Docs

Install and use Zinloop

Getting started

Create an account and sign in.
Add a client, then open it and create an upload token. Copy it; it's shown once.
Run the install script on the client's laptops through your RMM (below). Scans show up within a minute.

Install with your RMM

The scripts run as SYSTEM (Windows) or root (macOS, Linux). They download the scanner from your console, check its SHA-256 checksum, store the token where only administrators can read it, scan every user profile and send the report. Set two variables in your RMM tool:

Variable	Value
`ZINLOOP_CONSOLE_URL`	Your console address, for example `https://zinloop.com`
`ZINLOOP_TOKEN`	The client's upload token, starting `zlu_`

NinjaOne: add the script under Administration › Library › Automation and use script variables. Datto RMM: create a component with two site or component variables. N-able and ConnectWise Automate: create a script with the two values as parameters.

Windows (PowerShell)

Download install-windows.ps1. Add -Schedule to run it daily at 10:00.

powershell -ExecutionPolicy Bypass -File install-windows.ps1 -Schedule

macOS and Linux

Download install-unix.sh. Set ZINLOOP_SCHEDULE=1 to run it daily.

sudo ZINLOOP_CONSOLE_URL=https://zinloop.com ZINLOOP_TOKEN=zlu_... ZINLOOP_SCHEDULE=1 sh install-unix.sh

Run it by hand

Download the build for the computer from /download/zinloop-<os>-<cpu> on your console, then:

zinloop                     # readable summary for the current user
zinloop --json --out scan.json
zinloop --all-users         # every profile (run as administrator or root)
ZINLOOP_TOKEN=zlu_... zinloop --upload https://zinloop.com/api/scans

Without --upload the scanner sends nothing. You can open a saved scan.json in the console under Open a scan file.

Fix plain-text keys

Run as the laptop's user, with the AI apps closed:

zinloop fix-secrets            # preview, changes nothing
zinloop fix-secrets --apply    # move keys into the keychain

For each config file, Zinloop saves the keys in the system keychain and reads them back, copies the original file to <file>.zinloop-backup-<time>, and rewrites each connector to start through zinloop exec. If any step fails, the file is left as it was. Keys in headers, arguments or addresses are listed for fixing by hand. Keep the scanner in a permanent place (the install scripts use C:\ProgramData\Zinloop and /usr/local/zinloop), because its path is written into the configs.

Replace exposed keys

A key that sat in plain text may already have been copied. Create a new key with the provider, then:

zinloop rotate --list
zinloop rotate <name>          # paste the new key when asked

Files the scanner reads

App	Files
Claude Desktop	`claude_desktop_config.json` in the app's settings folder
Claude Code	`~/.claude.json`, project `.mcp.json`
Cursor	`~/.cursor/mcp.json`, project `.cursor/mcp.json`
Windsurf	`~/.codeium/windsurf/mcp_config.json`
VS Code	User `mcp.json` and `settings.json`, project `.vscode/mcp.json`

Command reference

Option	What it does
`--json`	Print the report as JSON
`--out FILE`	Also save the JSON report (owner-only file)
`--all-users`	Scan every user profile on the computer
`--project DIR`	Also check a project folder (repeatable)
`--upload URL`	Send the report to the console; token from `ZINLOOP_TOKEN` or `--token-file`
`--fail-on LEVEL`	Exit with code 2 if anything is at or above high, medium or low

Exit codes: 0 done, 1 bad setup, 2 risk at or above --fail-on, 3 scan ran but upload failed.