brew

Install curl with Homebrew, apk, chocolatey, apt, dnf, MacPorts, Nix, pacman, scoop, winget, zypper

Get a file from an HTTP, HTTPS or FTP server. Version 8.21.0 via Homebrew; verified 2026-06-27.

Install command Security notes

agent safety

Agent safety answer

curl can fetch remote scripts, call APIs, and exfiltrate data from files an agent can read.

Credential access

Reads netrc files, headers, cookies, tokens, and files used as request bodies.

Remote mutation

Can call arbitrary HTTP APIs that mutate remote systems.

Publish/artifact risk

Can upload artifacts or run installer pipelines when paired with a shell.

Recommended control

Gate credentialed requests, file uploads, and pipe-to-shell installer patterns.

Agent-use guidance

Allow simple public fetches; require approval for authenticated requests, uploads, and shell execution.

install

Additional install commands

macOS

Homebrewverified · 100%

brew install curl

local Homebrew formula metadata

MacPortsverified · 94%

sudo port install curl

MacPorts ports tree · net/curl/Portfile · source: api.github.com

Linux

Alpine Linux apkverified · 92%

sudo apk add curl

Alpine Linux edge package indexes · curl · source: dl-cdn.alpinelinux.org

Debian aptverified · 92%

sudo apt install curl

Debian stable package indexes · curl · source: deb.debian.org

Fedora dnfverified · 92%

sudo dnf install curl

Fedora Rawhide package metadata · curl · source: dl.fedoraproject.org

Nixverified · 92%

nix profile install nixpkgs#curl

nixpkgs package indexes · curl · source: raw.githubusercontent.com

Arch Linux pacmanverified · 92%

sudo pacman -S curl

Arch Linux sync databases · curl · source: geo.mirror.pkgbuild.com

openSUSE zypperverified · 92%

sudo zypper install curl

openSUSE Tumbleweed package metadata · curl · source: download.opensuse.org

Windows

Chocolateyverified · 92%

choco install curl

Chocolatey community package catalog · curl · source: community.chocolatey.org

Scoopverified · 92%

scoop install main/curl

Scoop official bucket manifest trees · bucket/curl.json · source: api.github.com

Windows Package Managerverified · 92%

winget install --id cURL.cURL -e

Windows Package Manager source index · cURL.cURL · source: cdn.winget.microsoft.com

overview

Package summary

Get a file from an HTTP, HTTPS or FTP server

Project links

Commands and aliases

curl
curl-config
wcurl

history

Project history and usage

curl is a command-line transfer tool and libcurl is its underlying URL transfer library. Together they became one of the default pieces of Internet plumbing in Unix-like systems, Windows, language runtimes, build systems, containers, and scripts.

Project history

curl traces back to late 1996, when Daniel Stenberg extended Rafael Sagula's HttpGet utility while building an IRC bot feature for currency exchange lookups. The project moved from HttpGet to urlget as protocols beyond HTTP were added, then became curl in March 1998 after upload support made the older name misleading.

Adoption history

The project history records early Linux RPM packaging in 1998, the first Debian package in 1999, a non-beta libcurl interface in 2000, PHP adopting libcurl the same year, and Mac OS X bundling curl in 2001. By 2018, curl's history page described it as shipped in Windows 10 and estimated curl and libcurl at five billion installed instances; by 2020 that estimate reached ten billion instances.

How it is used

curl is used interactively and in scripts to transfer data over URL-addressed protocols, especially HTTP(S), FTP(S), SMTP, IMAP, SFTP, WebSocket, and related network protocols. libcurl is embedded by applications that need the same transfer features through a stable C API.

Why package nerds care

curl matters to package managers because it is often both a package and a bootstrap tool: build scripts fetch with it, test suites depend on it, and other packages link against libcurl. Packaging has to track TLS backends, protocol feature flags, CA certificate behavior, ABI stability, and the split between the curl executable, libcurl, headers, and curl-config.

Timeline

1996: HttpGet 0.1 released; Daniel Stenberg soon becomes maintainer.
1998: curl 4 released under the curl name.
1999: First Debian package recorded in upstream history.
2000: libcurl non-beta interface arrives and PHP adopts libcurl.
2001: curl bundled in Mac OS X 10.1.
2010: Project switches from CVS to git hosted by GitHub.
2018: Windows 10 starts shipping curl.
2020: Upstream estimates 10 billion curl and libcurl installations worldwide.
2024: wcurl adopted into the curl organization.

Related projects

libcurl, wcurl, trurl, HTTPie, Curlie, and cURLpp are adjacent projects in the curl ecosystem.

Sources

security posture

Risk level: blue

doc example: network transfer tool.

Risk classifier

blue risk · high confidence · tool

Why

doc example: network transfer tool

Signals

override:curl

Install behavior

No Homebrew post-install hook is recorded in formula metadata.
Homebrew bottle metadata is available for 6 platform targets.
Installs with 8 runtime dependencies.
Build metadata lists 1 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix: ~/.curlrc

Credential files

Credential-bearing paths to review before unattended agent runs.

Unix: ~/.netrc~/.curlrc

executables

Installed executables

Command	Kind	Exposure
`curl`	cli	global executable
`curl-config`	cli	global executable
`wcurl`	cli	global executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08

manager version8.21.0

manager updated2026-06-27

local dataok

upstreamnot checked

latest detectednot detected

https://curl.se

infoRelease/tag comparison is only available for GitHub repositories.https://curl.senone confidence

install metadata

Package metadata

Package key	brew:curl
Version	8.21.0
Package manager	Homebrew
Package manager page	https://formulae.brew.sh/formula/curl
Homepage	https://curl.se
Repository	https://github.com/curl/curl
Upstream docs	https://curl.se/docs
License	curl
Source archive	https://curl.se/download/curl-8.21.0.tar.bz2
Last updated	2026-06-27T15:50:29Z
Pulse	updated
Dependencies	brotli, libnghttp2, libnghttp3, libngtcp2, libpsl, libssh2, openssl@3, zstd
Build dependencies	pkgconf
Uses from macOS	krb5, openldap
Bottle	available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install	not defined
Service	none declared

registry facts

Source database details

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	curl
Version Scheme	0
Revision	0
Head Version	HEAD
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	yes
URL Keys	head stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Debian apt95%

curl 8.14.1-2+deb13u3

command line tool for transferring data with URL syntax