Forge Anvil · sealed edition
In the sealed edition, every tool runs inside a locked container. It can reach only the engagement's approved addresses and ports during the testing window. Anything else is blocked by the computer itself and flagged on the engagement's Network log. If the container can't start, the tool doesn't run. Sign-in, license and scope checks are the same as the standard build.
64-bit Linux with administrator rights.
Download the sealed edition
Pick “Linux · Windows (WSL)” in the download window.
Extract it
CYBRARY tar xzf ForgeAnvil-<version>-linux-sealed-x64.tar.gz && cd ForgeAnvil-sealedCheck the download (recommended)
sha256sum ../ForgeAnvil-*-linux-sealed-x64.tar.gzSet up the sealed container (once)
Installs the container and network-lock tools and lets Anvil raise the lock without asking for a password each time. Works on Ubuntu, Debian, Kali, Fedora, RHEL, Arch and Alpine.
sudo ./setup-sealed.shStart Anvil
./run-anvil.shSign in and pick an engagement
Your license and the engagement's scope are checked before every tool runs.
Runs the same sealed Linux build inside Windows. The standard Windows download stays available if you don't want WSL.
Install WSL 2 with Ubuntu (once)
Run in PowerShell as administrator, then restart. Needs Windows 11, or Windows 10 22H2 or newer.
wsl --install -d UbuntuOpen Ubuntu from the Start menu
Create your Linux user name and password when asked.
Copy the download into Ubuntu
cp /mnt/c/Users/<you>/Downloads/ForgeAnvil-*-linux-sealed-x64.tar.gz ~/ && cd ~Extract and set up
If setup says it switched systemd on, run wsl --shutdown in PowerShell and reopen Ubuntu, then run setup again.
tar xzf ForgeAnvil-*-linux-sealed-x64.tar.gz && cd ForgeAnvil-sealed && sudo ./setup-sealed.shStart Anvil
The Anvil window opens on your normal Windows desktop.
./run-anvil.shDedicated workstation option
Electron can hold Anvil full screen and capture supported host shortcuts. Complete lockdown requires Windows or Linux device policy because secure operating-system keys cannot be overridden by Chromium or Electron.
Use a separate standard operator account and configure Windows Assigned Access or Shell Launcher for Forge Anvil. Keep a different administrator account for maintenance and recovery. Windows always reserves Ctrl+Alt+Delete.
Create a dedicated Anvil session that starts Forge Anvil instead of a normal desktop. Remove or rebind the window manager's task-switching, terminal and virtual-console shortcuts for that session. Keep a separate administrator login or recovery console.
Choose Managed kiosk from Display. Anvil captures supported task-switching and close-window shortcuts and sends them to its Linux desktop. Ctrl+Alt+Shift+Enter releases the session. Emergency Stop remains available and stops all tool activity.
Run sudo ./setup-sealed.sh again. Anvil refuses to fall back to an unrestricted process when its container or network lock is unavailable.
Confirm your Linux distribution supports user and network namespaces and that bwrap, iproute2 and nftables are installed. Managed machines may require an administrator to enable them.
Enable systemd in /etc/wsl.conf, run wsl --shutdown in PowerShell, reopen Ubuntu, and run setup-sealed.sh again.
Run the setup script with sudo. Start Anvil with your normal Linux user afterward; do not run the desktop application as root.
Verify the published SHA-256 checksum before opening the archive. The current beta is unsigned, so Linux and Windows may ask you to confirm that you trust it.
Confirm you are signed in with the assigned operator account, the company has Anvil access, and the engagement is Ready, Active or Retest with a testing window that has not ended.
Check your connection, then return to engagement selection and reopen the engagement. Anvil keeps the last signed scope but will not invent targets or extend an expired window.