Windows · x64 · Release 1.0.0

Connect a Windows host, with clear approval.

Pair the Caskveil agent to the account responsible for the host. Connected scans read local package inventory only, and run only on systems you are authorized to assess.

Open Agents page Read the enrollment steps

Version 1.0.0 · per-user installer · Node.js 20.18.1+

Install and pair

Four deliberate steps from install to connection.

The pairing code is temporary approval for one device. Windows enrollment does not ask for your Caskveil password or a reusable account key.

  1. 01

    Install for your Windows user

    Use the genuine CaskveilCloudAgent-1.0.0-x64.msi when it is available. The x64 MSI installs under your current user's Local AppData; it does not install machine-wide. Node.js 20.18.1 or later is required and is not bundled with the installer.

  2. 02

    Request a one-time pairing code

    In PowerShell, run the enrollment command with your HTTPS Caskveil origin. The agent prints a short code that expires after 10 minutes and can be claimed once.

    PowerShellreplace the origin placeholder
    node "$env:LOCALAPPDATA\Caskveil\caskveil-agent.mjs" --enroll https://<your-caskveil-origin>

    Replace https://<your-caskveil-origin> with the HTTPS origin shown in your Caskveil account.

  3. 03

    Approve it from the owning account

    Sign in to Caskveil with the account that should own this host. Enter the code on the Agents page and wait for the terminal to confirm approval.

    Open the signed-in Agents page
  4. 04

    Connect only after approval

    After the terminal confirms approval, start connected mode with the command below. Caskveil can then request a local package scan for this host.

    PowerShell · after approvalexplicit authorization required
    node "$env:LOCALAPPDATA\Caskveil\caskveil-agent.mjs" --connect --authorized

Assessment boundary

A scan stays inside the approval you gave.

Use the agent only on systems your organization owns or has explicit permission to assess. Each connected request is limited to the local package inventory.

Allowlisted inventory

On Windows, the agent reads OS metadata and local winget package data when a scan is requested.

Device credentials stay protected

The device credential is saved in the current user's protected agent config. It is not exposed to the browser, command line, URL, or agent output.

No unrelated host access

The agent does not inspect credential stores or unrelated files, change the host, or run exploits.

Windows advisory coverage may be partial. A package inventory does not mean every installed package has a matching advisory.

Ready to pair?

Approve the host from its future owner account.

Go to Agents