HomeFeaturesPricingDocumentationContactDOWNLOAD

Download SiteCMD

Local-first desktop app with a bundled MCP server. Get started today for free.

Download for macOS (Apple Silicon)v1.1.0 ยท released 2026-08-25

Verify your download

Every release publishes a SHA-256 checksum list, and every updater bundle and CLI archive is signed with one minisign key. The key is printed here and on the Trust page, so a tampered file and a tampered site cannot hand you a matching pair.

Check an installer

shasum -a 256 SiteCMD_1.1.0_universal.dmg
# compare the digest with the matching line in SHA256SUMS

Check a CLI archive

base64 --decode < sitecmd-cli_1.1.0_darwin-universal.tar.gz.sig > archive.minisig
minisign -Vm sitecmd-cli_1.1.0_darwin-universal.tar.gz -x archive.minisig -P RWTtzNh0gmMU/8O1AJBbQbUEy9oD5lpqL/dV0qRqlpsCldfWNWgxr5kE

Before you install, here is what leaves your machine

  • Your code never leaves your device, and your scan results do not either until you connect a site yourself. There is no account to create and nothing syncs on its own.
  • Beyond fetching the site you scan, the app makes a small, named set of calls: an update check, dependency and vulnerability lookups (package names and versions), a public domain-registry lookup, and Google PageSpeed when you open Web Vitals. Existing licenses can also validate and fetch maintained-catalog updates. Connected sites use the separate hosted-service calls disclosed on the Trust page.
  • Analytics and crash reports are off by default and opt-in.

See every call and verify it yourself

Local-first

Scans, history, and findings run on your machine and stay there. Work offline and keep your data off someone else's cloud.

MCP server

A built-in MCP server hands ranked issues and detailed fix prompts straight to Claude Code, Cursor, and other AI editors.

Verified fixes

Hand a ranked finding to your coding agent, re-run the check, and keep the issue closed only when SiteCMD verifies the fix.