---
title: Get Started
description: Install Caracal, run the stack, and ship your first integration.
pageType: landing
---

Caracal is a self-hosted execution boundary for AI agents. Run agents through Caracal, give them scoped access to tools and providers, and get enforceable audit and revocation without exposing provider secrets to agent code.

The default product path is intentionally narrow:

1. Create a zone.
2. Register an agent app.
3. Register a tool or provider resource with an upstream URL.
4. Choose a policy template.
5. Run the agent through the SDK or `caracal run`.
6. Send tool/provider calls through the Gateway.
7. Inspect audit records for both the authorization decision and the action result.

Other provider flows fit into three buckets: connector-verified services you own, application-managed external provider calls that keep Caracal context for attribution, and future native broker plugins. Start with the Gateway path unless you know which bucket applies.

## In this section

| Page | What you will do |
| ---- | ---------------- |
| [Welcome](./welcome/) | Understand the product promise and where to start |
| [What Caracal Does](./what-caracal-does/) | Learn the Gateway-first enforcement model before touching code |
| [Installation](./installation/) | Install the CLI, TUI, and SDK packages |
| [Quickstart](./quickstart/) | Bring up the local authority plane with a single command |
| [First Integration](./first-integration/) | Run an agent and call a provider through the Gateway |
| [Key Ideas at a Glance](./key-ideas/) | Review the simplified mental model and terminology |

## Prerequisites

- **Docker** 24+ with the Compose v2 plugin
- **curl** or **wget** (required by the shell install script)
- A POSIX shell (Linux or macOS) or PowerShell 7+ (Windows)

SDK requirements depend on language. See [Installation](./installation/) for details.
