NovaStack EdgeShield Agent downloads

The EdgeShield agent

Ikat

Install Ikat on every device that needs to reach your network. It connects outbound only, so no ports are opened and no public address is exposed.

Downloads

Choose your device

Check the SHA-256 fingerprint after downloading. If it does not match, do not run the file — tell us.

Android · phones and tablets

ikat-0.1.0-android.apk  ·  70.7 MB  ·  Android 8 and later

SHA-256 b2b4be04e8508f530d324929d046a42eeddcd5313f0bbdc92f82d49cedd7129d

Download

Linux · x86-64

ikat-0.1.0-linux-amd64.tar.gz  ·  19.1 MB

SHA-256 def67971a545639b1ee30cb6a674f68dcde02d50ec622de4e6279834c577cab8

Download

Linux · ARM64

ikat-0.1.0-linux-arm64.tar.gz  ·  17.2 MB

SHA-256 dafabad434dde5685d1789295f894a45c0632947e7d2a272b210a7e2237f5fbe

Download

Windows · x86-64

ikat-0.1.0-windows-amd64.zip  ·  16.0 MB

SHA-256 746971237b2783408436484b6d22d121cab0d7ea13c42a641cc4221e827c9760

Download

macOS · Apple silicon

ikat-0.1.0-darwin-arm64.tar.gz  ·  14.6 MB

SHA-256 b536637d8857e5d9a04ac71ee631c6923e75528ac87a513259d4c3ac8ed4e8a3

Download

Installing

Three things, five minutes

You need two details from your organisation's EdgeShield console: your organisation address and an enrolment key. The key works once and expires after 24 hours.

1

Get an enrolment key

Sign in to your organisation's console and press Create enrolment key. It is shown once only.

2

Linux

Unpack the download, then run the installer with your address and key.

sudo ./install-linux.sh \
  --server https://your-org.edgeshield.novastack.com.my \
  --key    hskey-auth-your-key
3

Windows and macOS

Run the daemon, then join with the same address and key.

ikat up --login-server https://your-org.edgeshield.novastack.com.my \
        --authkey hskey-auth-your-key
4

Android

Download the APK straight to the phone and open it to install. Android will ask permission to install from outside the Play Store — that is normal for a company's own app. Open Ikat, choose to sign in with your own server, and enter your organisation address.

5

iPhone and iPad

Open your organisation's address on the phone itself and install the profile it offers. That profile points the phone at your own server. Then install the app from the App Store and sign in — it goes to your server, nobody else's.

https://your-org.edgeshield.novastack.com.my/apple

Apple's iOS app wrapper cannot be forked, so for now iPhones use the official app pointed at your server. Your network, your keys and your records stay entirely yours.

What you should know

Two things we state plainly

Windows removes this file today

Microsoft Defender deletes the Windows download and reports a trojan. It is a false positive: Defender's machine-learning scanner distrusts unsigned programs that configure network adapters — which is precisely what any private-network client has to do. We have submitted the file to Microsoft for review.

macOS holds the file on first open for the same underlying reason: no signing certificate is in place yet. One is being arranged, and both problems disappear once it is. Until then, verify the SHA-256 fingerprint above — that is the check that actually proves the file came from us.

Ikat is built on open source

Ikat is a derivative of an open-source WireGuard client under the BSD 3-Clause licence, rebranded and pointed at your own EdgeShield server. That means the cryptography protecting your traffic has been publicly examined for years — not something we invented and asked you to trust.