> ## Documentation Index > Fetch the complete documentation index at: https://docs.cosmon.com/llms.txt > Use this file to discover all available pages before exploring further. # Air-gapped license > Install Argus with a node-locked, cryptographically signed license file that is verified on the machine, with no license server. This is one of the two ways to license an [on-premise (BYOK)](/architecture/deployment-options#on-premise-byok) install. For machines that can reach a license server, see [Floating license](/architecture/on-premise/floating-license). An air-gapped license is a file (`.lic`) that Cosmon signs for one specific machine. Argus verifies the signature and the machine on every start, entirely offline: no license server, no account, no check-in. | | | | - | - | | Bound to | One machine, by its fingerprint | | Verified | Locally, against Cosmon's Ed25519 signature — editing the file in any way invalidates it | | Network for licensing | None | | Valid until | The expiry date signed into the file, set to your contract term | | Renewal | Cosmon sends a new file before expiry; import it the same way | | Revocation | None remotely — the file stops working only at its expiry | ## What you receive Cosmon sends your team the installer for each operating system you're testing on, plus a provenance file for each one (`.sigstore.json`) that proves where the build came from — see [Release integrity](/architecture/release-integrity). The installer is the same however the machine is licensed; there is no separate on-premise build. **Windows** | | | | - | - | | File | `Cosmon Setup .exe` | | Format | 64-bit NSIS installer, Authenticode-signed | | Requires | Windows 10 or 11, 64-bit (ARM is not supported) | **Install:** run `Cosmon Setup .exe`. It installs for the current user into `%LOCALAPPDATA%\Programs\Cosmon` and never asks for administrator rights. **macOS** | | | | - | - | | File | `Cosmon--arm64.dmg` | | Format | Disk image, Developer ID-signed and notarized by Apple | | Requires | macOS 11 or newer on Apple Silicon (Intel Macs are not supported) | **Install:** open the `.dmg` and drag the app to **Applications**. No administrator rights are needed. **Linux** | | | | - | - | | File | `Cosmon-.AppImage` | | Format | AppImage, unsigned — check it against the SHA-512 digest Cosmon publishes with the release | | Requires | x86\_64 with glibc 2.28 or newer (RHEL/Rocky 8, Debian 10, Ubuntu 20.04 or later) | **Install:** make the file executable (`chmod +x Cosmon-.AppImage`) and run it. Allow about 2 GB of disk for the installed application. If your EDR restricts what runs, allowlist the Cosmon publisher certificate and process tree first, as described in [IT prerequisites](/architecture/it-prerequisites#workstation-baseline). You also receive one `.lic` file per machine, after you send Cosmon that machine's fingerprint (step 2). ## Install and activate **1. Install the application** Install it as described in [What you receive](#what-you-receive) for the machine's operating system. **2. Send Cosmon the machine fingerprint** Open Argus. On the first screen, choose **Activate a license key**. In the **Air-gapped** section, choose **Copy** next to the fingerprint — a 64-character code unique to this machine. Send it to Cosmon together with the machine's hostname, so each license file can be matched back to its machine. The fingerprint is a hash; the raw hardware identifier never leaves the machine. **3. Import the license file** When the `.lic` file arrives, return to the same screen, choose **Import license file…** in the **Air-gapped** section and select it. Argus opens immediately and makes no license calls from then on. The file only works on the machine it was issued for. Moving to another machine, or reinstalling the operating system, changes the fingerprint and needs a new file. **4. Connect your LLM** On the **Bring your own key** step of setup, or later under **Settings → Model & provider**: 1. Pick the **Provider**: Anthropic, OpenAI or Google. 2. Enter the **API key**. 3. For a gateway or internal model, enter its root address in **Gateway URL** (or **Anthropic Base URL** / **OpenAI Base URL** in Settings). Argus adds `/v1/messages` (Anthropic) or `/v1/chat/completions` (OpenAI) itself; OpenAI reasoning and Responses-only models use `/v1/responses` instead, so a gateway serving them must expose that path too. Gateways such as LiteLLM work with the Anthropic and OpenAI providers only. 4. Choose **Test connection**. It shows **Connected** with the response time once the endpoint answers. Keys are encrypted with the operating system's keystore: DPAPI on Windows, Keychain on macOS, and the Secret Service keyring (GNOME Keyring or KWallet) on Linux. On a Linux machine with no keyring running, keys are stored base64-encoded, not encrypted — run a keyring, or pass the key through the `ANTHROPIC_API_KEY`, `OPENAI_API_KEY` or `GOOGLE_API_KEY` environment variable instead. Prompts, responses and files go straight to this endpoint, never through Cosmon. If the machine reaches the internet through a proxy, set it first: choose **Network / proxy settings** on the first screen (or **Settings → Network**), set **Proxy mode** to **Manual**, and enter the **Proxy URL**. A TLS-inspecting proxy's root CA goes in the operating system's certificate store — see [TLS inspection](/architecture/it-prerequisites#tls-inspection-and-corporate-certificate-trust). **5. Check it works** Open a supported CAD or CAE application, start a new chat and send a short prompt. See [Quickstart](/getting-started/quickstart#your-first-prompt) for examples. To move a license off a machine, open **Settings → Account** and choose **Deactivate license**. This removes the file from the machine; importing it again restores access. ## What still reaches Cosmon The current build contacts Cosmon for the connections below, whichever license the machine uses. The machine only talks to the hosts in the **Destination** column; the **Processed by** column names the services the Cosmon backend forwards that data to. > [!WARNING] > > Turn off **Share conversation history for analytics** under **Settings → Privacy & security** on every machine. It is on by default, and while it is on, operational traces include prompts, responses and tool results. With it off, none of the connections below carry conversation content. | Connection | Destination | Processed by | Can it be turned off? | | - | - | - | - | | Update check and download | `desktop-api.cosmon.com`, then `storage.googleapis.com` | Cosmon | No. Blocking it stops automatic updates; install new versions by hand. | | Error reports | `desktop-api.cosmon.com` | Sentry | No. Stack traces, app version and OS only. | | Operational traces | `desktop-api.cosmon.com` | Logfire, and Sentry for error-level spans | No. Conversation content only while history sharing is on. | | Product analytics | `analytics.cosmon.com` | PostHog | Yes: turn off **Send anonymous telemetry** under **Settings → Privacy & security**. | See [Data handling](/architecture/data-handling#what-leaves-the-workstation) for what each connection carries. ## Updates To update by hand, run the new installer over the current version; chats, settings and the license are kept. Keep the previous installer in case you need to roll back. ## Where Argus stores data **Windows** | | | | - | - | | Application | `%LOCALAPPDATA%\Programs\Cosmon` | | Chats, settings, license | `%APPDATA%\nexus` | | Logs and traces | `%APPDATA%\nexus\logs` | **Uninstall:** remove **Cosmon** in **Settings → Apps**. To also delete chats, settings and the license, delete `%APPDATA%\nexus`. **macOS** | | | | - | - | | Application | `/Applications` | | Chats, settings, license | `~/Library/Application Support/nexus` | | Logs and traces | `~/Library/Logs/nexus` | **Uninstall:** move the app from **Applications** to the Trash. To also delete chats, settings and the license, delete `~/Library/Application Support/nexus`. **Linux** | | | | - | - | | Application | Wherever you saved the AppImage | | Chats, settings, license | `~/.config/nexus` | | Logs and traces | `~/.config/nexus/logs` | **Uninstall:** delete the AppImage. To also delete chats, settings and the license, delete `~/.config/nexus`. When you report a problem, send the logs folder from the affected machine. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.