Get baddie.

The installers are not code-signed. Signing certificates from Apple and Microsoft cost money, and this project is built with free tools only. Without a signature your system cannot tell who made the app, so it warns you the first time you open it.

The warning does not mean anything is wrong with the file. It does not prove the file is fine either. The steps below get past it for baddie alone: you do not need to switch off any protection for the whole computer, and should not.

First launch on macOS

The first time you open baddie, macOS shows this and offers no way to open it:

“baddie” Not Opened. Apple could not verify “baddie” is free of malware that may harm your Mac or compromise your privacy.

1. Choose Done. Not “Move to Trash”.
2. Open System Settings → Privacy & Security and scroll down to Security.
3. Next to “baddie was blocked to protect your Mac”, choose Open Anyway, then confirm with your password or Touch ID.

You do this once. On macOS 14 and earlier, right-click the app, choose Open, then Open again.

First launch on Windows

Your browser may first say the file “isn’t commonly downloaded”. Choose to keep it. Then, when you run the installer, Microsoft Defender SmartScreen shows a blue panel:

Windows protected your PC. Microsoft Defender SmartScreen prevented an unrecognized app from starting.

1. Choose More info.
2. The publisher reads “Unknown publisher”. That is what an unsigned app looks like.
3. Choose Run anyway.

First launch on Linux

No warning: Linux does not check signatures on these files. On Debian, Ubuntu and relatives, install the package:

sudo apt install ./baddie-*.deb

On other distributions, allow the AppImage to run, then start it:

chmod +x baddie-*.AppImage
./baddie-*.AppImage

The AppImage needs FUSE 2 (libfuse2, or libfuse2t64 on Ubuntu 24.04 and later). Without it, start it with --appimage-extract-and-run.

Every release includes a file called SHA256SUMS, written by the same public GitHub Actions workflow that builds the installers. Download it into the same folder as the installer, then run the command for your system.

On macOS:

shasum -a 256 --ignore-missing -c SHA256SUMS

On Linux:

sha256sum --ignore-missing -c SHA256SUMS

On Windows, in PowerShell. It prints a hash: compare it with the line for your file in SHA256SUMS.

Get-FileHash .\baddie-*-setup.exe -Algorithm SHA256

On macOS and Linux you should see the name of your file followed by OK. If it says anything else, delete the file and report it on GitHub.

What this proves: the file on your disk arrived intact and is the one the public workflow built. It does not prove who built it, and it is not a signature. You are trusting the code in the repository and the build that GitHub ran, both of which anyone can read.

The app and the baddie command-line tool build from the same repository. You need Node.js 22.13 or newer and pnpm.

git clone https://github.com/callmeBalloch/baddie.git
cd baddie
pnpm install
pnpm build

# open the app in your browser
node packages/cli/dist/bin.js app

# or stay in the terminal
node packages/cli/dist/bin.js --help

Nothing to trust but the code in front of you. The README has the full quick start, including how to connect an AI agent.

Connect your first account. Bluesky and Mastodon take about a minute. Other platforms need a free developer app of your own first: why some platforms ask for one. Everything baddie saves stays in one folder on your computer, with your tokens encrypted.

The install notes on GitHub cover updating, where your data is kept, and uninstalling.

Not ready to install anything? Try the live demo in your browser.