Install Cert-X-Gen

Install the cxg binary, confirm it runs, and see where it keeps the detection templates it fetches for itself.

Cert-X-Gen runs on macOS and Linux, on both x86-64 and ARM64. Every release also publishes a Windows binary, which works the same way but is not covered here.

Install

cargo

Needs a Rust toolchain. This compiles cxg from source, which takes several minutes.

cargo install cert-x-gen

The binary lands in ~/.cargo/bin/cxg. Make sure that directory is on your PATH.

To upgrade a cargo-installed copy later:

cargo install cert-x-gen --force

Release binary

Downloads the published build and checks it against the release’s SHA256SUMS. Replace cxg-darwin-arm64 with the asset for your platform: cxg-darwin-amd64, cxg-linux-arm64, cxg-linux-amd64, or cxg-windows-amd64.exe.

1. Download the binary and the checksum file.

   curl -fsSLO https://github.com/Bugb-Technologies/cert-x-gen/releases/download/v1.3.0/cxg-darwin-arm64
   curl -fsSLO https://github.com/Bugb-Technologies/cert-x-gen/releases/download/v1.3.0/SHA256SUMS

2. Verify the download before you make it executable.

   shasum -a 256 -c SHA256SUMS --ignore-missing

   cxg-darwin-arm64: OK

   On Linux, use sha256sum -c SHA256SUMS --ignore-missing.

   If this prints FAILED, stop. Delete the file and download it again.

3. Put it on your PATH as cxg.

   chmod +x cxg-darwin-arm64
   sudo mv cxg-darwin-arm64 /usr/local/bin/cxg

Homebrew

brew install bugb-technologies/cxg/cxg

The user/repo/formula form taps Bugb-Technologies/homebrew-cxg automatically, so no separate brew tap is needed.

The formula is regenerated by cert-x-gen’s release workflow, and it downloads the same release asset as the release-binary tab: same bytes, same SHA256SUMS entry. Check what you got with cxg version.

Which version each method gives you

All three methods give you 1.3.0, which is what this site’s reference documents. Pick on toolchain and upgrade path instead.

Method	Version today	Notes
cargo install cert-x-gen	1.3.0	Compiles from source. Needs a Rust toolchain.
Release binary	1.3.0	The published build, checksummed. No toolchain.
Homebrew tap	1.3.0	Installs the same release binary, and upgrades with brew upgrade.

Verified on 2026-08-19 against the v1.3.0 release, cargo search cert-x-gen, and brew info bugb-technologies/cxg/cxg.

Verify the install

cxg version

CERT-X-GEN v1.3.0
Advanced Multi-Language Security Scanning Engine

Build Information:
  Version: 1.3.0
  Target:  aarch64-macos

Links:
  Repository:    https://github.com/Bugb-Technologies/cert-x-gen
  Documentation: https://github.com/Bugb-Technologies/cert-x-gen/tree/main/docs
  Issues:        https://github.com/Bugb-Technologies/cert-x-gen/issues

Your Version: and Target: lines will differ. What matters is that the command prints this block rather than command not found.

Templates install themselves

Cert-X-Gen ships without detection templates, and fetches them for you. The first time you run any command on a machine with no templates, cxg announces 📦 First run detected! Installing templates from GitHub..., pulls the official repository, and then carries on with whatever you asked it to do. The line that confirms the fetch is:

[INF] Updated repositories: official

A summary follows, counting the templates it installed and breaking them down by language. Those numbers move with every template release, so treat them as a sign it worked rather than as a figure to remember.

You do not have to do anything to trigger this, and it happens once. Later runs go straight to work with no banner. It does need outbound HTTPS to github.com, so on a machine without it, fetch templates separately and copy them in.

To pull the latest templates yourself, at any time:

cxg template update

Cert-X-Gen also checks hourly whether newer templates exist. When they do, it prints a line telling you so and leaves the decision to you, rather than updating underneath a scan you are in the middle of.

Where templates live

cxg template pwd

📂 Template Directories (priority order):

  [✗] Local (project)    /Users/you/work/templates
  [✓] User               /Users/you/.cert-x-gen/templates
  [✗] System             /usr/local/share/cert-x-gen/templates

Your paths will differ. A [✓] on User means the auto-install worked, and that is where cxg template update writes.

Local (project) is a templates/ directory in whatever directory you are standing in, and it wins over the other two. That is useful when you are developing templates and surprising when you are not, so it is worth checking this output if a scan runs templates you did not expect.

A template runs as you

cxg starts a template as an ordinary child process with your files, your credentials, and your network access. The templates fetched above are the official set, but the same is true of any template you add. Read the template trust model before running templates you did not write.

Next

• Run your first scan reads a real finding on a target you control, and explains the summary and the results file.
• Scan a target covers scope, template selection, and output formats in full.
• CLI reference has every command, flag, and default.