> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/download-agent.md).

# Download Agent

Use **Settings -> Agent** to generate a short-lived deployment launcher for an internal assessment host.

The launcher downloads the agent package, enrolls it with the control plane, and starts the agent. Generate it when the assessment host is ready.

## Supported Platforms

* Windows
* Linux
* macOS Apple Silicon
* macOS Intel

## Before Generating a Launcher

Confirm:

* written authorization and approved subnet scope;
* the host is inside the target network or has a route to it;
* endpoint protection and EDR allow the BugBase PCE Agent package, install directory, state directory, and process;
* outbound HTTPS is allowed from the host to the RTCS URL and package download host;
* the host can initiate assessment traffic to approved internal targets;
* the operator has local administrator/root privileges where required.

## Generate and Run

1. Open **Settings -> Agent**.
2. Select the target platform.
3. Click **Generate Launcher**.
4. Copy or download the launcher.
5. Run it from an administrator/root shell on the assessment host.
6. Watch **Settings -> Agent** or **Dashboard -> Agents** until the agent appears connected.
7. Start internal discovery only after the agent is connected and reports the expected network information.

## Runtime Paths

The UI shows expected install, state, log, temp/download, and process paths for the selected platform. Use those paths for EDR/AV allowlisting and cleanup planning.

For Windows, the page also shows example Microsoft Defender commands for allowlisting the install path, state path, process, and self-signed code-signing certificate.

## Bootstrap Token

The page exposes an admin bootstrap/master callback token for enrollment workflows. Treat it as sensitive.

Rotate it when:

* it was copied into the wrong place;
* an operator leaves the engagement;
* a launcher or token was exposed;
* your security policy requires token rotation.

Rotating the token invalidates the current bootstrap token. Existing enrolled agents are not affected.

## After the Engagement

Plan cleanup before the scan:

* stop and remove the agent where it is not needed for recurring assessments;
* remove temporary files and logs according to your retention policy;
* remove temporary EDR/AV allowlisting if it was engagement-specific;
* rotate exposed credentials or tokens if they were copied outside approved storage.