Installation
Install forti from the APT repository or Homebrew, or build it from source.
Installation
forti is a single executable. Its only runtime library dependency is libcurl; the forti-api SDK is
header-only and compiled in. forti cert create also runs the openssl command, which macOS ships
(/usr/bin/openssl, LibreSSL) and the Debian package depends on. The package installs forti and its
man page (man forti).
Install forti
Pick the method for your platform: the APT package (Debian and Ubuntu, amd64), the Homebrew formula (macOS and Linux), or a build from source.
The forti-cli package (amd64) is published to the ValkyrianLabs APT repository:
1sudo install -d -m 0755 /etc/apt/keyrings2sudo curl -fsSL https://apt.valkyrianlabs.com/pubkey.gpg \3 -o /etc/apt/keyrings/valkyrianlabs.gpg4sudo chmod 0644 /etc/apt/keyrings/valkyrianlabs.gpg5 6echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/valkyrianlabs.gpg] https://apt.valkyrianlabs.com stable main" | \7 sudo tee /etc/apt/sources.list.d/valkyrianlabs.list > /dev/null8 9sudo apt update10sudo apt install -y forti-cliThe executable is /usr/bin/forti.
1brew install valkyrianlabs/tap/forti-cliThe formula builds from source against the forti-api formula, which it needs only at build time.
Recent Homebrew versions ask you to trust a third-party tap first: brew trust valkyrianlabs/tap.
Needs a C++23 compiler (Apple clang 16+ or GCC 13+), Meson 1.3 or later, Ninja and libcurl. The
forti-api SDK comes from pkg-config (libforti-api-dev or the Homebrew formula) or, failing that,
from the Meson wrap.
1# Ubuntu: sudo apt install meson ninja-build g++ pkgconf libcurl4-openssl-dev2# macOS: brew install meson ninja (libcurl comes with the SDK)3meson setup build4meson compile -C build -j 45meson install -C build --skip-subprojectsThe default build type is release (-O3). --skip-subprojects keeps meson install from
installing the SDK headers when they came from the wrap. See Building for
the details.
The typed endpoint operations are split across ten translation units ("engine shards"), each
needing about 2 GB of RAM to compile, so limit the jobs (-j) on a small machine.
forti-mcp (optional)
forti-mcp, the MCP server for AI clients, is a separate package with no dependency on forti-cli:
brew install valkyrianlabs/tap/forti-mcp or sudo apt install forti-mcp. With both installed,
forti install mcp registers it with your AI clients in the ~/.forti workspace
(AI agent integration).
Check the installation
1forti --version2forti discover firewall/address3forti home--version prints the forti version and the FortiOS schema version its models come from
(forti 0.2.0 (FortiOS schema 7.4.8)). discover works offline: the resource catalog is compiled in.
forti home shows where forti keeps its files: the forti home, ~/.forti (or $FORTI_HOME).
Upgrading from 0.1? Your existing setup keeps
working; see Pre-0.2 setups.
Next steps
Quick start
Configure a FortiGate, check it, and start an AI agent in ~/.forti.
Profiles and credentials
Every forti configure option, credential sources and TLS.
Building
Build options, engine shards and the release profile.