Install

Kenaz, a Kameas AI product.

Kenaz for Claude Code and Codex is the kenaz program and the plugin package for Claude Code and Codex. They come together in one archive per operating system and processor, which the one-line installers and Homebrew install. The Linux packages, npm and the Windows installer carry the kenaz program only; see Other ways to install.

Install in one command

macOS and Linux

curl -fsSL https://downloads.kameas.ai/kenaz-plugin/install.sh | sh

Windows (PowerShell)

irm https://downloads.kameas.ai/kenaz-plugin/install.ps1 | iex

Then run `kenaz init`

kenaz init

The installer ends with Run: kenaz init. If your terminal can't find kenaz yet, run the path the installer printed instead (for example ~/.local/bin/kenaz init), or on Windows open a new terminal.

kenaz init sets everything up in one go and asks before every change:

Puts kenaz on your PATH. On macOS and Linux it shows the change to your shell profile as a diff and asks first. On Windows it asks first, then adds the folder to your user Path.
Signs you in with kenaz login, if you aren't signed in yet. See Sign in and choose what to share.
Finds your apps: Claude Code, Claude Desktop, the Codex CLI and the ChatGPT desktop app.
Runs setup for each one it found, showing each diff and asking Apply? [y/N]. See Claude Code and Codex.
Ends with kenaz setup doctor and kenaz status, so you can check the result.

Afterwards, open a new terminal, and restart Claude Code, Codex, Claude Desktop and ChatGPT so they pick up the changes.

kenaz init [--yes] [--no-path] [--env E] [--bundle DIR | --no-bundle] [--no-browser]

Option	What it does
`--yes`	Apply every change without asking.
`--no-path`	Don't change `PATH`; print the line to add yourself.
`--env E`	Kameas Fleet environment: `prod` (default), `stage` or `dev`.
`--bundle DIR`	Register this extracted archive's plugin, replacing the `kenaz` marketplace from GitHub.
`--no-bundle`	Don't register this download's plugin; use `kenaz` from your `PATH`.
`--no-browser`	Sign in by printing the link instead of opening a browser.

How `kenaz init` changes `PATH`

On macOS and Linux it adds one marked block (# >>> kenaz PATH >>> … # <<< kenaz PATH <<<) to your shell's profile:

Shell	Profile
zsh	`~/.zshrc` (or `$ZDOTDIR/.zshrc`)
bash on macOS	the first of `~/.bash_profile`, `~/.bash_login` and `~/.profile` that exists, otherwise a new `~/.bash_profile`
bash on Linux	`~/.bashrc`
fish	`~/.config/fish/conf.d/kenaz.fish`

If the profile is a symbolic link, for example from a dotfiles manager, kenaz init edits the file the link points to and keeps the link.
Running it again changes nothing. If the install directory changed, it replaces the block instead of adding another.
The profile as it was before kenaz init first changed it is kept next to it as <profile>.kenaz-backup.
If it can't edit the profile, it changes nothing and prints the line to add yourself. See Troubleshooting.

On Windows it adds the folder to the front of your user Path (HKCU\Environment), unless it's already there.

What the installer checks

Both installers download the archive for your system from https://downloads.kameas.ai/kenaz-plugin/ over HTTPS, and refuse to install unless the archive's SHA-256 matches both the release's checksums.txt and the release manifest.

If cosign is installed, they also check the signature on checksums.txt against the release workflow of kameas-ai/kenaz-plugin-release (the same check as in Manual install → Verify), and refuse if it fails. Without cosign, they say so and print the command to check it yourself. Without cosign, only the checksum is checked, which protects against a damaged download but not against a compromised download server. To make the signature check mandatory, use --require-signature on macOS and Linux, or set $env:KENAZ_REQUIRE_SIGNATURE = '1' on Windows.

Read the script first

You don't have to pipe the script straight into a shell. To read it before it runs:

curl -fsSL https://downloads.kameas.ai/kenaz-plugin/install.sh -o install.sh
less install.sh
sh install.sh

On Windows:

irm https://downloads.kameas.ai/kenaz-plugin/install.ps1 -OutFile install.ps1
notepad install.ps1
powershell -ExecutionPolicy Bypass -File .\install.ps1

Installer options

macOS and Linux. Pass options after sh -s --, for example:

curl -fsSL https://downloads.kameas.ai/kenaz-plugin/install.sh | sh -s -- --version v0.6.0

Option	What it does
`--version vX.Y.Z`	Install that release instead of the current one.
`--system`	Link `kenaz` into `/usr/local/bin` (using `sudo` if needed) instead of `~/.local/bin`. The installation itself stays in your home directory, owned by you.
`--bin-dir DIR`	Link `kenaz` into `DIR`.
`--home DIR`	Install under `DIR` instead of `~/.kenaz` (or `$KENAZ_HOME`).
`--require-signature`	Refuse to install unless cosign verifies `checksums.txt`.

The installer puts the program in ~/.kenaz/install/ and links ~/.local/bin/kenaz to ~/.kenaz/install/current/bin/kenaz. It never replaces a kenaz that it didn't install.

Windows. Set these before you run the one-liner:

Variable	What it does
`$env:KENAZ_VERSION = 'vX.Y.Z'`	Install that release instead of the current one.
`$env:KENAZ_REQUIRE_SIGNATURE = '1'`	Refuse to install unless cosign verifies `checksums.txt`.

The installer puts the program in %LOCALAPPDATA%\Programs\Kenaz\ and adds %LOCALAPPDATA%\Programs\Kenaz\current\bin to your user Path.

Other ways to install

Homebrew (macOS)

brew install kameas-ai/tap/kenaz
kenaz init

The cask installs the same archive as the one-line installer, so kenaz init registers the plugin from it. Setup registers the plugin through Homebrew's kenaz link ($(brew --prefix)/bin/kenaz), so brew upgrade kenaz keeps it working. After an upgrade, kenaz setup doctor reminds you to run kenaz init to refresh the plugin files.

Installed 0.5.0 with Homebrew? Kenaz 0.5.0 registered the plugin through the versioned folder that brew upgrade deletes, so after brew upgrade, Claude Code and Codex can't start it. Run kenaz init once to repair the registration. Until you do, kenaz status and kenaz setup doctor tell you to.

Packages: apt, dnf, npm and the Windows installer

These packages install the kenaz program only, not the plugin package. So before you run kenaz init, add the plugin from the kenaz marketplace on GitHub, as described under From the kenaz marketplace for Claude Code and Codex. Setup then finds the marketplace and uses it. Without it, setup can't add the plugin.

The apt and dnf packages and the Windows installer install kenaz for every user of the machine, owned by the system (root or Administrators), not by you. The one-line installer installs it in your home directory instead.

Debian and Ubuntu (apt)

curl -fsSL https://downloads.kameas.ai/kenaz-plugin/apt/kenaz-archive-keyring.gpg | sudo tee /usr/share/keyrings/kenaz-archive-keyring.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/kenaz-archive-keyring.gpg] https://downloads.kameas.ai/kenaz-plugin/apt stable main" | sudo tee /etc/apt/sources.list.d/kenaz.list
sudo apt update && sudo apt install kenaz

Fedora and RHEL (dnf)

sudo curl -fsSLo /etc/yum.repos.d/kenaz.repo https://downloads.kameas.ai/kenaz-plugin/rpm/kenaz.repo
sudo dnf install kenaz

dnf checks the repository's signed metadata, which records the SHA-256 of every package. The .rpm files themselves are not signed.

The repository signing key

Both repositories are signed with the Kameas AI key with this fingerprint:

DC668C6D47790A18550C181208CC2C7D6AD44FDA

When dnf install asks you to import the key, check that the fingerprint it shows is the one above. To check the key yourself:

gpg --show-keys /usr/share/keyrings/kenaz-archive-keyring.gpg                                # apt
curl -fsSL https://downloads.kameas.ai/kenaz-plugin/rpm/RPM-GPG-KEY-kenaz | gpg --show-keys   # dnf

The program is installed as /usr/bin/kenaz, with the licence files in /usr/share/doc/kenaz/. Upgrade with your package manager (sudo apt update && sudo apt upgrade, or sudo dnf upgrade kenaz), then run kenaz init.

npm

npm install -g @kameas-ai/kenaz
kenaz init

This needs Node.js 18 or later. The package installs the official kenaz program for your platform, licensed under the Kameas Client Software License; the small launcher in the package is Apache-2.0. If the package for your platform wasn't installed (for example with --omit=optional), the launcher downloads the program once from https://downloads.kameas.ai/kenaz-plugin/ and refuses to run it unless its SHA-256 matches the one the package carries. To try it without installing: npx @kameas-ai/kenaz version. Upgrade with npm install -g @kameas-ai/kenaz@latest, then run kenaz init.

Windows installer (MSI)

Download the installer for your processor from the release folder, https://downloads.kameas.ai/kenaz-plugin/v<version>/, and open it:

Processor	File
x86-64 (Intel, AMD)	`kenaz_<version>_windows_amd64.msi`
ARM64	`kenaz_<version>_windows_arm64.msi`

It needs administrator rights. It installs kenaz.exe in %ProgramFiles%\Kameas\Kenaz\, with the licence files in its licenses\ folder, and adds that folder to the system Path. Open a new terminal, then run kenaz init. To upgrade, install the newer MSI; it replaces the older version. The MSI is listed in the release's checksums.txt, so you can check it as in Manual install → Verify.

Manual install

To install without the one-line installer, download, verify and install an archive yourself. Installing an archive needs no network access.

1. Download

Pick the file for your machine, from the download page or the release folder. Replace <version> with the release version, for example 0.6.0.

System	Processor	File
macOS	Apple silicon	`kenaz_<version>_darwin_arm64.tar.gz`
macOS	Intel	`kenaz_<version>_darwin_amd64.tar.gz`
Linux	x86-64 (Intel, AMD)	`kenaz_<version>_linux_amd64.tar.gz`
Linux	ARM64	`kenaz_<version>_linux_arm64.tar.gz`
Windows	x86-64 (Intel, AMD)	`kenaz_<version>_windows_amd64.zip`
Windows	ARM64	`kenaz_<version>_windows_arm64.zip`

Every release is published under https://downloads.kameas.ai/kenaz-plugin/v<version>/. Next to the archives, that folder holds checksums.txt and its signature files, checksums.txt.sig and checksums.txt.pem. https://downloads.kameas.ai/kenaz-plugin/manifest.json always names the latest release.

For example, on Apple silicon:

V=0.6.0
B=https://downloads.kameas.ai/kenaz-plugin/v$V
for f in "kenaz_${V}_darwin_arm64.tar.gz" checksums.txt checksums.txt.sig checksums.txt.pem; do
  curl -fLO "$B/$f"
done

2. Verify

Check the signature on checksums.txt with cosign, then check your archive against it. The signing identity is the release workflow of kameas-ai/kenaz-plugin-release on its main branch:

cosign verify-blob --certificate checksums.txt.pem --signature checksums.txt.sig \
  --certificate-identity https://github.com/kameas-ai/kenaz-plugin-release/.github/workflows/release.yml@refs/heads/main \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt

sha256sum -c --ignore-missing checksums.txt          # Linux
shasum -a 256 -c --ignore-missing checksums.txt      # macOS

Both commands must succeed. The first prints Verified OK; the second prints OK next to your archive's name.

On Windows, in PowerShell, compare the archive's hash with its line in checksums.txt:

cosign verify-blob --certificate checksums.txt.pem --signature checksums.txt.sig `
  --certificate-identity https://github.com/kameas-ai/kenaz-plugin-release/.github/workflows/release.yml@refs/heads/main `
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt
(Get-FileHash .\kenaz_0.6.0_windows_amd64.zip -Algorithm SHA256).Hash.ToLower()
Select-String kenaz_0.6.0_windows_amd64.zip checksums.txt

The download page also lists each file's SHA-256 under Verify downloads (SHA-256).

3. Extract and install

What's in the archive

Each archive extracts to one folder, kenaz_<version>_<os>_<arch>/:

Path	What
`bin/kenaz` (`bin\kenaz.exe` on Windows)	the `kenaz` program
`plugin/`	the plugin package for Claude Code and Codex
`.claude-plugin/`	a local `kenaz` marketplace that points at `plugin/`
`licenses/`	`LICENSE` (Kameas Client Software License), `LICENSE-APACHE`, `NOTICE`, `THIRD_PARTY_NOTICES`
`install.sh`	the archive's own install script (macOS and Linux only)
`README.txt`	these steps, in short
`SHA256SUMS`, `bundle.json`	the digest of every file in the folder, and the version and source commits

On macOS and Linux

tar -xzf kenaz_0.6.0_darwin_arm64.tar.gz
./kenaz_0.6.0_darwin_arm64/install.sh

install.sh checks every file against SHA256SUMS, copies the folder to ~/.kenaz/install/versions/kenaz_<version>_<os>_<arch>/ (read-only), and points ~/.kenaz/install/current at it. It prints the program's path:

kenaz install: selected kenaz_0.6.0_darwin_arm64
  executable: /Users/you/.kenaz/install/current/bin/kenaz

You can delete the downloaded archive and extracted folder afterwards.

To install somewhere else, pass --home <dir> or set KENAZ_HOME; the install then goes to <dir>/install/. Paths with spaces work.

Then run kenaz init by its full path:

~/.kenaz/install/current/bin/kenaz init

It puts ~/.kenaz/install/current/bin on your PATH, not a versions/… path, so upgrades and rollbacks reach every tool.

On Windows

The Windows zip has no installer script: the folder you extract is the installation.

Extract the zip and move the kenaz_<version>_windows_<arch> folder somewhere permanent, for example C:\Users\you\Kenaz\. A path with spaces is fine.
Run kenaz init by its full path, for example:
```
& "C:\Users\you\Kenaz\kenaz_0.6.0_windows_amd64\bin\kenaz.exe" init
```
It adds that bin folder to your user Path. Claude Code and Codex start the plugin's MCP server without a shell, so kenaz must resolve to kenaz.exe on your PATH.

Don't edit or move files inside an installed folder: setup checks them against bundle.json and refuses a modified folder.

Upgrade

Run the one-line installer again. It installs the current release and keeps the previous one for rollback. Then run kenaz init again, so each tool uses the new version:

curl -fsSL https://downloads.kameas.ai/kenaz-plugin/install.sh | sh
kenaz init

irm https://downloads.kameas.ai/kenaz-plugin/install.ps1 | iex
kenaz init

Steps that are already done change nothing. To set up one tool at a time instead, run kenaz setup claude or kenaz setup codex.

Homebrew, apt, dnf, npm or the Windows installer: upgrade with the same tool you installed with (see Other ways to install), then run kenaz init.

Manual install, macOS and Linux: download, verify and extract the new archive, run its install.sh, then run kenaz init (or kenaz setup for each tool, as install.sh reminds you).

Manual install, Windows: extract the new version beside the old one and run init from the new bin\kenaz.exe; it puts the new bin folder on your Path. Keep the old folder until the new one works, then delete it and remove its bin folder from your Path.

Roll back

macOS and Linux:

~/.kenaz/install/current/install.sh --rollback
kenaz setup claude
kenaz setup codex

--rollback selects the one previous version that's kept. If an install was interrupted, the next install.sh run finishes or undoes it; install.sh --recover does only that.

If install.sh reports that another install holds the lock and none is running, delete ~/.kenaz/install/.lock (and ~/.kenaz/install/.lock.takeover, if present) and try again.

Windows: run the one-line installer again with the earlier version pinned, then run setup for each tool:

$env:KENAZ_VERSION = 'vX.Y.Z'
irm https://downloads.kameas.ai/kenaz-plugin/install.ps1 | iex
kenaz setup claude
kenaz setup codex

Uninstall

Undo setup for each tool you set up. This removes the plugin registration and the settings setup added, and puts back the values it replaced:
```
kenaz setup --undo claude
kenaz setup --undo codex
```
If you installed the plugin from the marketplace yourself, also remove it in Claude Code (/plugin uninstall kenaz@kenaz, then /plugin marketplace remove kenaz) or in Codex.
Sign out: kenaz logout. kenaz logout deletes data waiting to be sent; synced memory stays in your account until you run kenaz memory forget-all.
Decide what to do with your memory before you remove the program. See Memory. kenaz memory path prints where the device notebook is.
Remove the program:
- macOS and Linux: delete the install root, ~/.kenaz (or the --home / KENAZ_HOME directory you used), and the kenaz link the installer made (~/.local/bin/kenaz, or /usr/local/bin/kenaz with --system). Remove the # >>> kenaz PATH >>> block from your shell profile.
- Windows: delete %LOCALAPPDATA%\Programs\Kenaz (or the folder you extracted), and remove its bin folder from your user Path.
- Homebrew, apt, dnf or npm: brew uninstall kenaz, sudo apt remove kenaz, sudo dnf remove kenaz or npm uninstall -g @kameas-ai/kenaz.
- Windows installer: uninstall Kenaz in Settings → Apps.

Check where a binary came from (optional)

Each official kenaz reports its version and source commits with kenaz version --json. To check an installed binary against the public source, use scripts/verify-release.sh from the kenaz-plugin repository at the release tag. It needs Go, git and the release's checksums.txt:

git clone --depth 1 --branch v0.6.0 https://github.com/kameas-ai/kenaz-plugin
./kenaz-plugin/scripts/verify-release.sh --checksums checksums.txt \
  --name kenaz_0.6.0_darwin_arm64 ~/.kenaz/install/current/bin/kenaz v0.6.0

On Windows, run it from Git Bash with --name kenaz_0.6.0_windows_amd64.exe and the path to bin\kenaz.exe.

The script copies the binary into a temporary directory under $TMPDIR and runs it from there. If that directory is on a noexec filesystem, the script stops and says so: set TMPDIR to a directory where programs can run (for example TMPDIR=$HOME/tmp) and try again.

Claude and Claude Code are trademarks of Anthropic, PBC. OpenAI and Codex are trademarks of OpenAI. Kenaz and Kameas are trademarks of Kameas AI, Inc. Kenaz for Claude Code and Codex is an independent product of Kameas AI, Inc. and is not affiliated with, endorsed or sponsored by Anthropic or OpenAI.

Install in one command​

macOS and Linux​

Windows (PowerShell)​

Then run kenaz init​

How kenaz init changes PATH​

What the installer checks​

Read the script first​

Installer options​

Other ways to install​

Homebrew (macOS)​

Packages: apt, dnf, npm and the Windows installer​

Debian and Ubuntu (apt)​

Fedora and RHEL (dnf)​

The repository signing key​

npm​

Windows installer (MSI)​

Manual install​

1. Download​

2. Verify​

3. Extract and install​

What's in the archive​

On macOS and Linux​

On Windows​

Upgrade​

Roll back​

Uninstall​

Check where a binary came from (optional)​