TrustRail Desktop

The operator console as a native app: approvals inbox, action ledger, kill switches, and a built-in assistant that finds the agents already on your computer. Version 0.9.2.

Already installed?

Open Setup Assistant

Scan known agent configs locally and choose what to bring over.

Scan my computer

macOS

Apple silicon and Intel · macOS 12+

Download .dmg (Apple silicon)TrustRail-0.9.2-arm64.dmgsha256 06886010e3f44089ea1f4d59d5bd7d1490ddf8e3ad4bd7a3109363e5d819c8e9Intel: TrustRail-0.9.2-x64.dmg

Windows

Windows 10 and 11 · x64

Download installerTrustRail-Setup-0.9.2.exesha256 b867e28b4df2719210b877ef6fc40245fb32d843eeda858e0551b70657a55fb8

Linux

AppImage and Debian package · x64

Download AppImageTrustRail-0.9.2.AppImagesha256 c43f0f76d157439dbd647e448fdb85b318ea3906e28ef193e86053d193ef0315Debian/Ubuntu: trustrail-desktop_0.9.2_amd64.deb

Every checksum above was computed on the machine that produced the file, before it moved; SHA256SUMS carries the same lines at the release host. shasum -a 256 -c SHA256SUMS checks what you have. A platform showing a build command instead of a button has no installer published yet.

Opening it the first time

TrustRail Desktop is not yet signed with a paid Apple or Microsoft publisher certificate, so both systems ask once before the first launch. The checksum above is how you confirm the file is the one we built.

  • macOS: open the .dmg and drag TrustRail to Applications. On first launch macOS says it cannot verify the developer — open System Settings → Privacy & Security, scroll down, and click Open Anyway. You only do this once.
  • Windows: if SmartScreen appears, click More info, then Run anyway.
  • Linux: chmod +x TrustRail-0.9.2.AppImage and run it, or install the .deb with sudo apt install ./ followed by the file name.

Connecting the app

  1. Install and open TrustRail Desktop.
  2. Let Setup Assistant scan the known local config locations, choose what to bring over, then select your team's TrustRail workspace. Scanning and preparing the import need no Docker, terminal, Node.js, or local stack.
  3. Sign in the same way as in the web dashboard, because the app opens your workspace's own sign-in page: your email and password, plus a passkey or authenticator code if you've added one, or your organization's single sign-on where the workspace has it set up. Sessions and permissions are the dashboard's. The app keeps only your chosen deployment origins in its config; the session cookie is held in the OS keychain-backed browser session for that deployment, exactly as a browser would, and is cleared on sign-out.

Have a self-hosted workspace instead? You can still enter its HTTPS origin (or a loopback development origin) in the last setup step.

Security posture

  • Renderer runs with context isolation; no Node integration in web content.
  • Navigation is restricted to the deployment origin you configured.
  • Provider credentials never reach the app — they live only in the TrustRail gateway.