How it works
Two install options — npm for Node.js environments, standalone binary for everything else. Three steps — download, install, connect.
Step 1
Download
Install via npm or download a standalone binary. No Node.js needed for the standalone version.
Step 2
Install & connect
Run the agent with your API token. It connects to PAssist and registers automatically. Standalone saves data locally.
Step 3
See results
Start a scan from the CLI or dashboard. The agent runs 28 audit modules. Results appear in your dashboard and locally.
Install via npm
Requires Node.js 18+. Use the installer to install or update from the private PAssist registry:
bash
curl -sSL https://agent.pentest-forge.com/api/v2/agent/install.sh | bashManual npm install
bash
npm install -g passist-agent --registry https://agent.pentest-forge.com/npm/Update
bash
passist-agent updateVerify installation
bash
passist-agent version
# passist-agent v1.4.0Requirements
- Node.js 18 or newer
- Linux, macOS, or WSL on Windows
- Root or sudo recommended for full audit coverage
- Network access to agent.pentest-forge.com
Frequently asked questions
What is the difference between npm and standalone?+
The npm version requires Node.js 18+ installed on your server. The standalone version includes its own Node.js runtime — download, extract, run. Both run the same 28 audit modules. The standalone also adds local data storage with cumulative diff between scans.
Where does the agent run?+
The agent runs locally on your server. It connects to the PAssist Gateway only to activate tokens and submit results. All security checks are performed on your machine.
Does the agent send raw data externally?+
No. All sensitive values (passwords, keys, tokens) are redacted before transmission. Only hashes, finding metadata, and compliance scores leave your server.
What is cumulative mode?+
In standalone mode, --cumulative saves scan data locally in ./passist-data/ and automatically compares each scan with the previous one. You can see which findings are new, resolved, or persistent, and track your CIS compliance score over time with the history, diff, and trend commands.
What happens after activation?+
A token gives you 24 hours and 20 audit launches per asset. The token binds to the server fingerprint — it cannot be transferred.
Can I run a scan without consuming a token?+
Yes! Use --dry-run to test the agent. It will run all modules and display results locally, but won't send anything to the server or consume a token. The standalone version also supports --no-upload to save locally without uploading.
What happens after an audit?+
After an internal audit, you can send the report to AI Analysis for intelligent triage, remediation prioritization, and contextual explanations. Go to Deliverables, find the report, and click the AI button.