Quickstart
Install Tachyonic, start a bounded security runtime, and inspect its evidence
This path starts a bounded runtime against an authorized endpoint and inspects its artifacts. The default runtime path supports signed evidence. Regional signing, retention, and sharing must be checked for the path you use.
Prerequisites
- macOS or Linux on arm64 or amd64
curl,jq, and Python 3- A target you own or are authorized to test
Install
curl -fsSL https://tachyonic.sh/install | bashThe script detects your platform, downloads the latest stable release and requires SHA-256 verification with sha256sum or shasum before installing to /usr/local/bin. It uses sudo when that directory is not writable.
Set TACHYONIC_INSTALL_DIR to choose another existing absolute directory. The script replaces tachyonic there only after successful verification. Add that directory to your PATH yourself.
Pick your platform: darwin-arm64, darwin-amd64, linux-arm64 or linux-amd64.
set -eu
PLATFORM=darwin-arm64
VERSION=$(curl --proto '=https' --proto-redir '=https' -fsSL --max-filesize 65 https://releases.tachyonic.sh/latest/version)
[ "${#VERSION}" -le 64 ]
printf '%s\n' "$VERSION" | grep -Eq '^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$'
case "$VERSION" in *'
'*) exit 1 ;; esac
TMP_DOWNLOAD=$(mktemp -d)
trap 'rm -rf "$TMP_DOWNLOAD"' EXIT
curl --proto '=https' --proto-redir '=https' -fsSL "https://releases.tachyonic.sh/$VERSION/$PLATFORM/tachyonic" -o "$TMP_DOWNLOAD/tachyonic"
curl --proto '=https' --proto-redir '=https' -fsSL --max-filesize 65 "https://releases.tachyonic.sh/$VERSION/$PLATFORM/tachyonic.sha256" -o "$TMP_DOWNLOAD/tachyonic.sha256"
EXPECTED=$(cat "$TMP_DOWNLOAD/tachyonic.sha256")
[ "${#EXPECTED}" -eq 64 ]
case "$EXPECTED" in *[!0-9a-f]*) exit 1 ;; esac
if command -v sha256sum >/dev/null 2>&1; then
ACTUAL=$(sha256sum "$TMP_DOWNLOAD/tachyonic")
elif command -v shasum >/dev/null 2>&1; then
ACTUAL=$(shasum -a 256 "$TMP_DOWNLOAD/tachyonic")
else
printf '%s\n' 'SHA-256 verification requires sha256sum or shasum' >&2
exit 1
fi
[ "${ACTUAL%% *}" = "$EXPECTED" ]
chmod +x "$TMP_DOWNLOAD/tachyonic"
sudo mv "$TMP_DOWNLOAD/tachyonic" /usr/local/bin/tachyonicThese commands preserve an existing installed binary if download or verification fails.
Check the install with tachyonic --version.
Create an account
Sign up at platform.tachyonic.co/sign-up.
Open Settings > API Keys and create a key with scan:read and scan:write.
Log in with the existing key through a hidden prompt:
tachyonic login --with-keyFor CI, supply TACHYONIC_API_KEY through its secret environment. Do not put
credentials in arguments, URLs, shell history, or output.
You can also run tachyonic login for browser device authorization.
Check your free limits
For API examples below, supply an existing key through the process environment
as TACHYONIC_API_KEY. Device login stores its key locally for CLI commands;
it does not export that environment variable.
import json
import os
from urllib.request import Request, urlopen
request = Request("https://api.tachyonic.sh/api/v1/entitlements",
headers={"x-api-key": os.environ["TACHYONIC_API_KEY"]})
with urlopen(request, timeout=30) as response:
print(json.dumps(json.load(response), indent=2))Free workspaces can start 3 runtimes per month in the default runtime pool. The free runtime cap is 15 minutes, $1, and 50,000 model tokens. Approval gates are required. For available default-path signed artifacts, the API enforces a 72-hour Free expiry limit for evidence and reviewer links. Download a copy you need to keep; an expiry limit does not establish artifact availability in another region.
Start a runtime
Warning
Use a target you own or are authorized to test. Do not pass --region on Free; the platform selects the default runtime pool.
tachyonic runtime start --target https://your-api.example.com | tee runtime.out
RID=$(awk '/^Runtime:/ { print $2; exit }' runtime.out)
export RIDFollow it to a terminal state:
tachyonic runtime watch "$RID"Download signed evidence
The runtime artifacts API returns temporary download URLs. Read them in-process, keep them out of logs, and download the bundle and manifest while available. Set RID to your runtime ID in the environment; the example below caps each artifact download at 16 MiB.
import json
import os
from pathlib import Path
from urllib.request import Request, urlopen
rid = os.environ["RID"]
destination = Path("tachyonic-evidence") / rid
destination.mkdir(parents=True, exist_ok=True)
request = Request(
"https://api.tachyonic.sh/api/v1/runtimes/" + rid + "/artifacts?limit=100",
headers={"x-api-key": os.environ["TACHYONIC_API_KEY"]},
)
try:
with urlopen(request, timeout=30) as response:
artifacts = json.load(response)["data"]
for artifact in artifacts:
if artifact["type"] not in ("finding_bundle_v1", "evidence_manifest_v1"):
continue
name = artifact["filename"]
if Path(name).name != name or name in ("", ".", ".."):
raise ValueError("invalid artifact filename")
with urlopen(artifact["url"], timeout=30) as response:
content = response.read(16 * 1024 * 1024 + 1)
if len(content) > 16 * 1024 * 1024:
raise ValueError("artifact exceeds example limit")
(destination / name).write_bytes(content)
except Exception:
raise SystemExit("Evidence download failed") from Nonetachyonic verify "tachyonic-evidence/$RID"Check
A passing verification prints OK, the artifact path, the SHA-256 digest, and the signing key ID.
Share with a reviewer
Create a read-only evidence link after the runtime completes:
import json
import os
from urllib.request import Request, urlopen
request = Request(
"https://api.tachyonic.sh/api/v1/runtimes/" + os.environ["RID"] + "/share",
data=json.dumps({"expires_in_hours": 72}).encode(),
headers={"x-api-key": os.environ["TACHYONIC_API_KEY"],
"content-type": "application/json"},
method="POST",
)
with urlopen(request, timeout=30) as response:
link = json.load(response)
# Use link["url"] in a private handoff to the intended reviewer. Do not log it.The response contains a url under https://platform.tachyonic.co/share/evidence/.... Send that link to the reviewer. See Share Evidence for the response shape and limits.
Local scans
For local-only testing, set the provider API key and run tachyonic scan:
# Supply ANTHROPIC_API_KEY through the process environment from your secret store.
tachyonic scan \
--target https://your-api.example.com/v1/chat/completions \
--provider anthropic \
--model claude-haiku-4-5-20251001Local scans write results to stdout by default. Use --format json --output scan-results.json or --format html --output report.html to save a report.