Skip to content

Install Endpoint Protection with a Script

Script-based installation installs the Boost endpoint updater on developer endpoints, which installs Endpoint Protection and keeps it up to date automatically. Use this option for endpoints that do not use the VS Code extension, or when you want to centrally manage the deployment of the Endpoint protection across Windows, macOS, and Linux endpoints.

This is the recommended option for organization-wide rollout through an EDR or MDM tool.

Requirements

Before installing Endpoint Protection with a script, make sure you have:

  • The install scripts, downloaded from the Endpoint Protection Installation page.
  • The Windows PowerShell scripts (.ps1) for Windows endpoints.
  • The shell scripts (.sh) for macOS and Linux endpoints.
  • Administrator privileges on Windows, or root privileges on macOS and Linux.
  • A deployment token, created from the Endpoint Protection Installation page. See Deployment Tokens.

Deployment Tokens

Script installation authenticates with a deployment token created from the Endpoint Protection Installation page. A deployment token has a deliberately narrow scope:

  • It can only be used to register devices. It grants no other access to Boost Security.
  • It is active for 30 days by default. You can change the duration when creating the token.
  • It is meant to be single use: delete it once your fleet is deployed, and create a new token for the next rollout.

During installation, each endpoint uses the deployment token to register and receives its own unique device token, which the endpoint uses for all subsequent communication with Boost Security. The deployment token is used once to enroll the device and is never stored on the endpoint. Registered devices are managed from the Endpoint Devices page, where administrators can revoke or delete individual devices without affecting the rest of the fleet.

Deployment Options

You can run the scripts in two ways:

  • Local installation - Run the scripts manually on a single endpoint. This is useful for testing the installation flow or validating configuration.
  • EDR or MDM deployment - Upload and run the scripts through an endpoint deployment tool to install Endpoint Protection across multiple developer endpoints.

Note: Boost has tested script deployment with EDR tools such as SentinelOne. The exact steps to upload, configure, and run scripts vary by vendor, including SentinelOne, CrowdStrike, and similar tools.

Configuration

Scripts downloaded from the Installation page come pre-configured: the page writes your deployment token, scan interval, and log level directly into the script, so it can be deployed as is.

To override the pre-configured values, set the following environment variables before running the script:

Variable Required Description
BOOST_DEPLOYMENT_TOKEN Yes Deployment token created from the Endpoint Protection Installation page. BOOST_API_KEY is accepted as a transitional alias; BOOST_DEPLOYMENT_TOKEN wins when both are set.
BOOST_INTERVAL No How often the endpoint is scanned and updates are sent to Boost, in seconds. Default: 86400 seconds, or 24 hours.
RUST_LOG No Log level of the installed services. Use debug or trace for troubleshooting.

Install

Use the install script for the endpoint operating system.

Windows

Configure the EDR or MDM tool to run the script with administrative privileges:

powershell -ExecutionPolicy Bypass -File install.ps1

To override the pre-configured values, set the variables before running the script:

$env:BOOST_DEPLOYMENT_TOKEN='...'; $env:BOOST_INTERVAL='86400'; powershell -ExecutionPolicy Bypass -File install.ps1

For a local test on a single endpoint, run PowerShell as Administrator and use the same command.

macOS and Linux

Configure the EDR or MDM tool to run the script with root privileges:

sh install.sh

To override the pre-configured values, set the variables before running the script:

BOOST_DEPLOYMENT_TOKEN=... BOOST_INTERVAL=86400 sh install.sh

For a local test on a single endpoint, run the same command with sudo:

sudo sh install.sh

Updates

Endpoint Protection keeps itself up to date. The install script sets up the Boost endpoint updater, which periodically updates itself and the installed components. There is no upgrade script to run and no version to pin.

Uninstall

Use the uninstall script to remove Endpoint Protection and all of its components from the endpoint. Uninstall is safe to run on an endpoint that was never installed.

Windows

Run PowerShell as Administrator:

powershell -ExecutionPolicy Bypass -File uninstall.ps1

macOS and Linux

Run the shell uninstall script as root:

sudo sh uninstall.sh

Security Notes

  • A deployment token can only register devices and expires automatically, but store it securely in your EDR or MDM deployment tool nonetheless, and delete the token once the fleet is deployed.
  • BOOST_DEPLOYMENT_TOKEN is read from the environment and is never passed on the command line, so it does not appear in process command lines. It remains readable in the installer's process environment, and it may be visible to tools that capture process environment blocks.
  • A script downloaded from the Installation page contains your deployment token, so treat the script itself, and any copy stored in your EDR or MDM deployment payload, as a secret until the token is deleted.