Installation

Choose an Installation Path

Linmas offers multiple distribution paths depending on how you plan to use the security skills and review engine.

1. Install via npm

Install the global Linmas CLI using npm:

npm install --global linmas@0.9.1
linmas list

Or invoke Linmas on-demand via npx without a global install:

npx --yes linmas@0.9.1 list
npx --yes linmas@0.9.1 review --skill linmas-secure-code-reviewer --input patch.diff

2. Install from GitHub Source

git clone https://github.com/TanKimGwan/linmas.git
cd linmas
npm ci
npm link
linmas list

To run directly without linking:

node bin/linmas.mjs list
node bin/linmas.mjs review --skill linmas-secure-code-reviewer --input patch.diff

3. Install into Codex

Add Linmas to Codex from its canonical Git repository:

codex plugin marketplace add TanKimGwan/linmas --ref v0.9.1
codex plugin add linmas@linmas
codex plugin marketplace list --json
codex plugin list --json

4. Single Skill Installation

Requires Node.js 24+, npm, and a supported host. The managed installer is the primary single-skill path. For Claude Code, choose Claude at the interactive host prompt; files are managed under ~/.claude/skills with ownership in ~/.claude/linmas-manifest.json.

npx --yes linmas@0.9.1 detect
npx --yes linmas@0.9.1 install linmas-secure-code-reviewer
npx --yes linmas@0.9.1 doctor

Inspect the doctor report, then start a fresh host session and ask it to list available Linmas skills. Detection alone is not proof that a skill is loaded. Claude managed skills do not imply native MCP plugin registration.

Manual alternative

If you only require a specific skill (e.g. linmas-secure-code-reviewer), you can inspect and copy its canonical prompt fromskills/linmas-secure-code-reviewer/SKILL.md ↗ into your agent's instructions.

Manual import does not register MCP tools, provide managed upgrades, or establish runtime parity. Installation does not send review inputs; live provider reviews can transmit the explicitly selected input and may incur charges.

Verification and troubleshooting

• Unsupported Node.js: run node --version and confirm Node.js 24+ before running npm or npx. If it does not match, select a supported Node.js release using your existing runtime manager, reopen the terminal, and check again. Do not bypass engine checks.
• Host not detected: check node --version, the host installation, and the detection report. Do not invent a host directory or overwrite existing instructions.
• Skill missing: run doctor, restart the host completely, and create a new task. For Codex, inspect both marketplace ref and installed plugin version.
• Permission or ownership conflict: stop and inspect the reported path; preserve user files. Do not retry with sudo or delete a manifest blindly.
• Provider error: installing a skill is separate from authentication, model availability, and provider execution. Use the offline tutorial first; never paste credentials into a prompt.
• Input file not found: patch.diff is an example filename, not an installed fixture. Save the intended diff locally, confirm your working directory and the readable file path, and quote paths containing spaces. Inspect and sanitize the input before any provider run; do not substitute an entire repository. For a provider-free check, download and run the authorization tutorial fixture.
• Upgrade or rollback: consult the versioned migration instructions before removing a plugin or changing a pinned ref. Windows destructive uninstall fails closed with SAFE_FILESYSTEM_OPERATION_UNAVAILABLE.

Commands checked against Linmas v0.8.0 usage documentation on 2026-09-08; host installation was not executed in this website workspace. Continue with the offline first-review tutorial.