Installation

NetsCLI publishes command-line binaries and desktop installers through GitHub Releases. The CLI/TUI binary is named netscli. The desktop app is distributed as NetsCLI Desktop.

Recommended installs

Platform	Recommended path	Installs
Windows	winget install netscli	CLI and TUI
Windows	winget install netscli-gui	Desktop app
macOS	Homebrew or install script	CLI and TUI
Linux	Install script, Homebrew, AUR, or release artifact	CLI and TUI
Rust users	cargo install netscli	CLI and TUI from crates.io
Node users	npx netscli	CLI and TUI from npm, no install step

Windows

Use winget for the hash-verified install path:

winget install netscli

The desktop app is distributed separately:

winget install netscli-gui

Both short names resolve today. The full identifiers are fstubner.netscli and fstubner.netscli.gui, and they cannot become ambiguous — use those if a short name ever matches more than one package in the catalog.

Scoop is also supported, for both the CLI and the desktop app:

scoop bucket add fstubner https://github.com/fstubner/scoop-bucket
scoop install netscli
scoop install netscli-gui

Or the PowerShell install script, which picks the right asset for your machine:

iwr -useb https://netscli.com/install.ps1 | iex

Direct Windows downloads are attached to GitHub Releases. From 0.3.3 on, both .exe builds and the .msi installer are Authenticode-signed, so Windows shows a named publisher rather than an unknown one. Releases before 0.3.3 are unsigned. A new certificate still has to build reputation with SmartScreen, so you may see a warning for a while regardless.

macOS

Use Homebrew when available:

brew tap fstubner/tap && brew install netscli

Or use the install script:

curl -fsSL https://netscli.com/install.sh | bash

Desktop .dmg artifacts are attached to GitHub Releases where the release workflow publishes them. macOS may require the usual first-run approval for unsigned or independently distributed apps.

Linux

Use the install script:

curl -fsSL https://netscli.com/install.sh | bash

Install with Homebrew on Linux when you use Linuxbrew:

brew tap fstubner/tap && brew install netscli

On Arch-based systems with an AUR helper:

yay -S netscli-bin

Release artifacts may include Linux CLI binaries and desktop packages such as .deb or .AppImage, depending on the release.

If the desktop window opens black or blank

On some hosts the window appears but never paints anything. This is WebKitGTK’s hardware compositing failing against a driver that only partly supports it, and it fails silently, so there is nothing on stderr to go on. It has been seen on virtual machines using the vmwgfx driver.

The app should recover by itself. It notices that a launch never drew anything and turns hardware compositing off on the next one, so closing the blank window and opening it again is usually enough. It prints the reason to stderr when it does this.

To skip the failed launch, or if the automatic recovery does not fire:

netscli-gui --disable-gpu-compositing

That is remembered, so later launches from the desktop icon keep it. To undo it and go back to hardware compositing:

netscli-gui --gpu-compositing

Compositing is not disabled by default because it costs hardware compositing for everyone, including the large majority whose drivers handle it correctly. The WEBKIT_DISABLE_COMPOSITING_MODE=1 environment variable also still works, and overrides everything above for that one run.

This applies to Linux only. Windows and macOS use a different web engine that has neither the fault nor the setting.

Cargo

If Rust is installed:

cargo install netscli

Cargo installs the CLI/TUI binary. It does not install the desktop app.

npm

If Node 18 or newer is installed, you can run NetsCLI without installing anything:

npx netscli --help

Or install it globally:

npm install -g netscli

npm downloads only the prebuilt binary for your platform. Published targets are Linux x64 and arm64, macOS x64 and Apple Silicon, and Windows x64. The Linux arm64 binary needs glibc 2.39 or newer.

What the npm build leaves out:

• Packet capture. It needs libpcap or Npcap on the machine, which npm cannot arrange. Use a package from the sections above if you need it.
• The desktop app. npm installs the CLI and TUI only.

If you mainly want the MCP server, see MCP server — the npm package is one of three ways to connect it.

Updating

Use the same package manager you installed with.

Update the CLI and TUI on Windows:

winget upgrade fstubner.netscli

Update the desktop app on Windows:

winget upgrade fstubner.netscli.gui

Update a Homebrew install:

brew upgrade netscli

The desktop app can also update itself from 0.3.4 on. It checks for a new release when it opens and offers to install it; see Updates for which installs can do this.

Update a global npm install:

npm update -g netscli

npx netscli may reuse a copy it has cached. To be sure you get the newest release, run npx netscli@latest.

For direct release artifacts, download the latest GitHub release and replace the previous install with the matching package for your platform.

Verifying a download

Every CLI and desktop release asset is checksummed and signed, and both can be checked before you run anything.

Checksums

Each asset ships a .sha256 sidecar next to it on the release page. The install scripts fetch and check it for you, and refuse to install if it is missing — a failed checksum request is not treated as permission to skip verification. To check a manual download yourself:

# Linux / macOS
curl -fsSLO https://github.com/fstubner/netscli/releases/latest/download/netscli-linux-x86_64
curl -fsSLO https://github.com/fstubner/netscli/releases/latest/download/netscli-linux-x86_64.sha256
sha256sum -c netscli-linux-x86_64.sha256

# Windows
(Get-FileHash -Algorithm SHA256 .\netscli-windows-x86_64.exe).Hash.ToLower()
# compare against the contents of netscli-windows-x86_64.exe.sha256

Signatures

A checksum only proves the file matches its own sidecar, and both come from the same place. The signature is what ties the asset to the workflow run that built it.

Every asset is signed keylessly with Sigstore cosign in CI, using the GitHub Actions OIDC identity — no key management, and the signature is bound to the exact run. Each asset ships a .sig and a .pem beside it:

cosign verify-blob \
  --signature netscli-linux-x86_64.sig \
  --certificate netscli-linux-x86_64.pem \
  --certificate-identity-regexp 'https://github.com/fstubner/netscli/.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  netscli-linux-x86_64

Substitute the asset name you downloaded — the same command works for the desktop .msi, .dmg, .deb and .AppImage. It needs the cosign CLI. A pass confirms the asset was built and signed by this repository’s release workflow and has not been altered since.

This is separate from platform code signing. From 0.3.3 on, the Windows executables and installer also carry an Authenticode signature. The macOS .dmg is not notarized yet. See the Windows and macOS sections above for what your OS will say on first run.

Packet capture

None of the installs above include packet capture. It is a compile-time feature, and the default builds — the desktop installers, the standard CLI release assets, and cargo install netscli — are built without it. That keeps the default install free of any libpcap/Npcap dependency and avoids redistributing Npcap.

Getting it is a deliberate extra step, and the rest of this section is how.

Normal scan, discovery, DNS, ARP, ping, trace, and interface workflows are unaffected and need none of this.

If you do want packet capture, you need both a build that has the feature compiled in and the system capture library.

CLI with packet capture

The install script does both at once — it selects the -pcap build and installs the system library:

curl -fsSL https://netscli.com/install.sh | NETSCLI_PCAP=1 bash

$env:NETSCLI_PCAP=1; iwr -useb https://netscli.com/install.ps1 | iex

On Windows this runs the Npcap installer, which needs administrator rights. Add NETSCLI_SKIP_NPCAP=1 (or NETSCLI_SKIP_LIBPCAP=1 on Unix) if you manage the capture library yourself.

Alternatively, download the -pcap asset directly from the latest release — netscli-linux-x86_64-pcap, netscli-macos-aarch64-pcap, netscli-windows-x86_64-pcap.exe, and so on — and install the capture library separately. There is no -pcap musl build.

Or build it yourself, which needs the development headers (libpcap-dev on Debian/Ubuntu, or the Npcap SDK on Windows):

cargo install netscli --features pcap

Desktop app with packet capture

There is no published desktop installer with packet capture. The Packet Capture tool appears in the app but shows setup guidance instead of running. To get a capture-capable desktop build you have to build from source:

cd apps/netscli-gui
npm install
npm run tauri build -- --features pcap

System requirements

Platform	Requirement
Windows	Npcap installed. wpcap.dll lives in C:\Windows\System32\Npcap\, which is not on PATH by default — add it, or let NETSCLI_PCAP=1 do it.
Linux	libpcap installed, plus capture permissions (CAP_NET_RAW or root).
macOS	libpcap available, plus capture permissions where required.

Checking what you have

netscli doctor works on every build and reports whether packet capture is compiled in and whether the runtime library is present:

netscli doctor

Note that netscli pcap --check only exists on builds that were compiled with the feature — on a standard build the subcommand is absent entirely and you will get an “unrecognized subcommand” error rather than a useful message. Use doctor to find out which build you have.