Install on Windows

This guide installs LaunchZero on Windows 10 or 11. LaunchZero is local-first: what you download is LaunchZero Setup - a single .exe that carries the product payload. Run it and the setup wizard does first-run configuration, installs LaunchZero, and a system-tray supervisor keeps the gateway running. When you’re done, monitored tools and LaunchZero-managed integrations use the applicable policy, and governed activity is recorded for verification.

Requirements

• Windows 10 or 11, x64 (Arm64 builds are offered under “Other builds” when available).
• A few hundred MB of free disk space.
• Nothing else to install. The .NET runtime is bundled with the installer, and the setup wizard installs Node.js for you if it isn’t already present (Node is used by OpenClaw).

The download page carries the authoritative requirements; if anything here disagrees with it, the download page wins.

Install

1. Open the download page and download the Windows installer, LaunchZero-<version>-win-x64.exe.
2. Run it. The setup wizard walks you through first-run configuration.
3. Follow the prompts to the end, then launch LaunchZero. It lands in your system tray.

Verify the download

Compute the SHA-256 hash of the installer and compare it to the published SHA256SUMS manifest:

Get-FileHash .\LaunchZero-*-win-x64.exe -Algorithm SHA256

Compare the Hash value against the entry for your file in SHA256SUMS, listed at /download/#checksums. They must match exactly. If they don’t, delete the file and download it again - do not run it. On Windows this checksum is the honest answer to the SmartScreen warning above.

First run

On first launch the setup wizard configures everything and:

1. Brings up the gateway - the three planes (GatewayServer decides, Executor runs, HostIntegrity watches) - and initializes the encrypted, machine-bound secret store whose keys are sealed to this machine.
2. Applies the recommended Balanced posture: common reads may run, selected writes and sends ask for approval, and unknown calls deny.
3. Detects, installs, and configures your agent - OpenClaw, Hermes, or both, running side by side - sets up the model and API key, and installs Node.js if it’s missing (for OpenClaw). No terminal, no hand-edited config.

When the wizard finishes, the system-tray supervisor keeps the gateway running in the background and restarts it if it stops. The tray icon shows the current state.

Confirm it’s running

There’s no CLI to check - status lives in the tray and the dashboard.

• The tray icon shows the gateway running.
• After setup, the tray supervisor launches the ControlApp, which opens the dashboard already signed in - it runs locally on your machine. Open it any time from the tray icon - the Home page shows the system healthy and your agent connected, and the Agents page shows it running.

Where things live

• Configuration, policy, and the machine-bound secret store: %USERPROFILE%\.launchzero (subfolders db\, logs\, keys\).
• The program itself: %LOCALAPPDATA%\LaunchZero.

Paste %USERPROFILE%\.launchzero into the Explorer address bar to open it. See Configuration for what each file controls.

Uninstalling

Open Settings → Apps → Installed apps, find LaunchZero, and choose Uninstall. This launches the LaunchZero uninstall wizard, which stops the tray supervisor, removes LaunchZero’s apps and configuration, and cleans LaunchZero’s entries out of your agent configs. The wizard can optionally uninstall the agents themselves (OpenClaw and Hermes) if you choose, or leave them in place. You don’t need to delete anything by hand - the uninstaller handles cleanup, including the machine-bound secret store, so any secrets it held can’t be recovered afterward.

Next steps

• Quickstart - from installed to a monitored tool call in minutes.
• Connect your agent - what the wizard writes into your agent’s config, and running OpenClaw and Hermes side by side.