Quickstart

This path starts a bounded runtime, waits for signed evidence, downloads the bundle, and verifies it locally.

Install

curl -fsSL https://tachyonic.sh/install | bash

Supports macOS (arm64, amd64) and Linux (arm64, amd64). The installer verifies the SHA-256 checksum.

Create an account

1. Sign up at platform.tachyonic.co/sign-up.
2. Open Settings > API Keys.
3. Create an API key with scan:read and scan:write.
4. Save it in your shell:

export TACHYONIC_PLATFORM_KEY=tach_live_...
tachyonic login --platform-api-key "$TACHYONIC_PLATFORM_KEY"

You can also run tachyonic login for browser device authorization.

Check your free limits

curl -sS \
  -H "x-api-key: $TACHYONIC_PLATFORM_KEY" \
  https://api.tachyonic.sh/api/v1/entitlements | jq .

Free workspaces can start 3 runtimes per month in the default runtime pool. The free runtime cap is 15 minutes, $1, and 50,000 model tokens. Approval gates are required. Evidence is retained for 72 hours and reviewer links can last up to 72 hours.

Start a runtime

Use a target you own or are authorized to test. Do not pass --region on Free. The platform selects the default signed runtime pool.

tachyonic runtime start --target https://your-api.example.com | tee runtime.out
RID=$(awk '/^Runtime:/ { print $2; exit }' runtime.out)

Follow it to a terminal state:

tachyonic runtime watch "$RID"

Download signed evidence

The runtime artifacts API returns presigned URLs. This shell snippet downloads the result bundle and manifest into a local directory. It uses jq.

mkdir -p "tachyonic-evidence/$RID"

curl -sS \
  -H "x-api-key: $TACHYONIC_PLATFORM_KEY" \
  "https://api.tachyonic.sh/api/v1/runtimes/$RID/artifacts?limit=100" \
  | jq -r '.data[]
      | select(.type == "finding_bundle_v1" or .type == "evidence_manifest_v1")
      | [.filename, .url]
      | @tsv' \
  | while IFS="$(printf '\t')" read -r name url; do
      curl -fsSL "$url" -o "tachyonic-evidence/$RID/$name"
    done

Verify the bundle:

tachyonic verify "tachyonic-evidence/$RID"

A passing verification prints OK, the artifact path, the SHA-256 digest, and the signing key ID.

Share with a reviewer

Create a read-only evidence link after the runtime completes:

curl -sS -X POST \
  -H "x-api-key: $TACHYONIC_PLATFORM_KEY" \
  -H "content-type: application/json" \
  -d '{"expires_in_hours":72}' \
  "https://api.tachyonic.sh/api/v1/runtimes/$RID/share" | jq .

The response contains a url under https://platform.tachyonic.co/share/evidence/.... Send that link to the reviewer. See Share Evidence for the response shape and limits.

Local scans

For local-only testing, set the provider API key and run tachyonic scan:

export ANTHROPIC_API_KEY=sk-ant-...

tachyonic scan \
  --target https://your-api.example.com/v1/chat/completions \
  --provider anthropic \
  --model claude-haiku-4-5-20251001

Local scans write results to stdout by default. Use --format json --output scan-results.json or --format html --output report.html to save a report.

Next steps

• Runtimes: lifecycle, limits, regions, budgets, approvals, and CLI commands.
• Share Evidence: reviewer links and expiry limits.
• Verifying Evidence: local signature verification.
• CLI Reference: all commands and flags.
• Attack Catalog: what Tachyonic tests for.