uninstaller, reached from the menu-bar supervisor. It removes LaunchZero’s apps and configuration and cleans LaunchZero’s entries out of your agent configs, and can optionally uninstall the agents themselves (OpenClaw and Hermes) if you choose, or leave them in place. You don’t need to delete ~/.launchzero by hand - the uninstaller handles cleanup, including the machine-bound secret store, so any secrets it held can’t be recovered afterward.

Next steps

• Quickstart - install to a monitored, approvable call in minutes.
• Connect your agent - what the wizard writes into your agent’s config, and running OpenClaw and Hermes side by side.