Download

A client that already knows where home is

A branded build ships with your rendezvous server, relay, API and key inside it, and with login required from the first launch — nobody types a server address. The builds below are the unbranded ones, for trying it against your own deployment.

All releases Deploy the server first

macOS

Apple silicon (arm64)

macOS 13 Ventura or newer. Screen Recording and Accessibility permissions are requested on first run.

Get the buildtracemote-aarch64.dmg

macOS

Intel (x86_64)

macOS 13 Ventura or newer, on Intel hardware.

Get the buildtracemote-x86_64.dmg

Windows

x86_64

Windows 10 1809 or newer. One installer; the service registers itself for unattended access.

Get the buildtracemote-x86_64-install.exe

Not yet code-signed, so Windows will show a SmartScreen warning the first time it runs. Signing is in progress; a branded build for your organisation is signed with your own certificate.

Linux

x86_64

A portable bundle. X11 is fully supported; Wayland capture depends on your compositor's PipeWire portal.

Get the buildtracemote-linux-x86_64.tar.gz

The newest of the three builds. Worth a pilot on one machine before a wide rollout.

What is inside

Preconfigured, and signed by you

The configuration is not a text file an end user can edit. It is signed at release time with your own key and verified by the client at startup — a tampered bundle is discarded rather than trusted.

Rendezvous serverbaked in, signed

Relay serverbaked in, signed

API serverbaked in, signed

Server keybaked in, signed

require-loginon

Auto-updateoff — you own the channel

unattended devices

# unattended devices: enrol against your backend, no UI
tracemote --deploy --token <enrolment-token>

# check what a build is actually configured with
tracemote --get-id
tail -f ~/.config/tracemote/TraceMote.log

Rolling it out

Start with the machines people connect from. A stock RustDesk client can still be controlled, but it cannot sign in against your backend — so once login is required it can no longer start a connection. Controlled devices can follow at their own pace.

Verifying a build

Every release is published alongside the source tag it was built from, and the release pipeline checks each artifact for the signed configuration and the licence before it is uploaded. If those checks fail, there is no artifact to download.

Requirements

What the client needs from the machine

macOS 13 or newer. Screen Recording and Accessibility permissions, granted once per machine. Unattended access needs the service installed, which is a prompt at first run.
Windows 10 1809 or newer. The installer registers a service so the machine is reachable at the login screen and after a reboot.
Linux, X11 or Wayland. X11 is fully supported; Wayland capture depends on your compositor exposing the PipeWire portal.
Outbound reachability to your rendezvous server on 21116 (TCP and UDP) and, when a direct path cannot be found, your relay on 21117. Nothing needs an inbound firewall rule.

Get started

No server yet?

The client is the second half. Either stand the server side up yourself — one compose file and a seeded admin — or have us run a deployment for you.

See pricing Self-hosting guide