Install Tau on your machine

Run Tau on your own Mac or Linux machine when you want to manage its software, data and agent runtime yourself. This guide takes you from an empty machine to a running instance with an administrator account. You will need a model-provider account before an agent can do useful work.

Before you start

Have these ready:

• A Mac with an active desktop login, or Linux with a working systemd user session. On Windows, run the installer inside WSL 2 rather than PowerShell.
• Node.js 24 LTS (minimum 22.19.0) on your PATH, for building Tau and its embedded documentation. Check with node --version.
• curl and git, plus permission to install files in your home directory.
• Docker Desktop or a running Docker daemon. The default setup uses Docker for PostgreSQL, even when agents run directly on the host. An existing PostgreSQL connection is an advanced alternative.
• Internet access to download the CLI, source, dependencies and database image.

For host-mode browser tools, install Chrome, Chromium, Edge or Brave. Host-mode local app deployments also need tmux. Setup reports missing optional tools so you can add them later.

Choose where agents run

The installer asks for a runtime. Choose it deliberately: this controls what agent commands can access.

Choice	Use it when
host	You trust agents to run as your own user on a personal machine. This has no sandbox isolation.
docker-socket	You want container workspaces on macOS or Linux. Access to the host Docker socket still gives agents substantial control over that host.
docker-sysbox	You already have Linux with Sysbox installed and want Docker running inside the sandbox container.
k3d	You specifically want a local Kubernetes environment and already have Docker, k3d and kubectl.

For a first personal install, host has the fewest agent-runtime components. Read runtime and access choices if you need isolation or remote access. The local installer does not provision the vm runtime or an existing Kubernetes cluster.

Run the installer

In your terminal, run:

curl -fsSL https://ficus.sh/cli/setup.sh | bash

Choose your runtime, review the printed plan, then confirm. Setup installs the Tau CLI, installs Bun if needed, and places the source checkout at ~/.tau/tau. It creates configuration, starts PostgreSQL, builds Tau, prepares the selected runtime, and starts the API and worker processes.

The first database image download and builds can take several minutes. Keep the terminal open until setup prints the URL and next steps.

For a noninteractive installation, supply the runtime explicitly:

curl -fsSL https://ficus.sh/cli/setup.sh | bash -s -- --runtime host --yes

--yes accepts the plan; it does not choose a runtime. To use another directory, put installer options before setup options:

tau server install --root ~/tau-local --runtime host --yes

If you already have a Tau checkout with Bun and dependencies installed, configure that checkout instead:

bun run setup -- --runtime host

You can inspect a checkout’s setup plan without changing it:

bun run setup -- --runtime host --dry-run

Create the first administrator

1. Open the URL printed by setup, normally on http://localhost:3000. The printed first-run link signs you in using the bootstrap password. Treat that link as private.
2. Enter your email to create the administrator account. If email delivery is configured, follow the verification step. Otherwise, the bootstrap flow continues without asking you to enter a verification code.
3. Register a passkey when prompted. The first passkey account becomes the system administrator.
4. Return to Tau using that passkey. Once an administrator has a passkey, the bootstrap password stops working for login.

If you opened the plain address and it asks for a password, find TAU_PASSWORD in the checkout’s .env file. Setup generates it for you. Keep the file and the first-run link out of shared screenshots or support messages.

Connect a model and try a task

Open Settings → AI Providers and connect the provider you want agents to use. Setup already creates the encryption key needed to save these credentials. Follow connect models to choose the right account type.

Then follow your first task. A working browser page alone does not test execution: send a small task and confirm the agent responds and can use its workspace.

To use the CLI with your new account:

tau auth login local --api-url http://localhost:3000
tau auth status

Approve the device in your browser. If you previously exported TAU_PASSWORD in this shell, unset it before browser-based login so it does not select the old password flow. See the CLI reference for backend selection.

Check the installation

tau server status
tau server logs -f

Status identifies the local checkout, runtime, service manager and process state. Logs follow the API and worker; press Ctrl+C to stop following them without stopping Tau.

The default service manager is launchd on macOS and systemd-user on Linux. A Mac install runs in your desktop login session and stops at logout. On Linux, follow setup’s linger instructions if the instance must keep running after logout. PM2 is also available through --supervisor pm2.

Use maintenance for restart, update and backup tasks, or troubleshooting if setup does not finish. Rerunning setup in the same checkout preserves existing secrets and configuration unless you explicitly replace a managed setting.