Install

Release binaries

Download from GitHub Releases (macOS / Linux; Windows best-effort). Installers are produced by cargo-dist on version tags.

curl --proto '=https' --tlsv1.2 -LsSf \
  https://github.com/kiket-dev/mayrun/releases/latest/download/mayrun-installer.sh | sh

From source

cargo install --git https://github.com/kiket-dev/mayrun --locked

Requires Rust 1.85+ (edition 2024 toolchain).

60s path — shell-hook (recommended)

cd your-repo
mayrun init --detect
eval "$(mayrun shell-hook)"   # fish: mayrun shell-hook | source

The hook fail-closes on deny / require_approval (prints rule_id + next steps). Outside a project (no policy), it passes through so $HOME shells are not bricked. Optional global policy: ~/.config/mayrun/policy.yaml or $MAYRUN_POLICY. Policy discovery walks upward from the current directory.

For agent shells that spawn bash -lc:

mayrun shell-wrap -- bash -lc 'cargo test'

Agent MCP setup

mayrun setup cursor              # print snippet
mayrun setup claude --write      # merge + .bak
mayrun setup opencode --write

Or paste manually — Cursor example:

{
  "mcpServers": {
    "mayrun": {
      "command": "mayrun",
      "args": ["mcp"],
      "env": {}
    }
  }
}

Prefer agent instructions: Use mayrun_run / mayrun_check instead of unrestricted shell for side effects. Working directory should contain mayrun.policy.yaml.

Verify

mayrun check 'echo hi'    # Allow
mayrun check 'rm -rf /'   # Deny
mayrun run 'git push'     # Require approval → --approve
mayrun status
mayrun metrics --since 7d
mayrun policy packs

Next: Quickstart · Policy · Architecture