Install & first scan

Install the launcher

One command downloads and installs rutken-launcher into ~/.local/bin — per-user, no sudo, no build, no repository checkout:

curl -fsSL https://www.rutken.com/install.sh | bash

The installer is security-conscious by design. It fetches the launcher binary along with a SHA-256 sidecar and an Ed25519 signature, verifies the SHA-256 (a cheap transit-corruption check) and then verifies the signature against a release public key pinned inside the install script itself — not a key fetched from storage. Both checks fail closed: openssl is a hard dependency and a failed signature aborts the install. The script also wires ~/.local/bin onto your PATH if it isn't already.

Why a launcher rather than a plain binary? rutken itself is a persistent alias the launcher owns and repoints at whichever edition you installed most recently. The launcher also handles update checks and entitlement refresh, so you install once and never re-run the script by hand.

Pick an edition

On first run the launcher asks which edition to provision. Community is free and needs no account. To provision it immediately and non-interactively, pass --community straight through the installer:

curl -fsSL https://www.rutken.com/install.sh | bash -s -- --community

Or run the launcher yourself after installing:

rutken-launcher --community --yes

Once an edition is provisioned, rutken is on your PATH. For a paid edition, run rutken-launcher without --community and sign in when prompted.

What each edition is for

• Community (free). The complete static analysis pipeline (parse / IR / CFG / rules / data-flow / taint), software composition analysis with CVE matching, and a taste of dynamic analysis: live traffic capture and TLS unpin driven by a bundled Frida gadget.
• Paid editions. Build outward from that floor: Rutken's own bespoke no-repack hooking engine (no Frida fingerprints), active runtime intervention, automation (CI gating, the REST API, the MCP server), and team / enterprise deployment. The pricing page has the current plans; the Platforms & operations guide covers what each capability does.

Capability names in this documentation are marked where a feature is paid-tier or platform-specific. Static analysis and SCA are never gated.

The command model

Rutken's CLI has two invocation shapes, and knowing which is which saves confusion:

• Target-form: rutken <target> <verb> [flags]. The target (an APK, ELF, PE, Mach-O, or iOS bundle) comes first, then the verb. This is how you scan and inspect a file: rutken app.apk rules, rutken app.apk info.
• Keyword-form: rutken <keyword> ... for commands that don't operate on a single file — rutken devices, rutken update, rutken packs list, rutken image scan ....

Your first scan

Point rules at any APK:

rutken app.apk rules

This runs the full static pipeline — decode, build the IR and control-flow graphs, run the rule set (including CFG-aware and data-flow/taint checks) — and prints findings to the terminal, ranked by severity. By default it reports everything from low severity up.

Narrow the output, or emit a machine-readable report:

# Only medium severity and above
rutken app.apk rules --min-severity medium

# JSON for another tool, or SARIF for a code-scanning dashboard
rutken app.apk rules --format json
rutken app.apk rules --format sarif --out findings.sarif

See exactly which rules exist (optionally filtered by platform) without running a scan:

rutken app.apk rules --list-rules
rutken app.apk rules --list-rules --platform android

A few more verbs

The verbs you'll reach for next, all target-form:

rutken app.apk info        # analysis summary and metadata
rutken app.apk manifest    # human-readable AndroidManifest view
rutken app.apk sca         # software composition analysis (libraries, CVEs)
rutken app.apk concepts    # where security concepts appear in this app

sca fingerprints bundled libraries and native code against a known-component dataset and matches against CVEs; concepts is a navigation layer that points you at where a given security concept lives in the app. The Static analysis guide covers all of these in depth.

The desktop GUI

Prefer a visual workflow? The desktop GUI is a separate binary, rutken-gui, that browses the class tree, control-flow graphs, and findings side by side. Open an APK directly:

RUTKEN_GUI_OPEN=path/to/app.apk rutken-gui

There is no rutken tui / rutken gui subcommand — the GUI is its own executable.

Updating

The launcher polls for new builds and tells you when one is available. To update immediately:

rutken update

This applies the latest build for your installed edition and re-validates your entitlement, so you don't need to re-run the install script or sign in again unless your session has expired.